valantic ERP Consulting GmbH Data Protection Declaration

With this Privacy Policy, we inform you about the scope of the processing of your personal data (hereinafter referred to as “data”).

1. Controller for data processing
The controller for data processing in accordance with the provisions of the General Data Protection Regulation (GDPR) is
valantic ERP Consulting GmbH
Hildegard-von-Bingen-Allee 2, 50933 Cologne, Germany
Phone: +49 221 71825 0
Web: https://www.valantic.com/
E-mail: info@erp.valantic.com

2. Contact details of our data protection officer
valantic GmbH
Jamie Crookes
Ainmillerstraße 22, 80801 Munich, Germany
Tel.: +49 89 2000 85 91 0
Fax: +49 89 2000 85 93 1
E-mail: datenschutz@muc.valantic.com

3. General information on data processing
We process data as part of our business and website operations.

This also includes disclosure by transmission to third parties and, if applicable, to so-called third countries outside the European Union (“EU”) and the European Economic Area (“EEA”). Where we transfer data outside the EU or the EEA, we have labelled this accordingly below.

4. Data processing
The individual data concerned, processing purposes, legal bases, recipients and, if applicable, transfers to third countries are listed below:

a) Contact us
If you contact us, we will process the following data from you for the purposes of the processing and handling of your enquiry: Name, contact details – if provided by you – and your message.

The legal basis for data processing is our obligation to fulfil the contract and/or to fulfil our pre-contractual obligations pursuant to Art. 6 para. 1 b) GDPR and/or our overriding legitimate interest in processing your enquiry pursuant to Art. 6 para. 1 f) GDPR.

b) Contact for applications
If you contact us to send us your application as an employee, e.g. by e-mail or via a contact form, the data you provide (e.g. name, e-mail address, desired place of work, etc.), your message and the application documents sent will be processed exclusively for the purposes of processing and handling your application enquiry.

The legal basis for data processing is primarily Section 26 of the German Federal Data Protection Act. Accordingly, the processing of data required in connection with the decision on the establishment of an employment relationship is permitted.

Should the data be necessary for legal prosecution after completion of the application process, data processing may be carried out to safeguard our legitimate interests in accordance with Art. 6 para. 1 f) GDPR, namely for the assertion and/or defence of claims.

c) Contract processing
We process various data as part of your commissioning by us and for the initiation and execution of the existing contractual relationship between you and us.

If we have commissioned you to provide a service, we process your data (if provided: name, contact details, address, personal qualifications) and all information necessary for the fulfilment of the order exclusively for the purposes of processing and handling the contractual relationship.

The processing of the data is carried out accordingly on the basis of Art. 6 para. 1 b) GDPR.

We also process your personal data in cases where we are subject to a legal obligation. This may arise from commercial, tax, money laundering, financial or criminal law.

In this context, the processing of the data is carried out accordingly on the basis of the fulfilment of our legal obligations in accordance with Art. 6 para. 1 c) GDPR.

Should the data be necessary for our own legal prosecution or defence, data processing may be carried out to safeguard our legitimate interests in accordance with Art. 6 para. 1 f) GDPR, namely for the assertion and/or defence of claims.

Categories of recipient data
External service providers that we use, for example, in the areas of technical infrastructure and maintenance.

Public authorities: Tax authorities, supervisory authorities, courts to which we transfer personal data to fulfil our legal obligations or to protect legitimate interests.

d) E-mail direct marketing for existing customers
Unless you have objected, we will send you direct marketing in connection with the goods and services you have purchased in order to offer you similar goods and services. We use the e-mail address you used when concluding the contract.

You can object to this use at any time without incurring any costs other than the transmission costs according to the basic rates.

The legal basis for sending this direct marketing is Section 7 (3) UWG in conjunction with Art. 95 GDPR. We use service providers to whom we transmit the specified data to send the advertising emails.

e) Competition entry
If you take part in a competition organised by us, we will process the data you provide: First name, surname, e-mail address, and – if provided by you-: Address, enterprise, telephone number for the purpose of participation or contacting you in the event of notification of a win. If you have been determined as the winner, we will ask for your surname, first name and address for the purpose of communicating the prize, unless this has already been done as part of your registration. In any case, we will inform you of your win in advance by e-mail.

To transfer the prize, we will send your surname, first name and address to the enterprise commissioned to deliver the prize.

The data processing is carried out to fulfil our obligations in the context of the prize draw in accordance with Art. 6 para. 1 b) GDPR.

f) Use of a ticket system
Various ticket systems are used as part of project management. This enables the systematic handling, in particular the recipient, confirmation, classification and processing of customer enquiries, as well as internal enquiries. The following data is processed:

• E-mail address (business)
• Name
• First name
• Ticket data

Data processing is carried out to fulfil our obligations arising from the underlying contractual relationship in accordance with Art. 6 para. 1 b) GDPR.

categories of recipients

• 4me, Inc, 555 Bryant Street#, Palo Alto, California, 94301 USA (4Me)
• Atlassian Inc, Level 6, 341 George Street, Sydney, NSW, 2000, Australia (Atlassian)

Third country transfer
The provider of our ticket system used by us, Atlassian, reserves the right to distribute contact and login information of the user accounts created in the ticket system to data centres outside the EU, taking into account current encryption and data transfer technologies (TLS1.2+, PFS and AES-256).

Information on hosting the cloud data:
https://confluence.atlassian.com/cloud/cloud-data-hosting-regions-979415715.html

Further information on technical protection and encryption measures:
https://www.atlassian.com/de/trust/security/security-practices#encryption-and-key-management

In the case of the 4Me ticket system, the data is processed in Amazon Web Service data centres in the EU. Amazon Web Service is certified under the EU-US Data Privacy Framework and is therefore covered by the EU adequacy decision for the USA.

We have concluded an EU standard contractual clause with both providers (Atlassian and 4Me). A copy of the standard contractual clauses can be requested via datenschutz@erp.valantic.com.

g) Organisation of webinars and online meetings
We process your data as part of your participation in webinars and online meetings:

• Communication data (e.g. your e-mail address, if you provide it personally)
• Personal master data (if you specify this)
• Log files, log data
• Metadata (e.g. IP address, time of participation, etc.)
• Profile data (e.g. your user name, if you provide this yourself)

We use the service of Mircosoft Teams.

Microsoft Teams is a product from the Microsoft Office 365 product range. Thanks to the video conferencing function of Microsoft Teams, we can offer you participation in our meetings and online events via video and audio. Microsoft Teams online events and meetings are not recorded by us unless we have obtained your consent in advance.

The chat content is logged when using Microsoft Teams. Files that users share in chats are saved in the OneDrive for Business account of the user who shared the file. The files that team members share in a channel are saved on the team’s SharePoint site.

In team meetings, all participants can set their own audio and video input. Unauthorised processing by other participants, e.g. by recording the meeting, cannot be definitively excluded or prevented by us.

Microsoft Office365 is a software of the company

Microsoft Ireland Operations Limited
One Microsoft Place
South County Business Park Leopardstown
Dublin 18
D18 P521
Ireland

Data processing with Office 365 is carried out on our behalf on servers in data centres in the European Union in Ireland and the Netherlands.

Third country transfer
Microsoft may request remote access for the purpose of remote maintenance. This access will be reviewed and authorised by us on a case-by-case basis if this is necessary for Microsoft to provide support services (e.g. for troubleshooting). In this case, such access may also be provided by Microsoft’s affiliated enterprises from outside the European Union. This may also involve countries for which there is no adequacy decision by the EU Commission. We have concluded standard contractual clauses with Microsoft exclusively for the case of this access from non-EU countries for which no adequacy decision exists. We will provide a copy of the contractual clauses on request. Please contact us at datenschutz@erp.valantic.com.

When using MS Teams, data may also be transferred to Microsoft in the USA. Microsoft is certified under the EU-US Data Privacy Framework and is therefore subject to the EU adequacy decision for the USA.

Own data processing by Microsoft
In accordance with its Privacy Policy, Microsoft reserves the right to process customer data for its own legitimate business purposes. We have no control over this data processing by Microsoft. To the extent that Microsoft Teams processes personal data in connection with its legitimate business purposes, Microsoft is an independent controller for these data processing activities and as such is responsible for compliance with all applicable data protection regulations. If you require information about the processing by Microsoft, please refer to the relevant Microsoft statement: https://privacy.microsoft.com/de-de/privacystatement.

Purpose and legal basis
The data processing under section 4 and 5. are carried out on the basis of a legitimate interest in accordance with Art. 6 para. 1 f) GDPR. The purpose and legitimate interest of this data processing are Provision of communication options with our customers, business partners and interested parties via the Internet and for internal coordination.

5. Duration of data storage
We only store personal data for as long as is necessary for the purposes for which it is processed or if you have withdrawn your consent. Insofar as statutory retention obligations must be observed, the storage period for certain data may be up to 10 years, regardless of the processing purposes.

6. Your rights as a data subject

a) Information
You can request information about all personal data that we have stored about you free of charge at any time.

b) Rectification, erasure, restriction of processing (blocking), objection
If you no longer consent to the storage of your personal data or if it has become incorrect, we will arrange for the deletion or blocking of your data or make the necessary corrections (insofar as this is possible under the applicable law) if instructed to do so. The same applies if we are only to process data with restrictions in future. You have the right to object in particular in cases where your data is required for the performance of a task carried out in the public interest or where the data processing is based on our legitimate interest, as well as profiling based on this. You also have such a right to object in the case of data processing for the purpose of direct marketing.

c) Right to withdraw consent with effect for the future
You can withdraw your consent at any time with effect for the future. Your withdrawal does not affect the lawfulness of the processing up to the time of withdrawal.

d) Data portability
If data processing is carried out on the basis of a contract, pre-contractual negotiations, consent or using automated procedures, you have the right to data portability. Upon request, we will provide you with your data in a common, structured and machine-readable format so that you can transfer the data to another controller if you wish.

e) Restriction of processing
Data for which we are not able to identify the data subject, e.g. if it has been anonymised for analysis purposes, is not covered by the above rights. Information, deletion, blocking, correction or transfer to another enterprise may be possible with regard to this data if you provide us with additional information that allows us to identify you.

f) Exercising your rights as a data subject and right to lodge a complaint
If you have any questions regarding the processing of your personal data, information, rectification, blocking, objection or deletion of data or if you wish to transfer the data to another enterprise, please contact datenschutz@erp.valantic.com.

You also have the option of complaining to a supervisory authority about your rights as a data subject.