Handling of data from customers, suppliers, other contractual partners and interested parties

General notes and mandatory information

In accordance with the provisions of Articles 13, 14 and 21 of the General Data Protection Regulation (GDPR), we hereby inform you about the processing of your personal data and your rights under data protection law in this regard. Which data is processed in detail and how it is used depends largely on the requested or agreed services. To ensure that you are fully informed about the processing of your personal data in the context of the performance of a contract or the implementation of pre-contractual measures, please take note of the following information.

a) Note on the responsible entity

The responsible body for data processing is:

ONEJOON GmbH
Leinetal / Auf der Mauer 1
37120 Bovenden / Germany

Phone: +49 55 1 820 830 - 0
E-mail: info@onejoon.de

The responsible party is the natural or legal person who alone or jointly with others decides on the purposes and means of the processing of personal data (e.g. names, e-mail addresses or similar).

b) Data protection officer required by law

We have appointed a data protection officer for our company.

PROLIANCE GmbH
Leopoldstr. 21
80802 Munich
Web: www.datenschutzexperte.de

E-mail: datenschutzbeauftragter@datenschutzexperte.de

c) Purposes and legal bases of the processing

We process your personal data in accordance with the provisions of the European General Data Protection Regulation (DSGVO) and the German Federal Data Protection Act (BDSG), insofar as this is necessary for the establishment, implementation or performance of a contract or for the implementation of pre-contractual measures. Insofar as personal data is required for the initiation or implementation of a contractual relationship or in the context of the implementation of pre-contractual measures, processing is lawful pursuant to Art. 6 (1) lit. b DSGVO.

If you give us express consent to process personal data for specific purposes (e.g., disclosure to third parties, evaluation for marketing purposes, or addressing you by e-mail for advertising purposes), the lawfulness of this processing is based on your consent pursuant to Art. 6 (1) a DSGVO. Consent given can be revoked at any time with effect for the future (see point i) of this data protection information).

If necessary and legally permissible, we process your data beyond the actual contractual purposes for the fulfillment of legal obligations pursuant to Art. 6 para. 1 lit. c DSGVO. In addition, processing may be carried out to protect the legitimate interests of us or third parties and to defend and assert legal claims pursuant to Art. 6 para. 1 lit. f DSGVO. If necessary, we will inform you separately, stating the legitimate interest, insofar as this is required by law.

d) Categories of personal data

We only process data that is related to the establishment of the contract or the pre-contractual measures. This may be general data about you or persons in your company (name, address, contact details, etc.) as well as any other data that you provide to us in the context of the establishment of the contract.

e) Sources of the data

We process personal data that we receive from you in the course of contacting you or establishing a contractual relationship or in the course of pre-contractual measures or that you provide to us via our contact form on our website.

f) Recipient of the data

We disclose your personal data within our company exclusively to those areas and persons who need this data to fulfill contractual and legal obligations or to implement our legitimate interest.

We may transfer your personal data to companies affiliated with us in Poland, China, South Korea and the USA to the extent that this is permissible within the framework set out in paragraph c) "Purposes and legal bases of processing".

In particular, we may process personal data jointly with our subsidiary ONEJOON Poland sp. z o.o., ul. Zygmunta starego, nr 26, 44-100 Gliwice, Poland, for the purpose of initiating, executing or fulfilling contracts.

Otherwise, data will only be transferred to recipients outside the company if this is permitted or required by law, if the transfer is necessary for the execution and thus the fulfillment of the contract or, at your request, for the implementation of pre-contractual measures, if we have your consent or if we are authorized to provide information. Under these conditions, recipients of personal data may be, for example:

• External tax consultant,
• Public agencies and institutions (e.g. BAFA, customs, public prosecutor's office, police, supervisory authorities, tax office) if there is a legal or official obligation,
• Recipients to whom disclosure is directly necessary for the purpose of establishing or fulfilling the contract, such as shipping companies, legal counsel, suppliers (e.g. in the case of direct delivery to or travel to the customer), customers (e.g. forwarding of data from our service providers used at the customer's premises).

g) Transfer to a third country

A transfer of personal data to countries outside the EEA (European Economic Area) or to an international organization will only take place if this is necessary for the processing and thus the fulfillment of the contract or, at your request, for the implementation of pre-contractual measures, the transfer is required by law or you have given us your consent. In these cases, recipients may include our affiliated companies, suppliers (e.g. in the case of direct delivery to or travel to the customer), customers (e.g. forwarding of data from our service providers used at the customer).

h) Duration of data storage

As far as necessary, we process and store your personal data for the duration of our business relationship or for the fulfillment of contractual purposes. This also includes, among other things, the initiation and execution of a contract.

In addition, we are subject to various storage and documentation obligations, which result, among other things, from the German Commercial Code (HGB) and the German Fiscal Code (AO). The periods prescribed there for storage or documentation are two to ten years.

Finally, the storage period also depends on the statutory periods of limitation, which, for example, according to §§ 195 et seq. of the German Civil Code (BGB), are generally three years, but in certain cases can be up to thirty years.

i) Revocation of your consent to data processing

Many data processing operations are only possible with your express consent. You can revoke consent you have already given at any time. The legality of the data processing carried out until the revocation remains unaffected by the revocation.

j) Right to object to the collection of data

Insofar as the processing of your personal data is carried out for the protection of legitimate interests pursuant to Art. 6 (1) lit. f DSGVO, you have the right pursuant to Art. 21 DSGVO to object to the processing of this data at any time for reasons arising from your particular situation. We will then no longer process this personal data unless we can demonstrate compelling legitimate grounds for the processing. These must override your interests, rights and freedoms, or the processing must serve the assertion, exercise or defense of legal claims.

In individual cases, we process your personal data to conduct direct marketing. You have the right to object at any time to processing for the purpose of such advertising. This also applies to profiling, insofar as it is related to such direct advertising. If you object to processing for the purpose of direct advertising, we will no longer process your personal data for these purposes.

If you wish to exercise your right of revocation or objection, an e-mail to the above mail address of the responsible person is sufficient.

k) Right of appeal to the competent supervisory authority

In the event of breaches of the DSGVO, data subjects shall have a right of appeal to a supervisory authority, in particular in the Member State of their habitual residence, their place of work or the place of the alleged breach. The right of appeal is without prejudice to other administrative or judicial remedies.

l) Right to data portability

You have the right to have data that we process automatically on the basis of your consent or in fulfillment of a contract handed over to you or to a third party in a common, machine-readable format. If you request the direct transfer of the data to another controller, this will only be done insofar as it is technically feasible.

m) Information, deletion and correction

Within the framework of the applicable legal provisions, you have the right at any time to free information about your stored personal data, its origin and recipient and the purpose of data processing and, if necessary, a right to correction or deletion of this data. For this purpose, as well as for further questions on the subject of personal data, you can contact us at any time.

n) Right to restriction of processing

You have the right to request the restriction of the processing of your personal data. For this purpose, you can contact us at any time. The right to restriction of processing exists in the following cases:

• If you dispute the accuracy of your personal data stored by us, we usually need time to verify this. For the duration of the review, you have the right to request the restriction of the processing of your personal data.
• If the processing of your personal data happened/is happening unlawfully, you may request the restriction of data processing instead of erasure.
• If we no longer need your personal data, but you need it to exercise, defend or enforce legal claims, you have the right to request restriction of the processing of your personal data instead of deletion.
• If you have lodged an objection pursuant to Art. 21 (1) DSGVO, a balancing of your and our interests must be carried out. As long as it has not yet been determined whose interests prevail, you have the right to request the restriction of the processing of your personal data.

If you have restricted the processing of your personal data, this data may - apart from being stored - only be processed with your consent or for the assertion, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of an important public interest of the European Union or a Member State.

o) Necessity of the provision of personal data

The provision of personal data for the decision on the conclusion of a contract, the performance of a contract or for the implementation of pre-contractual measures is voluntary. However, we can only make a decision in the context of contractual measures if you provide such personal data that is required for the conclusion of the contract, the fulfillment of the contract or pre-contractual measures.

p) Automated decision making

For the establishment, fulfillment or implementation of the business relationship as well as for pre-contractual measures, we generally do not use fully automated decision-making pursuant to Art. 22 DSGVO. Should we use these procedures in individual cases, we will inform you separately or obtain your consent, if this is required by law.