Sales and Order Processing
Below, we provide you with detailed information on all the key aspects of this data processing. We refer to all information obligations arising from Articles 13, 14, 15, 26 and 30 of the GDPR.
- What is the purpose of this processing?
We process personal data in connection with the marketing and sale of products and services. This includes data processing for the initiation, processing and monitoring of orders (contracts) with prospective customers and customers (legal and/or natural persons); verification of the identity of the person authorised to represent the prospective customer in accordance with EU Regulation 2019/1148 on the marketing and use of explosives precursors.
- Who is responsible for this processing?
CVM Chemie-Vertrieb Magdeburg GmbH & Co. KG
Address: Werner-von-Siemens-Ring 8, 39116 Magdeburg
Telephone: +49 (0) 391 / 50 86 20 - 0
Fax: + 49 (0) 391 / 50 86 20 - 40
Website: www.cvh.de
Email: magdeburg@cvh.de
- Who has been appointed as the company’s data protection officer?
Martin Lorenz, Am Hang 8, 31655 Stadthagen, datenschutzbeauftragter.cvhgruppe[at]triades-datenschutz.de
What is the legal basis? Why is this processing permitted?
- Protection of the controller’s legitimate interests in accordance with Article 6(1)(f) of the GDPR
- Performance of a contract in accordance with Article 6(1)(b) of the GDPR
- Compliance with a legal obligation pursuant to Article 6(1)(c) of the GDPR
Explanation of the multiple legal bases:- Article 6(1)(f) for the initiation and processing of orders/contracts with legal entities
- Article 6(1)(b) for the initiation and processing of orders/contracts with natural persons. Article 6(1)(c) for the procurement of raw materials for explosives
- Specifically, what ‘legitimate interests’ is the controller pursuing?
The right to acquire and retain customers;
the right to make a profit, and to ensure operational and cost efficiency
- Are there any legal or contractual requirements? What would happen if you did not provide your data?
Without the data, the sales contract with natural persons cannot be fulfilled; without the information, EU Regulation 2019/1148 cannot be complied with;
Who are the recipients authorised to access the data (both internal and external)?
- Sales staff
- Field staff
- Sales and trading partners
- Marketing staff
- Staff in specialist departments
- Suppliers and service providers
- Procurement
- Warehouse
- Logistics
- Development and production
- Accounts
- Management
- Sales
- IT service provider
When is the data deleted?
- Tax-related data is retained for ten years in accordance with Section 147(3) of the German Fiscal Code (AO), starting from the end of the calendar year in which the document was created
- Commercial and business correspondence is retained for six years in accordance with Section 257 of the German Commercial Code (HGB), starting from the end of the calendar year in which the document was created
- All other data is retained for three years in accordance with Section 195 of the German Civil Code (BGB), starting from the end of the calendar year in which the data was collected
- As a general rule, data is deleted once the purpose for which it was collected no longer applies and any retention obligations have expired
What categories of data are processed?
- Data relating to the initiation of a contract
- Quotation data
- Data relating to purchased products and services
- Identity verification data
- Order data, product data, tracking data: transport routes/location (products, tanks),
- Bank and credit card details (IBAN, BIC, bank, account holder, credit card number)
- Order and delivery data
- Email (date, recipient, text, attachments)
- Content data (text entries, photographs, videos)
- Project data
- Master data (name, address, contact details)
- Contract details
Which individuals are affected?
- Customers
- Prospective customers
- The right to ‘access’
You have the right to access the data relating to you. This document largely ensures that this right is upheld. If you have any further questions or concerns, please do not hesitate to contact us.
- The right to “rectification” of inaccurate data
You generally have the right to have inaccurate data rectified. Please contact us in this regard.
- The right to “erasure of your data”
You have the right to have your data erased provided that (a) the data is no longer necessary, (b) you have withdrawn your consent where applicable or there is no other legal basis (any longer), (c) you have legitimately objected, (d) the data has been processed unlawfully, (e) erasure is required by law, (f) the data relates to children and is to be erased. Please note that, in accordance with Article 17(3) of the GDPR, it may not be possible or permissible to erase the data.
- The right to ‘restriction of processing’
You have the right to have your data ‘restricted’, provided that (a) you contest the accuracy of the data, (b) the processing is unlawful and you do not wish the data to be erased, (c) we no longer require the data, but you still require it for your own legal claims, (d) you have objected to the processing and it has not yet been determined whether the legitimate interests of the controller override your interests.
- The right to “object to processing”
You have the right to object to processing provided there are grounds relating to your SPECIFIC SITUATION. For our part, we will assess whether we have compelling legitimate grounds for processing.
- The right to “withdraw consent”
You have the right to withdraw your consent (where this is relevant to the processing described here). The withdrawal applies only with future effect.
- The right to “data portability”
You have the right to receive a copy of your data (“data portability”), provided that (a) the legal basis is consent or a contract, and (b) you have provided this data yourself, and (c) the data is processed by automated means. Provided these conditions are met, you may also request that we transfer the data to a recipient of your choice.
- The right to “lodge a complaint”
You have the right to lodge a complaint with any data protection supervisory authority. The contact details of the data protection supervisory authority responsible for us are: LDI Saxony-Anhalt, Leiterstr. 9, 39104 Magdeburg, GERMANY, Tel. 0049 391-81803-0, www.datenschutz-sachsen-anhalt.de.
You are welcome to contact us first before getting in touch with the supervisory authority; our highly competent in-house data protection officer will deal with your enquiry much more quickly and just as thoroughly. If we are unable to assist you, you can always contact the supervisory authority afterwards.
- Data collection by third
parties No, no data is collected by third parties. Consequently, all data is requested and collected by us.
- Does profiling take place? Are personal characteristics analysed or predicted? Does automated individual decision-making take place?
No, this does not occur.
- Are data transferred to recipients in third countries (i.e. outside the EU)?
No, this does not take place.
- Are there several data controllers within the meaning of ‘joint controllership’?
No, there is only the ONE data controller mentioned above.
Additional information
There are letter templates circulating on the internet for requests for information which demand the most comprehensive information conceivable. In some cases, they request information that goes far beyond what is legally required. We would like to briefly explain this:
- With regard to specific data details (such as first name, surname, telephone number, etc.), there is no obligation to provide such information under the relevant Articles 14(1d), 15(1b) and 30(1c). Accordingly, we are providing you – as requested – with the CATEGORIES of data.
- There is also no right to information regarding technical and organisational measures. We do not disclose these measures because doing so would play into the hands of potential attackers. Only the supervisory authority may, in accordance with Article 30(1g), request a general description of these measures. Please rest assured that we take appropriate measures.
- With regard to a list of all third parties and data processors, we shall only specify the CATEGORIES of recipients and not any specific company names. This is a permissible option under Articles 13(1e), 14(1e) 15(1c) and 30(1d). We regard the list of our (very carefully selected) suppliers as a trade and business secret and wish to avoid any risks to ourselves and our customers that might arise should it become public knowledge.
Blanket requests for erasure/restriction or blanket withdrawals of consent/objections etc. are problematic. Please put yourself in our position: are we expected to alter our data processing without reliable proof of identity? This could lead to serious problems and may even constitute a data protection breach. We will therefore generally request additional information in accordance with Article 12(6) before we comply with these data subject rights under Articles 15–21. Please contact us in this regard.
