The protection of your personal data is very important to us. We process your personal data ("data" below) exclusively based on the principles of the legal regulations. This Privacy Statement is intended to inform you of how we process your data in our company and to provide information on the data protection claims and rights that you have as defined in Art. 13 of the European General Data Protection Regulation (EU GDPR).

1. Who is responsible for data processing and who can you contact?

The responsible body is

ROPA Fahrzeug- und Maschinenbau GmbH

Sittelsdorf 24

84097 Herrngiersdorf

Tel.: +49-(0) 87 85 - 96 01 - 0

The company data protection officer is

Gerald Lill

Projekt 29 GmbH & Co. KG

Ostengasse 14

93047 Regensburg

E-Mail: g.lill@projekt29.de

Tel.: 0941-2986930

2. What data are to be processed and what is the source of the data?

We process the data that we have received from you in the course of making or processing a contract, based on consent or as part of your job application with our company or as part of your employment with our company.

Personal information includes:

your master data and contact data, for Clients e.g., first name and last name, address, contact information (email address, telephone number, fax) bank information.

For job applicants and employees e.g., first name and last name, address, contact information (email address, telephone number, fax), date of birth, information from cv and references, bank information, religious affiliation.

For Business partners e.g. the title of your business legal representative, sales tax ID number, company number, address, contact data for contact persons (email address, telephone number, fax), bank information.

We also process the following additional personal data:

• information on the type and content of contract data, order data, sales and document data, customer and supplier history and consulting documents,

• commercial and sales data,

• information from your electronic communications with us (e.g. IP address, log-in data),

• miscellaneous data that we have received from you in the course of our business relationship (e.g. in customer meetings),

• data that we generate in-house from master and contact data and other miscellaneous data , such as analyses of customer requirements and customer potential,

• the documentation of your statement agreeing with the receipt of items such as newsletters.

3. For what purposes and on what legal basis are the data processed?

We process your data in conformity with the General Data Protection Regulation (GDPR) and the Bundesdatenschutzgesetz 2018 [German Federal Data Protection Act] in the current versions:

• for fulfilment of (pre-)contractual obligations (Art 6 Sec. 1(b) GDPR):

Your data for processing contracts are processed online or in one of our offices, and in our company for processing your contract of employment. The data are processed specifically for business relationships and when performing contracts with you.

• for fulfilment of legal obligations (Art 6 Sec. 1(c) GDPR):

It is also necessary to process your data for the purpose of fulfilling various legal obligations, such as the commercial code or the tax code.

• for maintenance of legitimate interests (Art 6 Sec. 1(f) GDPR):

Due to a balance of interests data we or third parties may process data for purposes beyond the actual fulfilment of the contract for the purpose of maintenance of legitimate interests. For example, data may be processed to maintain legitimate interests in the following cases:

•  Advertising or marketing (see no. 4),
•  Measures for business management and continuing development of services and products;
•  Maintenance of a group-wide customer database for improving customer service
•  As part of legal action.

• subject to your consent (Art 6 Sec. 1(a) GDPR):

If you have given consent for us to process your data, e.g. to send you our newsletter.

4. Processing personal data for advertising purposes

You can withdraw your consent for the use of your personal data for advertising purposes at any time in total or for specific actions without incurring anything other than the transmission costs at the basic prices.

Under the legal requirements of Sec. 7 Part 3 UWG [Unfair Competition Act] we are authorised to use the email address that you gave us when the contract was made for direct advertising for our similar goods or services. You will receive recommendations for products regardless of whether you have subscribed to a newsletter.

If you do not wish to receive recommendations of this type by email from us, you can withdraw your consent for the use of your address for this purpose at any time without incurring anything other than the transmission costs at the basic prices. A notification in plain text is sufficient to withdraw consent. An unsubscribe link is also included in every email.

5. Who receives my data?

If we appoint a service provider for processing an order, we still remain responsible for the protection of your data. All order processors are contractually obliged to manage your data confidentially and to process the data only for the purpose of providing the service. The order processors that we appoint receive your data to the extent that the data are required to fulfil the specific service. Examples of service providers include IT services that we require to operate and maintain our IT system and advertising and address service providers for our own marketing campaigns.

Your data are processed in our customer database. The customer database supports the maintenance of the data quality of our customer data (eliminating duplicates, correction of addresses) and enables the addition of data from public sources.

The data are supplied to the group companies when required for processing contracts. Customer data are stored by the group and separately, with the group company acting as a service provider for the various participating companies.

Governments and courts and also external auditors may be receivers of your data based on a legal obligation.

In addition, insurance companies, banks, credit agencies and service provider may also be receivers of your data.

6. How long are my data stored?

We process your data until the termination of the business relationship or until expiration of the applicable legal retention requirements (e.g. as specified by the commercial code, tax code, nursing home act or working hours act); in addition to the termination of any relevant legal disputes in which the data are required as proof.

7. Are personal data sent to another country?

We do not send any data to another country. In specific cases data will be sent based on an adequacy decision by the European Commission, standard contractual clauses, suitable guarantees or your express agreement.

8. What are my data protection rights?

You have the right to disclosure, correction, deletion or restriction of the processing of your stored information at any time. You have the right to object to the processing of your information, the right to transfer of information and the right to submit a complaint in accordance with the provisions of the privacy law.

Right of disclosure:

You can request disclosure from us of whether and to what extent we are processing your information.

Right of correction:

If we are processing your information that is incomplete or incorrect, you may request correction or completion by us at any time.

Right of deletion:

You may request us to delete your information if we are processing it illegally or if the processing does not conform to your rights to privacy. Please note that there may be reasons that prevent immediate deletion, such as legal requirements for retention of information.

Regardless of the perception of your right of deletion, we will delete your information immediately and in full unless transactional or legal retention requirements prevent deletion.

Right to restrict processing:

You may request the restriction of processing of your information if

•  you dispute the correctness of the information for a period sufficient to enable us to check whether the information is correct.

•  processing the information is illegal, but you reject deletion and instead demand a restriction on usage of the information,

•  if we no longer require the information for the stated purpose but you still need it for enforcement or defence of legal claims, or

•  you have submitted an objection to processing the information.

Right of transfer of information:

You may request us to to provide you with the information that you have given us in a structured, standard and machine-readable format and to allow you to transfer the information to another responsible party without interference by us provided that

•  we are processing this information subject to revocable approval by you or for fulfilment of a contract between us, and

•  the information is being processed by computerised procedures.

If it is technically feasible, you may request a direct transfer of your information to another responsible entity.

Right of objection:

If we are processing your information for an authorised interest, you may submit an objection to this processing at any time; this would also apply to profiling based on these provisions. We will then stop processing your information, unless we can demonstrate mandatory reasons for processing that take precedence over your interests, rights and freedoms or if the processing is intended for enforcing, exercising or defending legal claims. You can stop the processing of your information for the purpose of direct advertising without giving a reason.

Right of appeal:

If you believe that we are violating German or European law in processing your information, please contact us to allow us clarify the situation. You of course also have the right to contact the relevant security regulator, the state privacy authority.

If you wish to enforce one of the stated rights against us, please contact our privacy officer. In case of doubt we may also request additional information to confirm your identity.

9. Am I required to provide data?

It is necessary to process your data to conclude or to fulfil a contract with us. If you do not provide us with the required data, we will generally have to decline to conclude the contract or we will not be able to perform an existing contract and will be required to terminate it. However, you are not required to consent to processing data that are not required for fulfilment of the contract or that are not legally required.