Source: https://www.becc-group.com/privacy
Timestamp: 2019-04-20 23:12:56+00:00

Document:
﻿*Our transparency document can be found within the data protection regulations.
Data protection is of a particularly high priority for the management of the BECC Agency Group GmbH. The use of the Internet pages of the BECC Agency Group GmbH is possible without any indication of personal data; however, if a data subject wants to use special enterprise services via our website, processing of personal data could become necessary. If the processing of personal data is necessary and there is no statutory basis for such processing, we generally obtain consent from the data subject.
The processing of personal data, such as the name, address, e-mail address, or telephone number of a data subject shall always be in line with the General Data Protection Regulation (GDPR), and in accordance with the country-specific data protection regulations applicable to the BECC Agency Group GmbH. By means of this data protection declaration, our enterprise would like to inform the general public of the nature, scope, and purpose of the personal data we collect, use and process. Furthermore, data subjects are informed, by means of this data protection declaration, of the rights to which they are entitled.
As the controller, the BECC Agency Group GmbH has implemented numerous technical and organizational measures to ensure the most complete protection of personal data processed through this website. However, Internet-based data transmissions may in principle have security gaps, so absolute protection may not be guaranteed. For this reason, every data subject is free to transfer personal data to us via alternative means, e.g. by telephone.
The data protection declaration of the BECC Agency Group GmbH is based on the terms used by the European legislator for the adoption of the General Data Protection Regulation (GDPR). Our data protection declaration should be legible and understandable for the general public, as well as our customers and business partners. To ensure this, we would like to first explain the terminology used.
The website of the BECC Agency Group GmbH collects a series of general data and information when a data subject or automated system calls up the website. This general data and information are stored in the server log files. Collected may be (1) the browser types and versions used, (2) the operating system used by the accessing system, (3) the website from which an accessing system reaches our website (so-called referrers), (4) the sub-websites, (5) the date and time of access to the Internet site, (6) an Internet protocol address (IP address), (7) the Internet service provider of the accessing system, and (8) any other similar data and information that may be used in the event of attacks on our information technology systems.
When using these general data and information, the BECC Agency Group GmbH does not draw any conclusions about the data subject. Rather, this information is needed to (1) deliver the content of our website correctly, (2) optimize the content of our website as well as its advertisement, (3) ensure the long-term viability of our information technology systems and website technology, and (4) provide law enforcement authorities with the information necessary for criminal prosecution in case of a cyber-attack. Therefore, the BECC Agency Group GmbH analyses anonymously collected data and information statistically, with the aim of increasing the data protection and data security of our enterprise, and to ensure an optimal level of protection for the personal data we process. The anonymous data of the server log files are stored separately from all personal data provided by a data subject.
If one of the aforementioned reasons applies, and a data subject wishes to request the erasure of personal data stored by the BECC Agency GmbH, he or she may at any time contact our Data Protection Officer or another employee of the controller. The Data Protection Officer of the BECC Agency GmbH or another employee shall promptly ensure that the erasure request is complied with immediately.
Where the controller has made personal data public and is obliged pursuant to Article 17(1) to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform other controllers processing the personal data that the data subject has requested erasure by such controllers of any links to, or copy or replication of, those personal data, as far as processing is not required. The Data Protection Officer of the BECC Agency Group GmbH or another employee will arrange the necessary measures in individual cases.
If one of the aforementioned conditions is met, and a data subject wishes to request the restriction of the processing of personal data stored by the BECC Agency Group GmbH, he or she may at any time contact our Data Protection Officer or another employee of the controller. The Data Protection Officer of the BECC Agency Group GmbH or another employee will arrange the restriction of the processing.
In order to assert the right to data portability, the data subject may at any time contact the Data Protection Officer designated by the BECC Agency Group GmbH or another employee.
The BECC Agency Group GmbH shall no longer process the personal data in the event of the objection, unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.
If the BECC Agency Group GmbH processes personal data for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing. This applies to profiling to the extent that it is related to such direct marketing. If the data subject objects to the BECC Agency Group GmbH to the processing for direct marketing purposes, the BECC Agency Group GmbH will no longer process the personal data for these purposes.
In addition, the data subject has the right, on grounds relating to his or her particular situation, to object to processing of personal data concerning him or her by the BECC Agency Group GmbH for scientific or historical research purposes, or for statistical purposes pursuant to Article 89(1) of the GDPR, unless the processing is necessary for the performance of a task carried out for reasons of public interest.
In order to exercise the right to object, the data subject may directly contact the Data Protection Officer of the BECC Agency Group GmbH or another employee. In addition, the data subject is free in the context of the use of information society services, and notwithstanding Directive 2002/58/EC, to use his or her right to object by automated means using technical specifications.
If the decision (1) is necessary for entering into, or the performance of, a contract between the data subject and a data controller, or (2) it is based on the data subject's explicit consent, the BECC Agency Group GmbH shall implement suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and contest the decision.
If the data subject wishes to exercise the rights concerning automated individual decision-making, he or she may at any time directly contact our Data Protection Officer of the BECC Agency Group GmbH or another employee of the controller.
f the data subject wishes to exercise the right to withdraw the consent, he or she may at any time directly contact our Data Protection Officer of the BECC Agency Group GmbH or another employee of the controller.
The personal data of every individual who is in a contractual, pre-contractual or other relationship with our company deserve special protection. Our goal is to keep our data protection level to a high standard. Therefore, we are constantly developing our data protection and data security concepts.
Of course, we comply with the statutory provisions on data protection. According to Article 13, 14 GDPR, companies meet specific information requirements when collecting personal data. This document fulfills these obligations.
The terminology of legal regulations is complicated. Unfortunately, the use of legal terms could not be dispensed with in the preparation of this document. Therefore, we would like to point out that you are always welcome to contact our Data Protection Officer for all questions concerning this document, the used terms or formulations.
The purpose of the processing of personal data is the handling of all operations which concern the controller, customers, prospective customers, business partners or other contractual or pre-contractual relations between the named groups (in the broadest sense) or legal obligations of the controller.
All companies and branches that are part of our group (hereinafter referred to as “group companies”) that have their place of business or an office in a third country may belong to the recipients of personal data. The addresses of all group companies are available on our website. Furthermore, a list of all group companies can be requested from our Data Protection Officer.
According to Article 46(1) GDPR a controller or processor may transfer personal data only to a third country if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available. Appropriate safeguards may be provided without requiring any specific authorisation from a supervisory authority by means of standard contractual clauses, Article 46(2) lit. c GDPR.
The standard contractual clauses of the European Union are agreed with all recipients from third countries before the first transmission of personal data. Consequently, it is ensured that appropriate safeguards, enforceable data subject rights and effective legal remedies for data subjects which are resulting from the EU standard contractual clauses are guaranteed. Every data subject can obtain a copy of the standard contractual clauses from our Data Protection Officer. The standard contractual clauses are also available in the Official Journal of the European Union (OJ 2010 / L 39, page 5-18).
Each data subject has a right to access the personal data concerning him or her. The right to access extends to all data processed by us. The right can be exercised easily and at reasonable intervals, in order to be aware of, and verify, the lawfulness of the processing (Recital 63 GDPR). This right results from Art. 15 GDPR. The data subject may contact our Data Protection Officer to exercise the right to access.
According to Article 16 Sentence 1 GDPR the data subject has the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Moreover, Article 16 Sentence 2 GDPR provides that the data subject is entitled, taking into account the purposes of the processing, to have incomplete personal data completed, including by means of providing a supplementary statement. The data subject may contact our Data Protection Officer to exercise the right of rectification.
In addition, data subjects are entitled to a right to erasure and to be forgotten under Art. 17 GDPR. This right can also be exercised by contacting our Data Protection Officer. At this point, however, we would like to point out that this right does not apply insofar as the processing is necessary to fulfill a legal obligation to which our company is subject to, Article 17(3) lit. b GDPR. This means that we can approve an application to erase only after the expiration of the statutory retention period.
According to Article 18 GDPR any data subject is entitled to a restriction of processing. The restriction of processing may be demanded if one of the conditions set out in Article 18(1) lit. a-d GDPR is fulfilled. The data subject may contact our Data Protection Officer to exercise the right to restriction of processing.
Furthermore, Art. 21 GDPR guarantees the right to object. The data subject may contact our Data Protection Officer to exercise the right to object.
Art. 20 GDPR grants the data subject the right to data portability. Under this provision, the data subject has under the conditions laid down in Article 20(1) lit. a and b GDPR the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machinereadable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided. The data subject may contact our Data Protection Officer to exercise the right to data portability.
If processing of personal data is based on Art. 6(1) lit. a GDPR, which is the case, if the data subject has given consent to the processing of personal data for one or more specific purposes or is it based on Article 9(2) lit. a GDPR, which regulates the explicit consent to the processing of special categories of personal data, the data subject has according to Article 7(3) Sentence 1 GDPR the right to withdraw his or her consent at any time.
Withdraw of consent shall not affect the lawfulness of processing based on consent before its withdrawal, Article 7(3) Sentence 2 GDPR. It shall be as easy to withdraw as to give consent, Art. 7(3) Sentence 4 GDPR. Therefore, the withdrawal of consent can always take place in the same way as consent has been given or in any other way, that is considered by the data subject to be simpler. In todays information society, probably the simplest way to withdraw consent is a simple email. If the data subject wishes to withdraw his or her consent granted to us, a simple email to our Data Protection Officer is sufficient. Alternatively, the data subject may choose any other way to communicate his or her withdraw of consent to us.
As the controller, we are obliged to notify the data subject of the right to lodge a complaint with a supervisory authority, Article 13(2) lit. d GDPR. The right to lodge a complaint with a supervisory authority is regulated by Article 77(1) GDPR. According to this provision, without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes the General Data Protection Regulation. The right to lodge a complaint with a supervisory authority was only limited by the law of the Union in such way, that it can only be exercised before a single supervisory authority (Recital 141 Sentence 1 GDPR). This rule is intended to avoid double complaints of the same data subject in the same matter. If a data subject wants to lodge a complaint about us, we therefore asked to contact only a single supervisory authority.
If the processing of personal data is necessary for the performance of a contract to which the data subject is party, as is the case, for example, when processing operations are necessary for the supply of goods or to provide any other service, the processing is based on Article 6(1) lit. b GDPR. The same applies to such processing operations which are necessary for carrying out pre-contractual measures, for example in the case of inquiries concerning our products or services. Is our company subject to a legal obligation by which processing of personal data is required, such as for the fulfillment of tax obligations, the processing is based on Art. 6(1) lit. c GDPR.
According to Article 46(1) GDPR a controller or processor may transfer personal data only to a third country if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available. Appropriate safeguards may be provided without requiring any specific authorisation from a supervisory authority by means of standard data protection clauses, Article 46(2) lit. c GDPR.
According to Article 6(1) lit. f GDPR, processing shall be lawful only if the processing is necessary for the purposes of legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data. According to Recital 47 Sentence 2 GDPR a legitimate interest could exist where there is a relevant and appropriate relationship between the data subject and the controller, e.g. in situations where the data subject is a client of the controller. In all cases in which our company processes personal data based on Article 6(1) lit. f GDPR, our legitimate interest is in carrying out our business in favor of the well-being of all our employees and the shareholders.
According to Article 18 GDPR any data subject is entitled to restriction of processing. The restriction of processing may be demanded if one of the conditions set out in Article 18(1) lit. a-d GDPR is fulfilled. The data subject may contact our Data Protection Officer to exercise the right to restriction of processing.
Art. 20 GDPR grants the data subject the right to data portability. According to this provision the data subject has under the conditions laid down in Article 20(1) lit. a and b GDPR the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machinereadable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided. The data subject may contact our Data Protection Officer to exercise the right to data portability.
As the controller, we are obliged to notify the data subject of the right to lodge a complaint with a supervisory authority, Article 14(2) lit. e GDPR. The right to lodge a complaint with a supervisory authority is regulated by Article 77(1) GDPR. According to this provision, without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes the General Data Protection Regulation. The right to lodge a complaint with a supervisory authority was only limited by the law of the Union in such way, that it can only be exercised before a single supervisory authority (Recital 141 Sentence 1 GDPR). This rule is intended to avoid double complaints of the same data subject in the same matter. If a data subject wants to lodge a complaint about us, we therefore asked to contact only a single supervisory authority.
In principle, personal data is collected directly from the data subject or in cooperation with an authority (e.g. retrieval of data from an official register). Other data on data subjects are derived from transfers of group companies. In the context of this general information, the naming of the exact sources from which personal data is originated is either impossible or would involve a disproportionate effort within the meaning of Art. 14(5) lit. b GDPR. In principle, we do not collect personal data from publicly accessible sources.
Any data subject can contact our Data Protection Officer at any time to obtain more detailed information about the exact sources of the personal data concerning him or her. Where the origin of the personal data cannot be provided to the data subject because various sources have been used, general information should be provided (Recital 61 Sentence 4 GDPR).

References: Art. 15
 Art. 17
 Art. 21

Art. 20
 Art. 6
 Art. 7
 Art. 6

Art. 20
 Art. 14