Data Protection Policy for Business Partners and other Interested Parties

We take the protection of your personal data very seriously. We always treat your personal data confidentially and in accordance with the statutory data protection regulations. Therefore, we would like to inform you here about why we collect, use, and process certain data from you and what rights you have.

1. Who is responsible for data processing and who can I contact?

The responsible entity is:
IOTIQ GmbH
Emilienstraße 13
04107 Leipzig
Tel.: +49 341 99160100
Email: [email protected]

You can reach our company data protection officer at:
Dr. Andreas Melzer
kelobit IT-Experts GmbH
Tel.: +49 345 132553-80
Email: [email protected]

2. Which sources and data do we use?

We process the data necessary for establishing, carrying out, and/or terminating our business relationship. We generally collect this data directly from you, for example, when you request a quote or place an order, or when you contact us via our website, email, at trade fairs, or similar events.

Sometimes, we may initially receive your data from another person, such as a colleague in your company who designates you as their contact person. If this occurs, we will inform you of our source during our first communication.

The personal data we process includes:

Name, first name, and gender (for salutation)
Company affiliation and company address
Usually two contact options within your company (e.g., telephone number and email address)
Records of business transactions and related correspondence
Depending on the nature of the business, possibly also user IDs for protected areas on our website

3. What do we process your data for (purpose of processing) and on what legal basis?

We use the data listed above to prepare and fulfill business transactions and to establish and maintain effective business communication, including sending newsletters, for example. The legal basis for this processing is generally Article 6(1)(f) GDPR if you, as our business partner, represent another organization. Our legitimate interest lies in achieving the aforementioned purposes. If you are directly our contractual partner, we process your data instead on the basis of Article 6(1)(b) GDPR, which permits the processing of personal data for the performance of a contract or for taking steps prior to entering into a contract.

If you do not wish to receive newsletters, etc., you can exercise your right to object and inform us informally by email or post (see also section 11 of this privacy policy). The lawfulness of the processing of your data prior to your objection remains unaffected.

It is possible that we may collect further data from you or wish to use it in other ways at a later date. Should this occur, we will request your consent in accordance with Article 6(1)(a) in conjunction with Article 7 of the GDPR and inform you accordingly. If you grant us this consent, you may withdraw it at any time without giving a reason.

Should your data be required for legal proceedings, processing may be carried out to protect our legitimate interests pursuant to Article 6(1)(f) of the GDPR. Our interest in this case lies in asserting or defending against legal claims, for example, in the context of the burden of proof in legal proceedings.

4. Who receives my data?

In our company, only those individuals who require access to your data for the smooth operation of our business relationship have access to it. This may include several departments within our company, depending on the services or products you purchase from us. Our IT department also has access to your data for purely technical processing purposes.

Service providers we engage may also be recipients of your personal data in accordance with Article 28 of the GDPR (General Data Protection Regulation).

In processing your orders, it is sometimes necessary for us to transfer certain data to our respective suppliers, manufacturers, or distributors located in Germany, other European countries, or the European Economic Area. This includes, for example, your name, your first name (if applicable), your organizational affiliation, and your contact information within your organization.

Under certain circumstances, we may be required to disclose certain data to the appropriate authorities as part of our legal obligations.

5. Will data be transferred to a third country or an international organization?

Data is generally not transferred to entities in countries outside the European Economic Area (so-called third countries). However, data may be transferred to third countries in individual cases, provided that:

It is legally required,
you have given us your consent, or
this is legitimized by legitimate interest under data protection law and no higher legitimate interests of the data subject preclude it.

Furthermore, we do not transfer any personal data to entities in third countries or international organizations. However, we use service providers for certain tasks, who in turn often use service providers that may have their headquarters, parent company, or data centers in a third country. Such a transfer is permitted if the European Commission has determined that an adequate level of protection exists in the third country (Art. 45 GDPR). If the Commission has not made such a determination, we or our service providers may only transfer personal data to a third country if appropriate safeguards are in place (e.g., standard contractual clauses adopted by the EU Commission or the supervisory authority through a specific procedure) and enforceable rights and effective legal remedies are available.

We have concluded corresponding contracts with our service providers and have also contractually stipulated that their contractual partners must always maintain data protection guarantees in compliance with the European level of data protection.

6. How long will my data be stored?

We store your data for the entire duration of our ongoing business relationship with your organization, which includes, in particular, the existence of a contract or pre-contractual measures. If no contract currently exists or if a contract is expiring, your data will be deleted from our customer database after one year without business contact.

Furthermore, we only store your data to the extent and for as long as we are legally obligated to do so, such as by commercial or tax law retention periods. This generally applies to a period of ten years. If we no longer require your data for the purposes described above, it will be stored separately for the respective statutory retention period and will not be processed for any other purpose. After the statutory retention periods have expired, all remaining data will be securely deleted or destroyed immediately.

7. What data protection rights do I have?

Every data subject has the right to information under Article 15 GDPR, the right to rectification under Article 16 GDPR, the right to erasure under Article 17 GDPR, the right to restriction of processing under Article 18 GDPR, the right to object under Article 21 GDPR, and the right to data portability under Article 20 GDPR. The right to information and the right to erasure are subject to the limitations set out in Sections 34 and 35 of the German Federal Data Protection Act (BDSG). Furthermore, you have the right to lodge a complaint with a competent data protection supervisory authority (Article 77 GDPR).

You may withdraw your consent to the processing of your personal data at any time. This also applies to the withdrawal of declarations of consent that were given to us before the GDPR came into effect, i.e., before May 25, 2018. Please note that the withdrawal of consent is only effective for the future. Processing that took place before the withdrawal remains unaffected.

8. Is there an obligation to provide data?

Providing your personal data is initially neither legally nor contractually required, nor are you obligated to provide this data.

However, if you have a direct business relationship with us, you must provide the personal data necessary for establishing and maintaining that business relationship and fulfilling the associated contractual obligations. Without this data, we will generally have to refuse to conclude the contract or execute the order, or we may no longer be able to perform an existing contract and may have to terminate it.

If the business relationship involves a company that you represent to us, you must provide us with the personal data necessary for establishing and maintaining the representation/authorization and fulfilling the associated contractual obligations. Without this data, we will generally have to reject you as an authorized representative or revoke any existing authorization/authorization.

9. To what extent is there automated decision-making?

We do not use automated decision-making pursuant to Article 22 GDPR for the establishment, execution, or termination of the business relationship. Should we use these procedures in individual cases, we will inform you separately about this and your related rights, provided this is required by law..

10. Is profiling taking place?

We do not process your data with the aim of automatically evaluating certain personal aspects.

11. Information about your right to object under Article 21 GDPR

11.1 Right to object on a case-by-case basis

You have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data concerning you which is based on point (f) of Article 6(1) of the GDPR (processing based on legitimate interests). This also applies to profiling based on those provisions as defined in Article 4(4) of the GDPR.

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the purpose of establishing, exercising or defending legal claims.

11.2 Recipient of an objection

The objection can be made informally with the subject line “Objection”, stating your name and organization, and should be addressed to the contact details mentioned under point 1.

12. Changes to this Privacy Policy

We revise this privacy policy when there are changes to data processing or other circumstances that make it necessary. The current version can always be found on this website.

Last updated: June 13, 2023