Mandatory information according to Art. 13 or 14 EU-GDPR
Protecting personal data is extremely important to Carstensen Import-Export Handels-GmbH. For this reason, Carstensen Import-Export Handels-GmbH only processes personal data in keeping with applicable legal requirements, and by technical and organizational means ensures compliance with data protection regulations.
The following information provides an overview of data handling and the rights of data subjects under the European General Data Protection Regulation (GDPR) enacted on 5/25/2018.
Information pursuant to Art. 13 (Data collected directly from the data subject) and Art. 14 (Information collected from third parties) of the General Data Protection Regulation (GDPR)
Personal data is collected in connection with the provision of our services. Please observe the following data protection guidelines:
1. Information on the controller:
The controller for the data collection is:
Carstensen Import-Export Handels-GmbH
Internet address: www.carstensen.de
CEO: Martin Pancke
2. Information on the data protection officer:
Our external data protection officer can be reached at:
External data protection officer
Creditreform Compliance Services GmbH
Tel.: + 49 (0) 21 31 – 109 1072
3. Information on the supervisory authority
Supervisory authority responsible for data protection:
Unabhängiges Landeszentrum für Datenschutz in Schleswig-Holstein (Independent Local Center for Data Protection in Schleswig-Holstein)
P.O. Box 71 16
Tel: +49-(0) 431-988-1200
4. Purpose and legal basis for the processing
The legal basis for the processing of the data is as follows:
- Processing to fulfill contracts concluded with Carstensen Import-Export Handels-GmbH pursuant to 6(1) point b GDPR
If personal data is collected and processed for measures taken before the contract or on the basis of a contract, that data will be used to conclude the contract, execute the contractual relationship, and end it where applicable.
- Processing to protect legitimate interests pursuant to 6(1) point f GDPR
Data may be processed to protect the legitimate corporate interests of Carstensen Import-Export Handels-GmbH or of third parties where applicable. Reasons for this may include: to ensure IT security and IT operation, to prevent and investigate crimes/minor breaches of the law, to protect property rights, to offer our customers services after the contract is concluded (e.g. warranty) or for the purposes of direct advertising to existing customers when other requirements are fulfilled, etc.
- Processing based on consent, 6(1) point a GDPR
If the data subject of Carstensen Import-Export Handels-GmbH has granted consent for data processing for certain purposes (e.g. to send out newsletters), it is lawful to use the personal data within the scope of the consent.
- Processing to fulfill legal obligations, 6(1) point c GDPR
Data processing may ultimately be necessary to fulfill legal obligations, particularly retention requirements under the German Commercial Code and the General Tax Code.
- If we process special categories of personal data, the legal basis for this is 9(2) and (4) GDPR, where applicable in conjunction with Section 22 of the German Data Protection Act (BDSG).
5. Data categories that we collect from third parties
We process the following categories of personal data which we receive from third parties:
- Contact data (name, address, [possibly work address], e-mail address, phone number)
6. Sources (third parties) from which the personal data is obtained
Carstensen Import-Export Handels-GmbH processes personal data if that data is made available or transmitted by the data subjects themselves (e.g. customers, employees) or by third parties.
Insofar as Carstensen Import-Export Handels-GmbH receives personal data from third parties, this concerns the following persons/bodies in particular:
- Credit agencies
- Sales representatives
- Business partners, in association with the provision of contractual services
7. Recipients or categories of recipients of the personal data
At Carstensen Import-Export Handels-GmbH, only those people who need access to personal data in order to lawfully perform their duties are given access to such data. If external hired service providers receive personal data for these purposes, we ensure that appropriate technical and organizational measures are taken and the necessary agreements are made such that processing complies with the applicable data protection requirements and guarantees the protection of the rights of the data subject.
We may forward personal data to:
- External service providers (e.g. IT service providers, computer centers, support by software providers)
- Business partners to whom data must be transmitted in order for them to fulfill their duties, such as payment service providers/financial institutions, postal/package delivery services, sales representatives, external advisors, etc.
- possibly collection agencies, for the collection of debts
- Authorities and companies for the purpose of updates or to fulfill legal notification obligations (e.g. social insurance carriers, tax authorities, police and prosecutors, regulatory agencies, road traffic offices)
- Other third parties for which the data subjects have consented to data transmission or for which there is a legal authorization to transmit data (e.g. lawyers, insolvency administrators)
8. Intention to transmit data to a third country or an international organization
Personal data will not be transmitted to a third country (countries outside the European Union or the European Economic Area) or an international organization.
9. Duration of storage or criteria for establishing the duration
Personal data will only be stored as long as is permissible in accordance with the applicable legal basis. In particular, it will be stored as long as is necessary to fulfill the contractual purposes for which the personal data was collected, as long as it is necessary to retain the data in order to meet retention requirements or as a result of an overriding legitimate interest, or until the data subject withdraws their consent being the basis for the processing.
10. Rights of data subjects
You are entitled to the following rights associated with the collection of your personal data:
- Right to information, Art. 15 GDPR: Under Art. 15(1) GDPR, the data subject has the right to demand confirmation of whether personal data relating to them is being processed. If this is the case, they also have a right to receive information on that personal data and the other information pursuant to Art. 15(1) points a to h GDPR.
- Right to rectification, Art. 16 GDPR: Should the personal data be incorrect or incomplete, taking into account the purposes for which it is processed, Art. 16 GDPR confers a right to require rectification or completion of the personal data.
- Right to erasure, Art. 17 GDPR: Art. 17(1) GDPR confers a right to require that personal data be erased when it is impermissible to process personal data for one of the reasons mentioned in that provision. Erasure cannot be required, however, if it is necessary to continue processing the data in the cases referred to in Art. 17(3) GDPR, for example in order to fulfill legal obligations.
- Right to restriction of the processing, Art. 18 GDPR: Under the stipulations of Art. 18(1) points a through d GDPR, the data subject is entitled to request that the processing of their data be restricted (restriction).
- A right to data portability pursuant to Art. 20 GDPR: data subjects have the right to receive in a standard machine-readable format their personal data that they themselves have provided to Carstensen Import-Export Handels-GmbH which is automatically processed by Carstensen Import-Export Handels-GmbH GmbH based on granted consent or a contract. This right is subject to (among other things) the limitations of technical feasibility.
- Right to object, Art. 21 GDPR: data subjects have the right to object to the processing of their personal data which is processed on the basis of a weighing of interests (Art. 6(1) point f GDPR), taking into consideration the stipulations of Art. 21 GDPR.
- If the objection is directed against direct advertising (possibly with associated profiling), then data processing will no longer occur in this respect. In other cases, data can only be further processed despite an objection if there are compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defense of legal claims.
11. Right to withdrawal of consent
Furthermore, granted consent can at any time be withdrawn in full or modified without justification, effective for the future. The withdrawal of consent does not affect the lawfulness of the processing of your data based on your consent that occurred before such withdrawal.
You can either mail your withdrawal to Carstensen Import-Export Handels-GmbH, Werner-v.-Siemens-Str. 3-7, 25479 Ellerau, send an e-mail to firstname.lastname@example.org or submit your withdrawal to Carstensen Import-Export Handels-GmbH by fax +49-(0)4106-79950-90. You will not incur any additional costs beyond the basic rate.
12. Right to lodge a complaint with the supervisory authority
You have the right to lodge a complaint with a supervisory authority for data protection. The contact information for the supervisory authority with jurisdiction over us can be found in point 3 of this document.
13. Obligation to provide personal data
The contracts concluded or to be concluded give rise to an obligation to provide certain personal data in instances where the contract cannot be executed without the provision of the data. Furthermore, we may have to comply with legal obligations that require us to collect/process certain data.
In the case of data needed for a contract, it will not be possible to conclude the contract if information is missing.
If data must be provided due to legal obligations, it will not be possible to provide the associated service unless the information is supplied.
14. Automated decision-making or profiling
Automated individual decision-making, including profiling pursuant to Art. 22 GDPR, does not occur at Carstensen Import-Export Handels-GmbH.