Privacy Notice

Below, we provide information about the protection of your personal data (hereinafter "data"). This Privacy Notice fulfils the information obligations pursuant to Art. 12 et seq. GDPR. We would like to inform you in detail about which data concerning you we process when you use our website and our services and products (hereinafter "services"). We also inform you about your rights and the technical and organisational measures we have implemented to protect your data during processing.

Arvato Media GmbH
Reinhard-Mohn-Straße 28
33333 Gütersloh
Germany

Telephone: +49 5241 80-88077
Email: vva-handelsbetreuung@arvato.com

Arvato Media GmbH is responsible for the processing of your data. You can contact the Data Protection Officer of Arvato Media GmbH at the postal address stated above, adding "For the attention of the Data Protection Officer", or by email at data-privacy@arvato.com. Arvato Media GmbH (hereinafter referred to as "we" or "us") processes personal data in accordance with the provisions of the GDPR and the German Federal Data Protection Act (Bundesdatenschutzgesetz, hereinafter "BDSG").

When you visit the website, information is automatically collected from the accessing device (hereinafter "access data"). These access data include details of the content you request on the website and your usage behaviour, as well as information about browser type and version, operating system, internet service provider, date and time of use of the website, websites previously visited, pages subsequently accessed via the website, and the IP address of the device (also referred to as "server log files"). Pseudonymous usage profiles are created and analysed from the access data by means of web tracking. However, this does not enable us to identify you personally.

In principle, you can use the website without providing personal data, for example to obtain information about us. However, when using certain services, you are required to provide data such as your name, address, email address or telephone number, for example when contacting us or subscribing to a newsletter. Mandatory fields are generally marked with an *.

The purposes of data processing may arise from technical, contractual or legal requirements and, where applicable, from consent. We use your data for the following purposes:

Further information on these purposes of processing is provided in the sections below.

To ensure the functionality of the website, conduct security analyses and defend against attacks, the server log files forming part of the access data referred to in Section 2 are automatically collected by the computer system of the accessing device when the website is accessed and while it is being used, and are stored for a short period. Server log files are not stored together with other data. We use server log files for statistical analysis, to analyse and remedy technical incidents, defend against attempted attacks and fraud, and optimise the functionality of the website.

The legal basis for collecting server log files is Art. 6 para. 1 lit. f GDPR. Ensuring the functionality of the website, conducting security analyses and preventing threats constitute our legitimate interests.

After the website is accessed, server log files are stored on the web server and the IP address contained therein is deleted after no more than 7 days. This does not apply where there is a specific suspicion of an offence and longer storage is legally required for analysis and investigation.

You have the right to object to the processing of your data on grounds relating to your particular situation, where the applicable statutory requirements are met. If you wish to exercise your right to object, please contact us using the contact details provided in Section 1.

You can contact us via a contact form on the website. If you use this option, you provide us with data such as your title, surname, email address and specific enquiry (together, "contact data"), as well as, optionally, your first name and telephone number. The contact data are stored and used exclusively to process your enquiry, for example questions concerning products and services.

The legal basis for processing your contact data is generally Art. 6 para. 1 lit. f GDPR. Our legitimate interests lie in processing your specific enquiry and in subsequent communication. Where your contact is aimed at entering into a contract, for example for the use of our services, the additional legal basis is Art. 6 para. 1 lit. b GDPR.

Once your enquiry has been dealt with and any subsequent communication has ended, your contact data will be deleted. This does not apply where your contact is aimed at entering into a contract. In that case, the data will be retained until the applicable contractual and/or statutory retention periods, currently 6 to 10 years, have expired.

You have the right to object to the processing of your contact data on grounds relating to your particular situation, where the applicable statutory requirements are met. If you wish to exercise your right to object, please use the contact details provided in Section 1. If you object, we may be unable to continue processing your enquiry. This does not apply where storage of your contact data is necessary for taking steps prior to entering into a contract or for performance of a contract.

This Privacy Notice informs you of your ability to exercise your data protection rights, such as the right of access. In order to respond fully to your request, we are legally required to verify your identity. This serves to protect your data against unauthorised access. For this purpose, it may be necessary for you to provide us with a copy of your passport or comparable information about yourself and the relevant processing activities. You may redact information that is not required to verify your identity, for example eye colour, height or nationality on a passport copy. Without information that may be required for verification, we may be unable to comply with your request.

We are legally required under the GDPR to process your data for the purpose of handling requests to exercise data subject rights. The legal basis is Art. 6 para. 1 lit. c GDPR.

We retain correspondence with you concerning the exercise of data subject rights for a period of 3 years. Identity documents, such as a copy of your identity card marked as a copy, are excluded from this period where you have provided such a document. They will be deleted once your identity has been verified.

The processing of your data is necessary in order to fulfil your data subject rights. You therefore have no right to object to this processing.

You can download content provided by us via the website, such as studies or white papers on current topics in our business areas. For the download, your contact data are transmitted to us via the registration form and stored. We also record the date and time of your download. The download is voluntary, free of charge and generally independent of other website services. Further details can be found in the contractual terms.

The download of free content constitutes an online service provided by us to you. The legal basis for the processing of your personal data collected in this context is Art. 6 para. 1 lit. b GDPR.

Your data will be retained for as long as required for the performance of the contract concerning the download of free content. The contract terminates automatically upon successful completion of the download. Thereafter, your data will be retained in accordance with the applicable contractual and/or statutory retention periods, currently 6 to 10 years.

The processing of your data is necessary for performance of the contract relating to the download of free content. You therefore have no right to object to this processing.

You can register for individual events via the website. Events generally consist of presentations on current topics and developments in our business areas and may take place at premises provided by us or digitally, for example as a webinar. Our service portfolio and new products and services may also be presented. The registration form transmits to us your master data (title, first name, surname and company), contact data (business email address), participation date and information on participation in the evening meal, which we further process for your participation. If you provide them voluntarily, we also process information on participation in the accompanying programme, dietary requirements and the need for accommodation and/or a hotel. We also process the date and time of registration. We send informational emails to the contact details you provide in order to inform you about the relevant event, for example event requirements and updates. Your data will only be disclosed to third parties, such as event organisers or hotels, where this is necessary for your participation in the event.

We process your data for the organisation and delivery of events organised by us. Participation in events constitutes a service offered by us to you. The legal basis for processing the data collected is Art. 6 para. 1 lit. b GDPR for the performance of a contract.

Your data will be retained for as long as necessary to facilitate your participation in the respective event. Following the event, your data will be retained in accordance with the applicable contractual and/or statutory retention periods, currently 6 to 10 years. If we are unable to confirm your participation due to limited capacity, the purpose for further processing your data will cease to apply and your data will be deleted within 3 months, unless statutory retention obligations require continued retention.

The processing of your data is necessary for participation in the relevant event. You therefore have no right to object to this processing.

As part of our business relationships with corporate customers, we occasionally conduct customer surveys to assess customer satisfaction and improve our services. These surveys are intended for our corporate customers. Where you act as a contact person for a corporate customer, we generally store your contact details in our customer database and use them to invite you to participate in such surveys. Participation is voluntary. You may notify us at any time that you no longer wish to receive invitations to participate in future customer surveys.

The processing of your contact details is based on Art. 6 para. 1 lit. f GDPR. Our legitimate interests are to maintain and strengthen our customer relationships and to continuously improve our services.

As a general rule, survey results are retained for the duration of the business relationship. This does not apply where the survey results consist solely of statistical data.

You have the right to object to the processing of your contact data on grounds relating to your particular situation, where the applicable statutory requirements are met. If you wish to exercise your right to object, please use the contact details provided in Section 1.

Job vacancies are published on this website, allowing you to apply for positions at Arvato. When you select a job vacancy, you will be redirected to the Bertelsmann applicant portal. Accordingly, the actual processing of your personal data in connection with the online application process does not take place on this website. The company that publishes the respective job vacancy is responsible for that vacancy and will generally also receive your personal data when you submit your online application. Your personal data will not be disclosed to any other recipients in this context.

Further details on the processing of your data in connection with your online application are provided when you register and create your applicant profile and are available at this data privacy link.

Once your online application for a specific vacancy has been received, your data will be processed for recruitment purposes. During the pre-contractual phase of an employment relationship, your prospective employer has an interest in verifying that you have the professional qualifications and personal suitability required for the vacant position. The legal basis for processing your data is Art. 6 para. 1 lit. b GDPR.

Your data will be processed for as long as necessary to reach a recruitment decision. Once the online application process has ended, your data will be deleted after the applicable statutory retention period has expired, currently generally 6 months.

The processing of your data is necessary for the recruitment decision and therefore for pre-contractual purposes. Consequently, there is no right to object.

You can subscribe to various newsletters on the website. The data provided in the registration form are processed by us, with the assistance of service providers, in order to send communications at the frequency you select, daily, weekly or monthly. Your data are first used in a double opt-in procedure to verify the email address provided and, following successful verification, for sending the newsletter. The only mandatory information required is your email address. To demonstrate that you have consented to receiving our newsletter, we process your email address, the wording of the consent, the confirmation email, the IP address used for registration, the IP address used for confirmation, and the date and time of registration, confirmation and the most recent update.

Newsletters are sent by email on the basis of your subscription and the consent you have given to the processing of your personal data pursuant to Art. 6 para. 1 lit. a GDPR. You may withdraw your consent at any time and thereby stop receiving these newsletters. Where processing of personal data is necessary for compliance with a legal obligation to which our company is subject, Art. 6 para. 1 lit. c GDPR serves as the legal basis.

Your data will remain stored until you withdraw your consent or unsubscribe from the newsletter. We will then retain the data for a period of 3 years in order to demonstrate that we obtained your consent to send newsletters.

If you have consented to receiving newsletters, you may withdraw your consent at any time with effect for the future by notifying us at data-privacy@arvato.com with the subject line "Newsletter consent withdrawal" or by clicking the unsubscribe button in your newsletter. An objection to processing does not result in the deletion of data that may be retained due to legal obligations.

The Company is required under the German Act on the Detection of Proceeds from Serious Crimes (Anti-Money Laundering Act - Geldwäschegesetz, hereinafter "GwG") to collect, verify and retain data relating to its contracting parties, persons acting on their behalf and the beneficial owners of its contracting parties. Where required for statutory verification, the Company uses a service provider.

The Company is a factoring institution authorised by the German Federal Financial Supervisory Authority (Bundesanstalt für Finanzdienstleistungsaufsicht, "BaFin") within the meaning of section 1 para. 1a sentence 1 no. 9 of the German Banking Act (Kreditwesengesetz, "KWG") and is therefore an obliged entity pursuant to section 2 para. 1 no. 2 GwG.

Pursuant to section 10 para. 1 nos. 1 and 2 GwG, the Company is required to identify and verify its contracting parties, persons acting on their behalf and beneficial owners. The persons concerned under section 10 para. 1 nos. 1 and 2 GwG are identified pursuant to section 11 para. 1 GwG by collecting the data specified in section 11 paras. 4 and 5 GwG. The Company must verify these data pursuant to section 12 GwG.

As an obliged entity under the GwG, the Company must comply with the GDPR. Data processed on the basis of the GwG are subject to the purpose limitation requirements set out in section 11a GwG.

The processing of personal data within the meaning of Art. 4 no. 2 GDPR in conjunction with sections 10 para. 1 and 11 paras. 1, 4 and 5 GwG is based on Art. 6 para. 1 lit. c GDPR in conjunction with section 11a GwG.

As part of the processing activity described here, we process the following categories of personal data:

As a general rule, the data are collected by employees of the Company. Where identity documents are presented for an on-site check, employees of the Company make copies of the relevant documents.

In the course of complying with our statutory obligations under the GwG, personal data may be disclosed to, or made accessible to, service providers and other entities engaged by us insofar as this is necessary to fulfil our anti-money laundering obligations. These include, in particular, bfs finance GmbH, which has been engaged to perform the function of money laundering reporting officer, the money laundering reporting officers appointed there, and service providers used to carry out identification procedures.

Where in-person verification is not possible, the Company uses three POSTIDENT procedures offered by Deutsche Post AG as a service provider engaged by the Company. To fulfil the statutory verification obligation, the Company sends the person to be verified an email containing a link to the Deutsche Post AG POSTIDENT portal. The data subject can choose between three identification procedures:

The data collected during the video identification procedure, the portrait image and the video file are made available to the Company via a Deutsche Post AG portal. Due to the size of the file, the video stream is made available via an SFTP server. The data are encrypted in each case. The Company must actively retrieve the data.

Data generated through the identification procedures are stored both by the Company and by the service provider where the latter is involved in the identification.

Deutsche Post AG determines its own requirements for the storage and deletion of data. For information on data retention and deletion periods at Deutsche Post AG, please refer to the supplementary POSTIDENT information on the Deutsche Post AG website, in particular item 7 of that information.

The Company retains data collected exclusively on the basis of section 11 paras. 1, 4 and 5 GwG for the statutory retention period. The Company deletes these data once the retention period specified in section 8 GwG has expired.

A corresponding deletion routine is implemented in the Company's core system and runs at the end of each year.

You have the statutory data subject rights under the GDPR with regard to the processing of your personal data. These include, in particular, the right of access pursuant to Art. 15 GDPR, the right to rectification pursuant to Art. 16 GDPR, the right to erasure pursuant to Art. 17 GDPR and the right to restriction of processing pursuant to Art. 18 GDPR, in each case subject to the applicable statutory requirements.

Where the processing of personal data is necessary for compliance with our statutory obligations under the GwG, the right to erasure in particular may be restricted. This applies especially for as long as statutory retention obligations prevent erasure. Art. 17 para. 3 GDPR provides for an exception to the right to erasure where processing is necessary for compliance with a legal obligation. As a general rule, there is no right to object under Art. 21 GDPR in respect of the processing described in this section insofar as the processing is carried out for compliance with our legal obligations pursuant to Art. 6 para. 1 lit. c GDPR.

To exercise your data subject rights, please use the contact details provided in Section 1.

Where data are processed directly by Deutsche Post AG as part of the POSTIDENT procedure described above, the rights to object and seek cessation described above may be exercised only directly against Deutsche Post AG.

As part of the creation and transmission of electronic invoices, personal data are processed that are not collected directly from you but are transmitted in the course of the business relationship. These include, in particular, master data and billing data, such as name, business contact details, e.g. address and email address, customer numbers, contract or invoice numbers, bank account details and information on services rendered or deliveries made. Processing comprises the electronic recording, transmission, verification, archiving and, where applicable, onward transmission of invoice data within the IT systems used. Where external service providers or technical platforms are used to create, transmit or archive e-invoices, processing is carried out either on behalf of the controller pursuant to Art. 28 GDPR or under the respective entity's own responsibility as controller.

Personal data are processed for the purpose of properly handling invoicing, payment and accounting processes, including fulfilment of contractual obligations and compliance with statutory requirements. These include, in particular, tax and commercial-law obligations, evidentiary and documentation requirements, and audit and control purposes. The legal basis for processing is Art. 6 para. 1 lit. b GDPR insofar as processing is necessary for the performance of a contract or in order to take steps at the request of the data subject prior to entering into a contract. In addition, processing is based on Art. 6 para. 1 lit. c GDPR for compliance with legal obligations, in particular tax and commercial-law requirements. Where necessary, processing may also be based on Art. 6 para. 1 lit. f GDPR, provided that there is a legitimate interest in efficient, secure and traceable invoice processing and that such interest is not overridden by the interests or fundamental rights and freedoms of the data subject.

Personal data are retained only for as long as necessary to achieve the purposes stated above. In addition, data are retained for the applicable statutory retention periods, in particular under commercial and tax law. These periods are generally 6 to 10 years. After expiry of the relevant retention periods, personal data are deleted or anonymised unless further statutory obligations or legitimate interests prevent deletion.

Data subjects generally have the right to object to the processing of their personal data insofar as the processing is based on Art. 6 para. 1 lit. f GDPR. The objection may be made on grounds relating to the data subject's particular situation. Where there is a statutory obligation to process your personal data, for example tax and commercial-law retention obligations applicable to invoices, there is no right to object because we are legally required to carry out the processing.

Within our organisation, access to your data is granted to those units that require it in order to fulfil the purposes described in Section 3. Service providers engaged by us may also have access to your data (so-called "processors"). Data processing agreements ensure that these service providers are bound by our instructions and are required to maintain data security and confidentiality.

Data are disclosed to other recipients, such as advertising partners, social media service providers or enforcement authorities (so-called "third parties"), where required by law or where you have given your consent. Internal data protection policies and a shared data security management framework ensure confidential handling of your data and compliance with data protection requirements.

Where the service providers and/or third parties referred to in Section 4 are established outside the EU/EEA, your data may be transferred to a country in which a level of data protection equivalent to that in the EU/EEA cannot be guaranteed. An appropriate level of protection may nevertheless be ensured by suitable safeguards. Such safeguards may include standard contractual clauses provided by the European Commission. Exceptionally, such safeguards may not be required where the third-country transfer is necessary for performance of our contractual relationship. The European Commission has also recognised certain third countries as providing an adequate level of protection, in which case the Company need not provide additional safeguards. The use of Google services for web tracking and online advertising involves a third-country transfer. As a general rule, Google stores the data within the EU. Only in exceptional cases, for example due to technical maintenance, may Google access the data from the United States.

You have the right at any time to obtain information about the personal data concerning you that we store. If data concerning you are inaccurate or no longer up to date, you have the right to request rectification. You also have the right to request erasure or restriction of the processing of your data in accordance with Art. 17 and Art. 18 GDPR respectively. You may also have the right to receive data that you have provided to us in a commonly used, machine-readable format (the "right to data portability").

If you have given consent to the processing of personal data for specific purposes, you may withdraw that consent at any time with effect for the future. The withdrawal should be addressed to the Company using the contact details provided in Section 1.

In accordance with Art. 21 GDPR, you have the right, on grounds relating to your particular situation, to object at any time to processing of your data based on Art. 6 para. 1 lit. f GDPR. You also have the right to object at any time to the processing of your personal data for direct marketing purposes. The same applies to automated procedures involving individual cookies, unless those cookies are strictly necessary for the provision of the website.

In addition, you have the right to lodge a complaint with a data protection supervisory authority.

The competent authority is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen)

Kavalleriestr. 2-4
40213 Düsseldorf
Germany
Phone: +49 211 38424-0
Fax: +49 211 38424-10
E-Mail: poststelle@ldi.nrw.de

You may also contact the data protection supervisory authority responsible for your place of residence.