Privacy E-Mails
1. Name and contact information of the controller responsible for the processing sovanta AG (hereinafter referred to as: “we”)
X-House
Mittermaierstraße 31
69115 Heidelberg
info@sovanta.com
Phone: +49 (0)6221 18733-0
Fax: +49 (0)6221 18733-44
You can reach our Data Protection Officer as follows:
sovanta AG
Data Protection Officer
X-House
Mittermaierstr. 31
69115 Heidelberg
datenschutz@sovanta.com
2. The processing of your personal data; type(s) of data; purpose of processing; legal basis for the processing
If you enter into a contract with us, or if you act on behalf of a company or other organization that enters into a contract with us, or if we are in contact with you because we are interested in your or your company’s services, or you are interested in our services, or if we are in contact with you in any other way for business reasons, we collect the following personal and company-related data as necessary:
- Form of address, first name, last name;
- Email address;
- Company name;
- Company address;
- Phone number (landline and/or mobile/cell);
- Where applicable, position at the company/ in the organization, signatory authority, power of attorney;
- Value added tax (VAT) identification number of the company;
- Information necessary to process the purchase (such as credit card number, order number, etc.)
- Where applicable, other information necessary to fulfill the contract.
The collection and processing of this data is performed:
- to be able to identify you as our contractual partner or as a natural person acting on behalf of or as our designated contact(s) at our contractual partner;
- for the purpose of correspondence with our contractual partner or with you;
- for invoicing purposes;
- for the settlement of any existing liability claims and the assertion of any claims against you;
- for marketing purposes.
The processing of the aforementioned data is performed on the basis of various legal grounds. The processing of all data that we need to fulfill a contract which the data subject is a party to or to carry out pre-contractual measures that take place at the request of the data subject is done in accordance with Art. 6 Para. 1 S. 1 b) of the GDPR. The provision of contact information and payment data or other financial information such as tax numbers and their processing by us is necessary for the mutual fulfillment of obligations under a contract. If you are the designated contact of our contractual partner, the processing of your contact data for the same purposes takes place on the basis of Art. 6 Para. 1 S. 1 f) of the GDPR, because we have a legitimate interest in a specific contact at our contractual partner.
On the basis of Art. 6 Para. 1 S. 1 f) of the GDPR and thereby on the basis of our legitimate interests, the processing of information takes place for the settlement of any existing liability claims as well as for the pursuit of any claims against our contractual partner (such as delinquency in payment). Furthermore, we have a legitimate interest in processing your data for direct marketing purposes. For marketing purposes, we use the postal address and the email addresses of our contractual partners or of the designated contacts at their companies. However, we only use your email address if we have received the email address from you in connection with the sale of goods or services and only for direct marketing of our own similar goods or services. In general, you have the right to object to the processing of your data for direct marketing purposes without incurring any costs other than the basic communication costs. If you wish to do this, please contact us using the contact information provided in Section 1. The additional legal basis for this is Section 7 Para. 3 of the German Act against Unfair Competition (UWG).
The personal data we collect will be stored for as long as we need it for the purposes for which it was collected, unless you have given your consent for its continued storage or we are obligated to store it for a longer period of time in accordance with Article 6 Para. 1 S. 1 c) of the GDPR, for example, to comply with tax and commercial law retention and documentation obligations (such as those under the German Commercial Code (HGB), the German Criminal Code (StGB), or the German Fiscal Code (AO)).
If we process your data based on your consent, we will inform you in advance about the scope and extent of this consent. You have the right to withdraw such consent at any time with effect for the future, whereby the withdrawal of consent does not affect the lawfulness of the processing carried out on the basis of the consent up to the time of withdrawal.
3. Recipients of data; transfer of data to a third country
We commission IT service providers and infrastructure and platform service providers to process your data. Our legitimate interest is to ensure the reliable and secure processing of data in the performance of our activities and administrative management of our company with the support of professional service providers.
This data processing may also take place in a third country, meaning a country outside the European Union (EU) or the European Economic Area (EEA), as a result of the location of our service providers and/or their servers. Such data transfers take place, provided that there are no other guarantees for compliance with an adequate level of data protection (such as an adequacy decision issued by the EU Commission), on the basis of Art. 49 Para. 1 S. 1 b) and e) of the GDPR.
However, insofar as these service providers and vicarious agents act on our behalf, they only do so in accordance with instructions and are contractually obligated by us accordingly. This also applies to service providers located in a third country.
Specifically, we use the CRM platform “Hubspot” of Hubspot Inc., 25 First St., 2nd floor, Cambridge, Massachusetts 02141, USA to manage contact data. Here, the categories of data mentioned in section 2 may be collected and stored for the purposes listed in that same section. For more information about how Hubspot works, please see the privacy policy of Hubspot Inc. available at: https://legal.hubspot.com/privacy-policy.
To ensure and verify the accuracy of email addresses received, we selectively use the Kickbox service, an offering from Kickbox, Inc. 2556 Elm Street Dallas, TX 75214, US. Kickbox checks whether the e-mail address entered actually exists. In the process, your data may be transferred to Kickbox’s servers in the USA. We have concluded a data processing contract with Kickbox, which contains standard contractual clauses. For more information on the purpose and scope of data processing by Kickbox, please visit https://docs.kickbox.com/v2.0/docs/privacy-policy.
4. Your rights
Under Art. 15 of the GDPR, you have the right to request information free of charge about the personal data that has been stored about you (right of access). Under Art. 16, 17 and 18 of the GDPR, you have the right to correct inaccurate data (right of rectification), and to restrict (right to restriction of processing) and delete (right to erasure) your personal data. Furthermore, under the conditions set out in Art. 20 of the GDPR, you are also entitled to receive the stored personal data relating to you in a structured, commonly used and machine-readable format and to transfer this data to another controller without any hindrance from us (right to data portability).
In addition, under Art. 21 Para. 1 of the GDPR, you have the right to object to the processing of personal data relating to you based on Art. 6 Para. 1 S. 1 e) or f) of the GDPR, including profiling, on grounds relating to your particular situation (right to object).
If your personal data is processed for direct marketing purposes, under Art. 21 Para. 2 of the GDPR you have the right to object at any time to the processing of your data for such marketing, including profiling, insofar as it is related to such direct marketing.
We will comply with your aforementioned rights insofar as the legal requirements for the assertion of the rights are met.
Any requests regarding your personal data and your rights should be sent to the contact information provided at the beginning of this data protection and privacy declaration, or directly to our Data Protection Officer.
Every data subject also has the right to lodge a complaint with a data protection supervisory authority about our processing of data.