1. Legal basis for the processing of personal data We process your personal data in accordance with applicable data protection laws, including the General Data Protection Regulation (GDPR), if:
you have given your consent (Art. 6(1)(a) GDPR),
it is necessary for the performance of a contract with you or to take steps at your request prior to entering into a contract (Art.6(1)(b) GDPR),
it is necessary for compliance with legal obligations to which we are subject (Art.6(1)(c) GDPR), or
it is necessary for the purposes of our legitimate interests or those of third parties (Art.6(1)(f)GDPR), in particular our legitimate interests to pursue the purposes described in this Privacy Notice.
2. Categories of recipients We may share your personal data with the following categories of recipients if necessary for the purposes described in this Privacy Notice:
other group companies, who need your personal data, for example, to provide centralized services to us,
third-party service providers and business partners, who need your personal data to provide their services to us, including:
administration services (e.g. document service providers),
customer service and support services (e.g. call center, help desk or customer relationship management providers),
finance and accounting services (e.g. accountants, banks, credit check agencies, insurers, payment processors or tax advisors),
IT services (e.g. IT service and telecommunication providers),
legal and compliance services (e.g. auditors, lawyers, or other experts),
marketing and sales services (e.g. marketing and advertising, social media platforms or other media companies),
strategy and business development services (e.g. management consultants, government authorities, who need your personal data to perform their public tasks (e.g.business intelligence providers or other advisors),
government authorities, who need your personal data to perform their public tasks (e.g.courts for litigation, tax authorities for tax administration or law enforcement authorities for investigations), or
other third parties, such as potential buyers of our business (e.g. in case of a sale, merger, or acquisition), counterparties including their service providers (e.g. in litigation), or other recipients at your direction.
3. Third country transfers We usually process your personal data within the EU/EEA. If we transfer your personal data to recipients in countries outside of the EU/EEA ("third countries"), we apply the following safeguards to ensure that the protection of your personal data is not undermined:
For recipients in third countries with an adequate level of protection (you can find the current list of adequate third countries here: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en ), we rely on the EU Commission's adequacy decisions under Art.45 GDPR,
For recipients in third countries without an adequate level of protection, we usually rely on standard contractual clauses (here: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en ) under Art.46 GDPR, and
For recipients in third countries without an adequate level of protection and in the absence of standard contractual clauses, we rely on the following derogations under Art.49 GDPR, for example, if
you have given your explicit consent,
it is necessary for the conclusion or performance of a contract with you or in your interests, or
it is necessary to establish, exercise, or defend legal claims.
For more details about our third country transfers or copies of these safeguards please reach out to us via the contact details stated under "Data subjects rights and questions" section below.
4. Storage periods We store your personal data for no longer than is necessary for the purposes described in this Privacy Notice. To determine our storage periods, we particularly use the following criteria:
if you withdraw your consent or object to the processing of your personal data and we cannot rely on another legal basis, we will usually not store your personal data for any longer,
if we are legally obliged to store your personal data, we will usually retain your personal data for the prescribed retention period (e.g. for six and ten years under Sec. 257 Commercial Code (Handelsgesetzbuch) and Sec. 147 Fiscal Code (Abgabenordnung)),
if we are legally obliged to delete your personal data, we will usually not store your personal data for any longer,
if we need your personal data to establish, exercise, or defend legal claims, we will usually store your personal data for the statutory limitation period (e.g. for three years under Sec.195 Civil Code (Burgerliches Gesetzbuch)),
if we have an existing relationship with you, we will usually store your personal data for the period of our relationship, or
if we likely need to use your personal data in the future, we will usually store your personal data for this anticipated period in the future.
Once our applicable storage periods expire, we will delete or anonymize your personal data. For more details on our storage practices, please reach out to us via the contact details stated under "Data subjects rights and questions" section below.
5. Sources of personal data We usually collect personal data from you directly, in particular:
when you communicate with us,
when you use our services, offerings, or technologies,
when you otherwise interact with us directly.
You can provide your personal data voluntarily to us, unless you are legally or contractually obliged to do so, or it is necessary to enter into a contract. If you do not provide your personal data to us, you will likely not be able to enter into or maintain a contractual relationship with us or you will likely not be able to interact with us. For more details on your obligations and possible consequences, please contact us via the contact details stated in the "Data subjects rights and questions" section below.
We may also collect personal data from other sources than you, in particular from:
other group companies,
third-party service providers and business partners,
government authorities (e.g. law enforcement authorities for investigations),
other third parties, such as providers of publicly accessible sources (e.g. public websites, media, social media profiles, registers, records, or databases), counterparties including their service providers (e.g. in litigation), or other companies or individuals at your direction.
6. Data subject rights and questions You have the following rights under the GDPR:
right to withdraw consent: you can withdraw your consent at any time (Art.7(3) GDPR),
right of access to personal data: you can ask us to provide access to your personal data (Art.15 GDPR),
right to rectification: you can ask us to rectify inaccurate personal data or complete incomplete personal data (Art.16 GDPR),
right to erasure: you can ask us to delete your personal data (Art. 17 GDPR),
right to restriction of processing: you can ask us to restrict the processing of your personal data (Art. 18 GDPR),
right to data portability: you can ask us to transfer your personal data to you or to another recipient at your choice (Art.20 GDPR),
right to object: you can object to the processing of your personal data (Art. 21 GDPR).
If you want to exercise these rights or have questions about this privacy notice, please contact us via [data_privacy@aqrose.com]. Please note that your rights can be restricted in certain situations. In such case, we will inform you of the restriction's reason.
If you have any concerns about how we process your personal data, we encourage you to let us know so we can try to resolve your concerns. Irrespective of this, if you think we have not complied with data protection laws, you have the right to lodge a complaint with the competent supervisory authority under Art.77 GDPR.
7. Existence of automated decision-making As a matter of principle, we do not use automated decision-making and, in this context, no profiling within the meaning of Art.22 GDPR.
