Data Privacy Statement
Communication

PTV Planung Transport Verkehr GmbH, Sitz der Gesellschaft / Registered
Office: Karlsruhe, Geschäftsführung / Management Board: Christian U.
Haas (Vors./CEO), Dr. Karsten Kölsch (CFO), Handelsregister (HRB Nr.) /Commercial Register (HRB No.): 743055, USt-ID-Nr. / VAT ID No.:DE 812 666 053, Registergericht / Court of Registration: Mannheim.

Data Privacy Statement Communication

Contents

Contents
1

Controller ....................................................................................................... 3

2

Data Protection Officer ................................................................................... 33

Situations in which we process your Personal Data ....................................... 3

4

Tools & Programmes...................................................................................... 6

5

Method of Data Processing ............................................................................ 8

6

Legal Basis for Data Processing..................................................................... 97

Storage Duration .......................................................................................... 10

8

Data processing outside the EU or the EEA ................................................. 10

9

Removal options and data subject rights ...................................................... 11

Short title

Data Privacy Statement Communication

Version of the contract template

1.1.1 dated 2023-06-19

 PTV Planung Transport Verkehr GmbH / June 2023

Page 2/12

Data Privacy Statement Communication

Controller

Information on data processing during communication bye-mail, fax, telephone, etc. with interested parties, new andexisting customers(in accordance with Art. 12 and Art. 13 of the General Data Protection
Regulation, GDPR)
This Data Privacy Statement relates to data processing in connection with electronic
communication (by e-mail, fax, telephone, etc.) between employees of PTV GmbH andinterested parties, new or existing customers. In addition to support cases and reseller
constellations, proactive inquiries about our services and products via such contact
channels are also covered.
The Data Privacy Statement concerning data processing in connection with electronic
communication in the case of applications and application processes can be found in the
Data Privacy Statement PTV Planung Transport Verkehr GmbH.

1

Controller

Responsible in the sense of data protection law for the collection and use of personal
data isPTV Planung Transport Verkehr GmbHHaid-und-Neu-Str. 15
76131 Karlsruhe, Deutschland
Mail: info@ptvgroup.com

2

Data Protection Officer

Our external data protection officer can be contacted at datenschutz@ptvgroup.com.

3

Situations in which we process your Personal
Data

3.1

Data processing when you contact us by e-mail, fax, telephone

When you write us an e-mail, call us or send us a fax, we inevitably process personal datafrom you. This is because at least the personal data transmitted with the e-mail, fax or yourtelephone will be stored by us or our systems.
The processing of personal data when transmitted by e-mail, fax or telephone, serves us
to deal with your contact inquiry and your request. We absolutely need your e-mail address,
your fax number or your telephone number in order to be able to reply at all. This is also
the legitimate interest in processing the data.
The data is deleted as soon as it is no longer required to achieve the purpose for which it
was collected. For personal data sent by e-mail, this is the case when the respective
 PTV Planung Transport Verkehr GmbH / June 2023

Page 3/12

Data Privacy Statement Communication

Situations in which we process your Personal Data

conversation with you has ended, and we have then waited a grace period of up to 3 months
to see whether we may need to refer to your request or the details of the communication
again. The conversation is terminated when it is clear from the circumstances that thematter in question has been conclusively clarified.
Fax data is stored separately from print data in the device memory of the fax machine. Afterthe fax has been printed out, the occupied memory space is released again so that the next
fax can be received and stored there. Parts of the fax can remain temporarily in the device
memory after printing until they are overwritten by the next received fax. Normally this leads
to an automatic deletion of the data after approx. 1-2 weeks. If it is a computer fax, we
receive your fax as an e-mail and the explanations for e-mail apply accordingly.
In the case of incoming and outgoing calls to us, your telephone number or yourname/company name stored with your telephone provider as well as the date and time of
the call are stored in our telephone system in a so-called ring buffer, which overwrites theoldest data with new data. In general, this leads to an automatic deletion of the data in thetelephone system after approx. 3-4 months.
The communication may be subject to a retention obligation under commercial or tax law,which then takes precedence over the deletion (cf. the explanations above on "Datadeletion and storage period").
3.2

Data processing in the context of further communication

If further communication with you takes place after you have contacted us, further dataprocessing may follow on the basis of the knowledge gained about you, depending onwhether you are communicating with us as an interested party, as a new customer, as anexisting customer, as a service provider, business contact or similar.
3.3

Data processing regarding interested parties and new customers for the
purpose of contacting, advertising, and ordering

We collect and process personal data from interested parties and potential new customers
for the purpose of contacting them and presenting our products and services to them.
We process the data that you transmit to us voluntarily in connection with thecommunication in view of the respective means of communication or the data that is
mandatory to enable communication.
3.4

Data Processing regarding existing customers for the purpose ofcontract fulfillment (especially in support cases) and customer retention

We collect and process personal data from our customers for the purpose of fulfilling ourcontractual obligations, in particular to provide support services in the event of problems,
defects or errors (support cases).
In addition, we process customer data to offer customers further, similar services in addition
to the services they have already received, as well as in order to be able to provide service
offers for our customers and to carry out corresponding measures.
The data collection and data processing are carried out, for example, by the department
responsible for contract and order processing, by the support department or by our existingcustomer service.
 PTV Planung Transport Verkehr GmbH / June 2023

Page 4/12

Data Privacy Statement Communication

3.5

Situations in which we process your Personal Data

Data processing regarding service providers and other business contacts
for the purpose of cooperation or business exchange

We collect and process personal data from service providers and business contacts for the
purpose of communicating about future or existing cooperation or other business issues.
We process the data that is transmitted to us voluntarily by you in connection with yourapproach or the communication in view of the respective means of communication or thedata that is compulsory to enable the communication.
3.6

Data processing for the purpose of statistics, internal reporting andcontrolling

In addition, we process your personal data for our own purposes; for keeping internal
statistics and for our internal reporting and controlling. By evaluating this data, we want togain insights that help us to further improve ourselves and our offers and to keep them
relevant for interested parties and customers.
3.7

Data processing in the case of reseller activities of PTV GmbH

We act as resellers (brokers) for various companies and broker business between themand their customers as an interface.
For example, if you are interested in Microsoft's Bing Maps service from Switzerland or
Germany, Microsoft will ask you to contact us. In the event of an order, we will then orderthe desired Microsoft services for Bing Maps from Grey Matter Ltd, The Old Maltings, Prigg
Meadow, Ashburton, Devon, TQ13 7DF, England (https://greymatter.com/corporate/) as a
Microsoft Gold Partner on your behalf.
The transfer of your data to Gray Matter Ltd. in England is permitted on the basis of an
existing adequacy decision regarding the level of data protection in the UK being equivalent
to that in the EU (Art. 45 Sect.1 GDPR).
In the context of this reseller activity, we conclude an agency agreement with you, which
includes the billing by us for the services provided directly by the service provider (e.g.
Microsoft).
The legal basis for this data processing is the brokerage contract concluded between us
respectively the preparatory actions for its conclusion (Art. 6 Sect. 1 let. b GDPR).
Based on this contract, we store your data for the duration of the contractual relationshipand delete it at the latest when the contract is finally terminated and claims arising from it
can no longer be asserted (statute of limitations), which is regularly three years after theend of the contract, starting on December 31 of the year in question.
It may be that we also perform such reseller activities for other providers and services. In
that case, the procedure described here for Bing Maps will apply there in a comparable
manner. Since you are referred to us by the respective provider to initiate a contract, youare also already aware of our reseller activities when you contact us.

 PTV Planung Transport Verkehr GmbH / June 2023

Page 5/12

Data Privacy Statement Communication

4

Tools & Programmes

4.1

Data processing through the use of Microsoft 365

Tools & Programmes

We use Outlook for e-mail communication as part of the Microsoft 365 package fromMicrosoft Inc, USA. We use Outlook to process incoming e-mails quickly and clearly via
this standard solution, and to distribute and answer them internally.
For planning and conducting meetings and related actions, we use the Teams softwarefrom Microsoft, which enables us to effectively handle meetings by linking them to the otherapplications of the Microsoft 365 package.
We have entered into a Data Processing Addendum (DPA) with Microsoft. In thisagreement, Microsoft undertakes to take measures that meet the requirements of the
GDPR for data security and data protection. You can view the content of this agreement
here:https://www.microsoft.com/licensing/docs/view/Professional-Services-DataProtection-Addendum-DPA .
The data processing may be based on your consent (Art. 6 Sect. 1 Sent. 1 let. b GDPR),
on a contract concluded or to be concluded between you and us (Art. 6 Sect. 1 Sent. 1 let.
b GDPR) or on an overriding legitimate interest in data processing on our part (Art. 6 Sect.
1 Sent. 1 let. f GDPR).
E-mail communication with you may be routed via Microsoft servers. Microsoft promisesthat all personal data processed via Microsoft 365 products for EU-based enterprisecustomers will be processed and stored exclusively within the EU. This promise applies toall of Microsoft's core cloud services - Azure, Microsoft 365 and Dynamics 365, see
Microsoft's
statement:
https://news.microsoft.com/de-de/unsere-antwort-an-europamicrosoft-ermoeglicht-speicherung-und-verarbeitung-von-daten-ausschliesslich-in-dereu/).
This means that, in principle, there is no data transfer outside the EU or the EEA ("third
country transfer"). Should a third country transfer nevertheless take place, we haveconcluded the EU standard contractual clauses with Microsoft. In this agreement, Microsoft
undertakes to take and comply with measures that enable a level of data protection that is
almost equivalent to that in the EU. The agreement of the EU Standard Contractual Clauses
constitutes appropriate safeguards for carrying out a third country transfer (Art. 46 Sect. 1
in conjunction with Sect. 2 let. c GDPR).
Frequently asked questions about Microsoft and data protection are answered here:
https://www.microsoft.com/de-de/trust-center/privacy/gdpr-faqs?market=de .
4.2

Use of the Eloqua marketing tool from Oracle

We use the Eloqua marketing system from Oracle Corporation, Redwood City, CA, USA("Eloqua") for all automated e-mails sent. The data required for this (regularly your e-mailaddress, if applicable your first and last name to be able to address you personally) is
passed on to the Eloqua system for this purpose.
We have concluded the EU standard contractual clauses with Oracle. In these, Oracle
undertakes to take and comply with measures that enable a level of data protection that is
almost equivalent to the EU data protection level. In addition, we have agreed with Oracle
 PTV Planung Transport Verkehr GmbH / June 2023

Page 6/12

Tools & Programmes

Data Privacy Statement Communicationon the additions to these standard contractual clauses recommended by the German dataprotection authorities for Oracle to take additional measures to further increase the level ofdata protection. The agreement of the EU standard contractual clauses with these
additional measures constitutes appropriate safeguards to be able to carry out a third
country transfer (Art. 46 Sect. 1 in conjunction with Sect. 2 let. c GDPR).
Data processing may be carried out based on your consent (Art. 6 Sect. 1 Sent. 1 let. a
GDPR), on the basis of a contract concluded or to be concluded between you and us (Art.
6 Sect. 1 Sent. 1 let. b GDPR) or based on an overriding legitimate interest in dataprocessing on our part (Art. 6 Sect. 1 Sent. 1 let. f GDPR).
Under the laws of Germany, you will only receive advertising by e-mail if you have given
your consent to receive advertising by e-mail (cf. § 7 Sect. 2 No. 3 UWG) or if the exceptions
to the consent requirement in § 7 Sect. 3 UWG apply.
The e-mails sent automatically via Eloqua contain so-called web beacons or tracking pixels(e.g. one-pixel image files that are stored on our website). This makes it possible todetermine whether an e-mail message has been opened and which links, if any, have been
clicked on. In addition, technical information is stored (e.g. time of retrieval, IP address,
browser type and operating system). This data is collected exclusively in pseudonymised
form and is not linked to other personal data. The possibility of a direct reference to aperson is excluded. This data is used exclusively for the statistical analysis of email
campaigns. The evaluations serve us to recognise reading habits and to adapt our content
to them or to send different content according to the interests of the readers.
Informationon
data
protectionatEloquawww.oracle.com/legal/privacy/privacy-policy.html.

can

be

found

at:

Please note that your data is usually transferred to a server in the USA and stored there.
The USA is assessed by the European Court of Justice as a country with an insufficientlevel of data protection according to EU standards. There is a risk that your data may beprocessed by US authorities, for control and monitoring purposes, possibly also without
any legal remedy.
4.3

Data processing in our CRM system Microsoft Dynamics 365

We work with the customer relationship management (CRM) tool Dynamics from Microsoft.
All data of our contacts and customers are stored and processed there, as far as we havea legal basis for the data processing. The CRM system is used for the purpose of making
all contacts available to the relevant employees throughout the company and thus enabling
fast and satisfactory communication with you.
Data processing in our CRM system may be based on consent given by you (Art. 6 Sect.
1 Sent. 1 let. a GDPR), on a contract concluded or to be concluded between you and us(Art. 6 Sect 1 Sent. 1 let. b GDPR) or on an overriding legitimate interest in data processing
on our part (Art. 6 Sect.1 Sent. 1 let. f GDPR).
Microsoft makes every effort to comply with all European data protection requirements, inparticular the General Data Protection Regulation (GDPR). The data processed by and with
Microsoft when using Dynamics is adequately secured according to the state of the art.
 PTV Planung Transport Verkehr GmbH / June 2023

Page 7/12

Data Privacy Statement Communication

Method of Data Processing

Regarding the transfer of data to third countries, the information provided above on the useof Microsoft 365 applies in the same way.
Information on data protection in connection with Dynamics, including a white paper todownload, a FAQ list, etc. from Microsoft, can be found here:
https://docs.microsoft.com/de-de/dynamics365/get-started/gdpr/
4.4

Use of DocuSign for the purpose of concluding contracts

We use the services of Docusign by the company DocuSign Germany GmbH, Neue
Rothofstrasse 13-19, D-60313 Frankfurt (or the US parent company DocuSign, Inc., USA)for the creation and transmission of digital signatures for the purpose of concluding
contracts.
DocuSign's services support us and you in setting up transactions digitally or electronically,
carrying them out and/or proving their validity - for example, by signing a contractelectronically.
We generally use DocuSign to conclude contracts. For this purpose, DocuSign processes,
in the course of providing its services, those data that enable the parties to prove the validityof the transactions they have entered into. This data also includes the persons involved in
the business transactions and the end devices used by these persons.
The data collected via DocuSign is stored on DocuSign servers.
Your use of DocuSign is purely voluntary in that you conclude a contract with us via
DocuSign. The legal basis is therefore your consent (Art. 6 Sect.1 let. a GDPR). If you wish
to conclude the contract by other means, you can inform us so that we can conclude thecontract with you in a conventional manner.
In principle, the data is processed within the EU or the EEA, so that no third country transfer
takes place. Should a third country transfer nevertheless take place, we have concluded
the EU standard contractual clauses with DocuSign. In this agreement, DocuSign
undertakes to take measures and comply with measures that enable a level of dataprotection that is almost equivalent to that in the EU. The agreement of the EU Standard
Contractual Clauses constitutes appropriate safeguards to carry out a third country transfer(Art. 46 Sect.1 in conjunction with Sect. 2 let. c GDPR).
Further information on the handling of user data can be found in the DocuSign privacy
policy at:https://www.docusign.de/unternehmen/datenschutz

5

Method of Data Processing

Your data will be stored, processed, and managed in a database in compliance with ourtechnical and organisational measures on our internal IT systems or in data protectioncompliant online services used by us for this purpose.
The data is protected against access by unauthorised persons and against deletion anddestruction in accordance with the state of the art. The data protection measures are
regularly evaluated and adapted to the state of the art.
 PTV Planung Transport Verkehr GmbH / June 2023

Page 8/12

Data Privacy Statement Communication

Legal Basis for Data Processing

6

Legal Basis for Data Processing

6.1

Data processing based on consent (Art. 6 Sect. 1 Sent. 1 let. a GDPR)

If you proactively send us an e-mail or fax or call us without prior contact, the legal basis
for the processing of the data is Art. 6 Sect.1 let. a GDPR, as you have given your consent
to the associated data processing by actively contacting us. This applies at least to theusual scope of such data processing, which is necessary to answer your enquiry and istherefore also expected by you.
For any further data processing, one of the other legal bases described below is relevant.
Consent is also the correct legal basis if and insofar as you voluntarily make use of services
or tools that we have described above, e.g. conclude a contract with us via DocuSign, inthe knowledge of the associated data processing.
6.2

Data processing due to contract performance (Art. 6 Sect. 1 Sent. 1 let. b
GDPR)

The data processing of interested parties or our customers (new and existing customers)
is carried out in accordance with Art. 6 Sect. 1 Sent. 1 let. b GDPR.
The processing of the data is necessary for the performance of a contract to which you area party (customer support, warranty, service provision, etc.) or for the implementation ofpre-contractual measures (contacting, preparation of offers, contract negotiations, etc.),
which are carried out at your request.
In addition to the processing of support cases or general communication for contract
initiation and contract processing, this is particularly the case with our reseller activities.
Here, we conclude at least a free brokerage contract with you, for the fulfilment of whichdata processing is necessary.
6.3

Data processing due to legitimate interests (Article 6 Sect. 1 Sent. 1 let. f
GDPR)

Furthermore, data processing is carried out based on our legitimate interest pursuant toArt. 6 Sect.1 Sent. 1 let. f GDPR.
This applies, for example, to data processing via Eloqua for automated e-mail transmission.
This transmission can take place if we want to inform you about the receipt of your e-mailwithout further examination of your e-mail or if you send us an automatically readable or
standardisable enquiry with your e-mail enquiry, which we answer by means of automatedanswer control via Eloqua. Our legitimate interest in these cases lies in the need to be able
to answer the enquiries to us as efficiently and quickly as possible and to be able to move
forward with the communication with you as quickly as possible to the point you haverequested.
Data processing in connection with evaluation for the purpose of statistics also falls underlegitimate interest. Our legitimate interest here is specifically that the collection andprocessing of the data supports our advertising and marketing interests. Furthermore, a PTV Planung Transport Verkehr GmbH / June 2023

Page 9/12

Data Privacy Statement Communication

Storage Duration

legitimate interest is to check and, if necessary, improve the future orientation of ourservices and products regarding the evaluated information of our interested parties andcustomers.
Your interests and fundamental freedoms worthy of protection do not outweigh our interestsin this case after we have weighed them. We would like to point out the special right ofobjection that you have with this legal basis (see the note at the end of this information).

7

Storage Duration

7.1

Data processing by way of consent

If you have effectively consented to one of the data processing operations described here,
we will store the data until you informally send us a revocation concerning this dataprocessing, which you can do at any time with effect for the future.
7.2

Data processing for the performance of a contract

The personal data collected by us for the purpose of initiating or fulfilling the contract will
be stored until the end of the contract negotiations or until the expiry of the contract.
We also store the data until claims can no longer be asserted under the contract, i.e. until
the statute of limitations has expired.
The general limitation period according to § 195 BGB is three (3) years. However, certain
claims, such as claims for damages, only become time-barred after 30 years (cf. § 197
BGB). If there is reasonable cause to assume that this is relevant in an individual case, westore the personal data for this period. The aforementioned limitation periods begin at theend of the year (i.e. 31 December) in which the claim arose and the creditor becomesaware of the circumstances giving rise to the claim and the debtor or should have becomeaware without gross negligence.
7.3

Data Protection based on legitimate interests

We store the data collected on the basis of a legitimate interest until the legitimate interest
no longer exists, or in case the weighing comes to a different result or you have effectively
objected in accordance with Art. 21 GDPR (cf. the note on the special right of objection at
the end of this information) and we otherwise have no other authorisation to continue thedata processing, which may be possible despite such an objection.
7.4

Reference to retention and storage obligations

If we are obliged to store data for a longer period of time in accordance with Art. 6 Sect.1
Sent. 1 let. c GDPR due to obligations to store and document certain data under tax andcommercial law, we will store this data for the duration of the statutory periods.

8

Data processing outside the EU or the EEA

As described above in the description of the tools used, it is possible that data processing
takes place outside the EU or the EEA (i.e. in a so-called third country). This may inparticular concern data processing in the USA.
 PTV Planung Transport Verkehr GmbH / June 2023

Page 10/12

Data Privacy Statement Communication

Removal options and data subject rights

We have concluded a Data Processing Addendum with the respective providers, whichguarantee us the right to issue instructions and in which the providers ensure compliancewith the statutory data protection regulations. In addition, we have agreed to the EU
standard contractual clauses on data protection adopted by the European Commission toregulate the transfer of data outside the EU or the EEA with the respective providers.
In individual cases, it may also be the case that instead of using the EU standard
contractual clauses or in addition to these, we carry out the data transfer with the data
recipient in the third country based on its Binding Corporate Rules (BCR). These areinternal binding data protection rules of the data recipient that have been previously
reviewed and approved by the competent data protection authority. These BCR are also
appropriate safeguards for such a data transfer (cf. Art. 46 Sect. 2 let. b in conjunction with
Art. 47 GDPR).
No other transfer of the collected data to external recipients takes place.

9

Removal options and data subject rights

You have the possibility to revoke a given consent to the processing of your personal dataat any time or to object to further data processing on the grounds of legitimate interest (cf.
the reference to the special right of objection further below in this text). In such a case, theconversation with you cannot be continued.
The revocation of consent or the objection to further data processing is possible via informal
communication to us (e.g. by e-mail). All personal data stored during the communication
with us will be deleted in this case.
Overall, you have the following rights:•
as per Art. 7 Sect. 3 GDPR, to revoke consent you have given to us at any time.
This means that we may no longer process the data based on this consent in the future;•
to request information about your personal data processed by us in accordance with
Art. 15 GDPR. In particular, you may request information about the processing purposes,
the category of personal data, the categories of recipients to whom your data have been or
will be disclosed, the planned storage period, the existence of a right to rectification,
erasure, restriction of processing or objection, the existence of a right of complaint, theorigin of your data if it has not been collected by us, as well as the existence of automateddecision-making including profiling and, if applicable, meaningful information about its
details;•in accordance with Art. 16 GDPR, to demand the correction of incorrect or complete
personal data stored by us;•
to request the erasure of your personal data stored by us in accordance with Art.
17 GDPR, unless the processing is necessary for the exercise of the right to freedom of
expression and information, for compliance with a legal obligation, for reasons of public
interest or for the assertion or exercise or defence of legal claims;•
in accordance with Art. 18 GDPR, to request the restriction of the processing of yourpersonal data, insofar as the accuracy of the data is contested by you, the processing is PTV Planung Transport Verkehr GmbH / June 2023

Page 11/12

Removal options and data subject rights

Data Privacy Statement Communication

unlawful, but you oppose its erasure and we no longer need the data, but you need it for
the establishment, exercise or defence of legal claims or you have objected to theprocessing in accordance with Art. 21 GDPR;•
in accordance with Art. 20 GDPR, to receive your personal data that you haveprovided to us in a structured, common and machine-readable format or to request thetransfer to another controller and•to complain to a supervisory authority in accordance with Art. 77 GDPR. As a rule,
you can contact the supervisory authority of your usual place of residence or workplace or
our company headquarters for this purpose.

Right to object to processing on the grounds of legitimate interest, as well as the right toobject to direct advertising
Insofar as we process personal data on the basis of Art. 6(1)(f) GDPR (i.e. because ofoverriding legitimate interests), you have the right to object to the processing of personal
data relating to you by us at any time on grounds relating to your particular situation. If wecannot demonstrate compelling legitimate grounds for further processing that override yourinterests, rights and freedoms, or if we process the data concerned from you for the
purpose of direct marketing, we will end to process your data (cf. Art. 21 GDPR).
You can contact us for this purpose by post or by e-mail.
If personal data are processed for the purpose of direct marketing, you have the right toobject at any time to the processing of personal data concerning you for the purpose ofsuch marketing; this also applies to profiling insofar as it is related to such direct marketing.
To
exercisetheaforementioned
datenschutz@ptvgroup.com.

 PTV Planung Transport Verkehr GmbH / June 2023

rights,simplysend

ane-mailtoPage 12/12