Privacy policy

A) GDPR - General

(1) Definitions

• "Personal data" (Art. 4 No. 1 GDPR) is information relating to an identified or identifiable natural person (hereinafter "data subject"). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. The identifiability can also be given by means of a combination of such information or other additional knowledge. The origin, form or embodiment of the information is irrelevant (photos, video or audio recordings can also contain personal data).
• The "Processing" (Art. 4 No. 2 GDPR) means any operation which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
• "Person responsible" (Art. 4 No. 7 GDPR) is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. Where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.
• "Third" (Art. 4 No. 10 GDPR) means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data, including other legal entities in the group.
• "Processor" (Art. 4 No. 8 GDPR) is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
• The "ConsentConsent" (Art. 4 No. 11 GDPR) of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

(2) Name and address of the controller

We are the controller responsible for the processing of your personal data within the meaning of Art. 4 No. 7 GDPR:

digit xperts GmbH
A-30 Centre
Ringstrasse 36
32587 Löhne

represented by the managing director:

Dickson Usuwa
Phone: +49 5731 4987-0
E-Mail: info@digit-xperts.com

for the following website: digit-xperts.com

(3) Contact details of the data protection officer

Our company data protection officer is always available to answer any questions you may have and to act as your point of contact for data protection issues - her contact details are

Ana Kraljevic
Phone: +49 5731 4987-303
E-Mail: datenschutz@digit-xperts.com

(4) Legal basis for data processing

In principle, any processing of personal data is prohibited by law and is only permitted if the data processing falls under one of the following justifications:

• Art.6 para.1 S.1 lit. a GDPR ("consent"): If the data subject has voluntarily, in an informed and unambiguous manner, by means of a statement or other unambiguous confirmatory act, indicated that they consent to the processing of their personal data for one or more specific purposes;
• Art.6 para.1 S.1 lit. b GDPR: If the processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
• Art.6 para.1 S.1 lit. c GDPR: If the processing is necessary to fulfil a legal obligation to which the controller is subject (e.g. a legal obligation to retain data);
• Art.6 para.1 S.1 lit. d GDPR: If the processing is necessary to protect the vital interests of the data subject or another natural person;
• Art.6 para.1 S.1 lit. e GDPR: If the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, or
• Art.6 para.1 S.1 lit. f GDPR ("Legitimate interests"): If the processing is necessary for the purposes of the legitimate interests (in particular legal or economic interests) pursued by the controller or by a third party, except where such interests are overridden by the interests or rights of the data subject (in particular where the data subject is a minor).

For the processing operations we carry out, we indicate the applicable legal basis in each case below. Processing can also be based on several legal bases.

(5) Data erasure and storage duration

For the processing operations carried out by us, we indicate below how long the data is stored by us and when it is deleted or blocked. Unless an explicit storage period is specified below, your personal data will be deleted or blocked as soon as the purpose or legal basis for storage no longer applies. Your data will only be stored on our servers in Germany, subject to any disclosure in accordance with the provisions in A (7) and A (8).

However, data may be stored beyond the specified period in the event of an (impending) legal dispute with you or other legal proceedings or if storage is provided for by statutory provisions to which we are subject as the controller (e.g. Section 257 HGB, Section 147 AO). If the storage period prescribed by the statutory provisions expires, the personal data will be blocked or deleted unless further storage by us is necessary and there is a legal basis for this.

(6) Data security

We use suitable technical and organisational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction or against unauthorised access by third parties (e.g. SSL encryption for our website), taking into account the state of the art, the implementation costs and the nature, scope, context and purpose of the processing as well as the existing risks of a data breach (including its probability and effects) for the data subject. Our security measures are continuously improved in line with technological developments.

We will be happy to provide you with more detailed information on request. Please contact our data protection officer (see under A (3)).

(7) Cooperation with processors

As with any large company, we also use external domestic and foreign service providers to process our business transactions (e.g. for IT, logistics, telecommunications, sales and marketing). These service providers only act on our instructions and are contractually obliged to comply with data protection regulations in accordance with Art. 28 GDPR.

(8) Requirements for the transfer of personal data to third countries

As part of our business relationships, your personal data may be passed on or disclosed to third-party companies. These may also be located outside the European Economic Area (EEA), i.e. in third countries. Such processing takes place exclusively for the fulfilment of contractual and business obligations and to maintain your business relationship with us. We will inform you about the respective details of the transfer at the relevant points below.

The European Commission certifies that some third countries have a level of data protection comparable to the EEA standard through so-called adequacy decisions. However, in other third countries to which personal data may be transferred, there may not be a consistently high level of data protection due to a lack of legal provisions. If this is the case, we ensure that data protection is adequately guaranteed. This is possible via binding company regulations, standard contractual clauses of the European Commission for the protection of personal data, certificates or recognised codes of conduct. Please contact our data protection officer (see A.(3)) if you would like more information on this.

(9) Obligation to provide the data

As part of our business relationship, you must provide the personal data that is necessary for the establishment, implementation and termination of a business relationship and for the fulfilment of the associated obligations, which we are legally obliged to collect or which we are entitled to collect on the basis of legitimate interests. Without this data, we will generally not be able to enter into a business relationship with you.

(10) Legal obligation to ÜTransmission of certain data

We may be subject to a special legal or statutory obligation to provide the lawfully processed personal data to third parties, in particular public authorities (Art. 6 para. 1 sentence 1 lit. c GDPR).

(11) Your rights

You can assert your rights as a data subject with regard to your processed personal data at any time using the contact details provided at the beginning under A (2). As the data subject, you have the right to

• according to Art.15 GDPR to request information about your data processed by us. In particular, you can request information about the processing purposes, the category of data, the categories of recipients to whom your data has been or will be disclosed, the planned storage period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, the origin of your data if it was not collected by us, as well as the existence of automated decision-making including profiling and, if applicable, meaningful information about its details;
• according to Art.16 GDPR to demand the immediate correction of incorrect data or the completion of your data stored by us;
• according to Art.17 GDPR to demand the erasure of your data stored by us, unless the processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defence of legal claims;
• according to Art.18 GDPR to demand the restriction of the processing of your data if the accuracy of the data is contested by you or the processing is unlawful, but you oppose the erasure of the data, the controller no longer needs the data, but you require it for the establishment, exercise or defence of legal claims or you have objected to processing pursuant to Art. 21 GDPR
• according to Art.20 GDPR to receive your data that you have provided to us in a structured, commonly used and machine-readable format or to request that it be transmitted to another controller ("data portability");
• according to Art.21 GDPR to object to the processing if the processing is carried out on the basis of Art. 6 para. 1 sentence 1 lit. e or lit. f GDPR. This is particularly the case if the processing is not necessary for the fulfilment of a contract with you. If it is not an objection to direct advertising, we ask you to explain the reasons why we should not process your data as we have done when exercising such an objection. In the event of your justified objection, we will examine the situation and either discontinue or adapt the data processing or point out to you our compelling reasons worthy of protection on the basis of which we will continue the processing;
• according to Art.7 para.3 GDPR to withdraw your consent once given to us at any time (including before the GDPR came into force, i.e. before 25 May 2018) - i.e. your voluntary, informed and unequivocal expression of your consent to the processing of the personal data concerned for one or more specific purposes by means of a declaration or other unambiguous confirmatory act - if you have given such consent. As a result, we may no longer continue the data processing that was based on this consent in the future, and
• according to Art.77 GDPR to complain to a data protection supervisory authority about the processing of your personal data in our company, for example to the data protection supervisory authority responsible for us:

State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia
Kavalleriestr. 2-4
40213 Düsseldorf
Tel: 0211/38424-0
E-Mail: poststelle@ldi.nrw.de

(12) ÄChanges to the data protection information

As part of the ongoing development of data protection law and technological or organisational changes, our data protection information is regularly reviewed to determine whether it needs to be amended or supplemented. You will be informed of any changes here in particular.