Processing of personal data HEMA Group, European locations

Obligation to provide information to business partners

We are obliged to carry out all processing only in compliance with the relevant provisions of the Federal Data Protection Act (BDSG-New), the GDPR and the Telemedia Act (TMG) in their currently valid version. We would like to explain this to you below:

When we communicate with you, we only process your personal data as the responsible party if there is a legitimate interest in the processing (Art. 6 Para. 1 lit. f GDPR) and you have consented to the data processing (Art. 6 Para . 1 lit. a GDPR) if the processing is necessary for the initiation, justification, content design or change of a legal relationship between you and us (Art. 6 Para. 1 lit. b GDPR) or another legal norm permits or orders the processing .
We store your personal data in accordance with the legal deadlines or until

  • You ask us to delete it
  • You revoke your consent to storage or the purpose for data storage no longer applies (e.g. after your request has been processed)

Mandatory legal provisions – in particular tax and commercial law retention periods – remain unaffected.
Further details, in particular about your rights (information, objection, data portability, authorization, deletion, restriction and your right to complain to a supervisory authority), can be found in our data protection declaration. You can find these here.
 

1. Contact person

You can reach our data protection officer by email: datenschutz@hema-group.com.

Responsible person:
Steffen Walter
Responsible company:
HEMA Maschinen und Apparateschutz GmbH
Am Klinggraben 2
6500 Seligenstadt
Telephone: +49(0)6182/773-0
Email: info@hema-group.com
 

2. Purpose of data collection

Your personal data will be processed for

  • The creation of offers, Art. 6 Para. 1 lit. b GDPR
  • Execution of orders including warranty, Art. 6 Paragraph 1 Letter b GDPR


3. Legal basis

The legal basis for data processing is the contract concluded between you and us or its initiation in accordance with Article 6 Paragraph 1 Letter b of the GDPR.


4. Personal Information

The legal basis for data processing is the contract concluded between you and us or its initiation in accordance with Article 6 Paragraph 1 Letter b of the GDPR.

  • Company name
  • Name contact person
  • Address
  • Contact details (email, telephone, fax)
  • Data about the contract, such as measurements, etc.
  • Account details for transfer
     

5. Disclosure to third parties

Your data will only be processed within the European Union and states within the European Economic Area (EEA).
Internally, the following places can view this data:

  • Managing directors
  • Employees for contact with you and contractual cooperation (including the fulfillment of pre-contractual measures within the HEMA Group)

As part of order processing:

  • Support or maintenance of IT or IT applications data destruction, etc.

All service providers are contractually bound and are particularly obliged to treat your data confidentially and only process it on our instructions.
Other third parties: Data will only be passed on to recipients outside of our company in compliance with the applicable data protection regulations.
Recipients of personal data can e.g. B. be:

  • Credit and financial service providers (processing payment transactions)
  • Tax consultants or business, income tax and company auditors (statutory audit mandate)
     

6. Storage period of your data

We process and store your data as long as we are required to do so by legal or contractual obligations. As a rule, these are the statutory limitation periods for the preservation of evidence. The regular limitation period is three years from the end of the year of acceptance or handover (§§ 195 ff BGB), but can also be up to 30 years. If it concerns data for invoices, the obligation to store all business letters arises from Section 257 of the German Commercial Code (HGB) in conjunction with. V. m. § 147 para. 2, § 147 para. 1 in conjunction with V. m. Paragraph 3 Tax Code: Six years, if relevant to invoices: Ten years.

 

7. Automatic decision making

Automated decision making is not carried out.
 

8. What rights do you have regarding your data?

You have the right to information under Article 15 GDPR, the right to correction under Article 16 GDPR, the right to deletion under Article 17 GDPR, the right to object under Article 21 GDPR and the right to data portability under Article 20 GDPR.


8.1 Right to object to data collection in special cases

You have the right, for reasons relating to your particular situation, to object at any time to the processing of personal data concerning you, which is carried out on the basis of Article 6 Paragraph 1 Letters e or f.
We will then no longer process your personal data unless we can demonstrate compelling legitimate reasons for the processing that outweigh your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.
 

8.2 Revocation of your consent to data processing (Art. 13 Para. 2 lit. c GDPR)

You can revoke your consent for data processing at any time in the future. All you need to do is send us an informal message by post or email. The lawfulness of the data processing carried out until the revocation remains unaffected by the revocation.
 

8.3 Right to lodge a complaint with the supervisory authority (Art. 13 Para. 2 lit. d GDPR)

In the event of violations of the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, your place of work or the place of the alleged violation.
The right to lodge a complaint exists without prejudice to any other administrative or judicial remedies. You can submit your complaint to any supervisory authority. This applies regardless of any jurisdiction rules. You can find a list of all German supervisory authorities at www.bfdi.bund.de/Anschriften.
 

8.4 Voluntariness of data transfer (Art. 13 Para. 2 lit. e GDPR)

As part of the business relationship, only those personal data that are necessary for the establishment, implementation and termination of a business relationship or which we are legally obliged to collect must be provided. Without this data, the conclusion of the contract or the execution of the order will usually have to be rejected or an existing contract can no longer be carried out and may have to be terminated.
 

Valid from May 1, 2024, V1.0