Preamble

With the following privacy policy, we would like to inform you about the types of your personal data (hereinafter also referred to as "data") that we process, for what purposes, and to what extent. This privacy policy applies to all processing of personal data carried out by us, both in the context of providing our services and, in particular, on our websites.

The terms used are not gender-specific.

Version: December 2024

Name and Address of the Controller:

Plange GmbH
Hansastr. 6-8
41460 Neuss

Phone: +49 (0) 2131 2795 0

Email address: kontakt@plange.de

 

Authorized Representatives:

Michael Gutting, Martin Bindewald

Contact Data Protection Officer

Andreas Schwarz
VdE Service GmbH
Eduard-Pfeiffer-Straße 48
70192 Stuttgart
Tel.: +49 (711) 22 333 12
E-Mail: aschwarz@ernaehrung.net

Overview of Processing Activities

The following overview summarizes the types of data processed and the purposes of their processing and refers to the data subjects concerned.

Types of Data Processed

• Master data.
• Payment data.
• Contact data.
• Content data.
• Contract data.
• Usage data.
• Meta, communication and procedural data.

Categories of Data Subjects

• Service recipients and clients.
• Prospective customers.
• Communication partners.
• Users.
• Business and contractual partners.

Purposes of Processing

• Provision of contractual services and fulfillment of contractual obligations.
• Communication.
• Security measures.
• Office and organizational procedures.
• Organizational and administrative procedures.
• Feedback.
• Provision of our online services and user-friendliness.
• Business processes and economic procedures.

Relevant Legal Bases

Relevant legal bases under the GDPR: Below you will find an overview of the legal bases of the GDPR on which we process personal data.

• Consent (Art. 6(1) sentence 1 lit. a GDPR) - The data subject has given consent to the processing of personal data concerning them for one or more specific purposes.
• Performance of a contract and pre-contractual inquiries (Art. 6(1) sentence 1 lit. b GDPR) - Processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract.
• Legal obligation (Art. 6(1) sentence 1 lit. c GDPR) - Processing is necessary for compliance with a legal obligation to which the controller is subject.
• Legitimate interests (Art. 6(1) sentence 1 lit. f GDPR) - Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, provided that such interests are not overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

National Data Protection Regulations in Germany: In addition to the data protection regulations of the GDPR, national data protection regulations apply in Germany. This includes in particular the German Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG). The BDSG contains specific provisions regarding the right of access, the right to erasure, the right to object, the processing of special categories of personal data, processing for other purposes, and the transfer of data as well as automated decision-making in individual cases including profiling. Furthermore, state data protection laws of the individual federal states may apply.

Security Measures

In accordance with legal requirements, taking into account the state of the art, implementation costs, and the nature, scope, circumstances and purposes of processing as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons, we implement appropriate technical and organizational measures to ensure a level of protection appropriate to the risk.

These measures include, in particular, ensuring the confidentiality, integrity and availability of data by controlling physical and electronic access to the data as well as access, input, disclosure, safeguarding of availability and separation of the data. Furthermore, we have established procedures to ensure the exercise of data subject rights, deletion of data, and responses to data threats. We also take the protection of personal data into account during the development and selection of hardware, software and procedures, in accordance with the principle of data protection by design and by default.

Securing online connections through TLS/SSL encryption technology (HTTPS): In order to protect users’ data transmitted via our online services from unauthorized access, we use TLS/SSL encryption technology. Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are the cornerstones of secure data transmission on the Internet. These technologies encrypt the information transmitted between the website or app and the user's browser (or between two servers), thereby protecting the data from unauthorized access. TLS, as the more advanced and secure version of SSL, ensures that all data transmissions meet the highest security standards. When a website is secured by an SSL/TLS certificate, this is indicated by the display of HTTPS in the URL. This serves as an indicator to users that their data is transmitted securely and in encrypted form.

Transfer of Personal Data

In the course of processing personal data, it may be transferred to or disclosed to other entities, companies, legally independent organizational units, or individuals. Recipients of such data may include, for example, service providers entrusted with IT tasks or providers of services and content integrated into a website. In such cases, we comply with legal requirements and conclude appropriate contracts or agreements with the recipients of your data to ensure its protection.

Data transfer within the organization: We may transfer personal data to other departments or units within our organization or grant them access to it. Where such data transfer is carried out for administrative purposes, it is based on our legitimate business and economic interests, or it is carried out where necessary to fulfill our contractual obligations, or where consent of the data subjects or a legal authorization exists.

General Information on Data Storage and Deletion

We delete personal data that we process in accordance with statutory provisions as soon as the underlying consents are revoked or no other legal bases for processing exist. This applies to cases where the original purpose of processing no longer applies or the data is no longer required. Exceptions to this rule exist where statutory obligations or special interests require longer retention or archiving of the data.

In particular, data that must be retained for commercial or tax law reasons or whose storage is necessary for legal prosecution or to protect the rights of other natural or legal persons must be archived accordingly.

Our privacy notices contain additional information on the retention and deletion of data that specifically apply to certain processing activities.

If multiple retention periods or deletion deadlines are specified for a date, the longest period shall always apply.

If a period does not explicitly begin on a specific date and is at least one year, it automatically begins at the end of the calendar year in which the event triggering the period occurred. In the case of ongoing contractual relationships in which data is stored, the event triggering the period is the date on which the termination or other end of the legal relationship becomes effective.

Data that is no longer required for the originally intended purpose but is retained due to legal requirements or other reasons will be processed exclusively for the reasons justifying its retention.

Further Information on Processing Activities, Procedures and Services:

• Retention and Deletion of Data: The following general retention periods apply under German law:
• 10 years – retention period for books and records, annual financial statements, inventories, management reports, opening balance sheets as well as the work instructions and other organizational documents necessary for their understanding, accounting records and invoices (§ 147 para. 3 in conjunction with para. 1 no. 1, 4 and 4a AO, § 14b para. 1 UStG, § 257 para. 1 no. 1 and 4, para. 4 HGB).
• 6 years – other business documents: received commercial or business letters, copies of sent commercial or business letters, and other documents relevant for taxation purposes, e.g., wage slips, operating cost sheets, calculation documents, price markings, as well as payroll documents unless already accounting records and cash register receipts (§ 147 para. 3 in conjunction with para. 1 no. 2, 3, 5 AO, § 257 para. 1 no. 2 and 3, para. 4 HGB).
• 3 years – data required to consider potential warranty and compensation claims or similar contractual claims and rights and to process related inquiries, based on previous business experience and common industry practices, are stored for the duration of the regular statutory limitation period of three years (§§ 195, 199 BGB).

Rights of Data Subjects

Rights of data subjects under the GDPR: As a data subject, you have various rights under the GDPR, in particular arising from Articles 15 to 21 GDPR:

• Right to Withdraw Consent: You have the right to withdraw any consent given at any time.
• Right of Access: You have the right to request confirmation as to whether data concerning you is being processed and to obtain information about such data as well as further information and a copy of the data in accordance with legal requirements.
• Right to Rectification: In accordance with legal requirements, you have the right to request completion of the data concerning you or correction of inaccurate data concerning you.
• Right to Erasure and Restriction of Processing: In accordance with legal requirements, you have the right to request that data concerning you be deleted without undue delay or, alternatively, to request restriction of processing of the data.
• Right to Data Portability: You have the right to receive the data concerning you that you have provided to us in a structured, commonly used and machine-readable format in accordance with legal requirements or to request its transmission to another controller.
• Right to Lodge a Complaint with a Supervisory Authority: Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work, or the place of the alleged infringement, if you consider that the processing of personal data concerning you violates the GDPR.

Business Services

We process data of our contractual and business partners, e.g., customers and prospective clients (collectively referred to as “contractual partners”), within the framework of contractual and comparable legal relationships and related measures, and with regard to communication with the contractual partners (or pre-contractually), for example to respond to inquiries.

We use this data to fulfill our contractual obligations. This includes, in particular, the obligation to provide the agreed services, any update obligations, and remedies in the event of warranty claims or other performance disruptions. Furthermore, we use the data to safeguard our rights and for purposes of administrative tasks associated with these obligations as well as company organization. In addition, we process the data on the basis of our legitimate interests in proper and efficient business management and in security measures to protect our contractual partners and our business operations against misuse, risks to their data, secrets, information and rights (e.g., involvement of telecommunications, transport and other auxiliary services as well as subcontractors, banks, tax and legal advisors, payment service providers or tax authorities). Within the scope of applicable law, we only disclose data of contractual partners to third parties to the extent necessary for the aforementioned purposes or to fulfill legal obligations. Contractual partners are informed about further forms of processing, e.g., for marketing purposes, within this privacy policy.

We inform contractual partners which data is required for the aforementioned purposes prior to or during data collection, e.g., in online forms, by special markings (e.g., colors) or symbols (e.g., asterisks), or personally.

We delete the data after expiration of statutory warranty and comparable obligations, i.e., generally after four years, unless the data is stored in a customer account, e.g., as long as it must be retained for legal archiving reasons (e.g., for tax purposes usually ten years). Data disclosed to us by the contractual partner within the scope of an order is deleted in accordance with the specifications and generally after the end of the order.

• Types of Data Processed: Master data (e.g., full name, residential address, contact details, customer number, etc.); payment data (e.g., bank details, invoices, payment history); contact data (e.g., postal and email addresses or phone numbers); contract data (e.g., subject matter of contract, term, customer category); usage data (e.g., page views and duration of stay, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and functions). Meta, communication and procedural data (e.g., IP addresses, timestamps, identification numbers, involved persons).
• Data Subjects: Service recipients and clients; prospective customers; business and contractual partners.
• Purposes of Processing: Provision of contractual services and fulfillment of contractual obligations; security measures; communication; office and organizational procedures; organizational and administrative procedures; business processes and economic procedures.
• Retention and Deletion: Deletion in accordance with the information in the section "General Information on Data Storage and Deletion".
• Legal Bases: Performance of a contract and pre-contractual inquiries (Art. 6(1) sentence 1 lit. b GDPR); Legal obligation (Art. 6(1) sentence 1 lit. c GDPR); Legitimate interests (Art. 6(1) sentence 1 lit. f GDPR).