Datenschutzinformation
Data Protection Information
As of 25 May 2018, new data protection provisions are now in force through the EU General Data Protection Regulation (GDPR). In the following we should like to inform you about the processing of your personal data by the Association of the German Confectionery Industry (BDSI) and the rights afforded to you under data protection legislation:
1. Information on the processor:
Association of the German Confectionery Industry (BDSI)
Processor’s contact details:
Schumannstraße 4-6,
53113 Bonn, Germany
Vereinsregister (Register of Associations) of the Amtsgericht (Local Court) of Bonn 20 VR 2744
Processor’s electronic contact address: bdsi@bdsi.de
2. Details of the data protection officer:
Data protection c/o
Contact details of the data protection officer:
Association of the German Confectionery Industry (BDSI)
Schumannstr. 4?6, 53113 Bonn
Germany
Electronic contact address of the data protection officer:
3. Information on processing purposes and their legal basis:
The Association of the German Confectionery Industry (BDSI) processes your personal data in compliance with the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), and in compliance with all additional relevant statutory regulations.
Personal data is processed for the purpose of executing agreements and contracts concluded on the initiative of the data subjects (e.g. induction into association membership, staging of events and seminars). The legal basis for this is Art. 6 (1) (b) of the GDPR.
Personal data is also processed for purposes of meeting statutory obligations (e.g. information passed to financial authorities) or fulfilling statutory record-preserving requirements (e.g. Section 147 of the German Tax Code [Abgabenordnung]) to which our association is subject by law. The legal basis for this is Art. 6 (1) (c) of the GDPR.
Personal data is additionally processed to safeguard the legitimate interests of our association. This is the case, for example, when we store third-party contact data in pursuing the purposes of our association or when advertising our association’s services or in sending out newsletters. The legal basis for this is Art. 6 (1) (f) of the GDPR.
Personal data is ultimately processed on the basis of declarations of consent issued to us by data subjects. The legal basis for this is Art. 6 (1) (a) of the GDPR.
4. Information on categories of personal data recipients:
The recipients of personal data received from our association are primarily all service providers or contractors (e.g. EDP and IT service providers, banks, and commissioned third parties at events) that process personal data on our behalf. These act on the basis of contracts concluded with our association and serve as processors within the meaning of Art. 28 of the GDPR.
Other recipients of personal data are third parties which perform functions for our association within the scope of our activities, to the extent this is required to comply with statutory obligations or rules and regulations stemming from our articles of association.
Your contact data is stored in a jointly controlled database – within the meaning of Art. 26 of the EU General Data Protection Regulation (GDPR) – this database being shared by the following organisations – the Association of the German Confectionery Industry (BDSI), the German Association for the Promotion of Exports of Chocolate, Confectionery, Biscuits, Snacks, and Ice-cream (German Sweets), the German Cocoa and Chocolate Foundation (Stiftung der Deutschen Kakao- und Schokoladenwirtschaft), the German Confectionery Promotion Company (Süßwarenförderungs-GmbH), the Advisory Board of the International Sweets and Biscuits Fair (AISM), the German Industrial Disputes Support Fund Association (Arbeitskampf-Unterstützungsfonds e.V.), and the German Committee of Industrial Users of Sugar (IZZ).
5. Information on data transmission to a third country:
Personal data are not transmitted to a third country. Third countries are states that are not members of the European Union.
6. Information on the storage period for personal data:
We store personal data in keeping with a general data erasure concept in operation within our association. Accordingly personal data is allocated to a data erasure category. This data erasure category allocates storage deadlines and standard erasure deadlines to such personal data. On expiry of these standard erasure deadlines, the correspondingly flagged personal data is erased.
The personal data stored in connection with association membership is erased on termination of association membership if it is no longer possible to assert legal rights arising under association membership, e.g. when these have lapsed (statute of limitations of up to 30 years).
Personal data stored in connection with our PR activities (e.g. issuing of press releases, newsletters) are erased in response to your objection to continued use, on your objection to any existing declaration of consent, on termination of the service, and if legal claims against us no longer exist, e.g. if these have lapsed (statute of limitations of up to 30 years, but usually after a period of three years).
Generally your personal data is erased or in anonymised as soon is it is no longer required for the above-named purposes and we are not obligated to continue storing this data by statutory record-keeping and record-preserving requirements (record-preserving requirements of up to 10 years).
7. Information on the rights of data subjects:
As the data subject, you are afforded the following rights under the General Data Protection Regulation:
- Right of access to personal data (Art. 15)
- Right to rectification of personal data (Art. 16)
- Right to erasure of personal data (Art. 17)
- Right to restriction of processing of personal data (Art. 18)
- Right to objection against the processing of personal data (Art. 21)
- Right to data portability (Art. 20)
8. Information on the right of revocation:
In as far as processing is based on Art. 6 (1) (a) of the of the GDPR (consent) or Art. 9 (2) regarding particular types of personal data, in other words on consent given by the data subject, we want you to know that you have the right to revoke your consent at any time, without this affecting the legality of data processing conducted with your consent until such a revocation is declared.
You may also assert these rights vis-à-vis our association: bdsi@bdsi.de.
9. Information on the right to lodge a complaint:
The corresponding supervisory authority in our case is:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
(State Office for Data Protection and Freedom of Information of North Rhine-Westphalia)
Kavalleriestr. 2–4, 40213 Düsseldorf
Phone: 0211 38424-0
Fax: 0211 38424-10
E-mail: poststelle@ldi.nrw.de
Data subjects have a right to lodge a complaint under Art. 77 (1) of the GDPR in the event of an infringement of statutory regulations regarding the processing of personal data.
10. Provision of personal data:
Our association offers various services based on a contract agreed between you, the data subject, and our association (e.g. a contract regulating attendance of the data subject at events or seminars). In this case you are obliged to provide us with certain personal data. This is the data our association requires to fulfil such contracts (e.g. delivery address/payment information). If this data is not provided, contracts with our association cannot be concluded.
11. Automated decision-making and profiling:
Our association undertakes no activities related to automated decision-making (e.g. credit solvency checks) or to so-called profiling (e.g. information on preferences or behaviour of the data subjects) within the meaning of Art. 22 of the GDPR.
12. Collection of personal data pursuant to Art. 12 and 13 of the EU General Data Protection Regulation (GDPR) in connection with conducting (and participating in) video conferences
12.1. Description of Processing Activity
Data protection notices in connection with conducting (and participating in) videoconferences
12.2. Data Controller
Bundesverband der Deutschen Süßwarenindustrie e.V.
Data controller’s contact details:
Schumannstraße 4–6, 53113 Bonn
Vereinsregister des Amtsgerichts Bonn 20 VR 2744
Elektronische Kontaktadresse des Verantwortlichen:
bdsi@bdsi.de
12.3. Contact Details of the Data Protection Officer
Contact details of the data protection officer:
Data protection c/o
Bundesverband der Deutschen Süßwarenindustrie e.V.
Schumannstr. 4-6, 53113 Bonn
Electronic contact address of the data protection officer:
datenschutz@bdsi.de
12.4. Purpose and Legal Basis for Data Processing
Conducting video conferences, telephone conferences, and online meetings via Cisco Webex. Conducting video conferences is required for the purpose of performing contracts and for the purpose of exercising our association’s legitimate interests. The legal basis for data processing is Art. 6 (1) GDPR.
12.5. Data Recipients or Categories of Personal Data Recipient
We do not disclose personal data processed in connection with the participation in videoconferences to third parties unless such data is especially intended for disclosure or unless we are legally obliged to do so. Please note that the content of video conferences, as well as that of face-to-face meetings, is often used to communicate information to clients or third parties and is therefore intended for disclosure.
12.6. Transmission of Personal Data to a Third Country
There are no plans to transmit your personal data to a third country. We have subcontracted a data processing agreement with the provider Cisco Webex. Information on which data is processed by Cisco Webex and for which purposes can be found in Cisco Webex’s privacy policy (https://www.cisco.com/c/de_de/about/legal/privacy-full.html). Your data is stored on servers located within the European Union.
12.7. Duration of Personal Data Storage
After collection, your data will be stored by Cisco Webex for as long as is required under the statutory retention periods to complete the respective task.
12.8. Rights of the Data Subject
You have the following rights under the General Data Protection Regulation:
- If your personal data is processed, you have right of access to your stored personal data (Art. 15 GDPR).
- In the event that the personal data processed is incorrect, you have the right to correction of your personal data (Art. 16 GDPR).
- If the legal requirements are fulfilled, you may request the erasure or restriction of the data processed as well as file an objection to such data processing (Art. 17, 18 and 21 GDPR).
- If you have consented to your data being processed or if a data processing agreement exists and the data is processed using automated procedures, you may have a right to data portability (Art. 20 GDPR).
- If you exercise your above-mentioned rights, the data controller shall check whether the corresponding legal prerequisites have been fulfilled.
- Furthermore, you have the right of appeal which is to be filed with the State Commissioner for Data Protection:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
(State Office for Data Protection and Freedom of Information of North Rhine-Westphalia)
Kavalleriestr. 2–4, 40213 Düsseldorf
Phone: 0211 38424-0, Fax: 0211 38424-10
E-mail: poststelle@ldi.nrw.de
12.9. Obligation to Provide Data
If you do not provide the required data for participation, you will not be able to participate in the video conferences and events, webinars, or desk sharing.
12.10. Right to Revoke Consent
If you have consented to the collection of your data by the data controller via a corresponding declaration, you may revoke your consent at any time with future effect. Such revocation shall not affect the legality of any data processing which occurred on the basis of your consent prior to receipt of your revocation.
Information valid as of: July 2021 –
we shall inform you of any new information regarding relevant changes if and when required