Business Partner Privacy NoticeProtecting personal data of contact persons (each a “Business PartnerContact”) of our customers, end customers, suppliers, vendors and otherpartners (each a “Business Partner”) is important to ams OSRAM and its
affiliated companies (together “ams OSRAM”). Therefore, ams OSRAM
processes personal data in compliance with applicable laws on dataprotection and data security.
This Privacy Notice provides general information about data processing
carried out by ams OSRAM. In case of processing of personal information
through dedicated online shops, sites or platforms, please consult specificprivacy policies available in the respective shops, sites or on platforms.
This Privacy Notice is also applicable to the processing of personal
information of contact persons of organisations that do not have directbusiness relationship with ams OSRAM (e.g. workshops and dealers), if
it is necessary for the promotion, maintenance or repair of ams OSRAM
products.
A.

Name and address of the Controller

The controller within the meaning of the General Data Protection Regulation, other national
data protection laws and other data protection regulations isOSRAM GmbH
Marcel-Breuer-Straße 480807 Munich
Germany
Phone: +49 89 6213-0
Fax: +49 89 6213-2020
Email: contact@osram.com

Contact details for data privacy requests or issues: privacy@ams-osram.com
B.

Categories of personal data processed, purpose of the processing and legal basis

In the context of the business relationship with ams OSRAM, ams OSRAM may process
personal data for the following purposes:

••

•

•

•

•

Communicating with Business Partners about products, services and projects of ams
OSRAM or Business Partners, e.g. by sending out newsletters or responding toinquiries or requests;Planning, performing and managing the (contractual) relationship with BusinessPartners; e.g. by performing transactions and orders of products or services,
processing payments, performing accounting, auditing, billing and collection activities,
arranging shipments and deliveries, facilitating repairs and providing support services;
Administrating and performing customer surveys, marketing campaigns, marketanalysis, sweepstakes, contests, or other promotional activities or events, as well as
provision of information about new ams OSRAM products, services and projects;
Maintaining and protecting the security of our products, services and websites,
preventing and detecting security threats, counterfeiting, fraud or other criminal or
malicious activities;
Ensuring compliance with legal obligations (such as record keeping obligations),
Business Partner compliance screening obligations (to prevent white-collar, export
control violations or money laundering crimes), and ams OSRAM policies or industrystandards; andSolving disputes, enforce our contractual agreements and to establish, exercise ordefend legal claims.

For the purposes stated above, ams OSRAM may process the following categories of personaldata:•••••••••

Contact information, such as full name, work or private address, work or personal
telephone number, work mobile phone number, work fax number as well as email
address;
Payment data, such as data necessary for processing payments and fraud prevention,
including credit/debit card numbers, security code numbers and other related billinginformation;
Further information necessarily processed in a project or contractual relationship with
ams OSRAM or voluntarily provided by the Business Partner Contact, such as orders
placed, payments made, requests, and project milestones;
Information about products/services that may be of interest for the Business Partner
based on the order/request history;
Information about online behaviour and interests of Business Partner Contact in theams-OSRAM Xchange eShop, provided that informed consent to the use of tracking
cookies is granted within Cookie settings of the Xchange eShop;
Information about online behaviour and interests of end customers in our online shops
provided that an informed consent to the use of tracking cookies is granted within
Cookie settings of the respective shops or platforms.
Information collected from publicly available resources, integrity data bases and credit
agencies;
Information collected in order to provide technical support or respond to the requestsof Business Partners, andIf legally required for Business Partner compliance screenings: information about
relevant and significant litigation or other legal proceedings against Business Partners.

The processing of personal data is necessary to meet the purposes stated above including
the performance of the respective (contractual) relationship with Business Partners. Unlessindicated otherwise, the legal basis for the processing of personal data is Article 6 (1) (b) or (f)ams OSRAM Business Partner Privacy Notice

August 2024

of the EU General Data Protection Regulation or – if explicitly provided by Business PartnerContacts – consent to data processing according to Article 6 (1) (a) of the EU General Data
Protection Regulation.
Processing of Business Partner Contact’s personal data for secondary processing purposes
is limited to processing of data of existing customers for direct marketing, provided that there
is an option to object to the processing, or to processing which is necessary to fulfil a legal
obligation to which ams OSRAM is subject (such as notifications of suspicious activities underanti money laundering legislation). No statistical analysis of the processing of Business Partner
Contact’s personal data for secondary purposes takes place.
If the respective personal data is not collected and processed, the purposes indicated above
may not be pursued by ams OSRAM.
C.

Transfer and disclosure of personal data

Ams OSRAM may transfer personal data to other ams OSRAM affiliated companies, but only
if and to the extent such transfer is strictly required for the abovementioned purposes.
In cases where it is legally permitted, ams OSRAM may transfer personal data to courts, law
enforcement authorities, regulators or attorneys, if it is necessary to comply with legal
requirements or for the establishment, exercise or defense of legal claims.
ams OSRAM commissions service providers (so-called data processors), such as hosting or
IT maintenance service providers, which only act upon instructions of ams OSRAM and arecontractually bound to act in compliance with applicable data protection law.
Recipients of personal data may possibly be located in countries outside of the EU or the EEA(“third countries”), in which applicable laws do not offer the same level of data protection as
the laws of the respective individual’s home country. In such cases and unless permitted
otherwise by applicable law, ams-OSRAM takes measures to implement appropriate andsuitable safeguards for the protection of personal data by other means:D.

•We share personal data with ams OSRAM group companies in third countries only ifthey have implemented the ams OSRAM Binding Corporate Rules („BCR“) for theprotection of personal data. Further information about the ams OSRAM BCR can befound in our general Privacy Policy.

•We transfer personal data to external recipients in third countries only in case, if therespective recipient entered into EU Standard Contractual Clauses with ams OSRAM,
and implemented appropriate technical and organizational measures to protect
personal data in question.
Retention Periods

Unless explicitly indicated otherwise at the time of the collection of Business Partner Contact’s
personal data (e.g. within a consent form accepted by Business Partner Contact), we erase
personal data, if the retention of the personal data is no longer necessary in relation to thepurposes for which they were collected or otherwise processed and no statutory retention

ams OSRAM Business Partner Privacy Notice

August 2024

obligations under applicable law (such as tax or commercial law) require us to further retain
personal data.

E.

Processing based on a consent

If the processing of Business Partner Contact’s personal data is based on a consent, it isensured that the consent in question is freely given, specific, informed and unambiguous in
relation to the purposes of the processing and provided to ams OSRAM in a double opt-in
procedure.
In case a Business Partner Contact provided their consent for the processing of certainpersonal data by ams OSRAM, the Business Partner Contact has the right to withdraw theconsent at any time with future effect, i.e., the withdrawal of the consent does not affect thelawfulness of processing based on the consent before its withdrawal. In case consent iswithdrawn, ams OSRAM may only further process the personal data where there is anotherlegal ground for the processing.

F.

Right of access to and rectification or erasure of personal data, restriction ofprocessing, right to object to processing and right to data portability

Under applicable data protection law an affected Business Partner Contact may - provided
that the respective legal pre-conditions are met - have the right to:• confirmation as to whether or not personal data concerning the Business Partner
Contact are being processed, and where that is the case, access to the personal data;• the rectification of inaccurate personal data;• the erasure of Business Partner Contact’s personal data;• the restriction of processing regarding the Business Partner Contact’s personal data;• object, on grounds relating to the Business Partner Contact’s particular situation, toprocessing of personal data;• to receive the personal data concerning him or her in a structured, commonly used
and machine-readable format and have the right to transmit those data to anothercontroller.
The ams OSRAM Corporate Data Privacy Department that can be contacted under
privacy@ams-osram.com will always use best efforts to address and settle any requests orcomplaints brought to its attention.
In addition, there is always the possibility to approach the competent data protection authority
with requests or complaints.
Responsible authority for ams OSRAM:
Bavarian State Office for Data Protection Supervision
Postbox 1349
91504 AnsbachGermany
You can find an overview of all national data protection authorities in the EU at:https://edpb.europa.eu/about-edpb/about-edpb/members_en

ams OSRAM Business Partner Privacy Notice

August 2024