Scheidt & Bachmann Fare Collection Systems GmbH

PART 1: INFORMATION ON DATA PROTECTION FOR THE USE OF PERSONAL DATA

1. Scope
2. Data controller
3. Contact details of the data protection officer
4. Scope of the processing
5. Purpose and legal basis of the processing
6. Storage period
7. E-mail
8. General information on data transmission
9. Special information for the use of Microsoft Teams
   1. What data is processed?
   2. Purposes and legal bases of data processing
   3. Recipients of the collected contact data
   4. Data transfer to a third country
   5. Storage period
10. Your data subject rights
11. Your right to object according to Art. 21 GDPR
12. Final remarks

PART 2: SUPPLEMENTARY DATA PROTECTION DECLARATION FOR PHOTOGRAPHY AND FILMING AT EVENTS

1. Scope of the processing
2. Purpose and legal basis of the processing
3. Storage period
4. Supplementary information on data transmission

PART 1: INFORMATION ON DATA PROTECTION FOR THE USE OF PERSONAL DATA

pursuant to Art. 13, 14 and 21 of the General Data Protection Regulation (GDPR)

We, the Scheidt & Bachmann Fare Collection Systems GmbH (hereinafter "we", "us" or "Scheidt & Bachmann"), take the protection of your personal data very seriously and would like to inform you here about data protection at Scheidt & Bachmann.

Our data protection information is regularly updated in accordance with legal and technical requirements. Please note the current version of our data protection information.

This data protection information applies to the collection, processing and use of your personal data when we have contact with you as a contact person of interested companies, customers, suppliers, service providers, clients, contractors and cooperation partners (hereinafter "business partners").

Data controller in the sense of Art. 4 No. 7 GDPR is:

Scheidt & Bachmann Fare Collection Systems GmbH, Breite Straße 132, 41238 Mönchengladbach, Germany
Phone: +49 2166/266-343; e-mail: farecollectionsystems@scheidt-bachmann.de 

You can reach our data protection officer at the following contact details:

Scheidt & Bachmann GmbH
Data Protection Officer
Breite Straße 132, 41238 Mönchengladbach, Germany
Phone: +49 2166 266-839, e-mail: datenschutzbeauftragter@scheidt-bachmann.de

General data from the business relationship

We collect, process and use the following personal data in particular within the scope of the (developing) business relationship:

• Master data, in particular name and, if requested, function in the company;
• Contact details, in particular current business address, telephone numbers and email addresses and, if requested, post office box;
• If applicable, other data of your employer related to the fulfilment of the respective business relationship, such as dealer number, address data, contract data and/or payment and booking data

We collect, process and use personal data that is

• you have voluntarily surrendered to us,
• you or your employer have provided to us as part of the business relationship,
• arise from correspondence (postal and electronic) between you and your employer and us,
• arising from other postal, electronic or telephone communication.

Data from other sources

Furthermore, we also process - insofar as it is necessary for the fulfilment of the contract or pre-contractual measures with your employer or you or your employer have consented - such personal data that we have permissibly received from Scheidt & Bachmann group companies and other third parties.

We only process personal data from publicly accessible sources (e.g. authorities, internet) if this is legally permissible, for example because it is necessary for the provision of our services or you or your client/employer have consented.

We process your personal data insofar as this is necessary to protect the legitimate interests of Scheidt & Bachmann (Art. 6 para. 1 lit. f GDPR), in particular:

• to enter into or perform orders, contracts and other business relationships (including to process purchase orders, deliveries or payments) or to prepare or respond to requests for proposals and to determine the terms of the contractual relationship, with our business partners for whom you may be acting as an agent or employee;
• subsequent direct advertising (by e-mail or post pursuant to § 7 para. 3 Act against Unfair Competion (UWG), with offers of similar products, services or events in connection with the existing business relationship, unless you object or have objected to this use;
• for internal administrative purposes (e.g. for accounting);
• to conduct anti-terrorism and sanctions list screenings, if applicable;
• to conduct court and official proceedings and/or for the purpose of asserting/exercising as well as defending against legal claim(s) at home and abroad;
• in order to send you our customer information to the extent relevant to your business activities, such as newsletters with information on products and references to current topics and events of the Scheidt & Bachmann Group;
• to make documents, such as contract documents or product information, available to you for download as an authorised person in our data room;
• for other communication purposes;
• to ensure the IT security and IT operations of our company;
• Advertising, market and opinion research, insofar as you have not objected to the use of your personal data;
• Review and optimisation of needs assessment procedures;
• Statistical evaluations or market analysis;
• Benchmarking;
• Further development of services and products as well as existing systems and processes;
• Obtaining information such as data exchange with credit agencies;
• on the use of service providers (e.g. external IT service providers) that support our business processes;
• to plan and host events to which you are invited, including coverage of these events on our website or intranet, which may include the publication of images and video footage on the internet or intranet in which you are pictured.

Furthermore, the processing of your personal data might be necessary in the context of the performance of a contract or a pre-contractual measure (Art. 6 para. 1 lit. b GDPR) with you as an individual (natural person).

Furthermore, the processing of your personal data may be required to comply with legal requirements (Art. 6 para. 1 lit. c GDPR), e. g. according to the provisions of the Money Laundering Act (GwG), or in the public interest (Art. 6 para. 1 lit. e GDPR). Likewise, you may also have given us your consent in accordance with Art. 6 para. 1 lit. a GDPR.

We process your personal data only for as long as is necessary to fulfil the respective processing purpose and to comply with regulatory requirements, usually for the duration of the respective business relationship, or for the duration of any statutory retention period.

In addition, we are subject to various storage and documentation obligations, which result from the German Commercial Code (HGB) or the German Fiscal Code (AO), among other things. These can be up to 10 years.

Finally, the storage period is also assessed according to the statutory limitation periods, which can be up to thirty years, for example, according to §§ 195 et seq. German Civil Code (BGB), with the regular limitation period being three years.

Should you wish to contact us by e-mail, we would like to point out that the content of unencrypted e-mails can be viewed by third parties. We therefore recommend sending confidential information by post. Please note that personal data transmitted by e-mail will be stored and processed for the purpose of following up your enquiry.

We only transfer your personal data to third parties if

• you have given us consent to transfer the information to third parties,
• this is necessary in accordance with Art. 6 para. 1 p. 1 lit. b GDPR for the processing of contractual relationships with you,
• we are obliged to disclose, report and pass on data due to legal requirements,
• external service providers process the data on our behalf as order processors in accordance with Art. 28 GDPR or function transferees (e. g. external data centres, IT service providers, archiving, data destruction, legal advice, auditing, credit institutions, logistics companies, courier services).

In addition, we pass on your personal data to Scheidt & Bachmann group companies, which also process personal data partly under their own responsibility (so-called data controller, cf. Art. 4 No. 7 GDPR), to the extent necessary.

Within Scheidt & Bachmann, only those organisational units receive your data that require it to fulfil our contractual and legal obligations or in the context of processing and implementing our legitimate interest.

Beyond that, we do not pass on your personal data to third parties.

We do not intend to transfer your personal data to countries outside the European Union (EU) or the European Economic Area (EEA), but this may be done by external service providers if necessary. If external service providers come into contact with your personal data, we take legal, technical and organisational measures to ensure that they comply with the provisions of data protection laws and - if they act as processors - only process your data on our behalf and in accordance with our instructions.

If you access the Microsoft Teams website, the Microsoft Teams provider is responsible for data processing. However, accessing the website is only necessary for using Microsoft Teams in order to download the software for using Microsoft Teams. If you do not want to or cannot use the Microsoft Teams app, you can also use Microsoft Teams via your browser. The service will then also be provided via the Microsoft Teams website.

For more information on data protection at Microsoft, click here:

https://privacy.microsoft.com/de-de/privacystatement

https://www.microsoft.com/de-de/trust-center

1. What data is processed?

When using Microsoft Teams, various types of data are processed. The scope of the data also depends on the data provided before or during participation in a Teams meeting.

The following personal data are subject to processing:

• User details: e.g. display name, e-mail address if applicable, profile picture (optional), preferred language.
• Meeting metadata: e.g. date, time, meeting ID, phone numbers, location
• Text, audio and video data: It is possible to use the chat function in a Teams meeting. In this respect, the text entries made by the respective user are processed in order to display them in the Teams meeting. In order to enable the display of video and the playback of audio, the data from the microphone of your terminal device as well as from any video camera of the terminal device are processed accordingly for the duration of the meeting. The user can turn off or mute the camera or microphone at any time via the Microsoft Teams applications.

2. Purposes and legal bases of data processing

We use Microsoft Teams to conduct online meetings. If online meetings are to be recorded, this will be transparently communicated in advance and consent requested where necessary. The chat content is logged when using Microsoft Teams. Automated decision-making within the meaning of Art. 22 GDPR does not take place.

Insofar as personal data of our employees (or applicants) is processed, § 26 para. 1 Federal Data Protection Act (BDSG) is the legal basis for the data processing. If, in connection with the use of Microsoft Teams, personal data is not required for the establishment, implementation or termination of the employment relationship, but is nevertheless an elementary component in the use of Microsoft Teams, Art. 6 para. 1 lit. f GDPR is the legal basis for data processing. In these cases, our interest lies in the effective implementation of online meetings.

The legal basis for data processing when conducting online meetings is Art. 6 para. 1 lit. f GDPR. Here, too, our interest is in the effective implementation of online meetings.

3. Recipients of the collected contact data

Personal data processed in connection with participation in online meetings will not be disclosed to third parties unless it is intended for disclosure. Please note that the content of online meetings, as well as face-to-face meetings, may be used to communicate information to third parties and are therefore intended for disclosure.

Other recipients: The Microsoft Teams provider necessarily receives knowledge of the above-mentioned data insofar as this is provided for in the context of the order processing agreement with Microsoft.

4. Data transfer to a third country

Data processing in a third country outside the European Union (EU) does not take place in principle, as we have restricted the storage location to data centres in the European Union. However, we cannot exclude the possibility that data is routed via internet servers located outside the EU. This may be the case in particular if participants in online meetings are located in a third country. However, the data is encrypted during transport via the internet and thus protected against unauthorised access by third parties.

5. Storage period

Personal data is generally deleted if there is no need for further storage. A requirement may exist if the data is still needed, for example, to fulfil contractual services. In the case of statutory retention obligations, deletion is only considered after the expiry of the respective retention obligation.

Every data subject has the right to information under Art. 15 GDPR, the right to rectification under Art. 16 GDPR, the right to erasure under Art. 17 GDPR, the right to restriction of processing under Art. 18 GDPR and the right to data portability under Art. 20 GDPR. In order to exercise the aforementioned rights, you can contact the offices mentioned under clauses II and III.

If you have given us your consent to data processing, you can revoke this consent at any time without formalities. If possible, the revocation should be addressed to the offices mentioned under clauses II and III.

Furthermore, there is a right of appeal to a data protection supervisory authority (Art. 77 GDPR). The competent supervisory authority for Scheidt & Bachmann is:

North Rhine-Westphalia State Commissioner for Data Protection and Freedom of Information (LDI NRW)

However, we recommend that you first contact our data protection officer with a complaint.

You have the right to file an objection at any time, on grounds relating to your particular situation, against the processing of personal data relating to you which is carried out on the basis of Art. 6 para. 1 lit. f GDPR (processing of data on the basis of a weighing-up of interests) or Art. 6 para 1 lit. e GDPR; this also applies to any profiling based on this provision within the meaning of Art. 4 para. 4 GDPR.

If you file an objection, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

In individual cases, we process your personal data for the purpose of direct advertising. You have the right to object at any time to the processing of personal data concerning you for the purpose of such advertising; this also applies to profiling insofar as it is associated with such direct advertising.

If you file an objection to processing for direct marketing purposes, we will no longer process your personal data for these purposes.

The objection can be made form-free and should, if possible, be addressed to the offices mentioned in the data protection statement under clauses and III.

Security: We use technical and organisational security measures in order to adequately protect your personal data processed by us against accidental or intentional manipulation, loss, destruction or against access by unauthorised persons.

Validity and actuality of the privacy policy: This privacy policy is dated January 2023 and is valid as long as no updated version replaces it.
Due to the implementation of new technologies, it may become necessary to change this privacy policy. We reserve the right to change the privacy policy at any time with effect for the future. We recommend that you re-read the current data protection declaration from time to time.
 

PART 2: SUPPLEMENTARY DATA PROTECTION DECLARATION FOR PHO-TOGRAPHY AND FILMING AT EVENTS

In the context of events, we may take photographs and/or film recordings and collect and process the following in this context:

• Photo and film data and sound recordings of you
• If applicable, your name and, if requested, function in the company
• Contact details, if applicable.

If you do not wish to be photographed/filmed, please mention this directly to the photographer/cameraman so that your wish can be considered.

The legal basis for the data processing is Art. 6 para. 1 lit. f DSGVO. The photos/films will be taken for the purpose of documenting the event and will be used/saved/copied/distributed/exhibited/published on the internet via the company homepage of the data controller and/or on the intranet, in social media channels as well as in print media, in particular in the newsletter, for the purpose of documenting the event, for public relations and the presentation of the activities of the data controller in order to increase the level of awareness of the data controller as well as, if applicable, also for the long-term documentation of the company history of the data controller.

It can be assumed that the interest of the responsible person in the production and use of the photos/films does not unduly interfere with the rights and freedoms of the natural persons, especially since they are informed about the production and use of the photos/films in advance and/or at the event, and care is taken both in the production of photos/films and in the publication of the same that no legitimate interests of persons depicted are violated. If the rights and freedoms of a person depicted are violated for reasons particularly worthy of consideration, we will take appropriate measures to refrain from further processing. A deletion in print media that have already been issued cannot take place. Deletion on the website, in social media channels or on the intranet will be carried out within the scope of technical possibilities.

Data not used following the event will be deleted immediately. Otherwise, the data will be stored and deleted at the end of the 4th calendar year after production if it has not been used.

Departments of the data controller that necessarily need to receive the data in the course of carrying out the activity (e. g. marketing, IT, other administrative units), Scheidt & Bachmann group companies, contractors and processors involved in the processing (preparation as well as publication).

If applicable, tax advisors, authorities (tax office, other authorities) as well as legal representatives (in the enforcement of rights or defence against claims or in the context of official proceedings).

The data is made available on the internet to the worldwide public, on the intranet worldwide to the employees of the Scheidt & Bachmann group companies, and published in social media channels. The data will be published in print media: Employee newsletters distributed to employees of Scheidt & Bachmann group companies in a limited edition of 4,000 copies. Trade press/newsletters are distributed to the worldwide public.

The data will not be passed on to recipients who pursue their own purposes with this data. In the case of social media channels, however, it may be that the respective social media service receives the right to exploit the published data.

No other transfer to recipients in a third country (outside the EU) or to an international organisation is envisaged.

Through the use on the website, there is the possibility of worldwide access to the images/films or the retrieval of the posted data and images also from countries in which no or no sufficient data protection standard exists. The data controller can therefore neither influence the access to these data via the internet nor the use of these data and in this respect also cannot assume any guarantee for the observance of data protection.

Using suitable search engines, personal data can be found on the internet and the persons depicted in images can also be identified under certain circumstances. This also makes it possible to create personality profiles by combining this data and information with other data available on the internet and to open up additional possibilities of use, e. g. for advertising purposes. Due to the possibilities of worldwide retrieval and storage of data by other bodies or persons, further use by other bodies or persons or retrieval via archive functions of search engines cannot be ruled out in the event of revocation of consent and despite removal of your data and images from our website. Unidentification in print media that have already been issued cannot take place.