In the following, we inform you about the processing of your personal data. 

Responsible body  

weinor GmbH & Co. KG 
Mathias-Brüggen-Straße 110 
D-50829 Köln/Ossendorf (Germany) 

Phone: +49 (0) 221-59709-211 
E-mail: info@weinor.de  

Data Protection Officer 

Creditreform Compliance Services GmbH   
Hammfelddam 13 
D-41460 Neuss (Germany) 
E-mail:  Datenschutz@weinor.de  

Purposes and legal bases of the processing  

We process your personal data within the scope of our business relationship with you. For this purpose, your data can be processed for various purposes based on different legal bases:  

• Processing for the fulfilment of contracts according to Art. 6 para. 1 lit. b GDPR 
  In as far as personal data is collected for the implementation of pre-contractual measures or based on a contract and processed, this data is used for the conclusion of the contract, the implementation of the contractual relationship as well as its termination as applicable 

• Processing for the maintenance of legitimate interests according to Art. 6 para. 1 lit. f GDPR.
  It is possible that data is processed in order to safeguard our legitimate interests or, as applicable, a third party’s. This, for example can be required for guaranteeing IT security and IT operation, for the hindrance and clarification of offences/administrative offences, for securing domiciliary rights, to offer our customers post-contractual service or for the purpose of direct advertising with our own customers and for answering general enquiries.  

• Processing based on consent, Art. 6 para. 1 lit. a GDPR 
  In as far as you have granted weinor GmbH & Co. KG permission for data processing for specific purposes (e.g. sending E-mail newsletters), this personal data may be processed within the scope of the consent.  

• Processing for fulfilment of legal duties, Art. 6 para. 1 lit. c GDPR 
  Data processing can be required for the fulfilment of legal duties we are subject to (e.g. the fulfilment of statutory retention obligations). 

• Processing your data within the scope of appointment reservations using MS Bookings. 
  Processing takes place for administration and implementation of appointments and takes place according to Art. 6 para. 1 lit. b GDPR (fulfilment of a contract or pre-contractual measures) or based on justified interests according to Art. 6 para. 1 lit. f GDPR. 

Personal data categories 

We process the following personal data categories: 

• Contact data (name, address, [possibly work] E-mail address, phone number) 

• Communication data (E-mails, notes, minutes from meetings) 

• Purchasing and sales data 

• Payment data as applicable  

• Creditworthiness information 

Personal data origin 

We process your personal data in as far as we are provided with or transferred this data by you personally (e.g. from customers within the scope of the business relationship) or, as applicable, by third parties. 

In as far as we receive personal data from third parties, it comes in particular from the following bodies:  

• Credit agencies 

• Directly from you 

• Sales agents 

• Business partners within the scope of contractual services 

Recipients of your data 

At our company, the persons who require personal data for the respective legitimate fulfilment of their tasks are granted access to this personal data. In as far as commissioned external service providers receive personal data for these purposes, we ensure that appropriate technical and organisational measures are carried out and necessary agreements are concluded to ensure that processing takes place in accordance with the valid legal data protection regulations and guarantees protection of the rights of the person concerned. 

If required, we pass personal data on to: 

• external service providers (e.g. IT service providers, computer centres, support services from software providers and service providers for payroll and salary accounting) 

• Business partners for whom the data transfer is necessary for fulfilling the tasks, e.g. payment service providers/bank institutes, post/package services, sales agents, external consultants 

• Collection companies, as applicable, to collect receivables 

• Authorities and companies within the scope of updates or for the fulfilment of statutory reporting obligations (e.g. social insurance institutions, financial authorities, the police and public prosecutor, supervisory authorities, road traffic offices). 

• Further third parties for whom the person concerned has granted permission for data transfer or legal authorisation for data transfer exists (e.g. lawyers, insolvency administrators) 

On all occasions when your personal data is transferred to external recipients who process this data on our behalf, we ensure that your data is transferred, protected and processed in accordance with all applicable data protection regulations.  

Is data transferred to a third country? 

Upon principal, we do not transfer any data to third countries. If we nonetheless transfer your data to third countries in certain situations, this takes place exclusively under adherence to statutory requirements.  

Under certain circumstances and for work processes, it is possible that your data is transferred to third countries (e.g. to our Georgia subsidiary for processing inquiries and supporting processes). The transfer is only made under adherence to the statutory regulations (conclusion of the so-called Standard Contractual Clauses (SCC)).  

For how long will we store your data? 

The personal data will only be stored for as long as permitted by the valid legal basis. In particular as long as it is necessary to fulfil the purposes of the contract for which the personal data was collected as long as its further retention is required for the fulfilment of retention duties or for reasons of overriding legitimate interest. 

Your rights  

Every person concerned is entitled to information according to Art. 15 GDPR, the right to rectification according to Art. 16 GDPR, the right to deletion according to Art. 17 GDPR, the right to restriction of the processing according to Art. 18 GDPR as well as the right to data portability from Art. 20 GDPR. 

Right of cancellation in case of consent 

If we base data processing on your consent (cf. Art. 6 para. 1 lit. a and Art. 9 para. 2 lit. a GDPR), you are entitled to withdraw your consent at all times with effect for the future. This is also valid if special personal data categories are affected. The legality of the processing of your data until the point in time of cancellation remains unaffected.  

You can send your withdrawal using the contact information above.  

Right to lodge a complaint with the supervisory authority 

Moreover, you are entitled to lodge a complaint with a data protection supervisory authority of your choice.  

Duty to provide personal data 

The duty to provide certain personal data arises from the concluded contracts or those to be concluded in as far as the contracts cannot be implemented without provision of the data. Furthermore, legal duties may have to be observed which bind us to collect / process certain data. 

A contract cannot be concluded if information is missing regarding data required for it. 

If data must be provided due to legal duties, the respective service provided in this connection cannot be provided without the provision of this data.  

Automated decision-taking or profiling 

Automated decision-taking in isolated cases including profiling according to Art. 22 GDPR does not take place.