Source: https://www.chromsystems.com/gdpr-obligatory-information
Timestamp: 2019-04-18 14:23:25+00:00

Document:
The controller as per Art. 4 (7) of the EU General Data Protection Regulation (EU GDPR): Chromsystems Instruments & Chemicals GmbH (hereafter: “Chromsystems”).
The Chromsystems Data Protection Officer is available to answer your questions about the processing of personal data by e-mail to datenschutz@chromsystems.com, or by post, adding “Attn: The Data Protection Officer” to the address.
Chromsystems processes personal data received from you within the framework of a business relationship. To the extent necessary for the provision of its service, Chromsystems also processes personal data that it has legitimately received from other companies (e.g. in order to perform orders, fulfil contracts or received on the basis of consent granted). Chromsystems also processes personal data that it has legitimately obtained from publicly available sources (e.g. press, media) and which it may process.
Relevant personal data are master data (name, address and other contact details, date and place of birth and nationality) and authentication data (e.g. ID data). In addition, this may also include order data (e.g. order data, product data), data from the fulfilment of a contractual obligation (e.g. sales), creditworthiness data, scoring/rating data, advertising and sales data (including advertising scores), documentation data (e.g. documenting meetings), data about your use of offered telemedia (e.g. time of visit to a website, use of apps or newsletters, clicked pages or entries) as well as other data comparable with the categories mentioned.
The processing of personal data (Art. 4 No. 2 GDPR) takes place to fulfil the obligation arising in connection with customer contracts with you, in particular for the execution of contracts or pre-contractual measures with you and the execution of orders and all activities required in the industry associated with the operation and management of the company.
The purposes of data processing are based primarily on the specific product or service (e.g. order, framework agreement).
- Measures for business management and the further development of services and products.
Chromsystems' interest in the respective processing stems from the respective purposes and otherwise serves economic purposes (efficient performance of tasks, sales, avoidance of legal risks).
To the extent the specific purpose permits, Chromsystems processes your data in pseudonymised or anonymised form.
In so far as consent to the processing of personal data has been granted by you for specific purposes (e.g. dissemination of data within the Group, use of your e-mail address including for advertising about its own similar goods and services), such processing is deemed legal based on the consent. Granted consent can be revoked at any time. This also applies to the revocation of declarations of consent that were granted before 25 May 2018. Please note that the revocation is only effective for the future. Processing that occurred before the revocation is not affected.
- any other body you have given your consent to Chromsystems to transfer data to.
If necessary, Chromsystems processes and stores your personal data for the duration of the business relationship, which includes, for example, the initiation and execution of a contract.
In addition, Chromsystems is subject to various storage and documentation obligations, which stem from the German Commercial Code (HGB) or the German Tax Code (AO) among others. The deadlines for storage or documentation stipulated there are two to ten years. Lastly, the storage period is also determined according to statutory limitation periods that are, for example, usually three years, but in some cases can also be up to 30 years pursuant to Sections 195 et seq. German Civil Code (BGB).
Your data will only be transferred to countries outside the European Economic Area - EEA (third countries), if necessary to process the orders, if required by law or if your consent was given.
Each data subject has the right to information under Art. 15 GDPR, the right to rectification under Art. 16 GDPR, the right to erasure under Art. 17 GDPR, the right to restriction of processing under Art. 18 GDPR and the right to data portability from Art. 20 GDPR. With regard to the right to information and the right to erasure, the restrictions under Art. 34 and 35 FDPA apply. In addition, there is a right to lodge a complaint with data protection supervisory authority (pursuant to Art. 77 GDPR).
You have the right, for reasons stemming from your particular situation, to object at any time to the processing of the personal data pursuant to Art. 6 (1) (f) GDPR (data processing on the basis of a weighing of interests). This also applies to profiling based on this provision within the meaning of Art. 4 (4) GDPR, which can be carried out for customer advice and support and sales purposes.
If you object, your personal data will no longer be processed unless there are compelling legitimate grounds for processing that outweigh the interests, rights and freedoms, or unless the processing is for the purposes of asserting, exercising or defending against legal claims.
Chromsystems and the additional controllers can also process your data within the scope of the legal regulations for direct advertising purposes. You have the right to object at any time to the processing of the personal data for the purpose of such advertising. This also applies to profiling if it is associated with this direct marketing.

References: Art. 4
 Art. 15
 Art. 16
 Art. 17
 Art. 18
 Art. 20
 Art. 34
 Art. 77
 Art. 6
 Art. 4