Protection of your personal data and its confidential treatment are of utmost importance to this company. Your personal data will be processed exclusively in line with statutory provisions concerning data protection, in particular on the basis of the European Union General Data Protection Regulation (hereinafter referred to as the “GDPR”). On the basis of this Privacy Policy, we would like to provide you with information about how we process your personal data and about the rights to which you are entitled in this regard and applicable to our business relationship.

1. Data controller and data protection officer

The controller in terms of data processing law is:

Online Software AG
Bergstraße 31
69469 Weinheim
Phone: +49 6201 9988-0
Fax: +49 6201 9988-77
E-mail: info@online-software-ag.de

You can contact our data protection officer at:

Online Software AG, Peter Walter, Bergstraße 31, 69469 Weinheim, Germany, tel.: +49 6201 9988-0, e-mail: peter.walter@online-software-ag.de

2. Subject matter of data protection

The terms used in this Privacy Policy, for example “personal data” and its “processing”, correspond to the definitions under Art. 4 of the GDPR.

The subject matter of data protection consists in the processing of personal data. “Personal data” shall include any information relating to an identified or an identifiable natural person (hereinafter referred to as the “data subject”).

On a regular basis, we process the following data categories which we receive from the contact persons of our potential customers, existing customers, suppliers and other business partners:

• master data, in particular your family name, your given name, the form of address, the company you represent and your function/position;
• contact data, in particular your physical address and, if need be, your telephone or fax number and your e-mail address;
• contract data, in particular any data which you communicate to us for the purpose of executing a contract;
• invoice/payment data, in particular any information about the type of payment you selected and other data in the context of invoicing and payment processing; and
• content data, in particular any data which we exchange on the basis of correspondence between us.

We process your personal data in strict compliance with the relevant data protection provisions. This means that we will process your personal only on the condition that we obtained your consent for this or if this is admissible on the basis of the law, for example in cases where data processing is required (by law) for the purpose of rendering our contractual services (e.g. the processing of orders).

We implement both organisational and technical security measures in compliance with the state of the art to ensure that data protection law provisions will be complied with and to protect all personal data which we process from accidental or intentional manipulation, loss, destruction or from access by unauthorised third parties.

3. Purpose and legal bases of data processing

In the following, we provide you with an overview of both the purposes and the legal bases of data processing in the context of us contacting you or establishing/maintaining a business relationship with you.

3.1 Contract fulfilment

We process your personal data in the case where this is required for the purpose of preparing, concluding or executing a contract with you. The purposes depend on the subject matter of the relevant contract and they may particularly include, without limitation to this,

• the preparation and processing of commercial offers;
• the processing of existing contracts, e.g. the delivery of products and the provision of services;
• the performance of workshops and training courses;
• the processing of payments and the processing of personal data for accounting purposes;
• the customer support and the services before and during the business relationship with you and – to the extent to which this is admissible – after this is terminated; and
• the processing of possible warranty claims.

Your personal data will be processed on the basis of the provisions under point (b) of Art. 6(1) of the GDPR to the extent to which this is required for the purposes referred to above. Without this data, we will be unable to conclude or to fulfil a contract with you.

Personal data which we collect will be stored only for so long as this is required to fulfil the purposes for which such personal data had been collected in the first place. According to the above, we generally erase your personal data in the case where the contractual services were completely provided and if the warranty periods have lapsed, unless we are required to store such personal data for longer periods on the basis of any applicable statutory retention obligations.

3.2 Fulfilment of legal obligations

We process your personal data also for the purpose of fulfilling our statutory obligations which may, as an example, result from German commercial, export control, tax, anti-money laundering, financial or criminal law. In this regard, the exact purposes of the processing result from the relevant statutory obligations which we are obliged to fulfil; in general, the processing has the purpose of fulfilling statutory archiving and data retention obligations or government claims or requests for information to be provided. Consequentially, the data processing is based on the provisions under point (c) of Art. 6(1) of the GDPR. Once a legal obligation no longer applies, we will erase your personal data, unless another legal basis for data retention applies.

3.3 Protection of legitimate interests

In addition to the above, we process your personal data to protect our legitimate interests, for example for the following purposes:

• the storage of data in our customer database, for example to enable follow-up communication after initial contacts were made at a trade show;
• the performance of customer satisfaction surveys, marketing campaigns, market analyses, contests, raffles or similar campaigns and events (to the extent admissible on the basis of the law);
• the answering of questions not relevant for the contract and business correspondence;
• the delivery of information materials, price lists and information on events;
• the performance of credit standing checks;
• the assertion and enforcement of legal claims; and
• the optimisation of the safety of our products, services and our business processes.

To this extent, the data processing is based on the provisions under point (f) of Art. 6(1) of the GDPR. Our legitimate interest in this regard result from the purposes referred to above.

Apart from that, we reserve the relevant right and we hereby expressly inform you that we process your personal data, that is, to be more precise, your name and your contact data which you provided to us in the context of initial business contacts or the business relationship, also for the purpose of providing you with information, in particular also by e-mail, about similar products and services of the company. However, we do so under strict compliance with valid provisions under competition law in addition to the provisions under the GDPR. You have the right, at any time, to object to your personal data being used for the above purpose or for the performance of marketing activities (see sec. 6 below).