Data protection declaration

Information for business partners (and interested parties) according to Section 13 GDPR

We are a GMH Gruppe company with our main area of business in the European Economic Area (EEA). We also, however, have subsidiaries outside the European Economic Area. Jointly, we process personal data of our contact persons such as name, first name, phone number, etc. in order to be able to contact you.

A business relationship or the initiation of a business relationship is not possible without processing personal data of the contact persons. We use your data in the business to business (B2B) area.


1. Person responsible for data processing

We appoint the company named in the legal notice with its contact data as responsible entity according to Section 4 paragraph 7 EU-General Data Protection Regulation (GDPR) (see our Legal notice).

We are a GMH Gruppe company (https://www.gmh-gruppe.de).


2. Data protection officer

Our data protection officer is available for any inquiries relating to your personal data and their processing at datenschutz.systems@gmh-gruppe.de. You can also contact the data protection officer using the contact details stated above and adding “To the data protection officer”. Your enquiries will be passed on accordingly.


3. Purpose of data processing, data categories and legal basis

We store the personal data you provided within the scope of our business relationship and/or initiation of a business relationship (interested party) with you, particularly for the fulfilment of existing contracts and/or the execution of pre-contractual measures.

In this context, it is a question of company data made available to us within the scope of an enquiry, offer and order (handling queries / enquiries, making appointments, invoicing, customer advice / customer service and other statutory obligations of the person responsible), including the contact details of the respective contact person. As a fundamental principle, we collect this data within the scope of the initial contact with us via telephone, business cards provided (interested party or potential customer / service provider / supplier) and / or email received.

The legal basis for the data collection is the processing of personal data for the fulfilment of a contract or the execution of pre-contractual measures according to Section 6 paragraph 1 b) GDPR.

To uphold justified interests of our company according to Section 6 paragraph 1 f) GDPR, contact details are also used for statistical purposes and optimisation of our sales and dispatch processes. This personal data is stored in a customer database (Customer-Relationship-Management - CRM) in order to keep an overview of customer service, to improve our products and to maintain our contractual relationship.

Due to various legal provisions, GMH Gruppe companies are subject to further obligations which ensue, for example, from the German Commercial Code or tax legislation. These include, in particular, the tax law provisions concerning monitoring and reporting obligations, the implementation of compliance screenings (alignment of “EU terror lists” (European Anti-terror Regulations 2580/2001 and 881/2002) and prevention of fraud and money laundering) – the legal basis for data collection for fulfilment of legal obligations is Section 6 paragraph 1 c) GDPR.

We also use contact persons’ details to pass on information about our products, to inform about information events / exhibitions and to conduct a (voluntary) survey on customer satisfaction.

The use for these purposes takes place on account of our justified interest in direct marketing measures in accordance with Section 6 paragraph 1 f) GDPR or, if an agreement is required, via a declaration of consent, with the legal basis being Section 6 paragraph 1 a) GDPR in this case.

If you have already granted consent to the processing of your personal data, including consent to process other data than mentioned in this document, this agreement remains valid until revocation. You are entitled to revoke your consent in writing at any time, which we will naturally comply with in future.


4. Passing on of data

Processing of personal data may also be carried out by affiliated companies of GMH Gruppe. Within the specific responsible office or department at GMH Gruppe, only the persons or areas concerned with the fulfilment of the existing contracts, the implementation of pre-contractual business relationships and / or the preservation of our justified interests will have access to your data. In particular, this includes employees involved in preparing and handling requests for quotations, order processing (sales, dispatch, finances and accounting), purchasing and customer service. 

Further access to the data may be possible for service providers appointed by us and working on our behalf (so-called processors, see Section 28 GDPR) during care and maintenance of our systems, failure analysis and troubleshooting as well as ensuring IT security. In accordance with GDPR, this access is regulated in contracts governing the processing of orders.


5. Data transfer to third-party countries

On account of our business relationships and subsidiaries outside the European Economic Area, transfer of data to third-party countries is possible.


6. Storing of data

If no statutory retention period exists, and/or data storage is no longer required or the justified interest in storing has ceased, the data will be deleted. This is the case

a) if you do not place an order and do not express interest in receiving further offers, information or contact; and/or

b) after termination and complete fulfilment of the contract, providing there is no statutory retention period which needs to be observed.

The obligatory period for storage of personal data may extend from three (3) to thirty (30) years.


7. Your rights as an affected person

According to the EU General Data Protection Regulation you have the following rights:

  • If your personal data is processed, you have the right to information concerning stored data relating to your person (Section 15 GDPR).
  • If incorrect personal data has been processed, you have the right to correction (Section 16 GDPR).
  • If the legal requirements are fulfilled, you are entitled to request deletion or restriction of processing and also to raise an objection to the processing (Sections 17, 18 and 21 GDPR).
  • If you have given your consent to the data processing or if there is a contract concerning data processing in force and data processing takes place with the assistance of automated procedures, you may also be entitled to the right to transferability of data (Section 20 GDPR).

You are furthermore entitled to submit an objection to a supervisory data protection authority (Section 77 GDPR). If an affected person is of the opinion that the processing of the personal data concerning this person constitutes a breach of the GDPR, he/she has the right to complain to a supervisory authority, especially in the member state of his/her place of abode, his/her workplace or the place of the purported infringement.


8. Information about the right to object according to Section 21 General Data Protection Regulation (GDPR)

You are entitled, for reasons ensuing from your specific personal situation, to object at any time to the processing of personal data concerning your person which ensues on the basis of Section 6 paragraph 1f GDPR (data processing based on the weighing up of interests). The person responsible will then no longer process the personal data, unless he/she is able to prove compelling and legitimate reasons for the processing, which outweigh the interests, rights and liberties of the affected person, or the processing serves the purpose of enforcing, exercising or defending legal claims.