Source: http://www.carstensen.de/en/mandatory-information-according-to-art-13-or-14-eu-gdpr/
Timestamp: 2019-04-22 02:11:20+00:00

Document:
Protecting personal data is extremely important to Carstensen Import-Export Handels-GmbH. For this reason, Carstensen Import-Export Handels-GmbH only processes personal data in keeping with applicable legal requirements, and by technical and organizational means ensures compliance with data protection regulations.
The following information provides an overview of data handling and the rights of data subjects under the European General Data Protection Regulation (GDPR) enacted on 5/25/2018.
If personal data is collected and processed for measures taken before the contract or on the basis of a contract, that data will be used to conclude the contract, execute the contractual relationship, and end it where applicable.
Data may be processed to protect the legitimate corporate interests of Carstensen Import-Export Handels-GmbH or of third parties where applicable. Reasons for this may include: to ensure IT security and IT operation, to prevent and investigate crimes/minor breaches of the law, to protect property rights, to offer our customers services after the contract is concluded (e.g. warranty) or for the purposes of direct advertising to existing customers when other requirements are fulfilled, etc.
If the data subject of Carstensen Import-Export Handels-GmbH has granted consent for data processing for certain purposes (e.g. to send out newsletters), it is lawful to use the personal data within the scope of the consent.
Data processing may ultimately be necessary to fulfill legal obligations, particularly retention requirements under the German Commercial Code and the General Tax Code.
If we process special categories of personal data, the legal basis for this is 9(2) and (4) GDPR, where applicable in conjunction with Section 22 of the German Data Protection Act (BDSG).
Carstensen Import-Export Handels-GmbH processes personal data if that data is made available or transmitted by the data subjects themselves (e.g. customers, employees) or by third parties.
At Carstensen Import-Export Handels-GmbH, only those people who need access to personal data in order to lawfully perform their duties are given access to such data. If external hired service providers receive personal data for these purposes, we ensure that appropriate technical and organizational measures are taken and the necessary agreements are made such that processing complies with the applicable data protection requirements and guarantees the protection of the rights of the data subject.
Business partners to whom data must be transmitted in order for them to fulfill their duties, such as payment service providers/financial institutions, postal/package delivery services, sales representatives, external advisors, etc.
Personal data will not be transmitted to a third country (countries outside the European Union or the European Economic Area) or an international organization.
Personal data will only be stored as long as is permissible in accordance with the applicable legal basis. In particular, it will be stored as long as is necessary to fulfill the contractual purposes for which the personal data was collected, as long as it is necessary to retain the data in order to meet retention requirements or as a result of an overriding legitimate interest, or until the data subject withdraws their consent being the basis for the processing.
Right to information, Art. 15 GDPR: Under Art. 15(1) GDPR, the data subject has the right to demand confirmation of whether personal data relating to them is being processed. If this is the case, they also have a right to receive information on that personal data and the other information pursuant to Art. 15(1) points a to h GDPR.
Right to rectification, Art. 16 GDPR: Should the personal data be incorrect or incomplete, taking into account the purposes for which it is processed, Art. 16 GDPR confers a right to require rectification or completion of the personal data.
Right to erasure, Art. 17 GDPR: Art. 17(1) GDPR confers a right to require that personal data be erased when it is impermissible to process personal data for one of the reasons mentioned in that provision. Erasure cannot be required, however, if it is necessary to continue processing the data in the cases referred to in Art. 17(3) GDPR, for example in order to fulfill legal obligations.
Right to restriction of the processing, Art. 18 GDPR: Under the stipulations of Art. 18(1) points a through d GDPR, the data subject is entitled to request that the processing of their data be restricted (restriction).
A right to data portability pursuant to Art. 20 GDPR: data subjects have the right to receive in a standard machine-readable format their personal data that they themselves have provided to Carstensen Import-Export Handels-GmbH which is automatically processed by Carstensen Import-Export Handels-GmbH GmbH based on granted consent or a contract. This right is subject to (among other things) the limitations of technical feasibility.
Right to object, Art. 21 GDPR: data subjects have the right to object to the processing of their personal data which is processed on the basis of a weighing of interests (Art. 6(1) point f GDPR), taking into consideration the stipulations of Art. 21 GDPR.
If the objection is directed against direct advertising (possibly with associated profiling), then data processing will no longer occur in this respect. In other cases, data can only be further processed despite an objection if there are compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defense of legal claims.
Furthermore, granted consent can at any time be withdrawn in full or modified without justification, effective for the future. The withdrawal of consent does not affect the lawfulness of the processing of your data based on your consent that occurred before such withdrawal.
You can either mail your withdrawal to Carstensen Import-Export Handels-GmbH, Werner-v.-Siemens-Str. 3-7, 25479 Ellerau, send an e-mail to datenschutz@carstensen.de or submit your withdrawal to Carstensen Import-Export Handels-GmbH by fax +49-(0)4106-79950-90. You will not incur any additional costs beyond the basic rate.
You have the right to lodge a complaint with a supervisory authority for data protection. The contact information for the supervisory authority with jurisdiction over us can be found in point 3 of this document.
The contracts concluded or to be concluded give rise to an obligation to provide certain personal data in instances where the contract cannot be executed without the provision of the data. Furthermore, we may have to comply with legal obligations that require us to collect/process certain data.
In the case of data needed for a contract, it will not be possible to conclude the contract if information is missing.
If data must be provided due to legal obligations, it will not be possible to provide the associated service unless the information is supplied.
Automated individual decision-making, including profiling pursuant to Art. 22 GDPR, does not occur at Carstensen Import-Export Handels-GmbH.

References: Art. 15
 Art. 15
 Art. 15
 Art. 16
 Art. 16
 Art. 17
 Art. 17
 Art. 17
 Art. 18
 Art. 18
 Art. 20
 Art. 21
 Art. 21
 Art. 22