Privacy Policyof GROB-WERKE GmbH & Co. KG
for customers, suppliers and other business partners
Mindelheim, 20.02.2024
The protection of personal data is important to GROB-WERKE GmbH & Co. KG and also alegal requirement. This Privacy Policy will give you an overview of how we process yourpersonal data and of your rights under data protection law. The data individually processed and the way in which they are used depends largely on the agreed services. Therefore, not all parts of this report will apply to you.
Name and contact data of the responsible party pursuant to the General Data
Protection Regulation:
GROB-WERKE GmbH & Co. KG
represented by Managing Director Mr. Wolfram Weber
Industriestraße 487719 Mindelheim
Name and contact data of our Data Protection Officer:
GROB-WERKE GmbH & Co. KG
Industriestraße 487719 Mindelheim
e-mail: datenschutz@grob.de
Which data are processed?
We process personal data which we receive, under the terms of our business relationship,from our partners and other affected parties. We also process – where required to provision our service – personal data which we lawfully obtain from publicly accessible sources(e.g. records of debtors, land registers, registers of companies and associations, press,Internet) or which are legitimately transmitted to us by other third parties.
Which data categories are processed?
The following data are processed in compliance with the provisions of the EU General
Data Protection Regulation (DS-GVO) and the Federal Data Protection Act (BDSG):
To fulfil contractual obligations (Art. 6, para. 1 b DS-GVO)





Name of the company
Business address and other delivery addresses
Names of contact persons
Telephone numbers
Fax numbers
email addresses
Bank details
VAT ID number
Correspondence for executing the contractual relationship

Version 1.1

1/5



Data ensuing from the fulfilment of our contractual obligations

Personal data are also processed for the balancing of interests(Art. 6, para. 1 f DS-GVO). These are:








Credit checks (by Schufa for example)
Advertising, insofar as you have not objected to the use of your data
Assertion of legal claims and defence in case of legal disputes
Guaranteeing IT security and IT operation
Prevention and clarification of criminal offences
Measures for building and plant security (e.g. access controls)
Measures for safeguarding domiciliary rights
Risk control within our company

Processing in order to comply with legal requirements (Art. 6, para. 1 c DS-GVO) or in
the public interest (Art. 6 , para. 1 e DS-GVO) is a legitimate reason for the processing ofpersonal data.
Why do we process your data (purpose of processing)?
Data are processed in order to provision our services to honor our agreements with ourbusiness partners or to implement pre-contractual measures upon request. The purposeof data processing depends first and foremost on the specific product or service. In particular, data are processedto be able to identify you as our business partner;
to be able to provide you with appropriate advice;
to correspond with you;for billing purposes;

to safeguard our legitimate interests or those of third parties. Examples:






Advertising, insofar as you have not objected to the use of your data,
Assertion of legal claims and defence in case of legal disputes,
Guaranteeing IT security and IT operation,
Prevention and clarification of criminal offences,
Measures for building and plant security (e.g. access controls),
Measures for safeguarding domiciliary rights, measures for business management
and for the further development of products and services, risk control within ourcompany.

The consent you grant (Art. 6, para. 1 a DS-GVO) allows us to process your personal
data. If such consent forms the basis of processing, we shall provide you with detailed
information on the purposes of such processing. You can revoke your consent at any time.
We, as a company, are governed by various legal obligations, i.e. statutory requirements(e.g. taxation laws). The purposes of processing include the fulfilment of tax reporting
obligations, as well as the assessment and control of risks within our company.
Personal data are not disclosed to third parties, with the exception ofWithin our company, those departments that require your data in order to fulfil
our contractual and legal obligations have access to such data.

Version 1.1

2/5



Transmissions to third parties engaged by us in order to fulfil the terms ofcontractual and delivery relationships, examples include to banking institutes/payment service providers which process payments, and also to transportcompanies/shipping companies which handle shipments;

Transmissions to third parties engaged by us for the purpose of marketing andadvertising our in-house products and services, examples include marketing service providers and printing companies;

Transmissions to specialized service providers which, on our instruction and under
our responsibility, furnish services for us as part of the aforementioned purposes(order processing Art. 28 DS-GVO), examples include IT service providers;Transmissions to third parties to whom we have a legal obligation;

Transmissions to third parties for the purpose of fulfilling our commercial and tax
obligations, examples include our tax consultant

Essentially, we disclose information about our business partners only if statutory provisions so require or the partner has given their consent. Under these prerequisites, recipients of personal data include:public bodies and institutions,other companies within the Group,
service providers we engage in order to fulfil the terms of order processing relationships.

Other data recipients include those bodies for which you have granted your consent todata transmission or waived consent or to which we are authorized to transmit personal
data for the balancing of interests.
Data will be transmitted to a third-party country outside of the European Union, which is
not a contracting state to the Agreement on the European Economic Area, only if suchdata transmission is required to fulfil the terms of a contract existing between yourselves
and ourselves (delivery to a third-party country, for example).
Data storage
We process and store your personal data for as long as this is required to fulfil ourcontractual and legal obligations. It should be noted that our contractual relationshipconstitutes a continuing obligation, effective for several years.
If the data are no longer required to fulfil contractual or legal obligations, they will bedeleted on a regular basis, unless – short-term – further processing is required for thefollowing purposes:

to fulfil retention obligations under commercial and taxation law that can ensue,
e.g. from: the Commercial Code (HGB), Fiscal Code (AO). The periods for storage
and/or documentation are usually six to ten years.
the preservation of evidence under the statutory limitation regulations. In accordance with Section 195 et seq. of the Civil Code (BGB), these statutory limitation periods can be up to 30 years, the regular period of limitation being 3 years.

Legal remedy
Version 1.1

3/5

You have the right,
to demand from the responsible party a confirmation as to whether your personal data
are being processed; if this is the case, you have a right to information about these
personal data and to the information individually listed in Art. 15 DS-GVO (General Data
Protection Regulation).
The affected person has the right to demand from the responsible party an immediate
correction to any incorrect personal data and, where applicable, the completion of incomplete personal data (Art. 16 DS-GVO).
The affected person has the right to demand from the responsible party the immediatedeletion of their personal data, insofar as one of the reasons individually listed in Art. 17DS-GVO applies, e.g. if the data is no longer required for the pursued purpose (right todeletion).
The affected person has the right to demand from the responsible party the limitationof processing if one of the prerequisites listed in Art. 18 DS-GVO is met, e.g. if the affected person has lodged an objection to processing, for the duration of the review by theresponsible party.
Each affected party, notwithstanding any other administrative or judicial remedies, has
the right to complain to a supervisory authority, if the affected person believes thatthe processing of their personal data is in contravention of the DS-GVO (Art. 77 DSGVO). The affected person can exercise this right at a supervisory authority in the member state of their place of residency, their place or work or the place of the presumed
infringement.

Information on your right to object in accordance with Article 21 DS-GVO
Case-by-case right to object
You have the right, for reasons ensuing from your particular situation, to object at any
time to the processing of your personal data, which occurs pursuant to Article 6, para.
1, letter e DS-GVO (Data processing in the public interest) and Article 6, para. 1, letter f
DS-GVO (Data processing for the balancing of interests).
Should you object, we will cease to process your personal data unless we are able todemonstrate legitimate grounds for such processing that outweigh your interests, rights
or freedoms, or the processing serves to assert, exercise or defend legal claims.

Right to object against the processing of data for the purposes of direct advertising
In isolated cases, we will process your personal data for the purpose of direct advertising. You have the right to object, at any time, to the processing of your personal data
for the purposes of direct advertising, insofar as it this is in direct connection with suchdirect advertising.
If you object to processing for the purposes of direct advertising, we will no longer process your personal data for such purposes.
Recipient of an objection
Version 1.1

4/5

The objection can be made informally with the reference "Objection" stating your nameand address and should be sent to:
GROB-WERKE GmbH & Co. KG
Industriestraße 487719 Mindelheim
Mail: info@de.grobgroup.com

Version 1.1

5/5