Principles of data processing at CONCEPT X GmbH & Co. KG

Information in accordance with Articles 13, 14 and 21 of the General Data Protection Regulation (GDPR)

You have come to this page via a link because you want to find out how we handle (your) personal data. In order to fulfill our information obligations in accordance with Art. 12 ff. of the General Data Protection Regulation (GDPR), we are pleased to provide you with our information on data protection below.

1. Who is responsible for data processing and who can I contact?

The controller within the meaning of the General Data Protection Regulation is the:

CONCEPT X GmbH & Co. KG
Hörstkamp 7
48431 Rheine
Germany
E-mail: rheine@conceptx.de
Imprint

(hereinafter also referred to as “CONCEPT X GmbH & Co. KG” or “we”)

If you have any questions about this data protection notice or about the protection of your data by CONCEPT X GmbH & Co KG, you can also contact our data protection officer at any time:

Carla Holterhus
E‑Mail: datenschutz@conceptx.de

2. What data is collected, for what purpose and for how long is it stored?

If we have received data from you, we will only process it for the purposes for which we received or collected it.

Data processing for other purposes will only be considered if the necessary legal requirements pursuant to Art. 6 (4) GDPR are met. In this case, we will of course comply with any information obligations pursuant to Art. 13 (3) GDPR and Art. 14 (4) GDPR.

The legal basis for the processing of personal data is generally – unless there are specific legal provisions – Art. 6 GDPR. The following possibilities in particular come into consideration here:

• Consent (Art. 6 para. 1 lit. a) GDPR)
• Data processing for the performance of contracts (Art. 6 (1) (b) GDPR)
• Data processing on the basis of a balancing of interests (Art. 6 para. 1 lit. f) GDPR)
• Data processing to fulfill a legal obligation (Art. 6 para. 1 lit. c) GDPR)

If personal data is processed on the basis of your consent, you have the right to withdraw your consent from us at any time with effect for the future.

If we process data on the basis of a balancing of interests, you as the data subject have the right to object to the processing of personal data, taking into account the provisions of Art. 21 GDPR.

We process the data as long as this is necessary for the respective purpose.

Insofar as statutory retention obligations exist – e.g. under commercial law or tax law – the personal data concerned will be stored for the duration of the retention obligation. Once the retention obligation has expired, we will check whether there is any further need for processing. If it is no longer necessary, the data will be deleted.

At the end of a calendar year, we generally review data with regard to the need for further processing. Due to the volume of data, this review is carried out with regard to specific data types or purposes of processing.

Of course, you can request information about the personal data we have stored about you at any time (see below) and, if it is not necessary, request that the data be deleted or processing be restricted.

3. Who receives your data?

Data will only be passed on to third parties if you have given your consent or if there is a legal obligation to do so. Under these conditions, recipients of personal data may be, in particular:

• Processor (Art. 28 GDPR): Service providers commissioned by CONCEPT X GmbH & Co KG, who support CONCEPT X GmbH & Co KG in the implementation of the business relationship, are granted access to the data. These are companies in the categories of hosting providers, tracking service providers, web agencies, IT services, consulting, service providers in the context of first, second and third level support, call center services, customer administration, lettershops, marketing, media technology, compliance, telecommunications, CRM and lead management. If other categories of processors are also used, please refer to the respective data protection notices.
• Disclosure to third parties: In addition, we will pass on your data to third parties if legal or contractual provisions permit this and/or you have given your consent. Under this condition, the data may be passed on to the following categories of recipients: Public bodies and institutions (e.g. public prosecutor’s office, police, tax authority, data protection supervisory authority) for the processing of official inquiries, insofar as this is in your interest or we are legally obliged to do so. The legal basis is Art. 6 para. 1 sentence 1 lit. f or c GDPR.
• Data transfers within the CONCEPT X Group: We transfer your data to other companies within the CONCEPT X Group or grant them access to your data. If this is done for administrative purposes, this is based on our legitimate interest in internal administrative purposes and Group reporting. The legal basis is Art. 6 para. 1 sentence 1 lit. f GDPR. Insofar as this is necessary to initiate a contract on your initiative or to fulfill contractual obligations or with your consent, the legal basis is Art. 6 para. 1 sentence 1 lit. b GDPR or Art. 6 para. 1 sentence 1 lit. a GDPR. Insofar as we are legally entitled to do so, the legal basis results from Art. 6 para. 1 sentence 1 lit. c GDPR. For further disclosure to third parties, please refer to the respective data protection notices.
• Third parties with whom we have an ongoing business relationship: Insofar as this is necessary to initiate a contract or fulfill contractual obligations or is done with your consent, the legal basis is Art. 6 para. 1 sentence 1 lit. b GDPR or Art. 6 para. 1 sentence 1 lit. a GDPR. Insofar as we are legally obliged to do so, the legal basis results from Art. 6 para. 1 sentence 1 lit. c GDPR.

Further information can be found in the respective data protection notices.

Data transfer to third countries (countries outside the EU or the European Economic Area – EEA) takes place, for example, if this:

• is necessary for the performance of a contract to which you are party or to fulfill your request.
• is necessary to protect our legitimate interests.
• is required by law or you have given your consent.
• is carried out within the scope of order processing when using service providers.

If there is no decision by the EU Commission on a level of data protection appropriate to European data protection requirements for the country in question, we will ensure that your rights and freedoms are adequately protected by means of appropriate contracts. Such an agreement ensures that the recipient of the data has an adequate level of data protection, in particular by agreeing so-called EU standard contractual clauses of the European Union with the recipient. Otherwise, we can also transfer data on the basis of your express consent. You can withdraw your consent at any time with effect for the future, see section “What rights do you have when it comes to the processing of your data?”. We will provide you with more detailed information free of charge on request using the contact details above. If we base data processing by recipients without an adequate level of data protection solely on your consent, we would like to point out that the following risks exist: There may not be sufficient regulations to adequately protect your personal data, there is no data protection supervisory authority, the enforcement of your data protection rights as a data subject is made more difficult or is disregarded, there is no control over the further processing and transfer of data to third parties. You may find further information in our respective data protection information.

4. What rights do you have when it comes to the processing of your data?

You have the following rights vis-à-vis CONCEPT X GmbH & Co KG with regard to your personal data:

In accordance with Art. 15 GDPR, you have the right to obtain information about the personal data stored about you. If incorrect personal data has been processed, you have the right to rectification in accordance with Art. 16 GDPR. If the legal requirements are met, you can request the erasure or restriction of processing and object to data processing (Art. 17, 18 and 21 GDPR). In accordance with Art. 20 GDPR, you can assert the right to data portability for data that is processed automatically on the basis of your consent or a contract with you.

You also have the right to lodge a complaint with a data protection supervisory authority in connection with the processing of your personal data.

Status: 05.11.2023