Information on data protection regarding our processing of customer and interested party data in accordance with Articles 13, 14 and 21 of the General Data Protection Regulation (GDPR)
init innovation in traffic systems SE
INIT Innovative Informatikanwendungen in Transport-, Verkehrs- und Leitsystemen GmbH
INIT Mobility Software Solutions GmbH
Dear customer, dear interested party, dear contractual partner
in accordance with the provisions of Articles 13, 14 and 21 of the General Data Protection Regulation (GDPR), we hereby inform you about the processing of your personal data and your rights under data protection law in this regard. Which data is processed in detail and in which way it is used depends largely on the services requested or agreed upon. In order to ensure that you are fully informed about the processing of your personal data within the scope of the fulfilment of a contract or the implementation of pre-contractual measures, please take note of the following information.
1. RESPONSIBLE AUTHORITY IN THE SENSE OF DATA PROTECTION LAW
init innovation in traffic systems SE
Käppelestrasse 4-10
76131 Karlsruhe
Germany
Phone: +49.721.6100.0
fax: +49.721.6100.399
e-mail: webmaster_prefix@initse._suffixcom
Board members: Dr. Gottfried Greschner (Chairman), Dr. Jürgen Greschner, Dr. Marco Ferber, Matthias Kühn, Jörg Munz
2. CONTACT DETAILS OF OUR DATA PROTECTION OFFICER
Georg Biel
Data protection officer
e-mail: dataprotection_prefix@initse._suffixcom
3. PURPOSES AND LEGAL BASIS OF THE PROCESSING
We process your personal data in accordance with the provisions of the European General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG), insofar as these are necessary for the establishment, execution and fulfilment of a contract and for the implementation of pre-contractual measures. Insofar as personal data are required for the initiation or execution of a contractual relationship or in the context of the implementation of pre-contractual measures, processing is legitimate in accordance with Art. 6 para. 1 lit. b GDPR.
If you give us your express consent to process personal data for specific purposes (e.g. transfer to third parties, evaluation for marketing purposes or advertising by e-mail), the legitimacy of this processing is based on your consent pursuant to Art. 6 para. 1 lit. a GDPR. Any consent granted can be revoked at any time with effect for the future (see item 9 of this data protection information).
Where necessary and legally permissible, we process your data beyond the actual contractual purposes to fulfil legal obligations in accordance with Art. 6 Para. 1 lit. c GDPR. In addition, processing may be carried out to protect the legitimate interests of us or third parties and to defend and assert legal claims in accordance with Art. 6 Para. 1 lit. f GDPR. If necessary, we will inform you separately, stating the legitimate interest, insofar as this is required by law.
4. CATEGORIES OF PERSONAL DATA
We process only such data that are related to the contract justification or the pre-contractual measures. This can be general data about your person or persons in your company (name, address, contact data, etc.) as well as any other data that you provide us with in the context of the establishment of the contract.
5. SOURCES OF THE DATA
We process personal data which we receive from you in the course of establishing contact or a contractual relationship or in the course of pre-contractual measures or which you have given us via the contact form on our website or at trade fairs and events.
6. RECIPIENT OF THE DATA
Within our company, we only pass on your personal data to those departments and employees who need this data to fulfil contractual and legal obligations or to implement our legitimate interests. We may transfer your personal data to companies affiliated with us to the extent permitted by the purposes and legal basis set out in section 3 of this data protection information.
Your personal data will be processed on our behalf on the basis of data processing agreements in accordance with Art. 28 GDPR. In these cases we ensure that the processing of personal data is carried out in accordance with the provisions of the GDPR. The categories of recipients in this case are providers of Internet services and providers of customer management systems and software. Otherwise, data is only passed on to recipients outside the company to the extent permitted or required by law, the transfer is necessary for processing and thus for the fulfilment of the contract or, at your request, for the implementation of pre-contractual measures, we have your consent or we are authorised to provide information.
Under these conditions, recipients of personal data may be, for example
- External tax consultant
- Public bodies and institutions (e.g. public prosecutor's office, police, supervisory authorities, tax office) if there is a legal or official obligation,
- Recipients to whom the disclosure is directly necessary for the establishment or performance of the contract, such as suppliers and subcontractors, transport and logistics service providers.
- Other data recipients for whom you have given us your consent to the transfer of data: Sendinblue GmbH or Constant Contacts Inc.
7. TRANSMISSION TO A THIRD COUNTRY
Personal data will only be transferred to countries outside the EEA (European Economic Area) or to an international organisation if this is necessary for the processing and thus the fulfilment of the contract or, at your request, for the implementation of pre-contractual measures, if the transfer is required by law or if you have given us your consent. In such cases, the recipients may include local agencies and non-European group companies. The data will be transferred in accordance with Art. 45 para. 1 GDPR if an adequacy decision has been made by the European Commission, Art. 46 Para. 2 c) GDPR if signed European Commission Standard Contractual Clauses for data protection are available, or Art. 49 para. 1 a) in the case of consent or Art. 49 para. 1 b) for the performance of the contract.
8. DURATION OF DATA STORAGE
Where necessary, we process and store your personal data for the duration of our business relationship or for the fulfilment of contractual purposes. This also includes the initiation and execution of a contract.
In addition, we are subject to various storage and documentation obligations, which result from the German Commercial Code (Handelsgesetzbuch) and the German Fiscal Code (Abgabenordnung), among others. The periods of retention or documentation prescribed there are two to ten years.
Finally, the storage period also depends on the statutory limitation periods, which, for example, according to §§ 195 et sqq. of the German Civil Code (BGB), are usually three years, but in certain cases can be up to thirty years.
9. YOUR RIGHTS
Every data subject has the right of access under Art. 15 GDPR, the right of rectification under Art. 16 GDPR, the right of deletion under Art. 17 GDPR, the right to restrict processing under Art. 18 GDPR, the right of notification under Art. 19 GDPR and the right to data transferability under Art. 20 GDPR.
In addition, you have the right of appeal to a data protection supervisory authority pursuant to Art. 77 GDPR if you believe that the processing of your personal data is not legitimate. The right of appeal is without prejudice to any other administrative or judicial remedy.
If the processing of data is based on your consent, you are entitled under Art. 7 GDPR to revoke your consent to the use of your personal data at any time. Please note that the revocation is only effective for the future. Processing that took place before the revocation is not affected. Please also note that we may have to store certain data for a certain period of time in order to comply with legal requirements (see item 8 of this data protection information).
RIGHT OF OBJECTION
Insofar as the processing of your personal data is carried out in accordance with Art. 6 para. 1 lit. f GDPR for the protection of legitimate interests, you have, in accordance with Art. 21 GDPR the right to object to the processing of such data at any time for reasons arising from your specific situation. We will then no longer process this personal data unless we can prove compelling reasons for processing worthy of protection. These must outweigh your interests, rights and freedoms, or the processing must serve to assert, exercise or defend legal claims.
In individual cases, we process your personal data for the purpose of direct marketing. You have the right to object at any time to the processing of your personal data for the purpose of such advertising. This also applies to profiling, as far as it is connected to this direct advertising. If you object to processing for the purpose of direct marketing, we will not process your personal data further for these purposes.
In order to protect your rights, you can contact us using the contact details given in point 1.
10. NECESSITY OF THE PROVISION OF PERSONAL DATA
The provision of personal data for the decision to conclude a contract, for the performance of a contract or for the implementation of pre-contractual measures is voluntary. However, we can only make a decision within the framework of contractual measures if you provide such personal data as are necessary for the conclusion of the contract, the fulfilment of the contract or pre-contractual measures.
11. AUTOMATED DECISION MAKING
As a matter of principle, we do not use a fully automated decision-making process in accordance with Art. 22 GDPR to establish, fulfil or implement the business relationship or for pre-contractual measures. Should we use these procedures in individual cases, we will inform you of this separately or obtain your consent if this is required by law.