Image

Legal information

Dear Ladies and Gentlemen,

with this data protection information, we would like to inform you about the processing of your personal data by Nordsys GmbH as well as the rights to which you are entitled as a data subject under the new EU General Data Protection Regulation (GDPR) and the new Federal Data Protection Act (BDSG) since May 25, 2018.


Person responsible for the processing of your personal data:

NORDSYS GmbH
Mittelweg 7
38106 Braunschweig, Germany
Fon: 0531 296988-0
Fax: 0531 296988-99
info@nordsys.de


Data Protection Officer

You can reach our data protection officer at:

Tobias Lau
c/o BEL NET GmbH
Christian-Pommer-Straße 23
38112 Braunschweig, Germany
Fon: +49 531 2144-170
datenschutz@belnet.de

Data source

Customers / Suppliers

As a rule, you provide us with your personal data with your order or within the scope of our business relationship. This means that we collect your personal data directly from you.

However, we may also process personal data that was not collected by us. In this case, the source of the data may be public sources. These are:

  • Search engine results
  • Federal Gazette
  • Press

Further, in certain cases, we may receive your personal information from third party, non-public sources. These are:

  • Authorities:

Government agencies occasionally share your personal information with us to enable us to carry out your requests and related service.

  • Our business partners

Companies associated with us in the course of a business relationship occasionally forward your personal data to us in order to enable us to carry out your requests and the associated service.

Applicants

As a rule, you provide us with your personal data with your application. This means that we collect your personal data directly from you.

Further, in certain cases, we may receive your personal information from third party, non-public sources. These are:

  • Personnel service provider:

We occasionally commission personnel service providers to find suitable personnel to fill vacancies. In this process, your application documents are forwarded to us in order to continue the application process.

  • Professional social networks

We use professional social networks, such as XING or LinkedIn, to find suitable personnel to fill vacancies and, if necessary, to contact these persons. Furthermore, our application portal offers the possibility to transfer your resume and other data from a professional social net-work. Accordingly, your personal data is not collected directly from you, but is taken from the professional social network.

Employees

As a rule, we collect your personal data directly from you, via our personnel questionnaire at the time your employment relationship begins.

However, we may also process personal data that was not collected by us. In this case, the source of the data may be public sources. These are:

  • Debtor list
  • Search engine results

Further, in certain cases, we may receive your personal information from third party, non-public sources. These are:

  • Professional social networks

We use professional social networks, such as XING or LinkedIn, to find suitable personnel to fill vacancies and, if necessary, to contact these persons. Furthermore, our application portal offers the possibility to transfer your resume and other data from a professional social network and to identify acquisition potentials. Accordingly, your personal data is not collected directly from you, but comes from the professional social network.


Purposes and legal basis of data processing

We process your personal data exclusively in accordance with the legal requirements of the EU General Data Protection Regulation (GDPR), the new Federal Data Protection Act (BDSG) and any relevant sector-specific laws. Therefore, we process your data if there is a contractual basis for this, to protect our legitimate interest, you have given us your consent to process the data or a law permits the processing of your data or obliges us to do so.

Data processing for the purpose of fulfilling a contract or carrying out pre-contractual measures

Customers / Suppliers

We process your personal data that you have provided to us on the basis of the request, insofar as this is necessary for the implementation of pre-contractual measures, for the conclusion of the contract, the execution of the contract and the termination of the contractual relationship. This includes, in addition to the data of the service or goods ordered by you, your first name, your last name, your customer number and your address.

In order to enable proper contract processing and to be able to contact you as quickly as possible, for example in the event of queries or problems, we also process your telephone or mobile phone number and your e-mail address, insofar as you have provided us with these for this purpose.

The legal basis for data processing for the fulfillment of a contract and the implementation of pre-contractual measures in general is Art. 6 para. 1 lit. b DS-GVO.

Applicants

We process your personal data that you provide to us as part of the application process, insofar as this is necessary for the implementation of the application process. This includes your contact details (surname, first name, postal address, telephone number, e-mail address), your complete application documents (such as photo, CV, certificates, references) and all data that you disclose to us during the application process. The legal basis for data processing for the purpose of the employment relationship is usually Art. 6 (1) lit. b DS-GVO, Art. 88 DS-GVO in conjunction with § 26 BDSG.

Employees

We process your personal data that you have provided to us on the personnel questionnaire. This includes, among other things, personal information (e.g. your first and last name, your address, your phone/cell phone number, your e-mail address, your bank details), employment information (e.g. your job title, your highest school qualification), tax information (e.g. your ID number, your tax class) and social security information (e.g. your health insurance fund) as well as information on your driver's license.

If your employment involves a stay abroad in a non-EU country requiring a visa, your personal data required for this purpose will be forwarded to a visa procurement service provider.

The legal basis for data processing for the purpose of the employment relationship is usually Art. 6 (1) lit. b DS-GVO, Art. 88 DS-GVO in conjunction with § 26 BDSG.

Data processing for the purpose of safeguarding the legitimate interests of the person responsible or a third party

Customers / Suppliers

We also process your data insofar as this is necessary to protect our legitimate interests or the legitimate interests of a third party. The processing carried out by us on the basis of a legitimate in-terest regularly includes direct advertising for our own products, the compilation of internal statistics, the investigation of criminal offences, measures to ensure the proper operation of our IT infrastructure, as well as the transmission of your personal data to credit agencies to check your creditworthiness.

On our website, you also have the option of sending us a contact or support request via our contact form. In order to be able to contact you as quickly as possible as part of our response, we process your e-mail address and the data from your message.

Employees

We also process your data if this is necessary to protect our legitimate interests or the legitimate interests of a third party. The processing carried out by us on the basis of a legitimate interest regularly includes the preparation of internal statistics, the investigation of criminal offences, measures to ensure the proper operation of our IT infrastructure.

The legal basis for data processing to protect the legitimate interests of the controller or a third par-ty is Art. 6 (1) lit. f DS-GVO.

Data processing for the fulfillment of a legal obligation

We also process your data if this is necessary to fulfill a legal obligation to which we are subject. The obligations to be fulfilled by us include in particular the retention obligations under tax law and commercial law.

The legal basis for processing for the fulfillment of a legal obligation is Art. 6 (1) lit. c DS-GVO in conjunction with the relevant legal standard.

Data processing based on consent and for other purposes

Customers / Suppliers

We may also process your personal data if you have given your express consent to do so (see Art. 6 (1) a DS-GVO). The processing carried out by us on the basis of consent regularly includes the creation of a photograph of the employees, as well as the collection of emergency contacts of the employees.

If you send us your contact or support request via a contact form, you can also enter your first and last name, which we process exclusively with your express consent.

Employees

We may also process your personal data if you have given your express consent to do so (see Art. 6 (1) a DS-GVO). The processing carried out by us on the basis of consent regularly includes the creation of a photograph of the employee, as well as the collection of emergency contacts of employees.

In these cases, we will provide you with additional data protection information separately as part of the consent process. You can revoke your consent at any time using the contact details above.

If we process your personal data in the future for other purposes not listed in this data protection notice, we will inform you of this separately in accordance with the legal requirements.


Categories of recipients of the personal data

External service providers and affiliated companies

Our external service providers as well as our affiliated companies, which carry out data processing on our behalf, are contractually obligated, if required by law in the sense of Art. 28 DS-GVO, to handle the personal data in accordance with the applicable regulations. Insofar as these companies come into contact with your personal data, we have ensured through legal, technical and organizational measures as well as regular checks that they comply with the provisions of the data protec-tion laws. We currently use the following types of service providers when processing your data: property protection, document destruction service provider, visa procurement service provider.

Third parties

If necessary, we will make your personal data available to the authorities if this is required within the scope of our statutory notification obligations. In addition, in the case of an employment relationship, your personal data will be transferred to our tax advisor, to the insurance office responsible for the pension scheme and to the company doctor, if this is necessary for their activities.

Data transfer to a third country

In principle, we do not transfer your personal data to a third country or to an international organization outside the European Economic Area (EEA). If, in individual cases, we do transfer your personal data, we will only do so to third countries for which we have received an adequacy decision from the European Commission or for which the appropriate level of data protection has been ensured by suitable or adequate safeguards (e.g. Binding Corporate Rules or EU standard contractual clauses).


Duration of data storage

Customers / Suppliers / Employees

We store your personal data only for the period of time for which they are required in the context of the above-mentioned purposes and for the period of time in which we potentially have to expect the assertion of legal claims against us. The statutory limitation period for such claims can be between three and thirty years in individual cases.

In addition, we store your personal data insofar as we are obligated to do so within the scope of the statutory obligations to provide proof and to retain data (e.g. in accordance with the German Commercial Code, the German Fiscal Code or the German Money Laundering Act). The statutory retention periods can be up to ten years. Furthermore, in exceptional cases, special obligations to provide evidence may exist that make it necessary to retain your personal data for a longer period.

Applicants

We store your personal data only for the duration of the application process, as well as for the period in which we must potentially expect the assertion of legal claims against us. The statutory limitation period for such claims in the context of the application process is 6 months after the end of the application process.

If you have given us consent to process your data, your data will be processed until you revoke your consent.

Should an employment relationship result from your application, the retention periods for employee data apply accordingly.


Rights of the data subjects

As a data subject, you have the following rights pursuant to Art. 15 et seq. DS-GVO you have the following rights towards us. For this purpose, please contact us by e-mail at datenschutz@nordsys.de. Alternatively, please inform us of your request by mail to the above address.

Right to information

You have the right to request information from us as to whether we are processing personal data relating to you. If this is the case, you have the right to request information from us about this personal data.

Right to correction

You have the right to request that we correct any inaccurate personal data relating to you.

Right to deletion

In certain cases, you have the right to demand that we delete personal data relating to you without delay.

Right to restriction of processing

In certain cases, you have the right to demand that we restrict processing.

Right to data portability

You have the right to receive from us the personal data concerning you that you have provided to us in a structured, common and machine-readable format.

Right to object to processing

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Art. 6(1)(e) or (f) DS-GVO. Insofar as we use your data for direct marketing, you may object to this at any time.

Right of revocation

If you have given us permission to use personal data, you can revoke this permission at any time.

Data protection supervisory authority

In addition, you have the possibility to complain to the data protection supervisory authority about our data processing of personal data.The competent data protection supervisory authority is:

Die Landesbeauftragte für den Datenschutz Niedersachsen
Prinzenstraße 5
30159 Hannover, Germany

If you have any further questions or comments, please feel free to contact us or our data protection officer at any time.

Date: 20.08.2020