We are astora.
Data Privacy Statement of astora GmbH & Co. KG in accordance with Articles 13 and 21 GDPR
The following Data Privacy Statement describes how and for what purpose astora GmbH & Co. KG, Karthäuserstraße 4, 34117 Kassel, Germany (hereinafter also referred to as “astora” or “we”) processes personal data of its business partners and their employees.
1. Responsibility for data processing and contact data
The controller responsible for processing your personal data is:
astora GmbH & Co. KG
You can contact our Data Protection Officer at:
astora GmbH & Co. KG
Data Protection Officer
2. Type of data processed
We process the following personal data and categories of personal data we obtain from our business partners and their employees:
- Master data (e.g. surname, first name, title, function/post at the company, business phone number, business mobile phone number, business fax number, business e-mail address)
- Communications data (e.g. content of contact requests, records of conversations)
- Technical usage data in the case of communication by e-mail and phone
- Dokumentation von Geschäftsvorfällen
- Documentation of business transactions
- Voice recordings of calls/customer transactions
- Declarations relating to data protection (consent to processing of personal data, exercise of rights to obtain access to and information on personal data, rectification, deletion and restriction of processing of it, and data portability under data protection law, including information you send us in this connection)
3. Length of data storage
In general, we process personal data only for as long as required to fulfill the specific purpose defined in the following. Moreover, we are subject to various retention and documentation obligations under legislation such as the German Commercial Code (HGB) and the German Fiscal Code (AO). The retention and documentation periods stipulated by them range from two to ten years. Finally, the storage duration is also governed by the statutory limitation periods, which may be up to thirty years under Sections 195 et seq. of the German Civil Code (BGB), for example, with the standard limitation period being three years.
4. Purposes of data processing and legal foundation
We process your personal data in compliance with the relevant data protection regulations, in particular the General Data Protection Regulation (GDPR) and German Data Protection Act (BDSG), for various purposes. In principle, the purposes for which we process your data are: Processing
- to perform contractual obligations or steps prior to entering into a contract (Article 6 paragraph 1 point (b) GDPR),
- to safeguard legitimate interests (Article 6 paragraph 1 point (f) GDPR),
- subject to your prior consent (Article 6 paragraph 1 point (a) GDPR) and/or
- to comply with statutory obligations (Article 6 paragraph 1 point (c) GDPR).
|Purpose/legitimate interests||Processed data or categories of data||Legal basis|
|Administration of business partners and contact persons at business partners for the purpose of communication and initiating and conducting a business relationship (customer support, lead generation)||Master data; documentation of business transactions; communications data (e.g. content of contact requests, records of conversations)||Article 6 paragraph 1 points (b) and (f) GDPR|
|Direct marketing and direct advertising (e.g. to inform our customers of our products and services by newsletter)||Master data||Article 6 paragraph 1 points (a) and (f) GDPR|
|Events for and with customers (e.g. trade fairs)||Master data, travel data and preferences with regard to food as part of events||Article 6 paragraph 1 points (a), (b) and (f) GDPR|
|Quality assurance and documentation of business deals||Voice recordings of calls/customer transactions||Article 6 paragraph 1 points (a) and (f) GDPR|
|Prosecution, establishment or defense of legal claims||Master data; all data or categories of data of relevance to the claim in question.||Article 6 paragraph 1 point (f) GDPR|
|Administration of consents and objections (administration of declarations of consent and revocation, as well as objections to data processing)||Master data, declarations of the data subjects||Article 6 paragraph 1 point (c) GDPR|
|Administration of claims made by data subjects (establishment of claims by data persons to obtain access to and information on their data, rectification and deletion of it, restriction of data processing and data portability)||Master data, declarations of the data subjects, all data or categories of data that are the subject of the request.||Article 6 paragraph 1 point (c) GDPR|
5. Recipients and categories of recipient
Die personenbezogenen Daten können an die nachfolgend genannten Empfänger bzw. Kategorien von Empfängern weitergegeben werden:
We use service providers who process personal data on our behalf (termed “processors”; cf. Article 4 No. 8 and Article 28 GDPR). They include IT and telecommunications service providers.
If we are authorized pursuant to contractual or statutory provisions or a declaration of consent, we also pass on the above data to other companies, which process the data under their own responsibility, as part of the business relationship with the client (Article 4 No. 7 GDPR):
- Gazprom Germania GmbH
- Wingas Sales GmbH
- Wingas Holding GmbH
- Gazprom Marketing & Trading Ltd
6. Transfer of personal data to a third country or international organization
We transfer the above personal data to the following third countries (countries outside the European Economic Area (EEA)) or international organizations:
- PAO Gazprom (Russian Federation)
- OOO Gazprom Export (Russian Federation)
It is transferred only if an adequate level of protection for the data is guaranteed in the third country in question (Article 45 GDPR), there are appropriate safeguards (cf. Article 46 GDPR) or transfer is otherwise permitted by law (cf. Article 49 GDPR).
7. Obligation to provide data
As part of our business relationship, you must only provide personal data that is required to initiate and conduct a business relationship or that we are obliged to collect by law. If we are not given this data, we will usually have to refuse to conclude a contract or perform an order or will no longer be able to continue performing, or will possibly have to terminate, a contract.
8. Automated decision-making and profiling
We do not use your personal data for automated decision-making, including profiling.
9. Rights of data subjects
9.1. Access to and information on, rectification and deletion of data, restriction of processing, and data portability
Every data subject has the right to access personal data and obtain information on it (Article 15 GDPR), the right to rectification of data (Article 16 GDPR), the right to deletion of data (Article 17 GDPR), the right to restriction of processing (Article 18 GDPR), and the right to data portability (Article 20 GDPR). You can get in touch with us using the contact data specified in Section 1 “Responsibility for data processing and contact data” to exercise the above rights.
9.2. Right to object to processing in accordance with Article 21 of the General Data Protection Regulation (GDPR)
You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Article 6 paragraph 1 point (f) GDPR (data processing based on a weighing of legitimate interests), including any profiling based on those provisions within the meaning of Article 4 No. 4 GDPR. If you object, we will no longer process the personal data concerning you unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defense of legal claims.
If we process your personal data for direct marketing purposes, you have the right to object at any time to processing of personal data concerning you for such marketing. If you object to processing for direct marketing purposes, we will no longer process your personal data for such purposes.
Your objection can be submitted without using a special form and should be sent to us using the contact data specified in Section 1 “Responsibility for data processing and contact data”. You will not incur any costs other than the basic costs of transmission for that.
9.3. Revocation of consent
If you have given us your consent to process your personal data, you can revoke such consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on your consent before you withdrew it.
Please send your revocation to us using the contact data specified in Section 1 “Responsibility for data processing and contact data”.
10. Right to lodge complaints with the supervisory authority
Under Article 77 paragraph 1 GDPR, you have the right to issue a complaint with the supervisory authority if you consider that the processing of personal data concerning you infringes the law, in particular General Data Protection Regulation (GDPR).
The address of the supervisory authority responsible for WINGAS is:
Der Hessische Datenschutzbeauftragte (The Hessian Data Protection Commissioner (HDSB)), Postfach 3163, 65021 Wiesbaden, Germany
E-Mail: firstname.lastname@example.org, Tel.: +49 611 1408 – 0, Fax: +49 611 1408 - 900