Data Protection Information

Data Protection Information – Mandatory Information pursuant to Art. 13 f. GDPR

The company GSI mbH hereby provides information on the data processing that takes place in the scope of courses, examinations and other GSI mbH events in as far as such concerns the ordering party/contractual partner (hereafter also referred to as the “data subject”).

1.    Contact Data of the Responsible Party

GSI - Gesellschaft für Schweißtechnik International mbH
Bismarckstraße 85
47057 Duisburg

Email: sekretariat(at)gsi-slv.de  

2.    Contact Data of the Data Protection Officer 

Bernhard Pickert-Goldenbogen
Bechtle GmbH IT-Systemhaus Solingen

E-Mail: datenschutz(at)gsi-slv.de

3. Personal Data and their Sources

Personal data are deemed to be all information relating to an identifiable or identified natural person (e.g. name, address, date and place of birth).

GSI mbH processes personal data that contractual partners and/or participants of courses, examination candidates and other participants of GSI mbH events, make available to GSI mbH (e.g. data that is provided when registering for a course).

In as far as it is necessary for the purposes specified under the following No. 4, GSI mbH also processes data that can be legally obtained from public sources (e.g. Land Registers, commercial registers, registers of associations, records of debtors, the Federal Gazette, the press, the Internet).  

The data that GSI mbH processes decisively depends on the subject of the contract in the contract that is in preparation or that has already been concluded. The following data categories are normally relevant in connection with courses, examinations and other events that are provided by GSI mbH:

• personal data (e.g. name, date of birth, place of birth and nationality);
• contact data (e.g. address, telephone number, fax number, email address);
• qualifications data (e.g. vocational qualifications, vocational qualification/study qualification/degree/course certificates)
• authentication data (e.g. signatures, login data);
• data regarding financial situations (e.g. credit rating data);
• documentation data;
• terms of delivery and payment.

3.    Purpose and Legal Basis of the Processing

Personal data are processed in order to provide contractual or pre-contractual services in the scope of the fulfilment of a contract or in order to implement pre-contractual measures as requested. The legal basis for the processing is Art. 6 para. 1, 1st sentence, letter b) GDPR in this respect.

In as far as GSI mbH is provided with personal data for particular purposes that are not connected to the provision of contractual and pre-contractual performances (e.g. the sending of advertising materials or newsletters), the personal data are processed on the basis of consent that has been granted in the past. The legal basis for the processing is Art. 6 para. 1, 1st sentence, letter a) GDPR in this respect.

GSI mbH also processes the personal data on the basis of Art. 6 para. 1, 1st sentence, letter f) GDPR in order to safeguard its justified interests, fundamental rights and its fundamental freedoms, in as far as this is necessary and the interests, fundamental rights and fundamental freedoms of the data subject have priority over the justified interest of GSI mbH in the processing of the data. A justified interest of GSI mbH can especially be the following in individual cases:

• the assertion, exercising of legal claims or the defence against such (especially defence against liability claims);
• the ensuring of the GSI mbH IT security and IT operation;
• the development of new customer and business relationships;
• direct marketing measures;
• the prevention and investigation of crimes;
• measures that serve the business management and further development of the services provided by GSI mbH.

5.    Persons with Access Authorization

GSI mbH basically processes personal data within the company. GSI mbH only passes personal data on to third parties if 

• the ordering party/contractual partner, the participant (or the data subject) has issued explicit consent pursuant to Art. 6 para. 1, 1st sentence, letter a) GDPR;
• it should be necessary to pass the personal data on pursuant to Art. 6 para. 1, 1st sentence, letter f) GDPR DS-GVO in order to assert or assert legal claims or defence against such  and if there are no grounds to assume that the data subject has an interest worth protecting with regard to the not passing of the personal data on and this interest has priority;
• there is a legal obligation to passing the personal data on pursuant to Art. 6 para. 1, 1^st sentence, letter c) GDPR;
• the passing of the personal data on pursuant to Art. 6 para. 1, 1st sentence, letter b) GDPR is necessary in the scope of the fulfilment of a contract or in order to implement pre-contractual measures as requested (e.g. during an audit conducted by an external auditing and certification organisation such as DVS-PersZert, TÜV Nord, Frosio etc.)

Should GSI mbH outsource a part of the data processing with the use of service providers and vicarious agents (such as IT service providers, telecommunications service providers), GSI mbH shall subject these order processors (see Art. 28 GDPR) to a contractual obligation to only processing personal data conform with data protection legislation requirements and to ensuring that the rights of the data subject are safeguarded.

No data is transferred to bodies or persons in non-EU member states and this is also not planned.

6.    Duration of the Processing

Personal data shall be deleted and blocked after the purposes stated under No. 4 above no longer exists, this especially being the case should a processing of the data no longer be necessary in order to fulfil a contract or implement pre-contractual measures. GSI mbH observes retention periods stipulated in acts of law and/or fiscal codes. It is therefore possible that further processing could be necessary in individual cases for the following purposes:

• adherence to commercial and fiscal law retention periods, especially the retention periods stipulated in the German commercial code (HGB) and the German fiscal code (APO), this being a maximum period of 10 years;
• obtaining of evidence in the scope of the statutory limitation rules that can have a maximum duration of 30 years pursuant to Sections 195 et seq. of the German civil code (BGB), whereby the standard period of limitation is 3 years.

7.    Your Rights as the Data Subject

The applicable legislation stipulates the data subjects have diverse rights with regard to their personal data. Should data subjects wish to assert these rights, they are to file an informal application, sent to the address stated under No. 1 (“Contact Data of the Responsible Party”) together with a clear identification of their person.

The rights are as follows:

7.1  Confirmation and information right

Data subjects have the right at all times to be provided with confirmation as to whether their personal data is being processed. Should this be the case, they also have the rights to request information concerning the personal data that is stored in addition to a copy of these data categories.

There is also a right to the following information:

• the processing purpose;
• the personal data categories that are being processed;
• the recipient or category of recipients to whom the personal data are made known or to whom it shall be made known, especially in cases where the recipients are in non-EU member states or are international organisations;
• if possible, the planned duration during which the personal data are stored or should this not be possible, the criteria for the determination of this duration;
• the existence of a right to amend or delete the personal data or to restrict the processing by the responsible party or the existence of the right to object to this processing;
• the existence of the right to file a complaint with a supervisory authority;
• all available information regarding the origin of the data should the personal data not have been collected from the data subject;
• the existence of an automated decision making including profiling pursuant to Art. 22 paras. 1 and 4 GDPR and – at least in these cases – meaningful information concerning the logic involved in addition to the extent and and envisaged effects of such a processing for the data subject.

Should personal data be transferred to bodies or persons in a non-EU member state or to international organisations, the data subjects have the right to be informed of the pertinent warranties pursuant to Art. 46 GDPR in connection with the transfer.

7.2  Amendment Right

Data subjects have the right to demand the amendment of incorrect personal data without delay. Data subjects also have the right to demand the completion of incomplete personal data – including in the form of a supplementary declaration –, taking the purpose of the processing into account.

7.3 Deletion right ("right to be forgotten")

Pursuant to Art. 17 para. 1 GDPR, data subjects have the right to demand that their personal data be deleted without delay. GSI mbH is then obliged to delete the personal data should one of the following grounds exist:

• the personal data are no longer required for the purpose for which they were collected or processed in another form;
• the data subject revokes his approval, this having been the basis for the processing pursuant to Art. 6 para. 1, 1^st sentence, letter a) GDPR or Art. 9 para. 2, letter a) GDPR in the past, and no other legal basis for the processing exists;
• the data subject files an objection to the processing pursuant to Art. 21 para. 1 GDPR and no overriding legitimate interests exist for the processing, or the data subject files an objection to the processing pursuant to Art. 21 para. 2 GDPR;
• the personal data were processed without justification;
• the deletion of the personal data is necessary in order to meet a legal obligation stipulated in Union law or the law of the member state that GSI mbH is subject to;
• the personal data were collected in connection with services offered by the information society pursuant to Art. 8 para. 1 GDPR.

Should GSI mbH have published the personal data that is to be deleted pursuant to Art. 17 GDPR, it is to adopt measures that are deemed to be reasonable when taking the available technology and the implementation costs (including of a technical kind) into account, that serve to inform responsible third parties that are responsible for the data processing and that also process the personal data, that the data subject has demanded the deletion of all links to this personal data or of copies or replications of this personal data.

7.4  Right to restrict the processing

Data subjects have the right to restrict the processing should one of the following requirements be given:

• the data subject disputes the correctness of the personal data, this being for a duration that enables GSI mbH to validate the correctness of the personal data;
• the processing is unlawful and the data subject has refused to have the personal data deleted and has demanded a restricted use of the personal data;
• should the personal data no longer be required for processing but the data subject requires the data for the purpose of asserting or exercising legal claims or defence against such;
• the data subject has filed an objection to the processing pursuant to Art. 21 para. 1 GDPR, as long as it is not certain whether the justified grounds of our company have a higher priority than those of the data subject.

7.5  Right to data transferability

Data subjects have the right to receive their personal data that has been made available to GSI mbH in a structured, standard and machine-readable format. Data subjects also have the right to transfer this data to another responsible person without impairment by GSI mbH in as far as

• the processing is based on consent pursuant to Art. 6 para. 1, 1^st sentence, letter a) GDPR or Art. 9 para. 2 letter a) GDPR or a contract pursuant to Art. 6 para. 1, 1^st sentence, letter b) GDPR

and

• the processing is carried out by automated means.

When exercising the right to data transferability in accordance with the 1st paragraph, data subjects have the right to have the personal data transferred to another responsible party by GSI mbH direct, in as far as this is technically feasible.

7.6  Right to object

Should grounds exist in their personal situation, data subjects have the right to object to the processing of their personal data at all times when such is processed on the basis of Art. 6 para. 1, 1^st sentence, letter f) GDPR. GSI mbH shall then no longer process the personal data other than in cases where GSI mbH can provide proof of the existence of grounds for the processing that are worthy of protection and have priority over the interests, rights and freedoms of the data subject, or should the processing serve the assertion or exercising of legal claims, or defence against such.

Should personal data be processed for the purpose of direct marketing (especially product recommendations), data subjects have the right to file an objection against the processing of his personal data for the purpose of such advertising.

7.7  Right to revoke consent provided pursuant to data protection law

Data subjects have the right to revoke consent that has been provided for the processing of personal data, this also being possible in parts – with effect for the future (by email sent to our email address as stated in Section I). General statutory permission remains unaffected by the revocation however. It is therefore possible that a continued processing of the data can still be permissible despite a revocation, should general statutory permission exist.

7.8  Right to file a complaint with a supervisory authority

Data subjects have the right to file a complaint with a supervisory authority, especially in the member state that is their place of abode, their place of work or the place in which the supposed infringement has taken place, should they be of the opinion that the processing of their personal data is unlawful.

8.    Obligation to Make Data Available

Contractual partners and/or participants in courses, examination candidates and participants in other GSI mbH events, are to make such personal data available to GSI mbH as is required in the scope of courses, examinations and other events that are organised by GSI mbH in their training facilities, in order to fulfil a contract or implement pre-contractual measures and the related contractual and pre-contractual obligations. Without this data, GSI mbH shall be unable to conclude a corresponding contract or execute the same.

9.    Automated Decision Making and Profiling

GSI mbH does not implement a fully automatic decision making system pursuant to Art. 22 GDPR. GSI mbH also does not use personal data for profiling.

Data protection information