DATA PROTECTION STATEMENT AND INFORMATION FOR CUSTOMERS, SUPPLIERES AND BUSINESS PARTNERS

1. General Information

1.1 Introduction

With this statement we would like to inform you about the processing of your personal data and your rights in respect of such processing under the EU General Data Protection Regulation (“GDPR”) and other regulations concerning data privacy. If you log on to our website www.kallegroup.com / www.kalle.de, we would like to refer you also to our data protection statement there.

1.2 Responsible Body (Controller)

We, the following companies 

are the responsible bodies according to the GDPR and, as such, responsible for the processing of personal data as further explained and elaborated in the following:

1.3 Contact Person

You may contact our person in charge for data protection anytime using the following contact details: 

Or you may contact our Data Protection Officer:

2. Information on the Processing of Personal Data

2.1 Categories of Data

We process the following categories of your personal data:

• (a)    contact data, in particular your name, company name, address, phone numbers, bank details, email addresses, role within the company, IP addresses,
• (b)    contract data (possibly including tax data and commercial registration data),
• (c)    data on accounts and data on contract performance and execution, in particular bank accounts, scope and time of contract or performance,
• (d)    possibly camera footage of you recorded by CCTV installed on our industrial premises, which will be deleted within 72 hours,
• (e)    information (including any interest) provided by you on our services and goods.

2.2 Purposes of the Data Processing

We process your personal data mentioned above in order to  

• communicate with you,
• support you as a customer or business partner, in particular to inform you in accordance with all applicable regulations on new offers, new products (e.g. by sending you catalogues, brochures, newsletters, flyer or leaflets),
• provide customer relationship management in line with market standards,
• request or call for offers from you or services to be provided by you, 
• prepare quotes or offers for you and submit them to you or to improve our offers,
• screen your data in respect of sanction lists or examine such data for other compliance issues in accordance with good corporate governance,
• process and execute your offers, requests or orders in accordance with the contract and statutory law, in particular with respect to accounting requirements, warranty and liability issues
• ensure factory and production security as well as the protection of confidentiality.

2.3 Legal Basis for the Processing of Personal Data 

We process your data if and to the extent it is necessary for the performance of a contract to which you are party or in order to take steps at your requests prior to entering into a contract (Art. 6 para 1 sentence 1 point (b) GDPR. In addition, we process your data if such processing is necessary for compliance with a legal obligation to which we are subject, according to Art. 6 para 1 sentence 1 point (c) GDPR. 
Finally, we process your personal data if and to the extent it is necessary for the purposes of legitimate interests pursued by us or a third party, except where such interests are overridden by your fundamental rights and freedoms or interests, which require protection of personal data (Art. 6 para 1 Sentence 1, point (f) GDPR). This applies in particular if we send offers, leaflets, brochures and catalogues to existing customers as part of our customer relationship management.
Otherwise we only process your personal data if you have given consent to the processing.

2.4 Voluntary Provision of Data

Provision of your personal data is voluntary. You are under no obligation to provide your personal data to us nor is the provision of such personal data necessary to comply with legal requirements, nor in order to comply with an obligation to conclude a contract. There will be no consequences, if you do not provide your personal data, other than that that we will not enter into a contract with you or send you information.

2.5 Data Sources

Unless we receive your personal data directly from you, we use publicly accessible sources (e.g. public directories) or receive such data from one of our Kalle affiliates. If and to the extent we use and process data, which has been collected by one of our companies, jointly within the Kalle group, then we do so in a transparent manner after having determined the respective responsibilities by means of an arrangement pursuant to Art. 26 GDPR. We will send your extracts of the arrangement upon your request. Finally, we might receive your personal data from third persons like audit or inspection companies (e.g. in the context of screening obligations based on sanction lists).

2.6 Storage Time

We will delete your personal data,

• a)    if your personal data is not necessary anymore for the purposes of their original collection, and
• b)    there are no storage obligations under applicable tax or commercial laws. 

As soon as those requirements are met, we delete your personal data within 6 months the latest. Besides, we will delete your personal data immediately upon your request unless there is a legal basis for a continuing storage by us.

2.7 Data Transfer to Third Parties

We transfer your data, in any event only to the extent necessary, to the following parties

• if required for the execution of contracts, the processing of orders and the provision of services and/or delivery of goods
  • to our bank or other financial institutions for payment handling
  • to logistics providers, suppliers and other service providers involved in contract execution or  payment processing,
• to a factoring company (as the case may be),
• your name and address to a research company, investigators or inspection companies (Dun & Bradstreet, SAPPER, etc.) due to compliance requirements (e.g. foreign trade law, law on money laundering, etc.),
• to ordinary courts, tribunals, custom authorities, tax and other prosecutors, external security companies, external lawyers or other authorized third parties to the extent permitted by the GDPR based on our legitimate interests or in order to comply with statutory requirements,
• finally, to Kalle affiliates in Germany within the context of a jointly used accounting system (SAP ERP) or other centralized functions (e.g. Finance, Legal, HR, Marketing) as joint controllers (see Art. 26 GDPR).

We transfer personal data to third countries (U.S.A.) only in the event the execution of an agreement with you or an order by you necessitates the transfer of such data to our affiliates in the U.S.A., namely Kalle USA, LLC and Jif-Pak Manufacturing, LLC.

3. Your Rights

3.1 Your rights according to the GDPR

As the affected person, you may, either formal or informal and at any time, contact our person in charge of data protection or our Data Protection Officer under the contact details stated above to exercise your rights according to the GDPR. Those rights are:

• (a)    the right to obtain from us confirmation as to whether or not your personal data are being processed, and, where that is the case, access to the personal data as set forth under Art. 15 GDPR and a copy of the personal data undergoing processing,
• (b)    the right to obtain from us the rectification of inaccurate personal data (Art. 16 GDPR, Right to rectification),
• (c)    the right to obtain from us the erasure of personal data as set forth under Art. 17 GDPR, and, where we have made personal data public, to ask reasonable steps from us to inform controllers that you have requested the erasure of such data,
• (d)    the right to obtain restriction of processing, if the requirements stated under Art. 18 GDPR (Right to restriction of processing) are met,
• (e)    the right to receive the personal data which you have provided, in a structured, commonly used and machine-readable format and to transmit those data to another controller (Right to data portability, Art. 20 GDPR),
• (f)    the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you, which is based on Art. 6 (1) point (e) or (f) GDPR, according to Art. 21 GDPR, Right to object),
• (g)    the right to withdraw your consent at any time to prevent further processing based on your consent according to Art. 7 GDPR (note that the withdrawal does not affect the lawfulness of any data processing prior to the withdrawal of your consent),
• (h)    the right to lodge a complaint with a supervisory authority, if you consider that the processing of your personal data infringes the GDPR (Right to lodge a complaint, Art. 77 GDPR).

3.2 Modification of this Statement

Changes in law may necessitate the modification of this statement on data protection. In such event, we will inform you accordingly. If and to the extent such modifications relate to the processing of data based on your consent, we will ask you to consent again to the processing of your personal data.