Source: https://european-enamel-authority.org/en/privacynotice
Timestamp: 2019-04-25 11:01:46+00:00

Document:
Many thanks for your visit to our website and your interest in vitreous enamel.
We take data protection seriously and herewith inform you how we will process your data and what your claims and rights are in accordance with data protection regulations.
Valid as of 25 May 2018.
We process personal data in accordance with the provisions of the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) as well as other applicable data protection regulations (details will follow). Which individual data are processed and how they are used primarily depends on the services requested and or agreed upon. For further details or additions for the purpose of data processing, you may refer to the respective contract documents, forms, a declaration of consent and/or other information provided to you (e.g. when using our website or our general terms and conditions). Furthermore, this data protection information may be updated from time to time. Please, refer to our website www.european-enamel-authority.org.
​​​​​​Personal data are being processed to implement our contracts with you and to execute your orders as well as to take measures and to carry out activities in the scope of precontractual relations, e.g. with interested parties. Processing such data particularly is required to be able to render services in accordance with your orders and requests and this includes the necessary services, measures and activities. This mainly includes the contract-related communication with you, the traceability of transactions, orders and other agreements as well as measures to control and optimize business processes as well as to exercise due diligence, steering and control by affiliated companies and associations; statistic evaluations for corporate management, cost recording and controlling, reporting, internal and external communication, emergency management, settlement and fiscal evaluation of operational performances, risk management, assertion of legal claims and defense in legal disputes; safeguarding IT security and the general safety, assurance of integrity, authenticity and availability of data, prevention and investigation of criminal offences; control by supervisory boards or supervisory bodies (e.g. audit).
Processing your personal data for certain purpose (e.g. the use of your e-mail address for marketing purposes) may be carried out based on your agreement. Normally, you may revoke your permission any time. This also applies to the revocation of declarations of consent given to us before the GDPR came into effect, this means before 25 May 2018. You will be separately informed about the purposes and about the consequences of a revocation or a non-issuance of a declaration of consent in a corresponding text. Basically, the revocation of a declaration of consent will take effect in the future only. Processing carried out before the revocation are not concerned and remain legitimate.
Client and supplier data we obtain in the scope of our services rendered.
We process and store your data for the duration of our business relationship. This also includes the initiation of a contract (precontractual relationship) and the implementation of a contract.
Moreover, we are subject to several retention and documentation obligations which, among others, result from the German Commercial Code (HG8) and the German Fiscal Code (AO) as well as the International Accounting Standards (I FRS). The periods for retention and/or documentation stated there, amount to up to ten years after the termination of the business relationship and/or the pre-contractual legal relationship.
Furthermore, particular legal provisions may require a longer retention period, as for example the maintenance of pieces of evidence in the scope of statutory limitation periods. According to §§ 195 ff. of the German Civil Code (8GB), the regular statutory limitation period is three years; however, even limitation periods of up to 30 years may apply.
When data are no longer required for complying with contractual or judicial obligations and rights, they will be deleted at regular intervals unless their - limited - further processing is required for complying with the purposes for a predominantly legitimate interest stated in item 2.2. Such a predominantly legitimate interest for example also exists when a deletion is not possible or only possible at disproportionate expense because of the kind of storage and a processing for other purposes by suitable technical and organisation measures is impossible.
​​​​​​You are entitled to be informed by us about your data stored by us according to the provisions of Art. 15 GDPR (if necessary, with restrictions as per § 34 BDSG).
Upon your request we will correct the data stored about you as per Art. 16 GDPR when they are incorrect or inaccurate.
You only have to provide those data that are required for starting and performing business relations or for a precontractual relationship with us or that we are legally obliged to collect. Generally, we will not be in a position to conclude or execute a contract without these data. This may later on also refer to data that are required in the scope of our business relations. If we ask you for data going beyond that scope, you will be separately informed on the voluntary nature of your information.
Possibly we partly process your data with the objective to evaluate certain personal aspects (profiling). In order to purposefully be able to inform you about products and to advise you, we may use evaluation tools. These tools allow a needs-based product design, communication and advertising including market research and opinion polling.
When there are reasons resulting from your particular situation, you always are entitled to object to the processing of your data on the basis of Art. 6 Section 1 f GDPR (Data processing on the basis of balancing of interests) or on the basis of Art. 6 section e GDPR (Data processing in public interest) This will also apply to a profiling in terms of Art. 4 No.4 GDPR based on this provision.
Our privacy statement as well as the information on data protection concerning our data processing as per Article (Art.) 13,14 and 21 GDPR may change from time to time. We will publish any changes on www.european-enamel-authority.org.

References: Art. 15
 § 34
 Art. 16
 Art. 6
 Art. 6
 Art. 4