The protection of your personal data is very important to us. Therefore, we process your personal data ("data" for short) only based on the legal regulations. With this data privacy statement, we want to inform you in detail about the processing of your data at our company and the claims and rights you have with respect to data privacy law according to Art. 13 of the European General Data Protection Regulation (EU GDPR).

1. Who is responsible for data processing and whom can you contact?

Person in charge is

ROPA Fahrzeug- und Maschinenbau GmbH

Sittelsdorf 24

84097 Herrngiersdorf

Tel.: +49-(0) 87 85 - 96 01 - 0

The operational Data Protection Officer is

Gerald Lill

Projekt 29 GmbH & Co. KG

Ostengasse 14

93047 Regensburg

E-mail: g.lill@projekt29.de

Tel.: 0941-2986930

2. What data is processed and from which sources does this data come?

We process the data that we receive from you in the course of contract negotiation and processing, from consents or in the course of your application to us or as part of your employment with us.

Personal data includes:

Your master/contact data, which includes for customers e.g. first and last names, address, contact data (e-mail address, telephone number, fax), bank details.

For applicants and employees e.g. first and last names, address, contact data (e-mail address, telephone number, fax), date of birth, data from CV and work certificates, bank details, religious affiliation.

For business partners e.g. the name of your legal representative, company, company register number, VAT ID number, company number, address, contact person's contact data (e-mail, address, telephone number, fax), bank details.

In addition, we also process the following personal data:

• Information about the type and content of contract data, order data, sales and document data, customer and supplier history, and consulting documents

• Advertising and sales data

• Information from your electronic traffic with us (e.g. IP address, login data)

• Other data that we have received from you in the course of our business relationship (e.g. in customer negotiations)

• Data that we generate ourselves from master/contact data, as well as other data, such as customer needs and customer potential analyses

• Documentation of your declaration of consent to receive newsletters, e.g.

3. For what purposes and on what legal basis is the data processed?

We process your data in compliance with the provisions of the GDPR and the German Federal Data Privacy Act 2018 in the respectively applicable version:

• For the fulfillment of (pre-)contractual duties (Art. 6 Para. 1 let. b GDPR):

The processing of your data is done for contract processing online or in one of our branch offices, for contract processing of your employment at our company. The data is processed especially for business initiation and execution of contracts with you.

• For the fulfillment of legal duties (Art. 6 Para. 1 let.c GDPR):

Processing of your data is necessary for the purpose of fulfilling various legal duties, e.g. from commercial law or tax law.

• To preserve valid interests (Art. 6 Para. 1 let.f GDPR):

Due to a weighing of interests, data processing can extend beyond the actual fulfillment of the contract to the preservation of our valid interests or those of third parties. Data processing to preserve valid interests is done in the following cases, for example:

•  Advertising or marketing (see No. 4)
•  Measures for business control and the enhancement of services and products;
•  Management of a group-wide customer database to improve customer service
•  In the course of prosecution.

• As part of your consent (Art 6 Para. 1 let.a GDPR):

If you have granted us consent to process your data, e.g. for the sending of our newsletter.

4. Processing of personal data for advertising purposes

You can revoke the use of your personal data for advertising purposes at any time overall or for individual measures without incurring any costs other than the transfer costs according to the basic rates.

Under the legal provisions of § 7 Para.3 UWG we are entitled to use the e-mail address that you specified on contract conclusion for direct advertising for similar goods or services. You receive these product recommendations from us regardless of whether you have subscribed to a newsletter.

If you do not wish to receive such recommendations from us via e-mail, you can revoke the use of your address for this purpose at any time without incurring any costs other than the transfer costs according to the basic rates. A text message is sufficient for this. Of course each e-mail also includes an unsubscribe link.

5. Who receives my data?

If we use a service provider for order processing, we are nevertheless responsible for the protection of your data. All contract processors are contractually obligated to treat your data confidentially and only to process it in the course of service provision. The contract processors we commission receive your data insofar as they need the data to perform their services. These are, for example, IT service providers that we need for the operation and security of our IT system, as well as advertising and address storage for our own advertising campaigns.

Your data is processed in our customer database. The customer database helps us improve the data quality of the existing customer data (purging of duplicates, changed/defunct identifiers, address correction) and allows the enrichment with data from public sources.

This data is made available to the group companies insofar as necessary for contract processing. The saving of customer data is done company-related and separately, whereby our parent company functions as a service provider for the individual participating companies.

If there is a legal obligation and in the course of prosecution, authorities and courts, as well as external auditors may be recipients of your data.

In addition, for the purpose of contract initiation and fulfillment, insurance companies, banks, information agencies, and service providers may be recipients of your data.

6. How long will my data be saved?

We will process your data up to the end of the business relationship or up to the expiry of the applicable legal storage deadlines (according to commercial law, tax law, homes act or working hours act); in addition up to the end of any legal disputes in which the data is required as proof.

7. Will personal data be transmitted to a third country?

Essentially, we do not transmit any data to a third country. A transfer only takes place in individual cases on the basis of an arrangement of the European Commission, standard contract clauses, suitable guarantees or with your express permission.

8. What data privacy rights do I have?

You always have a right to information about, the correction, deletion or restriction of processing of your saved data, a right of objection to the processing and a right to data transmission and to complaint according to the prerequisites of the data privacy law.

Right to information:

You can request information from us about whether and to what extent we process your data.

Right to correction:

If we process your data that is incomplete or incorrect, you can request at any time that we correct or complete it.

Right to deletion:

You can request that we delete your data, insofar as we are processing it illegally or we are intervening in your justified privacy interests. Please note that there can be reasons that speak against an immediate deletion, e.g. in case of legally regulated retention requirements.

Depending on the perception of your right to deletion, we will delete your data immediately and completely, insofar as no legal-business or legal retention requirement opposes this.

Right to restriction of processing:

You can request that we restrict the processing of your data if

•  You dispute the correctness of the data and in particular, for a duration that allows us to check the correctness of the data.

•  The processing of the data is illegal, but you decline deletion and instead request a restriction of data use

•  We do not require the data for the intended purpose, but you need this data to press or defend against legal claims or

•  You have objected to the processing of the data.

Right to data transmission:

You can request that we provide you with your data, with which you have provided us, in a structured, common and machine-readable format and that you can transfer this data to another responsible authority without interference from us insofar as

•  we are processing this data based on revocable permission you have granted or for the fulfillment of a contract between us and

•  this processing is done using automated processes.

If technically feasible, you can request that we transmit your data directly to another responsible authority.

Right of objection:

If we are processing your data for a justified interest, you can object to this data processing at any time; this would also apply for a profiling based on these provisions. We will then no longer process your data unless we can prove compelling privacy reasons for the processing that override your interests, rights and freedoms or if the processing serves the pressing, exercise or defense of legal claims. You can object to the processing of your data for the purpose of direct advertising at any time without specifying reasons.

Right to complain:

If you are of the opinion that with the processing of your data we are violating German or European data privacy law, we ask you to make contact with us in order to clarify questions. Of course you also have the right to contact responsible authorities, the local authority for data privacy supervision.

Insofar as you want to press legal claims against us, please contact our data privacy officer. In case of doubt, we will request additional information to confirm your identity.

9. Am I obligated to provide data?

The processing of your data is required to conclude and fulfill the contract you have concluded with us. If you do not make this data available to us, we will generally have to decline to conclude the contract or we will no longer be able to execute an existing contract and will therefore have to end it. However, you are not obligated to grant consent for data processing for data that is not relevant or legally required for the contract fulfillment.