Privacy Notice pursuant to Articles 13 and 14 GDPR

1. Contact details of the Controller

BWI GmbH, Auf dem Steinbüchel 22, 53340 Meckenheim, Phone: +49 2225 988-22054, Email: info@bwi.de.

Where these Privacy Notices refer to “we” or “us”, this refers to the above-mentioned company.

2. Contact details of the Data Protection Officer

BWI GmbH, Auf dem Steinbüchel 22, 53340 Meckenheim, Email: datenschutzbeauftragter@bwi.de.

3. Your Rights as a Data Subject

If personal data relating to you is processed, you are a data subject within the meaning of the GDPR. Provided the legal requirements are met, you have the following rights against the controller:

Right of access: Pursuant to Article 15 GDPR, you have the right to request information about the personal data we process concerning you.
Right to rectification: Pursuant to Article 16 GDPR, you have the right to request the immediate rectification of inaccurate personal data or the completion of incomplete personal data stored by us.
Right to erasure: Pursuant to Article 17 GDPR, you have the right to request the erasure of personal data stored by us, unless the processing is necessary to fulfil a legal obligation or to establish, exercise or defend legal claims.
Right to restriction of processing: Pursuant to Article 18 GDPR, you have the right to request the restriction of processing of your personal data where you contest the accuracy of the data, the processing is unlawful, or we no longer need the data.
Right to data portability: Pursuant to Article 20 GDPR, you have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format, or to request its transfer to another controller.
Right to object: Pursuant to Art. 21 GDPR, you have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you which is based on Article 6(1)(e) or (f) GDPR; this also applies to profiling based on those provisions. Where personal data is processed for direct marketing purposes, you also have the right to object at any time to the processing of personal data concerning you for such marketing purposes, including profiling to the extent that it is related to such direct marketing.
Right of withdrawal: Pursuant to Article 7(3) GDPR, you have the right to withdraw any consent you have given at any time. This means that we may no longer continue the data processing based on that consent going forward.
Right to lodge a complaint with a supervisory authority: Pursuant to Article 77 GDPR, you also have the right to lodge a complaint with a supervisory authority. To exercise these rights, you may contact us at any time using one of the contact details provided at the beginning of these Privacy Notices. If you have questions about the processing of your data, you may also contact our Data Protection Governor. If you believe that the processing of your data violates data protection law or that your data protection rights have otherwise been infringed, you may also contact the Federal Commissioner for Data Protection and Freedom of Information (BfDI).

4. Description of Processing Activities

4.1 Provision of our Website

4.1.1 Purposes

This processing serves the public communication of our company.

4.1.2 Categories of Data

We process connection data (access data and device data) as categories of data relating to you.

4.1.3 Legal Basis

The legal basis is the performance of pre-contractual measures and fulfilment of contracts pursuant to Art. 6(1)(1)(b) GDPR.

4.1.4 Necessity

The processing of the above-mentioned data relating to you is necessary for your use of our website. If you do not provide us with the above-mentioned data, we cannot display our website to you.

4.1.5 Retention Period

The retention period is for the duration of the browser session.

4.1.6 Recipients

The recipient of the above-mentioned data relating to you is Zentrum für Digitale Souveränität der Öffentlichen Verwaltung GmbH (ZenDiS), Suttner-Nobel-Allee 4, 44803 Bochum, Germany, as our processor for website hosting.

4.1.7 Storage of Information on the Terminal Device

Each time the website is accessed, data that is strictly necessary for us to provide the service you have expressly requested is stored on your terminal device. The legal basis for this storage is Section 25(2) No. 2 TDDDG (German Telecommunications Digital Services Data Protection Act).

4.2 Website Security

4.2.1 Purposes

This processing serves to ensure the security of the processing of data relating to you.

4.2.2 Categories of Data

We process connection data (access data and device data) and your system information as categories of data relating to you.

4.2.3 Legal Basis

The legal basis is our statutory obligation to ensure the secure processing of personal data pursuant to Art. 6(1)(1)(c) GDPR in conjunction with Art. 24 and 32 GDPR.

4.2.4 Necessity

The processing of the above-mentioned data relating to you is necessary for the fulfilment of our statutory obligations.

4.2.5 Retention Period

The retention period is 90 days.

4.2.6 Recipients

4.3 Consent Management

4.3.1 Purposes

This processing serves the management and documentation of your consent.

4.3.2 Categories of Data

We process consent data as data relating to you.

4.3.3 Legal Basis

The legal basis for processing the above-mentioned data relating to you is our obligation to demonstrate compliance pursuant to Art. 6(1)(1)(c) GDPR in conjunction with Art. 5(2) and Art. 7(1) GDPR.

The storage of a technically necessary cookie on your terminal device for the management and documentation of your consent is necessary for us as the provider to make available our website as the digital service expressly requested by you as a user, pursuant to Art. 5(2) GDPR in conjunction with Art. 6(1)(1)(c) GDPR in conjunction with Section 25(2) No. 2 TDDDG.

4.3.4 Necessity

The processing of the above-mentioned data relating to you is necessary for the fulfilment of our statutory obligations.

4.3.5 Retention Period

The retention period for this processing of the above-mentioned data relating to you is until the withdrawal of your consent. We retain a deletion log for three years to meet our obligation to demonstrate compliance.

4.3.6 Recipients

4.4 Contact via Form and Email

4.4.1 Purposes

The processing of email correspondence serves to respond to enquiries.

4.4.2 Categories of Data

We process your contact details and the content of your enquiry as categories of data relating to you.

4.4.3 Legal Basis

Our legal basis for processing the above-mentioned data relating to you is our legitimate interest pursuant to Art. 6(1)(f) GDPR.

If your contact relates to the exercise of your rights as a data subject within the meaning of Art. 4(1) GDPR, our legal basis for processing the above-mentioned data relating to you is the fulfilment of our legal obligations as controller within the meaning of Art. 4(7) GDPR.

If your contact aims at the conclusion of a contract, our legal basis for processing the above-mentioned data relating to you is the performance of pre-contractual measures and fulfilment of contracts pursuant to Art. 6(1)(1)(b) GDPR.

4.4.4 Necessity

The processing of the above-mentioned data relating to you is necessary for handling your enquiry. If you do not provide us with the above-mentioned data, we cannot process your enquiry.

4.4.5 Retention Period

Your data will be deleted once your enquiry has been fully answered and no statutory retention obligations prevent deletion, such as in the case of any subsequent contract processing.

4.4.6 Recipients

If you use our contact form, the data you submit via the form is also processed by our processor Reinhard Söllradl, Brandstatt 9, 4070 Eferding, Austria, who provides us with the Form.taxi software as a sole proprietor.

4.5 Website Analytics

4.5.1 Purposes

This processing serves the analysis of the use and reach of our website.

4.5.2 Categories of Data

We process connection data (access and device data) and your usage data as categories of data relating to you.

4.5.3 Legal Basis

The legal basis is our legitimate interest in analysing the use and reach of our website pursuant to Art. 6(1)(1)(f) GDPR.

4.5.4 Retention Period

The above-mentioned data relating to you is anonymised prior to web analysis.

4.5.5 Recipients

The above-mentioned data relating to you is also transferred to PostHog, Inc., 2261 Market Street #4008, San Francisco, CA 94114, United States of America. The United States of America is a third country with an adequacy decision pursuant to Art. 45 GDPR. PostHog, Inc. is certified under the Data Privacy Framework.

4.5.6 Right to Object

You may direct your objection to this processing at any time to our contact details provided above. You can withdraw your consent to website analytics here.