PRIVACY NOTICE for BUSINESS PARTNERS

As the controller, Sika Automotive Frankfurt-Worms GmbH (hereinafter “Sika”) have prepared this privacy notice toinform you in accordance with the requirements of the Regulation (EU) 2016/679 (General Data Protection
Regulation- GDPR) about the nature, scope and purpose of the processing of personal data of sales agents,customers, suppliers and other business partners as well as advertising activities in connection with thedevelopment of customer relationships.

1. GENERAL INFORMATIONa) NAME AND CONTACT DETAILS OF THE CONTROLLER
Sika Automotive Frankfurt-Worms GmbH
Weinsheimer Str. 96
67547 Worms
Germany
Telephone: +49 6241-301-0
Telefax: +49 6241-301-200b) CONTACT DETAILS OF THE DATA PROTECTION OFFICEROBSECOM GmbH
Königstraße 40
70173 Stuttgart
Germany
Telephone: +49 711 46 05 025-40
Telefax: +49 711 46 05 025-49
E-Mail: sika-automotive@obsecom.euc) SCOPE
This Privacy Policy applies to you if you belong to one of these categories:▪
▪

Business partners of Sika as a natural person (for example, a consultant or a sole trader);Employees of a business partner who are in contact with Sika on behalf of such a business partner.

d) LEGAL BASES
Sika process personal data based on at least one of the following legal bases:▪
▪

The data subject has given consent to the processing of his or her personal data for one or more specificpurposes pursuant to Art. 6(1)(a) GDPR;
Pursuant to Art. 6(1)(b) GDPR the processing is necessary for the performance of a contract to which the data
subject is party or in order to take steps at the request of the data subject prior to entering into a contract;

Sika Privacy Notice for Business Partners February 2022
Version: 01.02.2022, Revision_02
Page 1 of 5▪
▪
▪

Pursuant to Art. 6(1)(c) GDPR the processing is necessary for compliance with a legal obligation to whichSika are subject;
Processing is necessary in order to protect the vital interests of the data subject or of another natural
person pursuant to Art. 6(1)(d) GDPR;
Pursuant to Art. 6(1)(f) GDPR the processing is necessary for the purposes of the legitimate interests
pursued by Sika or by a third party.

In this privacy policy we refer to the respective legal basis of the individual data processing operations.

2. CATEGORIES OF DATA AND PURPOSES FOR PROCESSING OF DATAa) CATEGORIES OF PERSONAL DATA
We collect personal data, as far as possible, from the data subject. If lawful, personal data may be collected to theextent necessary from public sources, other affiliated companies and / or other authorized third parties. We
process the following categories of personal data:
Category

ExamplesPersonal information

Name, gender, job title, name of the employer

Contact details

Business address, phone numbers, mobile phone, e-mailaddress

Content of communication

E-mails and business letters

Payment and billing information

Bank detailsb) PURPOSE OF PROCESSING
Sika may collect, process and use personal data for the following purposes:
Aquisition

Your name and telephone number will be used in the context ofacquisition activity for contact by telephone, provided that, and accordingto § 7(2) Nr. 2 UWG, your presumed consent to establish contact is to beassumed. We use your address data to send you written information,seasonal mail (for example, Christmas greetings) or congratulations onbirthdays. Personal data that you have provided to Sika when entering intoa business relationship (for example, contact details of your business card)
will be processed for the purpose of developing the business relationship.
The legal basis is our legitimate interest in developing and maintaining astable customer relationship in accordance with Art. 6(1)(f) GDPR.

Performance of a contract

If you are a contract party, Sika processes your contact details insofar as
this is necessary for the implementation of pre-contractual measures orfor the fulfilment of a contract that was made at your request (including
the fulfilment of contractual obligations, invoice processing and contractrelated communication). The legal basis for data processing is Art. 6 (1)(b)
GDPR. If you are a contact person of our customer/business partner, weprocess your professional contact details for contractual and customer
communication. The legal basis for data processing is our legitimate
interest according to Art. 6 (1)(f) GDPR in maintaining business relations. In

Sika Privacy Notice for Business Partners February 2022
Version: 01.02.2022, Revision_02
Page 2 of 5

individual cases, Sika will pass on your contact details to subcontractors ifnecessary for the preparation of cost estimates and quotations for parts ofthe entire order. The legal basis is our legitimate interest in the conduct ofregular business operations according to Art. 6(1)(f) GDPR.
Direct marketing

If you are a Sika customer and your e-mail address was collected inconnection with the sale of goods or services, Sika may use it for direct
marketing of their own similar goods or services. This only applies if you
have not objected, and Sika clearly informs you of the possibility ofobjection when collecting the e-mail address and every time you use it.
The legal basis of processing is Sika’s legitimate interest in direct marketing
according to Art. 6(1)(f) GDPR in connection with § 7(3) UWG.

E-Mail Newsletter

If you have consented to data processing, Sika may use your name and email address for the purpose of sending e-mail newsletters on specifictopics. The e-mail address will be used for this purpose until you withdraw
your consent or unsubscribe from receiving the newsletter. Unsubscribing
is possible at any time, for example via a link at the end of eachnewsletter. The legal basis of the data processing is your voluntarily given
consent by means of the so-called double opt-in procedure pursuant toArt. 6(1)(a) GDPR.

Legal obligations

Sika also processes your personal data to comply with legal obligations towhich Sika is subject. The obligations may arise, for example, fromcommercial, tax, money laundering, financial, criminal, administrative,criminal procedure, or civil procedure law. The purposes of the processing
result from the respective legal obligation. As a rule, the processing serves
the purpose of fulfilling state control and information obligations. The
legal basis for processing personal data is Art. 6 (1)(c) or (e) GDPR.

Further purposes

Sika also process personal data in accordance with Art. 6(1)(f) GDPR in theirown or a legitimate interest of a third party to enable group-wide
information exchange, conduct internal investigations, conduct mergers
and acquisitions, or to prevent fraud or misuse of IT systems, physicalsecurity, IT and network security.

3. RECIPIENTS
We only transfer your personal data to recipients outside Sika if this is necessary to process or handle your request, if
there is another legal basis, or if we have your consent to do so.
a) Within the group▪

To other legal entities within the group of Sika companies.

b) To third parties▪

To external companies we use to provide services, for example in the area of technical infrastructure andmaintenance.

▪

Where applicable, personal data will be transferred to acquiring or acquired companies and the relevant
advisors if the Sika company with which you have a business relationship is sold or transferred, or anothercompany is acquired and integrated into the relevant Sika company - including comparable cases before theSika Privacy Notice for Business Partners February 2022
Version: 01.02.2022, Revision_02
Page 3 of 5

transaction (for example, during the due diligence phase) or after the transaction, subject to all rights
available under law, including in jurisdictions where the other company is located.
▪

Personal data may be disclosed to public bodies (for example, office for public prosecution, courts, or taxauthorities) if we are under an obligation of disclosure for legal reasons. The transfer is then made based on
Art. 6 (1)(c) GDPR.

c) To data processors▪

Where applicable, personal data is transferred to data processors who process such data on behalf of Sika inaccordance with our instructions.

4. DATA TRANSFER
The transfer of data may include disclosure of data to recipients outside the EU/EEA. Some countries whererecipients are established ensure adequate levels of data protection for personal data (such as Switzerland). For
data transfer to recipients in third countries without an adequate level of data protection, Sika will takenecessary measures to ensure that such transfers are adequately protected in accordance with applicable dataprotection legislation (for example, by implementing EU standard contractual clauses). A copy of the EU standard
contractual clauses is available at: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=en
You may request from Sika a copy of the warranties under which your personal data is transmitted to third
countries or to international organizations.

5. OBLIGATION TO PROVIDE DATA
The provision of your personal data is voluntary. While processing, it may be necessary for us to ask you for further
information about yourself. If you do not wish to provide us with the additional information in such a case, thiswill of course not have any adverse consequences for you.

6. PERIOD OF DATA STORAGE
Unless otherwise provided for in this privacy notice, personal data will be deleted, if these data are no longer
necessary in relation to the purposes for which they were collected or otherwise processed, and the deletion does
not conflict with statutory retention requirements. In addition, we will erase the personal data processed by us inaccordance with Art. 17 GDPR on your request, if the conditions provided therein are met. If personal data arerequired for other lawful purposes, they will not be erased, but their processing will be restricted in accordancewith Art. 18 GDPR. In case of restriction, the data will not be processed for other purposes.
Sika will store personal data in connection with the performance of a contract will be stored for the duration of
the contractual relationship and beyond if necessary. For example, data must be kept for 6 years pursuant toSection 257 (1) Nos. 2 and 3 German Commercial Code (HGB) and Section 147 (1) Nos. 2, 3, 5 German Tax Code(AO); data must be kept for 10 years pursuant to Section 257 (1) Nos. 1 and 4 HGB and Section 147 Abs. 1 No. 1, 4,4a AO.

7. AUTOMATED DECISION MAKING
Sika does not do automated decision making as part of a business partner relationship.

Sika Privacy Notice for Business Partners February 2022
Version: 01.02.2022, Revision_02
Page 4 of 5

8. YOUR RIGHTS:
As a data subject you have the following right:▪

Pursuant to Art. 15 GDPR to request information about your personal data processed by us. You may also
request information regarding the purposes of the processing; the categories of personal data concerned; therecipients or categories of recipients to whom the personal data have been or will be disclosed; the envisaged
period for which the personal data will be stored, or the criteria used to determine that period; where thepersonal data are not collected from you, the data source; the existence of automated decision-making,including profiling, and meaningful information about the logic involved, as well as the significance and theenvisaged consequences of such processing; the existence of the right to request rectification or erasure ofdata concerning you, the right to restrict processing or to object to such processing, the right to lodge acomplaint with a supervisory authority. Finally, you have a right to know whether personal data has beentransferred to a third country or to an international organisation, and, if so, the appropriate safeguards
relating to this transfer;▪

Pursuant to Art. 16 GDPR to demand the immediate rectification of inaccurate personal data and to haveincomplete personal data that are stored with us to be completed;▪

Pursuant to Art. 17 GDPR to demand the erasure of your personal data stored with us , unless the processing
is necessary for exercising the right of freedom of expression and information , for compliance with a legal
obligation, for reasons of public interest, or for the establishment, exercise or defence of a legal claim;▪

Pursuant to Art. 18 GDPR to request the restriction of the processing of your personal data if the accuracy ofthe personal data is contested by you; the processing is unlawful but you oppose the erasure of the personal
data and request the restriction of their use instead; we no longer need the personal data for the purposes ofthe processing, but they are required by you for the establishment, exercise or defence of legal claims; youhave objected to processing pursuant to Art. 21(1) GDPR pending the verification whether our legitimate
grounds override your interests;▪

Pursuant to Art. 20 GDPR to receive your personal data, which you have provided to us, in a structured,commonly used and machine-readable format and have the right to transmit those data to anothercontroller;▪

Pursuant to Art. 21 GDPR to object to the processing of your personal data on grounds relating to yourparticular situation, or if you object to processing for direct marketing purposes and the legal basis for theprocessing are our legitimate interests pursuant to Art. 6 para. 1 lit. f GDPR;▪

Pursuant to Art. 7 para. 3 GDPR to withdraw your consent given to us at any time. As a result, we are nolonger allowed to continue the data processing that was based on this consent in the future;▪

Pursuant to Art. 77 GDPR to lodge a complaint with a supervisory authority, in particular in the Member Stateof your habitual residence, place of work or place of the alleged infringement. A list of contact details of thedata protection officers and supervisory authorities can be found on this website:
https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html.

If you wish to assert the data subject rights mentioned above, you can contact the Data Protection Officer of Sika at
any time using the contact details above. To exercise your rights, you can also use this web form for sending us a
subject access request:
https://privacyportal-de.onetrust.com/webform/9aaa3e8a-b171-45d6-b15b-5e7dba70499a/f1eec563-697f-46fe9bab-6cd2017f6a2eSika Privacy Notice for Business Partners February 2022
Version: 01.02.2022, Revision_02
Page 5 of 5