With the following information, we would like to give you an overview of the processing of your personal data by us and your rights under data protection law. Personal data are all data that can be related to you personally, e.g., name, address, email addresses.
I. Data Processor
1. Name and contact details of the controller
Bayerische Milchindustrie eG
E.ON-Allee 1
84036 Landshut
Represented by the Executive Board Mr. Dr. Thomas Obersojer and Mr. Winfried Meier
Phone: +49 871 685112
Email: bmi@bmi-eg.com
2. Contact details of the Data Protection Officer
You can reach our Data Protection Officer Alexander Bugl at:
Bugl & Kollegen GmbH
Sedanstraße 7
93055 Regensburg
Email: kontakt@buglundkollegen.de
II. Processing Framework
1. Storage Duration
We process and store your personal data for as long as this is necessary to fulfill our contractual and legal obligations. Even without a specific request from our customers, we naturally comply with our obligations to delete personal data. Such obligations arise, for example, from Art. 17 GDPR. Deletion is then necessary, among other things, if the personal data are no longer required for the purposes for which they were collected or otherwise processed.
However, there is personal data that is exempt from this deletion obligation and for which we are even obliged by other laws to continue storing it. For example, there are retention obligations under § 257 of the German Commercial Code (HGB) and § 147 of the German Tax Code (AO). We only store this data to fulfill legal retention obligations. Upon expiry of the retention periods, we will delete this data immediately without you having to request us to do so.
2. Processing Purposes and Legal Basis
The processing of your data by us takes place for the fulfillment and performance of our contractual obligations, in accordance with Art. 6 para. 1 sentence 1 b) GDPR. In some cases, we also use other business partner companies if this is necessary for the fulfillment of the contract. These can be, for example: logistics or shipping companies. In this context, necessary personal information such as name, address, invoices, and other invoicing and financial data such as tax number, commercial register number, etc., are forwarded.
Should it be necessary, we process your data beyond the actual fulfillment of the contract to protect legitimate interests of ours or third parties, in accordance with Art. 6 para. 1 sentence 1 f) GDPR. This is necessary, for example, for asserting legal claims and defending against legal disputes, for preventing or investigating criminal offenses, for consultation and data exchange with credit agencies, or for measures for business management and the further development of services and products.
If you have given us consent to process personal data for specific purposes, the lawfulness of this – purpose-bound – processing is given on the basis of your consent in accordance with Art. 6 para. 1 sentence 1 a) GDPR. Consent given can be withdrawn at any time. The withdrawal of consent only takes effect for the future and does not affect the lawfulness of the data processed until the withdrawal.
Under certain circumstances, the provision of personal data is legally or contractually required. Processing is then necessary in accordance with Art. 6 para. 1 sentence 1 c) GDPR for the fulfillment of a legal obligation to which we are subject.
3. Obligation to Provide and Possible Consequences of Non-Provision
Within the scope of our business relationships, you are obliged to provide those personal data that are necessary for the establishment, execution, and termination of a business relationship and for the fulfillment of the associated contractual obligations or that we are legally obliged to collect. Without this data, we are generally unable to conclude a contract with you, execute it, or terminate it.
4. Existence of Automated Decision-Making
The processing of data related to you by us is not associated with automated decision-making or profiling.
III. Disclosure and International Data Transfer
1. Recipients / Categories of Recipients
To execute the contract concluded with you, your data has been or will be – if necessary – transmitted to the following categories of recipients:
Internal persons, meaning employees of Bayerische Milchindustrie eG who urgently need the data for further processing. Processors, with whom appropriate contractual agreements have been concluded beforehand and, where necessary, also external third parties. These can be, for example, as already mentioned above, logistics or shipping companies, authorities or offices.
2. Intention of Transfer to Third Countries
Transfers by us to recipients in so-called third countries, i.e., in states outside the European Union (EU), or to international organizations are generally not carried out by us. The following exceptions apply:
An adequate level of data protection exists in the third country according to Art. 45 GDPR.
https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en
Standard data protection clauses are concluded according to Art. 46 GDPR, provided that data processing is not permissible according to Art. 45 GDPR.
IV. Data Subject Rights
You have the following rights vis-à-vis us regarding your personal data:
1. Right of Access according to Art. 15 GDPR
The data subject can request confirmation from the controller as to whether personal data concerning them are being processed. If this is the case, the data subject has the right to information about certain data concerning these personal data.
2. Right to Rectification according to Art. 16 GDPR
The data subject has the right to demand from the controller without undue delay the rectification of inaccurate personal data concerning them. Taking into account the purposes of the processing, the data subject has the right to have incomplete personal data completed.
3. Right to Erasure according to Art. 17 GDPR
The data subject has the right to demand from the controller that personal data concerning them be erased without undue delay, and the controller is generally obliged to erase personal data without undue delay. However, there is personal data that is exempt from this deletion obligation and for which we are even obliged by other laws to continue storing it.
4. Right to Restriction of Processing according to Art. 18 GDPR
The data subject has the right to demand from the controller the restriction of processing, provided certain conditions are met.
5. Right to Object according to Art. 21 GDPR
The data subject has the right to object, on grounds relating to their particular situation, at any time to processing of personal data concerning them which is based on Article 6 paragraph 1 point (e) GDPR (processing in the public interest) and Article 6 paragraph 1 point (f) GDPR (processing based on a balancing of interests), including profiling based on those provisions within the meaning of Article 4 No. 4 GDPR.
If they object, we will no longer process their personal data, unless we can demonstrate compelling legitimate grounds for the processing which override their interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims.
6. Right to Withdraw Consent according to Art. 7 para. 3 GDPR
The data subject has the right to withdraw their consent at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
7. Right to Lodge a Complaint with the Supervisory Authority
Should you be of the opinion that the processing of your personal data by us is unlawful or that we may be violating data protection law for other reasons, you can lodge a complaint with the supervisory authority responsible for us:
Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18
91522 Ansbach
https://www.bfdi.bund.de/EN/Service/Anschriften/Laender/Laender-node.html
