With this privacy policy, we inform you as the data controller in accordance with the provisions of Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR) about the type, scope and purpose of the processing of personal data in connection with our website.

I. Definitions

“Personal data” means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

“Processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

“Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;

“Recipient” means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing;

II General information

1. person responsible for data processing

KPW PartmbB
Königstr. 40
70173 Stuttgart
Tel. +49 711 410 190 30
Fax +49 711 410 190 59
E-Mail info@kpw-law.de

2. contact details of the company data protection officer

Obsecom GmbH
Königstr. 40
70173 Stuttgart
Phone +49 711 460 502 540
E-mail: datenschutz@obsecom.de

3. legal bases

We process personal data on the basis of at least one of the following legal bases:

• Consent of the data subject to the processing of personal data concerning him/her for one or more specific purposes (Art. 6 para. 1 sentence 1 lit. a GDPR);
• Performance of a contract with the data subject or in order to take steps at the request of the data subject prior to entering into a contract (Art. 6 para. 1 sentence 1 lit. b GDPR);
• Fulfillment of a legal obligation to which we are subject (Art. 6 para. 1 sentence 1 lit. c GDPR);
• protect the vital interests of the data subject or another natural person (Art. 6 para. 1 sentence 1 lit. d GDPR);
• Safeguarding our legitimate interests or those of a third party (Art. 6 para. 1 sentence 1 lit. f GDPR)

In this privacy policy, we refer below to the respective legal basis of individual processing operations.

4. disclosure of data to recipients

We only pass on personal data to recipients (processors or other third parties) to the extent necessary and only under one of the following conditions:

• The data subject has consented to the disclosure;
• The transfer serves to fulfill contractual obligations or pre-contractual measures at the request of the data subject;
• We are legally obliged to pass them on;
• The data is passed on on the basis of our legitimate interests or those of a third party.

5. third countries

The transfer of personal data to a country or an international organization outside the European Union (EU) or the European Economic Area (EEA) is subject to legal or contractual permissions only in accordance with the requirements of Art. 44 et seq. GDPR. This means that an adequacy decision of the EU Commission pursuant to Art. 45 GDPR exists for the country concerned, suitable guarantees for data protection pursuant to Art. 46 GDPR or binding internal data protection regulations pursuant to Art. 47 GDPR exist.

6. rights of data subjects

As the data subject, you have the following laws:

• In accordance with Art. 15 GDPR, you can request information about your personal data processed by us; you can also request information about the purposes of processing, the categories of personal data processed, the recipients or categories of recipients to whom your data has been or will be disclosed, the planned storage period or the criteria for determining the storage period, the origin of your data if it has not been collected from you, the existence of automated decision-making including profiling and, if applicable, meaningful information about its details such as logic, scope and effects, the existence of a right to rectification or erasure of personal data concerning you, the right to restriction of processing or to object to such processing, the existence of a right to data portability, the right to object to such processing and the right to data portability. the existence of automated decision-making, including profiling and, where applicable, meaningful information about its logic, scope and impact, the existence of the right to rectification or erasure of personal data concerning you, the right to restriction of processing or to object to such processing, the existence of the right to lodge a complaint with a supervisory authority and, finally, the right to obtain information as to whether personal data have been transferred to a third country or to an international organization and, where that is the case, as to the appropriate guarantees relating to the transfer;
• In accordance with Art. 16 GDPR, you can request the immediate correction of incorrect or the completion of your personal data stored by us;
• In accordance with Art. 17 GDPR, you can request the deletion of your personal data stored by us, unless the processing is necessary to exercise the law on freedom of expression and information, to fulfill a legal obligation, for reasons of public interest or to assert, exercise or defend legal claims;
• in accordance with Art. 18 GDPR, you can request the restriction of the processing of your personal data if the accuracy of the data is disputed by you, the processing is unlawful but you refuse to delete it and we no longer need the data, you no longer need the data for the assertion, exercise or defense of legal claims or you have objected to the processing in accordance with Art. 21 GDPR, but it has not yet been determined whether our legitimate reasons for data processing outweigh your interest;
• In accordance with Art. 20 GDPR, you may request the provision of your personal data that you have provided to us in a structured, commonly used and machine-readable format or the transfer to another controller;
• In accordance with Art. 21 GDPR, you can object to the processing of your personal data if there are reasons for this arising from your particular situation or if the objection is directed against direct advertising and the legal basis for the processing of personal data is legitimate interests pursuant to Art. 6 para. 1 sentence 1 lit. f GDPR;
• In accordance with Art. 7 (3) GDPR, you can withdraw your consent to us at any time. As a result, we may no longer continue the data processing based on this consent in the future;
• In accordance with Art. 77 GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement.

If you would like to assert the aforementioned data subject rights, you can contact us or our data protection officer at any time using the contact details given above.

7. deletion and restriction of personal data

Unless otherwise stipulated in this privacy policy for individual cases, personal data will be deleted if this data is no longer necessary for the purposes for which it was collected or otherwise processed and the deletion does not conflict with any statutory retention obligations. We also erase the personal data processed by us on request in accordance with Art. 17 GDPR if the conditions stipulated therein are met. If personal data is required for other and legally permissible purposes, it will not be erased, but its processing will be restricted in accordance with Art. 18 GDPR. In the event of restriction, the data will not be processed for other purposes. This applies, for example, to personal data that must be retained by us for commercial or tax law reasons. Documents pursuant to Section 257 (1) Nos. 2 and 3 HGB and Section 147 (1) Nos. 2, 3, 5 AO are stored for 6 years, documents pursuant to Section 257 (1) Nos. 1 and 4 HGB and Section 147 (1) Nos. 1, 4, 4a AO for 10 years.

III Individual processing operations

1. hosting

To provide our website, we use the services of hosting companies, such as the provision of web servers, storage space, database services, security services and maintenance services. In doing so, we, or our hosting provider, process personal data of users of our website on the basis of our legitimate interests in the efficient and secure provision of this online service in accordance with Art. 6 para. 1 lit. f GDPR.

2. access data and log files

When you access our website or the individual pages, the browser on your device automatically sends information to the server of our website. This information is stored in log files by us or our hosting provider and deleted after 6 months at the latest.

The following information is stored:

• IP address of the requesting computer,
• Date and time of access,
• Name and URL of the retrieved file,
• Website from which access is made (referrer URL),
• Browser used and, if applicable, the operating system of your computer
• Name of your access provider.

This data is processed for the following purposes:

• Provision of the website including all functions and content
• Warranty of a smooth connection to the website,
• Warranty of a comfortable use of our website,
• Ensuring system security and stability
• Anonymized statistical evaluation of accesses
• Optimization of the website
• Disclosure to law enforcement authorities if an unlawful intrusion/attack on our systems has taken place
• other administrative purposes.

The legal basis for data processing is Art. 6 para. 1 sentence 1 lit. f GDPR. Our legitimate interest follows from the data collection purposes described above. Under no circumstances do we use the data collected for the purpose of drawing conclusions about a person.

3. contact form / other forms of contact

If you use the contact form, you will be asked to provide your name and e-mail address and any other contact details so that we can get in touch with you personally. Further information can be provided voluntarily. Data processing for the purpose of contacting us and responding to your request is carried out in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR on the basis of your voluntary consent. All personal data collected in connection with the contact form will be deleted after your request has been dealt with, unless storage is necessary for the documentation of other processes (e.g. subsequent conclusion of a contract).

If you contact us using the contact details published on our website (e.g. by e-mail) and provide us with personal data, we will only use this data to process your request and then delete it.

4. applications

If you would like to apply for a job with us, we need your name, your contact details and meaningful application documents so that we can review your application and contact you personally. Data processing for the purpose of processing your application is carried out in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR on the basis of your voluntary consent. All personal data collected in connection with the application form will be stored for a period of 6 months after completion of the application process, taking into account the objection periods of the General Equal Treatment Act (AGG), and then deleted, unless storage is necessary for the documentation of other processes (e.g. subsequent recruitment).

5. e-mail direct advertising to clients

If you are a client of ours and we have received your e-mail address in connection with the provision of a service, we may use your e-mail address for direct advertising for our own similar services. This only applies if you have not objected and we clearly inform you of the possibility of objection when collecting the e-mail address and each time it is used. The legal basis for processing is our legitimate interest in direct marketing in accordance with Art. 6 para. 1 lit. f GDPR.

6th Newsletter

If you would like to receive our newsletter, we need your e-mail address. Your data will be processed in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR on the basis of the consent you have voluntarily given in the so-called double opt-in procedure. Your data will be used for this purpose and stored until you withdraw your consent or unsubscribe from the newsletter. You can unsubscribe at any time via a link at the end of each newsletter.