Go to main content

Information obligations regarding the processing of suppliers’ personal data

Information obligations regarding the processing of personal data of suppliers to Gasteig München GmbH in accordance with Article 13 of the European General Data Protection Regulation (EU GDPR)

Name and contact details of the controller

Gasteig München GmbH
Represented by its Managing Director Max Wagner

 

Address: Rosenheimer Straße 5, 81667 Munich, Germany
E-mail: zentral@gasteig.de
Tel.: +49 89 480980


Categories of recipients of personal data

Your personal data will be transmitted or made accessible to other recipients only insofar as this is necessary for us to process your request or insofar as we have entrusted other recipients with the performance of individual tasks or services and access to your personal data is thereby necessary or cannot be excluded.

 

The categories of recipients of personal data are:

  • Internal departments involved in completing the respective business processes (e.g. Purchasing, Events Management, Accounts, IT)
  • Service providers for hosting, maintenance and administration of our applications or databases
  • External service providers for the direct, instruction-bound or independent support of the respective business processes (e.g. for support within the scope of an order or project award)
  • External auditors or accountants

The transfer of your personal data to the above recipients is based on your consent in accordance with point (a) Art. 6(1) EU GDPR, insofar as this is necessary for taking pre-contractual measures or for fulfilling a contract with you in accordance with point (b) Art. 6(1) EU GDPR, on the basis of the legitimate interest of the controller, insofar as this is necessary for implementing pre-contractual measures or for fulfilling a contract with our suppliers in accordance with point (f) Art.6(1) GDPR, on the basis of contract processing in accordance with Art.28(1) EU GDPR or insofar as we are legally obliged to do so in accordance with point (c) Art. 6(1) EU GDPR.

 

In addition, your personal data are transmitted to state institutions or authorities insofar as we are obliged to provide information by law or as a result of a court order. Furthermore, your personal data are transmitted to government institutions or authorities insofar as this is necessary to prosecute criminal offences against us as the injured party or to assert, exercise or defend civil law claims (legal basis for processing your personal data: legitimate interest of the controller in accordance with point (f) Art. 6(1) EU GDPR, processing for other purposes by non-public bodies in accordance with Para. 24(1) of the German Federal Data Protection Act (BDSG)).


Transfer of data to recipients in a third country or to an international organisation

A transfer of your personal data to a recipient in a third country or to an international organisation is not planned.


Duration of storage of personal data

Your personal data will only be stored for as long as is necessary to fulfil the purposes for which they were processed. As a rule, this is the case for as long as your personal data is required for carrying out pre-contractual measures or for fulfilling a contract in accordance with point (b) Art. 6(1) EU GDPR or point (f) Art. 6(1) EU GDPR. Furthermore, your personal data will be stored if you have given us your consent in accordance with point (a) Art. 6(1) EU GDPR or if mandated by legal, statutory or contractual retention periods. For example, personal data relevant to tax law are usually stored for a period of ten years; other personal data are usually stored for a period of six years in accordance with German commercial law regulations.


Information on your rights as a data subject

In general and with respect to your personal data you may exercise the rights set out below.

  • Right to information in accordance with Art. 15 EU GDPR: You have the right to request information from the controller about the personal data stored about you and other information relating to this personal data.
  • Right to rectification in accordance with Art. 16 EU GDPR: You have the right to obtain from the controller rectification of inaccurate personal data concerning you.
  • Right to erasure in accordance with Art. 17 EU GDPR: You have the right to obtain from the controller the erasure of personal data concerning you.
  • Right to restrict processing in accordance with Art. 18 GDPR: You have the right to request the controller to restrict the processing of personal data concerning you.
  • Right to data portability in accordance with Art. 20 EU GDPR: You have the right to receive your personal data from the controller in a structured, commonly used and machine-readable format.
  • Right of revocation in accordance with Art. 7(3) EU GDPR: You have the right to withdraw your consent given in accordance with point (a) Art. 6(1) EU GDPR to the processing of your personal data at any time. Your withdrawal of consent does not affect the lawfulness of processing based on your consent before its withdrawal.
  • Right to object in accordance with Art. 21(1) EU GDPR: You have the right to object at any time to the processing of your personal data in accordance with Art. 6(1) point (e) or (f) EU GDPR.
  • Right to lodge a complaint with a supervisory authority in accordance with Art. 77 EU GDPR: If, as data subject, you consider that the processing of your personal data infringes the EU GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement.

You can address your above rights directly to the contact details provided under “Name and contact details of the controller” in this information.


Contact details of the Data Protection Officer

Data Protection Officer of Gasteig München GmbH
℅ TÜV SÜD Akademie GmbH
Westendstraße 160
80339 Munich

Germany
E-mail: dsb.gasteig@tuvsud.com


Further questions

If this Privacy Policy leaves any questions regarding your personal data processed through our website unanswered, you may address your questions directly to the contact details provided in this Privacy Policy under “Name and contact details of the controller” or “Contact details of the Data Protection Officer”.

As at: August 2022