The protection of your private rights and freedoms is important to us; we only use your data for the purposes intended. Since it is important to us that you know at all times to what extent we collect, use and, if necessary, transfer your data to third parties, we will inform you in detail below about the processing of your personal data collected by us or stored by us. When processing personal data, we strictly adhere to the provisions of the EU General Data Protection Regulation (GDPR) and, if applicable, other data protection-relevant provisions.
Greenplan GmbH
Dr. Clemens Beckmann
Rabinstraße 1
53111 Bonn
Germany
Phone: +49 67 42 87 27 80
E-mail: contact@greenplan.de
If you have any questions regarding the processing of your personal data, if you wish to exercise your rights as a data subject (such as the right to information, correction, blocking or deletion of data) or if you wish to withdraw your consent, please contact our data protection officer directly.
After the purpose of storage has ceased, the retention periods are generally at least six or ten years. As a rule, data is deleted immediately in accordance with our deletion concept, provided that this does not conflict with any retention obligation, necessity for contract fulfillment or a legitimate interest.
We protect your personal data processed by us against loss, destruction, access, alteration or distribution by unauthorized persons by means of appropriate technical and organizational measures. However, despite regular checks, complete protection against all risks is not possible.
The EU General Data Protection Regulation (GDPR) provides for extensive rights for data subjects in Chapter III, which we explain to you accordingly below with regard to the processing of your personal data:
This requirement concerns in particular information on the following details of data processing:
We will correct any erroneous data immediately, provided that you inform us of the circumstance accordingly.
Provided that the processing is no longer necessary and one of the following conditions is met:
Within the scope of the deletion request, we will, if necessary, pass on your request to those third parties to whom a transfer of your data had previously taken place.
Provided that one of the following conditions is met:
If it is technically possible and does not affect the rights and freedoms of other persons, we will - at your request - transfer your data to another recipient (responsible party).
If we collect or have collected and process personal data from you (on the basis of Art. 6 (1) e or f or Art. 9 (2) a GDPR), you have the right to object to the data processing (including profiling) at any time (with effect for the future). In exceptional cases, the objection may be ineffective, e.g. if we can demonstrate compelling interests worthy of protection for the processing that outweigh your interests or processing serves the assertion, exercise or defense of legal claims. If we process your personal data for the purpose of direct marketing, you have the right to object to such processing at any time. This also applies to profiling, insofar as it is related to such direct advertising. You also have the right to object to processing of your data concerning you which is carried out by us for scientific or historical research purposes or for statistical purposes pursuant to Article 89 (1) GDPR, unless such processing is necessary for the performance of a task carried out in the public interest.
If we collect or have collected and process personal data from you, you have the right not to be subject to any decision based solely on automated processing - including profiling - which produces legal effects concerning you or similarly significantly affects you. Exceptions to this requirement apply if the decision is necessary for the conclusion or performance of a contract between you and us or you have expressly consented to the processing. In any case, we will take reasonable steps to safeguard your rights and freedoms and legitimate interests, including at least the right to obtain the intervention of a person on our part, to express our own point of view and to contest the decision.
You have the right to revoke consent to the processing of personal data at any time.
A list of the supervisory authorities responsible in Germany can be found on the website of the Federal Commissioner for Data Protection or at the following link: https://www.bfdi.bund.de/EN/Service/Anschriften/Laender/Laender-node.html.
We process personal data in accordance with the requirements of the GDPR, depending on the type and purpose of the processing as follows:
| Permitted use | Specification of the GDPR |
| Informed consent | Art. 6 para. 1 a |
| Performance of a contract | Art. 6 para. 1 b |
| Implementation of pre-contractual measures | Art. 6 para. 1 b |
| Fulfillment of legal obligations | Art. 6 para. 1 c |
| Protection of vital interests | Art. 6 para. 1 d |
| Safeguarding our legitimate interest | Art. 6 para. 1 f |
Our legitimate interest, as defined in Article 6 (1) f GDPR, is based on the performance of our business activities in order to maintain our ability to operate and secure the employment of our employees.
Depending on the processing, purposes, legal basis and other information may vary; you will find the exact allocation of information in the following chapter.
| Purpose of the processing of general data |
| ||||
| Legal basis (according to Art. 6 / 9 GDPR) | |||||
| Recipient (if applicable) | To 1) Processor (Details: Processor in the sense of Art. 4 No. 8 DSGVO in conjunction with Art. 28 DSGVO) To 1) External (Details: Service providers, other organizations, other third parties) To 1) Internal (Details: Internal department) To 1) Public body (Details: Public body: Authority, body of the administration of justice, public-law institution of the Federation, federally indirect corporations, institutions, foundations and their associations in accordance with § 2 para. 1-3 BDSG.). | ||||
| If applicable, intention of forwarding to a third country or int. organization (incl. info on adequacy decision of the Commission or suitable guarantees) | A data transfer to a third country does not take place and is not planned | ||||
| If known: Duration of data storage | See General deadlines for data deletion | ||||
| Obligation to provide personal data (e.g. due to legal or contractual regulations) / necessity | Yes | ||||
| Consequences of non-compliance (in case of failure to provide the required data) | If the data is not provided, the described processing cannot be carried out. | ||||
| If applicable, existence of an automated decision-making process | In this context, we do not use automatic decision-making. | ||||
| If applicable, origin of the data (if not collected directly from the data subject) | Re 1) Direct collection (details: the data was collected directly from the data subject through: e.g. questionnaire, contract, contact form, online store, conversation). |
| Purpose of the processing of general data |
| ||||
| Legal basis (according to Art. 6 / 9 GDPR) | |||||
| Recipient (if applicable) | Re 1) Internal (Details: Internal department) | ||||
| If applicable, intention of forwarding to a third country or int. organization (incl. info on adequacy decision of the Commission or suitable guarantees) | A data transfer to a third country does not take place and is not planned | ||||
| If known: Duration of data storage | See General deadlines for data deletion | ||||
| Obligation to provide personal data (e.g. due to legal or contractual regulations) / necessity | Yes | ||||
| Consequences of non-compliance (in case of failure to provide the required data) | If the data is not provided, the described processing cannot be carried out. | ||||
| If applicable, existence of an automated decision-making process | In this context, we do not use automatic decision-making. | ||||
| If applicable, origin of the data (if not collected directly from the data subject) | Re 1) Direct collection (details: the data was collected directly from the data subject through: e.g. questionnaire, contract, contact form, online store, conversation). |
| Purpose of the processing of general data |
| ||||
| Legal basis (according to Art. 6 / 9 GDPR) | |||||
| Recipient (if applicable) | Re 1) Internal (Details: Internal department) | ||||
| If applicable, intention of forwarding to a third country or int. organization (incl. info on adequacy decision of the Commission or suitable guarantees) | A data transfer to a third country does not take place and is not planned | ||||
| If known: Duration of data storage | See General deadlines for data deletion | ||||
| Obligation to provide personal data (e.g. due to legal or contractual regulations) / necessity | Yes | ||||
| Consequences of non-compliance (in case of failure to provide the required data) | If the data is not provided, the described processing cannot be carried out within the scope of purchasing tasks. | ||||
| If applicable, existence of an automated decision-making process | In this context, we do not use automatic decision-making. | ||||
| If applicable, origin of the data (if not collected directly from the data subject) | Re 1) Direct collection (details: the data was collected directly from the data subject through: e.g. questionnaire, contract, contact form, online store, conversation). |
| Purpose of the processing of general data |
| ||||
| Legal basis (according to Art. 6 / 9 GDPR) | |||||
| Recipient (if applicable) | Re 1) Internal (Details: Internal department) | ||||
| If applicable, intention of forwarding to a third country or int. organization (incl. info on adequacy decision of the Commission or suitable guarantees) | A data transfer to a third country does not take place and is not planned | ||||
| If known: Duration of data storage | See General deadlines for data deletion | ||||
| Obligation to provide personal data (e.g. due to legal or contractual regulations) / necessity | Yes | ||||
| Consequences of non-compliance (in case of failure to provide the required data) | If the data is not provided, the described processing cannot be carried out within the scope of customer support. | ||||
| If applicable, existence of an automated decision-making process | In this context, we do not use automatic decision-making. | ||||
| If applicable, origin of the data (if not collected directly from the data subject) | Re 1) Direct collection (details: the data was collected directly from the data subject through: e.g. questionnaire, contract, contact form, online store, conversation). |
| Purpose of the processing of general data |
| ||||
| Legal basis (according to Art. 6 / 9 GDPR) | |||||
| Recipient (if applicable) | Re 1) Internal (Details: Internal department) | ||||
| If applicable, intention of forwarding to a third country or int. organization (incl. info on adequacy decision of the Commission or suitable guarantees) | A data transfer to a third country does not take place and is not planned | ||||
| If known: Duration of data storage | See General deadlines for data deletion | ||||
| Obligation to provide personal data (e.g. due to legal or contractual regulations) / necessity | No | ||||
| Consequences of non-compliance (in case of failure to provide the required data) | There is no obligation to provide personal data. | ||||
| If applicable, existence of an automated decision-making process | In this context, we do not use automatic decision-making. | ||||
| If applicable, origin of the data (if not collected directly from the data subject) | Re 1) Direct collection (details: the data was collected directly from the data subject through: e.g. questionnaire, contract, contact form, online store, conversation). |
| Purpose of the processing of general data |
| ||||
| Legal basis (according to Art. 6 / 9 GDPR) | |||||
| Recipient (if applicable) | Re 1) External (details: service providers, other organizations, other third parties) Re 1) Internal (details: internal department) | ||||
| If applicable, intention of forwarding to a third country or int. organization (incl. info on adequacy decision of the Commission or suitable guarantees) | A data transfer to a third country does not take place and is not planned | ||||
| If known: Duration of data storage | See General deadlines for data deletion | ||||
| Obligation to provide personal data (e.g. due to legal or contractual regulations) / necessity | Yes | ||||
| Consequences of non-compliance (in case of failure to provide the required data) | If the data is not provided, the described processing cannot be carried out within the framework of the accounting system. | ||||
| If applicable, existence of an automated decision-making process | In this context, we do not use automatic decision-making. | ||||
| If applicable, origin of the data (if not collected directly from the data subject) | Re 1) Direct collection (details: the data was collected directly from the data subject through: e.g. questionnaire, contract, contact form, online store, conversation). |
| Purpose of the processing of general data |
| ||||
| Legal basis (according to Art. 6 / 9 GDPR) | |||||
| Recipient (if applicable) | Re 1) Processor (details: IT service provider) Re 1) Public body (details: law enforcement authorities, if applicable) | ||||
| If applicable, intention of forwarding to a third country or int. organization (incl. info on adequacy decision of the Commission or suitable guarantees) | A data transfer to a third country does not take place and is not planned | ||||
| If known: Duration of data storage | See General deadlines for data deletion | ||||
| Obligation to provide personal data (e.g. due to legal or contractual regulations) / necessity | Yes | ||||
| Consequences of non-compliance (in case of failure to provide the required data) | If the data is not provided, the described processing in the area of IT security cannot be carried out. | ||||
| If applicable, existence of an automated decision-making process | In this context, we do not use automatic decision-making. | ||||
| If applicable, origin of the data (if not collected directly from the data subject) | Re 1) Direct collection (Details: The data was collected directly from the data subject). |
| Purpose of the processing of general data |
| ||||
| Legal basis (according to Art. 6 / 9 GDPR) | |||||
| Recipient (if applicable) | To 1) Processor (Details: Processor in the sense of Art. 4 No. 8 DSGVO in conjunction with Art. 28 DSGVO) To 1) External (Details: Service providers, other organizations, other third parties) To 1) Internal (Details: Internal department) To 1) Public body (Details: Public body: Authority, body of the administration of justice, public-law institution of the Federation, federally indirect corporations, institutions, foundations and their associations in accordance with § 2 para. 1-3 BDSG.). | ||||
| If applicable, intention of forwarding to a third country or int. organization (incl. info on adequacy decision of the Commission or suitable guarantees) | A data transfer to a third country does not take place and is not planned | ||||
| If known: Duration of data storage | See General deadlines for data deletion | ||||
| Obligation to provide personal data (e.g. due to legal or contractual regulations) / necessity | Yes | ||||
| Consequences of non-compliance (in case of failure to provide the required data) | If the data is not provided, the described processing in the area of enterprise management cannot be carried out. | ||||
| If applicable, existence of an automated decision-making process | In this context, we do not use automatic decision-making. | ||||
| If applicable, origin of the data (if not collected directly from the data subject) | Re 1) Direct collection (details: the data was collected directly from the data subject through: e.g. questionnaire, contract, contact form, online store, conversation). |
| Purpose of the processing of general data |
| ||||
| Legal basis (according to Art. 6 / 9 GDPR) | |||||
| Recipient (if applicable) | To 1) Processor (Details: Processor in the sense of Art. 4 No. 8 DSGVO in conjunction with Art. 28 DSGVO) To 1) External (Details: Service providers, other organizations, other third parties) To 1) Internal (Details: Internal department) | ||||
| If applicable, intention of forwarding to a third country or int. organization (incl. info on adequacy decision of the Commission or suitable guarantees) | A data transfer to a third country does not take place and is not planned | ||||
| If known: Duration of data storage | See General deadlines for data deletion | ||||
| Obligation to provide personal data (e.g. due to legal or contractual regulations) / necessity | No | ||||
| Consequences of non-compliance (in case of failure to provide the required data) | There is no obligation to provide personal data. | ||||
| If applicable, existence of an automated decision-making process | In this context, we do not use automatic decision-making. | ||||
| If applicable, origin of the data (if not collected directly from the data subject) | Re 1) Direct collection (Details: Data was collected directly from the data subject through: e.g. questionnaire, contract, contact form, online store, conversation) Re 1) Publicly available (Details: Data collected from publicly available sources (e.g. telephone directory)). |
| Purpose of the processing of general data |
| ||||
| Legal basis (according to Art. 6 / 9 GDPR) | |||||
| Recipient (if applicable) | To 1) Processor (Details: Processor in the sense of Art. 4 No. 8 DSGVO in conjunction with Art. 28 DSGVO) To 1) External (Details: Service providers, other organizations, other third parties) To 1) Internal (Details: Internal department) | ||||
| If applicable, intention of forwarding to a third country or int. organization (incl. info on adequacy decision of the Commission or suitable guarantees) | A data transfer to a third country does not take place and is not planned | ||||
| If known: Duration of data storage | See General deadlines for data deletion | ||||
| Obligation to provide personal data (e.g. due to legal or contractual regulations) / necessity | Yes | ||||
| Consequences of non-compliance (in case of failure to provide the required data) | If the data is not provided, the described processing cannot be carried out. | ||||
| If applicable, existence of an automated decision-making process | In this context, we do not use automatic decision-making. | ||||
| If applicable, origin of the data (if not collected directly from the data subject) | Re 1) Direct collection (details: the data was collected directly from the data subject through: e.g. questionnaire, contract, contact form, online store, conversation). |
| Purpose of the processing of general data |
| ||||
| Legal basis (according to Art. 6 / 9 GDPR) | |||||
| Recipient (if applicable) | To 1) Processor (Details: Processor in the sense of Art. 4 No. 8 DSGVO in conjunction with Art. 28 DSGVO) To 1) External (Details: Service providers, other organizations, other third parties) To 1) Internal (Details: Internal department) | ||||
| If applicable, intention of forwarding to a third country or int. organization (incl. info on adequacy decision of the Commission or suitable guarantees) | A data transfer to a third country does not take place and is not planned | ||||
| If known: Duration of data storage | See General deadlines for data deletion | ||||
| Obligation to provide personal data (e.g. due to legal or contractual regulations) / necessity | Yes | ||||
| Consequences of non-compliance (in case of failure to provide the required data) | If the data is not provided, the described processing cannot be carried out. | ||||
| If applicable, existence of an automated decision-making process | In this context, we do not use automatic decision-making. | ||||
| If applicable, origin of the data (if not collected directly from the data subject) | Re 1) Direct collection (details: the data was collected directly from the data subject through: e.g. questionnaire, contract, contact form, online store, conversation). |