Transparent Information
Contact Information for the Data Controller
The data controller within the meaning of the General Data Protection Regulation is:
Company: punkt.de GmbH
Contact Person: Patrick M. Hausen
Address: Sophienstraße 187
ZIP Code/City: 76185 Karlsruhe
Phone: +49 721 91 09 0
Email: dsgvo@punkt.de
The following person has been appointed as Data Protection Officer:
Mr. Dirk Fox
Secorvo Security Consulting GmbH
Phone: +49 721 255171-203
Email: datenschutz@punkt.de
What sources are used to collect personal data?
We process personal data that we receive directly from our customers as part of our business relationship. In addition, we process personal data that we have received from other companies, e.g., for the execution of orders, the fulfillment of contracts, or based on consent you have provided.
We also process personal data that we have lawfully obtained from publicly accessible sources (e.g., commercial and association registries, the press, media, the Internet) and are permitted to process.
Personal data relevant to us may include:
Customer contact information
During the business initiation phase and throughout the business relationship—particularly through personal, telephone, or written contact initiated by you or one of our employees—additional personal data is generated, such as information regarding the contact channel, date, reason, and outcome; (electronic) copies of correspondence, as well as information regarding participation in direct marketing activities.
Credit report
Business credit documents: income/surplus statements, balance sheets, business analyses, and the nature and duration of self-employment.
For what purposes is your data processed, and on what legal basis?
We process the aforementioned personal data in accordance with the provisions of the EU General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG-neu):
When processing personal data for which we obtain the data subject’s consent, Article 6(1)(a) of the General Data Protection Regulation serves as the legal basis.
When processing personal data necessary for the performance of a contract to which the data subject is a party, Article 6(1)(b) of the GDPR serves as the legal basis. This provision also covers processing operations necessary for the implementation of pre-contractual measures.
To the extent that the processing of personal data is necessary to comply with a legal obligation to which our company is subject, Article 6(1), sentence 1(c) of the GDPR serves as the legal basis.
If the processing is necessary to safeguard a legitimate interest of our company or a third party, and the interests, fundamental rights, and fundamental freedoms of the data subject do not override the aforementioned interest, Article 6(1)(f) of the GDPR serves as the legal basis for the processing. Our company’s legitimate interest lies in the conduct of our business activities.
We process your data for the following purposes:
- To send you the newsletter—provided you have registered on our website
- To contact you via email, in writing, or by phone regarding offers, events, or training sessions that may be of interest to you, for the purpose of establishing or maintaining a business relationship
This link will take you to our Privacy Policy https://punkt.de/de/f/datenschutzerklaerung.html
Disclosure of Data to Third Parties
Within our company, your personal data is only shared with those individuals and departments that require it to fulfill our contractual and legal obligations.
We transfer data to third parties only to the extent necessary to fulfill a contractual obligation.
No data is transferred to third parties beyond the purposes specified in Section 3.
In addition, we transfer data to third parties if there is a legal obligation to do so. This is the case when government agencies (e.g., authorities and government offices) request information in writing, when a court order is in place, or when a legal basis permits the disclosure.
If we provide advance payment, e.g., for purchases on account, we reserve the right to obtain identity and creditworthiness information from specialized service providers (credit bureaus) to protect our legitimate interests.
Transfer of Data to Third Countries
Personal data is not transferred to so-called third countries outside the EU/EEA.
Data Retention Periods/Deletion Deadlines
We process and store your personal data for as long as necessary to fulfill our contractual obligations and for all other purposes specified in Section 3, or as required by the retention periods stipulated by law.
Data Subject Rights
If you have any questions regarding your personal data, you may contact us in writing at any time.
Under the GDPR, you have the following rights:
The right of access (Article 15 of the GDPR)
You have the right at any time to obtain information about which categories and details of your personal data we process, for what purpose, how long and according to what criteria this data is stored, and whether automated decision-making, including profiling, is used in this context. You also have the right to know to which recipients or categories of recipients your data has been or will be disclosed; in particular, to recipients in third countries or international organizations. In this case, you also have the right to be informed about appropriate safeguards in connection with the transfer of your personal data.
In addition to the right to lodge a complaint with the supervisory authority and the right to information regarding the origin of your data, you have the right to erasure, rectification, as well as the right to restrict processing or to object to the processing of your personal data.
In all of the above cases, you have the right to request a free copy of your personal data processed by us from the data controller. For any additional copies you request or that go beyond the data subject’s right to information, we are entitled to charge a reasonable administrative fee.
The Right to Rectification (Art. 16 GDPR)
You have theright to request the immediate rectification of your inaccurate personal data and, taking into account the purposes of the processing, to request the completion of incomplete personal data, including by means of a supplementary statement.
If you wish to exercise your right to rectification, you may contact our Data Protection Officer or the data controller at any time.
The Right to Erasure (Art. 17 of the GDPR)
You have the right to request the immediate erasure of your data (“right to be forgotten”), in particular if the storage of the data is no longer necessary, you withdraw your consent to data processing, your data has been processed unlawfully or collected unlawfully, and there is a legal obligation to erase it under EU or national law.
However, the right to be forgotten does not apply if there is an overriding right to freedom of expression or freedom of information, if data storage is necessary to fulfill a legal obligation (e.g., retention requirements), archiving purposes preclude erasure, or the storage serves to assert, exercise, or defend legal claims.
The Right to Restriction of Processing(Art. 18 GDPR)
You have the right to request that the controller restrict the processing of your data if you contest the accuracy of the data, the processing is unlawful, you object to the erasure of your personal data and instead request restriction of processing, if the necessity for the purpose of processing no longer applies, or you have objected to the processing pursuant to Article 21(1), as long as it has not yet been determined whether our legitimate grounds override yours.
The Right to Data Portability (Art. 20 GDPR)
You have the right to data portability regarding your personal data that you have provided to our company in a commonly used format, so that you can have your personal data transferred to another controller without hindrance, provided, for example, that you have given your consent and the processing is carried out by automated means.
The Right to Object (Art. 21 GDPR)
You have theright to object at any time to the processing of your personal data, unless there are legitimate grounds for processing that override your interests. Legitimate grounds for data processing exist, for example, when the interests, rights, and freedoms of the data subject prevail or when the processing serves to assert, defend, or exercise legal claims. In addition, you may also exercise a separate, explicit right to object at any time to the processing of your personal data for the purpose of direct marketing.
Right to lodge a complaint with the data protection supervisory authority (Art. 77 GDPR in conjunction with § 19 BDSG)
You have the right to lodge a complaint with the competent supervisory authority if you believe that there has been a violation in the processing of your personal data.
Right to Withdraw Consent Under Data Protection Law (Art. 7(3) GDPR)
You may withdraw your consent to the processing of your personal data at any time and without providing a reason. This also applies to the withdrawal of consent given to us prior to the entry into force of the EU General Data Protection Regulation.
Legal or contractual requirements regarding the provision of personal data and the possible consequences of failure to provide such data
We hereby note that the provision of personal data may be required bylaw in certain cases (e.g., tax regulations) may be required by law or may result from contractual provisions (e.g., information regarding the contractual partner). For example, in order to conclude a contract, the data subject/contracting party may be required to provide their personal data so that their request (e.g., an order) can be processed by us at all. An obligation to provide personal data arises primarily when concluding contracts. If no personal data is provided in this case, the contract with the data subject cannot be concluded. Before providing personal data, the data subject may contact our Data Protection Officer or the data controller. The Data Protection Officer or the data controller will then inform the data subject whether the provision of the required personal data is mandated by law or contract, or is necessary for the conclusion of the contract, and whether the data subject’s request gives rise to an obligation to to provide the personal data or what consequences the failure to provide the requested data will have for the data subject.
Legal Basis for Automated Decision-Making (including Profiling)
As a responsible company, we do not use automated decision-making or profiling in our business relationships.
