Privacy Notice in Accordance with the EU General Data Protection Regulation (GDPR)

(As of 12/2023)

The following information provides an overview of how we process your personal data and your rights under data protection law. The specific data we process and how it is used depend largely on the underlying business relationships in each case.

1. Data Controller

The person responsible is:

Train4you Vertriebs GmbH
Kolumbastraße 5
50667 Cologne
Tel: +49 221 800 20 820
Fax: +49 221 800 20 829
Email: info@train4you.de

2. Data Type and Data Source

We process personal data that we receive from our customers in the course of our business relationship. In addition, to the extent necessary for the provision of our services, we process personal data that we have lawfully received from other third parties (e.g., business information services) to the extent necessary to provide our services (e.g., to execute orders, fulfill contracts, or based on consent you have provided).
Furthermore, we process personal data that we have lawfully obtained from publicly accessible sources (e.g., commercial and association registries, the press, media, and the Internet) and are permitted to process.
Relevant personal data may include, for example: name, address, phone number, email address, license plate number, and vehicle type.

3. Purpose of the Processing and Legal Basis

We process the personal data mentioned above in accordance with the provisions of the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG) for the following purposes:

3.1 To fulfill contractual obligations
(Article 6(1)(b) of the GDPR)
Personal data is processed in connection with the performance of our contracts with our customers or to take precontractual measures in response to your request.

3.2 In the context of balancing interests
(Article 6(1)(f) of the GDPR)
To the extent necessary, we process your data beyond the actual performance of the contract to protect our legitimate interests or those of third parties, such as:
– Advertising, provided you do not object to the use of your data
– Asserting legal claims and defending against legal disputes
– Ensuring IT security and IT operations
– Preventing criminal offenses
– Video surveillance to enforce property rights
– Measures for building and facility security (e.g., access controls)
– Measures to ensure property rights
– Risk management within the Group

3.3 Based on Your Consent
(Article 6(1)(a) of the GDPR)
If you have given us your consent to process personal data for specific purposes (e.g., consent to the use of cookies on our website), the lawfulness of this processing is based on your consent. Consent that has been given may be withdrawn at any time. This also applies to the withdrawal of consent given to us prior to the entry into force of the EU General Data Protection Regulation, i.e., before May 25, 2018. Please note that the withdrawal of consent takes effect only for the future. Processing that took place prior to the withdrawal is not affected.

3.4 Due to legal requirements (Article 6(1)(c) of the GDPR) or in the public interest
(Article 6(1)(e) of the GDPR)
To fulfill legal obligations, that is, legal requirements such as the documentation obligations under the German Commercial Code (HGB).

4. Authorized Users and Data Recipients

Within our company, access to your data is granted only to those departments that need it to fulfill our contractual and legal obligations. Service providers and agents we engage may also receive data for these purposes, provided they comply with our written data protection guidelines. These are primarily companies from the categories listed below:

– Public agencies and institutions (e.g., tax authorities, Federal Central Tax Office, Federal Railway Authority) when there is a legal or regulatory obligation to do so.

– Examples of data processors to whom we transfer personal data in order to conduct our business relationship with you include:
— Financial accounting service provider
— IT service providers for the support and maintenance of computer and IT applications
— Data destruction service providers
— Mailing service providers
— Website development companies
— Auditing firms
— Service providers in the areas of catering, logistics, and administration
— Communications and marketing service providers

5. Processing of Your Data in a Third Country

Data may be transferred to entities in third countries (countries outside the European Union (EU) or the European Economic Area (EEA)) if such transfer is necessary to fulfill an order or contract from or with you, it is required by law (e.g., tax reporting obligations), adequate levels of data protection are in place, or you have given us your consent.

Your data may also be processed in a third country in connection with the engagement of service providers under a data processing agreement. If the European Commission has not issued a decision recognizing an adequate level of data protection in the country in question, we ensure through appropriate contracts that your rights and freedoms are adequately protected and guaranteed. For detailed information, please refer to the individual descriptions of the processing activities under Section B. Information regarding the appropriate or adequate safeguards and the possibility of obtaining a copy of them can be requested upon request.

6. Retention Periods

We process and store your personal data for as long as necessary to fulfill our contractual and legal obligations. Once the data is no longer required to fulfill contractual or legal obligations, it is regularly deleted. With regard to retention periods, please note, for example, the German Commercial Code (HGB) and the German Fiscal Code (Abgabenordnung). The retention and documentation periods specified therein range from two to ten years. In addition, data is retained to preserve evidence within the limitation periods pursuant to Sections 195 et seq. of the German Civil Code (BGB). The limitation periods can be up to 30 years, although the standard limitation period is three years.

7. Data Protection Rights

Every data subject has the right of access under Article 15 of the GDPR, the right to rectification under Article 16 of the GDPR, the right to erasure under Article 17 of the GDPR, the right to restriction of processing under Article 18 of the GDPR, the right to object under Article 21 of the GDPR, and the right to data portability under Article 20 of the GDPR. With regard to the right of access and the right to erasure, the restrictions set forth in Sections 34 and 35 of the Federal Data Protection Act (BDSG) apply. In addition, you have the right to lodge a complaint with a data protection supervisory authority (Article 77 of the GDPR in conjunction with Section 19 of the BDSG). You may revoke any consent you have given to the processing of personal data at any time. This also applies to the revocation of consent given to us prior to the entry into force of the EU General Data Protection Regulation, i.e., before May 25, 2018. Please note that the withdrawal of consent takes effect only for the future. Processing that took place prior to the withdrawal is not affected.

8. Obligation to Provide Data

As part of our business relationship, you must provide the personal data necessary for establishing and conducting a business relationship and fulfilling the associated contractual obligations, or data that we are legally required to collect. Without this data, we will generally have to refuse to enter into the contract or execute the order, or we will no longer be able to perform an existing contract and may have to terminate it. If you do not provide us with the necessary information and documents, we will not be able to establish or continue the business relationship you have requested.

9. Automated Decision-Making and Profiling

As a general rule, we do not use fully automated decision-making in accordance with Article 22 of the GDPR to establish or carry out the business relationship. We do not process your data for the purpose of evaluating specific personal aspects (profiling).

10. Cookies

Right to Object Under Article 21 of the EU General Data Protection Regulation (GDPR)

1. Right to Object on a Case-by-Case Basis

You have the right, for reasons arising from your particular situation, to object at any time to the processing of your personal data carried out pursuant to Article 6(1)(e) of the GDPR (processing in the public interest) and Article 6(1)(f) of the GDPR (processing based on a balancing of interests). If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims.

2. Right to Object to the Processing of Data for Marketing Purposes

In certain cases, we process your personal data to send you direct marketing. You have the right to object at any time to the processing of your personal data for the purpose of such direct marketing. If you object to the processing for direct marketing purposes, we will no longer process your personal data for those purposes. The objection may be submitted in any form and should be addressed to:

Train4you Vertriebs GmbH
Kolumbastraße 5
50667 Cologne
Tel: +49 (0) 221- 800 20 820
Fax: +49 (0) 221 – 800 20 829
info@train4you.de