Privacy Notice pursuant to Art. 13(3) GDPR

Personal data is processed and stored by the controller for as long as is necessary to fulfil the defined purposes and statutory obligations. The following information describes which data is processed, how it is used and which rights you have under the General Data Protection Regulation (GDPR).

The controller within the meaning of data protection law is:

Only personal data that is necessary to fulfil the defined purposes and statutory obligations is processed. The following categories may be involved:

• Contact information such as salutation, first name, last name, address, email address, phone numbers
• Other information such as access data, IP address or payment data

As a rule, data is processed only for the purposes for which it was collected, for example:

• to perform and process the contract
• to correspond with you
• to fulfil legal and statutory obligations
• to safeguard legitimate interests
• to handle any mutual settlements

Data processing for other purposes is only considered if the legal requirements pursuant to Art. 6(4) GDPR are met. Information obligations under Art. 13(3) GDPR and Art. 14(4) GDPR are observed.

The legal basis for the processing of personal data is, as a rule, Art. 6 GDPR. The following options may apply:

• Consent (Art. 6(1)(a) GDPR): You can withdraw your consent at any time with effect for the future.
• Processing for the performance of a contract (Art. 6(1)(b) GDPR): The processing is necessary to ensure completeness and accuracy of the data and its digitisation, and to perform the contract.
• Processing on the basis of a balancing of interests (Art. 6(1)(f) GDPR): The processing is necessary to ensure and optimise informed decisions and to secure a consistently high quality and uniformity of customer advice. You have the right, under Art. 21 GDPR, to object to the processing.
• Processing to fulfil a legal obligation (Art. 6(1)(c) GDPR): The processing is necessary to ensure the completeness and accuracy of tax data under the German Fiscal Code, the German Trade Code and the German Commercial Code.

Data is processed for as long as is necessary for the respective purpose. Where statutory retention obligations exist — for example in commercial or tax law — personal data is stored for the duration of the retention obligation (10 years). After expiry, it is checked whether further necessity exists. If not, the data is deleted.

The general storage period may exceptionally be up to 30 years, where necessary to assert, exercise or defend legal claims. You can request information about the data we hold about you at any time and, if it is no longer necessary, request its deletion or restriction of processing.

Personal data is, as a rule, only disclosed to third parties where necessary for:

• performing the contract with you
• disclosure based on a balancing of interests pursuant to Art. 6(1)(f) GDPR
• a legal obligation to disclose
• cases where you have given consent

It is not planned to transfer personal data to a third country or an international organisation, unless this is necessary to perform the contract. You will be informed separately of any details, where legally required.

Personal data is processed exclusively in data centres located in the Federal Republic of Germany.

The company regularly checks your creditworthiness when concluding contracts and in certain cases where a legitimate interest exists. For this purpose, it cooperates with Creditreform Kempten/Allgäu, Winterstein KG, Fürstenstraße 1, 87439 Kempten. Name and contact details are transferred to this company.

For further information on data processing at Creditreform pursuant to Art. 14 EU GDPR, please see: www.creditreform.de/navigations/content-footer/datenschutzerklaerung.html

On our contact page we provide a contact form that lets you send us a message without obligation. For the technical operation and delivery of the messages submitted via the form, we use the Formspree service provided by Formspree, Inc. (USA).

Data processed: We process only the data you enter into the form – first and last name, email address, telephone number and company (where provided) – together with the content of your message and technical connection data such as your IP address and the time of submission.

Purpose and legal basis: The data is used solely to handle and respond to your enquiry. The legal basis is our legitimate interest in efficiently handling contact enquiries (Art. 6(1)(f) GDPR); where your enquiry is aimed at concluding or performing a contract, Art. 6(1)(b) GDPR additionally applies.

Transfer to the USA: Formspree, Inc. processes the data in the USA. This involves a transfer of personal data to a third country. The transfer is safeguarded by appropriate guarantees within the meaning of Art. 44 et seq. GDPR.

Storage period: We store your enquiry until it has been conclusively dealt with and no statutory retention obligations prevent deletion. Submissions stored at Formspree are processed in accordance with their privacy terms.

For more information on data processing by Formspree, please see their privacy policy at formspree.io/legal/privacy-policy.

Online conferencing tools are used to communicate with customers. When you communicate via video or audio conference over the internet, personal data is collected and processed.

The conferencing tools record:

• Email address and/or telephone number
• Duration of the conference, start and end of participation
• Number of participants and “context information” relating to the communication (metadata)

The provider processes technical data required to handle the online communication, in particular:

• IP addresses, MAC addresses
• Device IDs, device type
• Operating system type and version
• Client version, camera type
• Microphone or speakers, and type of connection

If content is shared, uploaded or made available, it is stored on the servers of the tool providers. This includes cloud recordings, chat / instant messages, voicemails, uploaded photos and videos, files, whiteboards and other information shared during use.

Please note that there is no full influence over the data processing operations of the tools used. The available options depend on the policy of the respective provider. For further information, please refer to the privacy statements of the tools used.

The conferencing tools are used to communicate with prospective or existing contractual partners or to offer services (Art. 6(1)(1)(b) GDPR). Their use also serves the general simplification and acceleration of communication (legitimate interest under Art. 6(1)(f) GDPR).

Where consent has been requested, use is based on that consent; it can be withdrawn at any time with effect for the future.

Data collected directly is deleted from the systems as soon as you request deletion, withdraw your consent for storage, or the purpose ceases to apply. Stored cookies remain on your device until you delete them. Mandatory statutory retention periods remain unaffected.

There is no influence over the storage period of data that the operators of the conferencing tools store for their own purposes. Please obtain that information directly from the operators.

Provider: LogMeIn, Inc., 320 Summer Street, Boston, MA 02210, USA

Data-processing details: www.logmeininc.com/de/legal/privacy

A data processing agreement has been concluded. The strict requirements of the German data protection authorities are fully implemented during use.

Provider: TeamViewer Germany GmbH, Bahnhofsplatz 2, 73033 Göppingen, Germany

Data-processing details: www.teamviewer.com/de/datenschutzerklaerung

A data processing agreement has been concluded. The strict requirements of the German data protection authorities are fully implemented during use.

Provider: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA

Data-processing details: privacy.microsoft.com/de-de/privacystatement

A data processing agreement has been concluded. The strict requirements of the German data protection authorities are fully implemented during use.

You have the following rights:

• Right of access (Art. 15 GDPR): You have the right to obtain information about the personal data we process about you, in particular about processing purposes, categories of data, categories of recipients, planned storage period, the existence of rights to rectification / erasure / restriction, the right to lodge a complaint, the origin of the data (if not collected from the controller) and information about automated decision-making including profiling and meaningful information about it.
• Right to rectification (Art. 16 GDPR): You can request the immediate correction of inaccurate, or the completion of, the personal data we hold about you.
• Right to erasure (Art. 17 GDPR): You can request the deletion of the personal data we hold about you, unless the processing is necessary to exercise the right of freedom of expression and information, to comply with a legal obligation, for reasons of public interest, or to assert, exercise or defend legal claims.
• Right to restriction (Art. 18 GDPR): You can request restriction of processing where the accuracy of the data is contested, the processing is unlawful but you oppose erasure, the controller no longer needs the data but you need it to assert, exercise or defend legal claims, or you have objected under Art. 21 GDPR.
• Right to data portability (Art. 20 GDPR): You can receive your personal data, which you provided to the controller, in a structured, commonly used, machine-readable format, or request its transfer to another controller.
• Right to withdraw consent (Art. 7(3) GDPR): You can withdraw consent that you have given to the controller at any time. As a result, the controller may no longer continue, for the future, the data processing that was based exclusively on that consent.
• Right to lodge a complaint (Art. 77 GDPR): You can lodge a complaint with a supervisory authority. You can usually contact the authority of your usual place of residence or work, or of the company‘s registered office.

For an access request that is not made in writing, please understand that proof may be required to demonstrate that you are the person you claim to be.

You have the right to object under Art. 21(1) and (2) GDPR to the processing of your data in connection with direct marketing, where this processing is based on a balancing of interests.

You have the right to lodge a complaint about the processing of personal data by us with a data protection supervisory authority:

Systabuild Software Group GmbH – Salzstraße 25 – 87499 Wildpoldsried – Germany

Despite careful content review, Systabuild Software Group GmbH assumes no liability for the contents of external links.