Privacy Notice for Business Partners
Last Updated January 2023
Grover Group attaches great importance to the protection of personal information and privacy.
This privacy notice is addressed to our existing or potential business partners (“you”) to inform you how we process personal data of you or of your employees, owners or representatives, etc. acting as or on behalf of you (“other individuals concerned by the processing of personal data”).
This privacy notice provides you with information relating to which personal data we collect, the reasons why we use and share such data, how long we keep it, what the rights of the data subjects are and how they can exercise them.
1. Controller
Grover Group GmbH, Potsdamerstraße 125, 10783 Berlin, Germany, e-mail: [email protected] (hereinafter referred to as “Grover Group”, “we”, “our”, or “us”) is responsible, as a controller, for collecting and processing your personal data in relation to our business activities.
2. Data Protection Officer
We hereby inform you that you and/or any other individual concerned by the processing of personal data can contact our Data Protection Officer to request any additional information or clarification at:
datenschutz nord GmbH
Branch office Berlin
Kurfürstendamm 212
10719 Berlin
E-Mail: [email protected].
3. Legal bases and Purposes
We process personal data in accordance with the provisions of the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).
The processing of personal data may arise from implementing pre-contractual measures that precede a contractually regulated business relationship or from fulfilling obligations resulting from a contract concluded with you. This may include, for example, the processing of purchase orders, deliveries or payments, or the preparation and response to quotation requests from individuals, to determine the establishment or terms of a contractual relationship. We may further use personal data for answering your inquiries in connection with our business relationship (Article 6 para. 1 lit. b GDPR). Further details regarding the purpose of data processing within the scope of contracts can be found in the respective contract documents.
In addition, Grover Group is subject to various legal obligations that may make the processing of personal data necessary (Art. 6 para. 1 lit. c GDPR). These legal obligations may arise, for example, from tax law, commercial and trade law regulations, etc.
Moreover, it may be necessary to process personal data to protect our legitimate interests (Art. 6 para. 1 lit. f GDPR). The legitimate interests are, in particular, the conclusion or execution of contracts and other business relations with you which requires the processing of personal data of your representatives or employees acting on behalf of you. Furthermore, legitimate interests include the response to your inquiries outside of a contract or pre-contractual measures, internal administrative purposes (e.g. accounting purposes) or to ensure IT security and operations, as well as to conduct compliance investigations, to ensure building and facility security or to assert, exercise or defend legal claims.
If you and/or any other individual concerned by the processing of personal data have given us your/their consent to process personal data for specific purposes, the legality of this processing is based on the consent (Art. 6 para. 1 lit. a GDPR). The consent can be revoked at any time. Please note that the revocation is only effective for the future.
In the context of our business relationship, you must provide those personal data that are necessary for the establishment, implementation and termination of a business relationship and for the fulfilment of the associated obligations, which we are required by law to collect or are entitled to collect on the basis of legitimate interests. Without this data, we will generally not be able to contact you and/or enter into a business relationship with you. Where the provision of personal data is necessary, we will indicate this accordingly during the data collection process.
4. Categories of Personal Data
Depending on the type of business relationship that we have with you, we collect various types of personal data, including:
Contact information, such as full name, work address, work phone number, work mobile phone number, work fax number and work email address;
Payment data, such as data necessary for processing payments and fraud prevention;
Further information necessarily processed in a project or contractual relationship with Grover Group or voluntarily provided by you, such as personal data relating to orders placed, requests, and project details;
Personal data collected from publicly available resources, integrity databases and credit agencies; and
If required by law for compliance reasons, all publicly available information such as trade register excerpts, press coverage, financial information and information about relevant and significant litigation or other legal proceedings against you.
5. Recipients of your personal data
Within our company those departments that need access to personal data to fulfil our contractual and legal obligations are granted access to personal data.
We will pass on personal data to the following categories of recipients if this is necessary to fulfil a contractual relationship with you or to carry out pre-contractual measures (Art. 6 para. 1 sentence 1 lit. b GDPR) or to safeguard legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR):
IT service providers, especially software as a service, hosting, storage and cloud computing providers
Payment service providers and credit institutions for the collection of a charge or the provision of a payment service
Collection agency for the enforcement of claims
Service providers who support us in risk analysis and fraud prevention
External accountants, tax consultants, insurance companies and legal service providers.
Insofar as processing is necessary to safeguard legitimate interests, for example when using IT services, our legitimate interest is to outsource functions.
In addition, personal data will be passed on to third parties if you and/or any other individual concerned by the processing of personal data have expressly consented to the transfer beforehand (Art. 6 para. 1. lit. a GDPR), or if we are obliged to do so by law (Art. 6 para. 1 lit. c GDPR). Where data is processed by order processors on our behalf, these are carefully selected in each case, are also audited by us and are contractually obligated in accordance with Art. 28 GDPR.
6. Data transfer to third countries
For the processing of personal data we also use service providers located in third countries outside the European Union or the European Economic Area (EEA). The transfer will only take place if the third country has been confirmed by the EU Commission to have an adequate level of data protection, if we have provided for appropriate guarantees for the protection of your personal data (for example, by concluding EU standard contractual clauses with the data recipient and conducting a transfer impact assessment), or if you and/or any other individual concerned by the transfer of personal data have given your/their consent in accordance with the requirements of Article 49 GDPR.
7. Retention period
Personal data will be processed according to the legal regulations and deleted in accordance with the intended deletion periods.
As far as necessary, we process and store personal data for the duration of our contractual relationship with you, which also includes, for example, the initiation and execution of a contract. Please note that the contractual relationship may also be a continuing obligation.
In the case of contractual relationships, but also in the case of other civil law claims, the storage period is also governed by the statutory limitation periods, which, for example, according to §§ 195 ff. of the German Civil Code (BGB), are usually three years, but in certain cases can be up to thirty years.
In addition, we are subject to various storage and documentation regulations, which result from the German Commercial Code (HGB) and the German Fiscal Code (AO), among others. The periods of retention or documentation specified there are six years for correspondence in connection with the conclusion of a contract and 10 years for accounting records and business letters (§§ 238, 257 para. 1 and 4 HGB, § 147 para. 1 and 3 AO).
8. Data subject rights
You and/or any other individual concerned by the processing of personal data have the following data subject rights with respect to us regarding personal data relating to yourself/themselves:
Right to access (Art. 15 GDPR, Sections 29 (1) sentence 2, 34 BDSG): The data subject can request the confirmation as to whether and how we process personal data. In particular, the data subject can request access to the personal information we maintain about them. If the data subject requests such access, we will provide the data subject with all the information as required by law on the purposes of the processing, categories of data processed, categories of recipients, data retention periods, etc. The data subject also has the right to obtain a copy of the personal data undergoing processing.
Right to rectification (Art. 16 GDPR): The data subject can request that we amend or update their personal data where it is inaccurate or incomplete.
Right to erasure (right to be forgotten, Art. 17 GDPR, Section 35 BDSG): The data subject can exercise the right to erasure your personal data where applicable.
Restriction of processing (Art. 18 GDPR): The data subject can request that we restrict the processing of your data, provided that the legal requirements are met.
Data portability (Art. 20 GDPR): If the data subject has provided us with data on the basis of a contract or consent, the data subject may, if the legal requirements are met, request that the data subject has provided us with are handed over in a structured, common and machine-readable format or that we transfer it to another controller.
Right to object (Art. 21 GDPR): The data subject has the right to object to processing by us at any time based on the safeguarding of legitimate interests for reasons arising from their particular situation. If the data subject makes use of the right to object, we will stop processing the data unless we can prove compelling reasons for further processing worthy of protection which outweigh your rights and interests.
Objection to direct marketing: If we process personal data of the data subject for the purpose of direct marketing, the data subject has the right to object to our processing of their data for this purpose at any time. If the data subject exercises the right to object, we will stop processing their data for this purpose.
Right to lodge a complaint with a supervisory authority (Art. 77 GDPR, Section 19 BDSG): The data subject can also lodge a complaint with the competent supervisory authority if the data subject believes that the processing of their data violates applicable law. The data subject can contact the supervisory authority responsible for their place of residence or their country or the supervisory authority responsible for us.
Revocation of consent: If the data subject has given us their consent to process their personal data, the data subject can revoke it at any time with effect for the future. The legality of the processing of their data until revocation remains unaffected.
9. The data subject can exercise their data protection rights here:
You and/or any other individual concerned by the processing of personal data can contact us free of charge if you/they have questions regarding the processing of your/their personal data and/or if you/they want to assert your/their rights as a data subject.
Please contact us at [email protected] or by letter mail to “Potsdamerstraße 125, 10783, Berlin, Germany”.
10. Automated decision-making
As a matter of principle, we do not use fully automated decision-making pursuant to Art. 22 GDPR for the establishment and implementation of our contractual relationship. Should we use these procedures in individual cases, we will inform you about this separately if this is required by law.