Data privacy statement

The data controllers mentioned above are responsible for processing personal data at our group, in accordance with “Joint Controllership” as specified in Art. 26 GDPR. K industries GmbH is subject to the GDPR obligations and has been identified as the first contact point for the rights of data subjects (rights in accordance with Art. 26 (3) remain unaffected). If you are employed by a different data controller, the local Personnel department shall in some cases fulfil the obligations to provide information to the affected employees.

We process personal data which we receive from our customers or other involved parties in the context of our business relationship. Moreover, we process personal data — when required for the fulfilment of our service — which we obtain in a permissible manner from publicly accessible sources (e.g. lists of debtors, land registers, registers of business and associations, the press, Internet) or which are transferred to us legitimately from other companies of the group or from other third parties (e.g. a credit agency).

Relevant personal data are personal details (name, address and other contact data such as citizenship).

Beyond this, such data can also include order data (e.g. development order), data from the fulfilment of our contractual obligations, information about the financial situation of our customers (e.g. creditworthiness data, scoring or rating data, source of financial assets), advertising and marketing data (incl. advertising scores), documentation data as well as other data from categories comparable to those named.

As a matter of principle, we do not process any special categories of personal data except if attention is drawn to this in a special statement.

We process personal data in compliance with the provisions of the EU General Data Protection Regulation (GDPR) in addition to the Austrian Data Protection Act and the German Federal Data Protection Act (BDSG):

a. For the fulfilment of contractual obligations (Art. 6(1) point (b) GDPR):

Data processing is carried out to enable the manufacture of our products and the fulfilment of our services in mechanical engineering in the context of executing our contracts with our customers or for carrying out contractual measures which are performed upon request. The purposes of data processing are determined primarily by the specific product concerned and, in addition to the contract-related written, telephone and email communication with you, can include needs assessments, consultancy, project management, design engineering and construction, among others.

Further details on the purposes for data processing can be found in the relevant contract documents and terms and conditions of business as well as a specific data privacy statement for these services, as the case may be.

b. In the context of legitimate interests (Art. 6(1) point (f) GDPR):

To the extent necessary, we process your data beyond the actual fulfilment of the contract in order to safeguard our legitimate interests or those of third parties.

Examples:

• Consultation of and data exchange with credit bureaus (e.g. SCHUFA) for the determination of credit risks,
• Analysis and optimization of procedures for needs assessment for the purpose of direct customer contact, advertising or market and opinion research provided you have not objected to the use of your data,
• The exercise of legal rights and defence in the event of legal disputes,
• Safeguarding of information security and the company’s operations,
• The prevention and investigation of criminal acts,
• Video surveillance for the safeguarding of premises access rights, for the collection of evidence in the event of industrial espionage, assaults, robbery and fraudulent activities,
• Building and plant security measures (e.g. physical access control),
• Measures for the safeguarding of the right to ban individuals from the premises,
• Measures for business management and ongoing development of services and products,
• Risk control in the group.

c. Based on your consent (Art. 6(1) point (a) GDPR):

Consent that has been granted can be withdrawn at any time.This also applies for the withdrawal of declarations of consent which were granted to us before the GDPR went into effect, meaning before 25 May 2018. The withdrawal of consent has an effect for the future only and does not affect the legality of the data processing which took place up to the time of the withdrawal.

d. Based on legal obligations (Art. 6(1) point (c) GDPR) or in the public interest (Art. 6(1) point (e) GDPR):

As a group of companies, we are subject to various legal obligations, or statutory requirements (e.g. tax laws, IT security laws, German Telemedia Act (TMG), etc.).

The purposes for processing include matters such as the fulfilment of tax-law storage and reporting obligations.