Handling of your data and your rights

Duty to inform according to Art. 13 DSGVO

We would like to inform you in the following about the processing of your personal data by us and the claims and rights you are entitled to according to the data protection regulations.

Which data is processed in detail and how it is used depends largely on the agreed services.

Name and contact details of the person responsible (Art. 13 para. 1 a DS-GVO)

Nanoscribe Solutions GmbH & Co. KG
Hermann von Helmholtz Platz 6
76344 Eggenstein-Leopoldshafen
E-Mail: info@nanoscribe.com

Name and contact details of the data protection officer (Art. 13 para. 1 b DS-GVO)

ENSECUR GmbH
Kaiserstraße 86
76133 Karlsruhe
Personally responsible: Mr. Steven Bösel
E-Mail: dsb-nanoscribe@ensecur.de

Purpose and legal basis of data processing (Art. 13 para. 1 c DS-GVO)

1. Fulfilment of contractual obligations, such as the processing of your inquiries or orders (Article 6 paragraph 1b DSGVO)
The processing of personal data is carried out for the purpose of providing and procuring our services, in particular for the execution of our contracts or pre-contractual measures with you and the execution of your orders as well as all activities required for the operation and administration of a company.

The purposes of data processing are primarily based on the specific product or order. Further details regarding the purpose of data processing can be found in the respective contract documents and terms and conditions.

2. Consent, e.g. for the implementation of marketing measures or with regard to the transfer of data to third parties (article 6 paragraph 1a DSGVO)
If you have given us your consent to process personal data for specific purposes (e.g. transfer of data, evaluation of user data for marketing purposes), the legality of this processing is based on your consent. A granted consent can be revoked at any time. This also applies to the revocation of declarations of consent that were given to us before the DSGVO became effective, i.e. before 25 May 2018. Please note that the revocation is only effective for the future. Processing that took place before the revocation is not affected.

3. Balancing of interests (Article 6 para. 1f DSGVO)
As far as necessary, we process your data beyond the actual fulfillment of the contract to protect legitimate interests of us or third parties, such as in the following cases

• Ensuring IT security and IT operation;
• Testing and optimization of procedures for requirements analysis and direct customer contact;
• Execution of requirements analyses for the purpose of sales management;
• advertising or market and opinion research by telephone or letter post, unless you have objected to the use of your data;
• Assertion of legal claims and defence in the event of legal disputes;
• measures for business management and further development of services and products;
• Prevention and investigation of criminal offences.

As far as the processing of your data is carried out for the protection of legitimate interests, you have the right to object to this processing at any time using our contact details provided, if reasons arise from your particular situation that oppose this data processing. We will then stop this processing unless it serves predominant interests worthy of protection on our part.

4. Legal requirements (Article 6 para. 1c DSGVO) or public interest (Article 6 para. 1e DSGVO)
In addition, like every company, we must fulfill various legal obligations, e.g. requirements from tax laws or storage obligations for commercial and tax law reasons.  

5. Processors (according to article 28 DSGVO)
Even processors employed by us, who are carefully selected by us and contractually obliged to comply with data protection regulations in accordance with the requirements of Article 28 DSGVO, may receive data for the aforementioned purposes. These are, for example, companies in the categories of IT services, logistics, printing services, telecommunications, debt collection, consulting and advisory services, and sales and marketing. Processors under Article 28 DSGVO may provide services for us in the following areas:

• IT infrastructure and services (such as support and further development of internal IT infrastructure, system administration and operation of applications from server systems and security, authorization management, etc.)
• Development (such as development of software and system architecture, quality assurance, technical support etc.)
• Marketing (such as campaign and lead management, support of social media & business networks, maintenance and further development of the website, sales support etc.)
• Legal advice (e.g. consulting/support in operational and administrative legal issues, drafting of contracts, support in the defense/enforcement of claims

Categories of recipients of personal data (Art. 13 para. 1 e DS-GVO)
In many cases, we work together with other service providers and contract processors to provide our services. Our service providers are carefully selected and obliged to comply with the applicable data protection laws. For this purpose, contracts are concluded with service providers in accordance with Article 28 DS-GVO and their technical and organizational measures are carefully checked. The following categories of contract processors and other service providers and may be involved:

• Advertising agencies
• IT service provider
• Suppliers / Logistics
• Billing service provider
• Telecommunications company
• Collection
• Consultation & Consulting

Transfer to third countries (Art. 13 para. 1 f DS-GVO)
As a matter of principle, there is no transfer to a third country. In special cases, in which this is necessary for the execution of an order, a transfer can take place.

Storage period in accordance with statutory storage obligations (Art. 13 para. 2 a DS-GVO)
We process and store your personal data for the duration of our business relationship, which also includes, for example, the initiation and execution of a contract.
In addition, we are subject to various storage and documentation obligations, which result from the German Commercial Code (HGB) and the German Fiscal Code (AO), among others. The periods of retention or documentation stipulated there are two to ten years.
Finally, the duration of storage is also assessed according to the statutory limitation periods, which, for example, according to §§ 195 ff. of the German Civil Code (BGB), are usually three years, but in certain cases can be up to thirty years.

Right to information, correction, deletion, restriction, data transferability and objection (Art. 13 para. 2 b DS-GVO)
As a data subject, you have the right to information, correction, and deletion of your data and to limitation of processing, as well as a right to data transferability. For this purpose, please contact the person responsible at the contact details provided.

Right of objection (Art. 21. para. 1 DS-GVO)
As far as the processing of your data is carried out for the protection of legitimate interests, you have the right to object to this processing at any time using our contact details provided, if reasons arise from your particular situation that oppose this data processing. We will then stop this processing unless it serves predominant interests worthy of protection on our part.

Right of appeal (Article 13 (2) d DS-GVO)
As a person affected, you can contact the responsible State Commissioner for Data Protection and Freedom of Information in Hamburg at any time in the event of complaints.

Need to provide personal data (Art. 13 para. 2 e DS-GVO)
Within the scope of our business relationship, you only have to provide the personal data that is necessary for the establishment, execution or termination of a business relationship or that we are legally obliged to collect. Without this data, we will usually have to refuse to conclude the contract or execute the order or are unable to execute an existing contract and may have to terminate it.