ZEPPELIN POWER SYSTEMS GMBH [ZPS] DATA PROTECTION NOTICE
The General Data Protection Regulation (GDPR) that came into force on May 25, 2018 includes comprehensive obligations to provide information regarding the use of personal data (hereinafter referred to as “Data”). Over the next few pages, we would like to give you a summary of the kind of data Zeppelin Power Systems GmbH (hereinafter referred to as “ZPS”) collects and how the data are processed. We also provide additional legally required information below.
I. Scope of Data Collection, Intended Purposes and Data Transfer
Creating a quote
ZPS processes your contact details in order to create and transfer quotes (contract formation process). To this end, we store your contact details in our CRM/ERP systems. The legal basis for data processing in this respect is point (b) of Article 6(1) GDPR.
Execution of the Contract
ZPS processes the data that is provided when placing an order to fulfill the contract and, where applicable, uses a specialist service provider to do so. Data processing for the performance of a contract covers the use of data to perform the contractually agreed service, including the settlement of any possible warranty claims (possibly including the involvement of Optimarin AS, Sjøveien 34, 4315 Sandnes (Norway) in relation to the manufacturer’s warranty). For service contracts, data processing for the performance of a contract also includes the retrieval of the fault log and other operational data, such as position information from the GPS data, condition and maintenance information such as fault, event and diagnostic codes of our BWT systems, parts or other systems. If you have also ordered an Optimarin (OptiLink) or Zeppelin telematics system, corresponding data relating to each of the BWT systems, parts or systems shall be displayed at the contractually agreed intervals in a dashboard . These data are processed in accordance with point (b) of Article 6(1) GDPR.
Data collected by ZPS from the purchase of BWT systems, parts, systems or use of services may also be shared with ZPS’s external auditors and/or tax advisors for the purposes of consultation and auditing. Data collected to perform the contract are stored by ZPS in the operational system for as long as there are warranty claims. Subsequently, data that fall under the retention obligations stipulated in Sections 146 et seqq. of the German Fiscal Code (Abgabenordnung) and Section 257 of the German Commercial Code (Handelsgesetzbuch) shall be archived and erased when these obligatory retention periods expire. All other data shall be deleted immediately unless other intended purposes for the data are specified in this notice. Data regarding warranty claims are processed in accordance with point (b) of Article 6(1) GDPR, including compliance with legal obligations (point (c) of Article 6(1) GDPR).
Address Verification and Creditworthiness
For verification of address and creditworthiness, ZPS retrieves your company’s address and credit information which are saved by credit agencies in data banks. This includes data that are calculated using mathematical and statistical processes (scoring). This occurs if ZPS assumes economic risk when the contract is concluded and wishes to establish safeguards by carrying out credit checks. This information helps ZPS to calculate the extent to which ZPS is able to grant credit.
The following credit agencies provide ZPS with addresses and credit information:
- Creditreform München Ganzmüller, Groher & Kollegen KG, Machtlfinger Str. 13, 81379 München
- CRIF Bürgel GmbH, Radlkoferstr. 2, 81373 München
- Creditsafe Deutschland GmbH, Schreiberhauer Str. 30, 10317 Berlin
Your credit information shall be erased five years after you last place an order or use services. These data are processed in accordance with point (f) of Article 6(1) GDPR to enable you to access credit financing. No automated individual decision-making, as described in Article 22 GDPR, is performed.
Sharing Data within the Zeppelin Group
ZPS shares the master data (company name, contact person, address and contact details such as telephone number and email address) with other Zeppelin Group companies so that the data can be managed and used consistently across the Group companies. This also includes sharing updates to this data, of which we or another Group company become aware. These updates shall also be made available to other Group companies. This helps simplify our processes and means you do not need to resubmit master data when contacting a different Group company.
A summary of the Group companies is available at www.zeppelin.com. These data shall be erased five years after you last place an order or use services, unless specific data are still subject to obligations for continued retention in accordance with Sections 146 et seqq. of the German Fiscal Code and/or Section 257 of the German Commercial Code. In this case, the data shall be deleted when the obligatory retention periods expire. These data are processed in accordance with point (f) of Article 6(1) GDPR.
Use of Data by Zeppelin Power Systems GmbH for Marketing Purposes
ZPS and the relevant commissioned service providers (lettershops, etc.) use name and address details to provide more information about products and services from the Zeppelin Group. Address details are also forwarded to Optimarin AS, Sjøveien 34, 4315 Sandnes (Norway) for marketing purposes.
ZPS and, if necessary, relevant commissioned service providers use data collected during the business relationship (contact details, products purchased, services ordered, etc.) to perform analytics for marketing purposes (“consumer scoring”). In addition, data that Zeppelin retains on the basis of your consent may also be analyzed for marketing purposes (for example, data on the use of individual BWT systems, parts or systems that are collected when the Optimarin (OptiLink) or Zeppelin telematics system is activated). Reference is made to this data analysis when obtaining consent.
ZPS also uses your phone number for marketing purposes provided that you have consented or there is evidence of implied consent, e.g. as part of an existing business relationship. In addition, ZPS uses email addresses collected when concluding the contract for promoting similar ZPS products. The right to object to marketing is mentioned when collecting data and in every instance of contact for the purpose of advertising.
To achieve the marketing objectives, the data shall be used over a period of five years from the time the last order was placed or service was used. The data shall be erased at the end of this five-year period, unless there is consent for extended use of the data and/or specific data are subject to statutory retention periods. In the latter case, the data shall be erased when the statutory retention period expires. Data processing for marketing purposes is performed in accordance with point (f) of Article 6(1) GDPR, unless you have explicitly consented to a specific form of marketing material. By sending you these marketing materials, we aim to keep you updated about our products and services into the future and in this way establish a long-lasting business relationship with you.
Queries regarding the purposes of telephone market research carried out by Zeppelin Power Systems GmbH
ZPS conducts telephone surveys for market research purposes. We intend to gain insights from the telephone surveys that will help us identify how to improve our products and services. We conduct surveys of this type if you have given us separate consent for us to do so, or there is evidence of implied consent. As part of the telephone survey, we shall ask for your consent to further use of this data, including sharing survey results with Optimarin AS, Sjøveien 34, 4315 Sandnes (Norway). If you withdraw your consent, the data will be erased. The telephone calls are carried out based on consent or in accordance with Section 7(2) number 2, subsentence 2 of the German Act Against Unfair Competition (Gesetz gegen den unlauteren Wettbewerb, “UWG”). Results of the survey are processed on the basis of consent.
Transfer of Data to Optimarin AS (Optimarin)
ZPS transfers customer master data (company name, contact person, address) and details relating to purchased products (e.g. serial numbers of BWT systems and parts) and/or used services, as well as results from the telephone surveys (telephone interviews), to Optimarin in Norway. These data are processed for any product recall purposes required, and for Optimarin’s own marketing purposes. We therefore want to give you the chance to be contacted directly with current news from Optimarin and/or with information regarding product safety in the event of a product recall.
You may withdraw your consent to having your data shared with Optimarin in Norway for marketing purposes at any time by emailing datenschutznoSpam@noSpamzeppelin.com. These data are processed on the basis of consent and master data is transferred in accordance with point (f) of Article 6(1) GDPR.
II. Your Rights as a Data Subject
All data subjects are entitled to the following rights:
- Right to access (Article 15 GDPR);
- Right to rectification of inaccurate data (Article 16 GDPR);
- Right to erasure or “the right to be forgotten” (Article 17 GDPR)
- Right to restrict processing of personal data (Article 18 GDPR);
- Right to data portability (Article 20 GDPR).
You may withdraw your consent to having your personal data processed for marketing purposes, including customer data analysis or transfer to third parties for marketing purposes, at any time without having to give justification.
The data subject also has a general right to object (Article 21(1) GDPR). In this case, you must justify your objection to the processing of your data. If the legal basis for processing the data is consent, then this can be revoked at any time and the revocation shall be effective for future processing.
Please contact datenschutznoSpam@noSpamzeppelin.com or the address listed below to exercise any of these data subject rights.
III. General Information
The data controller as defined in the GDPR is Zeppelin Power Systems GmbH, Ruhrstr.158, 22761 Hamburg, Germany.
Our in-house Data Protection Officer will be happy to answer any questions you have regarding data protection (email: datenschutznoSpam@noSpamzeppelin.com).
The relevant supervisory authority is the Hamburgische Beauftragte für Datenschutz und Informationsfreiheit (Data Protection Authority of Hamburg for the Private Sector), Klosterwall 6 (Block C), 20095 Hamburg, Germany. You can use the following email address for email communication with the supervisory authority: mailboxnoSpam@noSpamdatenschutz.hamburg.de
This data protection notice may be updated occasionally. If there is a new intended purpose for data that have already been collected, we shall inform you without being prompted to do so.
Hamburg, November 1, 2019.
Zeppelin Power Systems GmbH
Ruhrstr. 158 – 22761 Hamburg, Germany