Information About Data Protection at the VP Group

 

In accordance with Art. 13 of the General Data Protection Regulation (GDPR), this document will inform you about the processing of personal data by the Vereinigte Papierwarenfabriken GmbH.
For use of our website, please note our Declaration of data protection at: https://www.vp-group.de/en/data-protection/.

 

1.    Controller and Data Protection Officer

Controller in the sense of the GDPR:
Vereinigte Papierwarenfabriken GmbH
Industriestraße 6
91555 Feuchtwangen
Germany
Tel +49 (0) 9852 901-0
Fax +49 (0) 9852 901-174
Mail: contact@vp-group.de

Contact details of the data protection officer:
Tel.: (+)49 (0) 89 18917360
Mail: datenschutz@vp-group.de

 

2.    Processed Data, Purposes and Legal Bases of Processing

If we receive data from you, we will only process this data for the purposes for which we received or collected this data. We will only process data concerning you for other purposes on a corresponding legal basis.

 

2.1.    Establishment and Performance of Contractual Relationships

2.1.1.    Suppliers and Service Providers
If we commission you as a supplier or service provider, we will process the data you provide to us for the contractual relationship. The processing purpose is the performance and settlement of orders.
This especially includes the following data: Company, address, tax numbers, commercial register number; titles and first and last names of contact persons; their contact details and telephone numbers, fax number, email address; contents of the contract or of individual orders; payment details.
The legal basis for this processing is Art. 6(1) Letter b GDPR (performance of a contract).


2.1.2.    Prospective Clients and Clients
If you request information material or an offer from us or submit a different inquiry, we will process the data you disclose to us to process your request.
This especially includes the following data: Company, address; title, first and last name of the contact person; the contact person’s contact details, such as telephone numbers, fax number, email address; contents of the inquiry.
We will process data concerning you to process your inquiry.
The legal basis for this processing is Art. 6(1) Letter a GDPR (pre-contractual measures).
If a contract is concluded for the products and services offered by us, we will process the data you disclose for the client relationship.
This especially includes the following data: Company, address, tax numbers, commercial register number; titles and first and last names of contact persons; their contact details and telephone numbers, fax number, email address; contents of the contract or of individual orders; payment details.
The legal basis for this processing is Art. 6(1) Letter b GDPR (performance of a contract).

2.1.3.    Applicants and Employees
If you apply to us, we will process the data you submit to review your application and for the selection process.
This especially includes the following data: Title, name, address, telephone number, and  contact details, such as telephone numbers, fax number, email address; documents submitted with the application or subsequently, such as CVs and report cards; if applicable, payment details for travel cost reimbursement.
The legal basis for this is Section 26(1) Sentence 1 of the German Federal Data Protection Act [Bundesdatenschutzgesetz, BDSG] (data processing for employment-related purposes where necessary for hiring decisions).
Processing of this data is necessary to process your application. Without processing this data, your application cannot be considered.
If a training or employment relationship has been established or if you are otherwise an employee under Section 26(8) of the German Federal Data Protection Act, we will process the data you disclose if necessary for the performance or termination of your employment relationship or for exercising the rights or for fulfillment of the obligations of the works council.
The legal basis for this processing is Section 26(1) Sentence 1 of the German Federal Data Protection Act (data processing for employment-related purposes).

 

2.2.    Safeguarding Legitimate Interests

2.2.1.    General Provisions
If necessary, we will process your data beyond the above-stated contract performance to safeguard legitimate interests of ours or of third parties. These legitimate interests especially include: Customer relations management; requirements analyses; further development and improvement of our services; establishment, exercise and defense of legal claims; guaranteeing the security of our establishment; direct marketing.

2.2.2.    Applicants and Employees
If necessary, we will also process your data for the prevention and investigation of crimes; the legal basis for this is Section 26(1) Sentence 2 of the German Federal Data Protection Act.
Furthermore, if necessary, we will also process data concerning you to safeguard legitimate interests. The legal basis for this is Art. 6(1) Letter f GDPR (safeguarding legitimate interests). Our legitimate interests especially consist of the establishment, exercise and defense of legal claims.

2.2.3.    Direct Marketing
Without your express consent, we will only process data concerning you to send marketing material by mail. We will only process data concerning you for telephone, fax or email marketing with your express consent.
If you subscribe to our email newsletter, we will process your name and email address to send you the newsletter. You may freely withdraw your consent at any time.
Exceptions apply to email marketing under Section 7(3) German Act Against Unfair Competition [Gesetz gegen den unlauteren Wettbewerb, UWG]: If we obtain your email address in relation to a contract for goods or services, we may send you advertisements for similar goods or services of ours by email if you do not object; your objection options will be noted in every marketing email.

2.2.4.    Right to Object
Under Art. 21(2) GDPR, you may object to the processing of data concerning you for direct marketing purposes at any time.
Under Art. 21(1) GDPR, you may object to the processing of data concerning you to safeguard legitimate interests on grounds relating to your particular situation at any time. Except in case of a legal exception, we will no longer process data concerning you for these purposes.

 

2.3.    Compliance with Legal Obligations

Furthermore, we will process data concerning you if necessary for compliance with legal obligations to which we are subject. This is especially the case when storing data concerning you beyond a contractual relationship due to legal storage obligations under commercial and tax law or in case of inquiries by courts or authorities, e.g., the tax office.
The legal basis for this is Art. 6(1) Letter c (compliance with legal obligations).

 

3.    Transfers to Third Parties

We will transfer data concerning you to third parties if necessary for an above-stated purpose.

3.1.    Clients
As part of contract performance, we will transfer data concerning you to third parties if necessary for the performance of our contractual obligations, especially to supply goods to commissioned service providers. We will transfer data concerning you to third parties if necessary for the fulfillment of your contractual obligations, especially payment obligations to service providers. The necessity will be determined by the contents of the respective contract.

3.2.    Applicants
We will only transfer data concerning you to third parties without your consent in the following cases:
If necessary for hiring decisions, especially in case of follow-up questions by employers, training companies and references you provided. In such cases, the legal basis is Section 26(1) Sentence 1 of the German Federal Data Protection Act.
If necessary for safeguarding legitimate interests. Our legitimate interests especially consist of the exercise and defense of legal claims. In such cases, the legal basis is Art. 6(1) Letter f GDPR.

 

4.    Consent

We will only process data concerning you for purposes for which none of the above-stated legal bases apply, e.g., for marketing purposes, with your consent.
If personal data is processed on the basis of your consent, you have the right to withdraw your consent at any time for the future.

 

5.    Storage Duration

5.1.    General Provisions
We will process data concerning you for as long as necessary for the respective purpose.
In case of legal storage obligations—e.g., under commercial or tax law—, the personal data concerning you will be saved for the duration of the storage obligations. After the storage obligations expire, we will review whether there is any further necessity for processing. If there is no further necessity, the data will be deleted.
If we save data to safeguard legitimate interests through the establishment, exercise or defense of legal claims, the storage duration will be based on legal limitation periods. Under Section 195 et seq. of the German Civil Code [Bürgerliches Gesetzbuch, BGB], the normal limitation period lasts 3 years after the end of the year in which the claim was established and the claimant learns of the circumstances establishing the claim. The limitation period may be longer in special cases.


5.2.    Applicant Documents
We will save data concerning you for as long as necessary for processing your application. However, this does not apply to data which we may not erase due to legal obligations. For the exercise or defense of claims, we will save data concerning you for up to 6 months after the completion of the application process.
If necessary, we may ask you if we may save your application data for future job openings. We will only save your application data with your express consent. This consent may be freely withdrawn at any time.
Towards the end of the year, we review the necessity for further processing of data. Due to the quantity of data, this review is performed for specific data types and processing purposes.

 

6.    Commissioned Processing

We use several technical service providers to process data concerning you on our behalf and only according to our specifications (commissioned processors). The legal basis for this is a contract with the commissioned processors under Art. 28 GDPR.
Data concerning you will be processed exclusively in the EU, i.e., under the application of the GDPR. All service providers commissioned by us are based in Germany. Our commissioned processors are:

  • SGH Service GmbH, Daimlerring 53, 31135 Hildesheim, Germany (outsourcing, e.g., invoice dispatch)
  • Agentur triebwerk GmbH, Rollnerstraße 59, 90408 Nuremberg, Germany (marketing agency, web design)
  • PBS Network GmbH, Rosensteinstr. 9, 70191 Stuttgart, Germany (e-commerce solutions)
  • All for One Steeb AG, Gottlieb-Manz-Straße 1, 70794 Filderstadt, Germany (IT support)
  • Bosch Sicherheitssysteme GmbH, Robert Bosch Ring 5-7, 85630 Grasbrunn, Germany (operational security)
  • Hermann Kaiser Bürotechnik e.K., Industriestraße 9, D-91522 Ansbach, Germany (IT support)

7.    Your Rights

If the legal requirements are fulfilled, you are entitled to the following rights:

 

  • To withdraw any consent you granted.
  • You have the right of access to saved personal data concerning you (Art. 15 GDPR).
  • You have the right to obtain rectification of inaccurate data (Art. 16 GDPR).
  • You have the right to obtain erasure (Art. 17) or restriction of processing (Art. 18 GDPR) for data that is no longer needed. In case of legal storage obligations, e.g., for business correspondence under commercial or tax law or in case of another legal exception, data will not be erased, but processing will merely be restricted.
  • You have the right to data portability (Art. 20 GDPR), i.e., the right to receive in a structured, commonly used and machine-readable form of the data you provided to us and have the right to transmit this data to another controller without hindrance from us; if applicable, you also have the right to have us transmit this data directly to another controller if technically feasible.
  • For the right to object (Art. 21 GDPR), please see Section 2.2.4.

If you consider the processing of data concerning you to infringe on data protection law, you may lodge a complaint with a supervisor authority (Art. 77 GDPR). Our competent supervisory authority is the Data Protection Authority of Bavaria for the Private Sector, Promenade 27 (Schloss), 91522 Ansbach, Germany, Tel.: +49 (0) 981 53 1300, Fax: +49 (0) 981 53 98 1300, Email: poststelle@lda.bayern.de.