Data Protection Declaration
„XeelTech GmbH“

3. Services for customers and business partners

If a contract is concluded between you and us and you subsequently use one of our services or work together with us on a project, we will process the following personal data from you:

• First name, last name
• E-mail address
• Availability by telephone
• Title
• Department
• Position
• Company affiliation and address
• Value added tax identification number
• Contract master data, billing and payment data
• Customer ID
• User name in accordance with our SecureDocs
• Date and time of log-in
• Information regarding the incident / issue

If, for example, other companies of the STIWA Group or Inventus Development GmbH also carry out data processing within the scope of a project and joint responsibility exists in accordance with Article 26 of the Data Protection Regulation, the STIWA companies involved in the project have concluded an agreement to determine which data controller fulfils which data protection obligations within the meaning of the EU Data Protection Regulation. The essential content of this agreement can be made available to the data subject upon request.

The processing of the above-mentioned personal data is carried out for the following purposes:

• Planning, implementation and administration of (contractual) business relations; among other things, for processing incidents, for technical and organisational support, furthermore for inspection, for processing repairs / complaints and for compiling statistics.

Legal basis:

The processing of your personal data for the above-mentioned purposes is based on our legitimate interest pursuant to Art. 6 (1) lit. f GDPR (here: fulfilment of contractual obligations) and is therefore necessary.

Insofar as we are also required to fulfil legal obligations (including commercial or tax regulations), the processing of your personal data on the basis of legal requirements pursuant to art. 6 para. 1 lit. c GDPR also comes into consideration and is in this case also necessary.

Storage period:

Your personal data will be deleted immediately after the purpose ceases to apply, unless you object in advance to the processing of your personal data based on the legitimate interest (Article 21 (1) GDPR) or unless any legal claims or statutory retention periods prevent deletion. Legal retention periods may result, for example, from commercial and tax law retention obligations (up to 7 years).

Recipient:

• STIWA companies / Inventus Development GmbH, insofar as this is necessary to achieve the above-mentioned purpose: Please note that in this case, data may also be transferred to companies in a third country (United States of America / China) on an ad hoc basis. A transfer to a third country is only permitted if there are appropriate guarantees for the protection of your personal data. For this reason, we have recourse to standard contractual clauses of the European Commission: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc/standard-contractual-clauses-international-transfers_de
• IT service providers, if they have to be used for the maintenance and support of our data processing equipment. Corresponding contracts (order processing contracts or, in the case of a third country transfer, standard contractual clauses of the EU Commission) have been concluded with them, which oblige them to comply with legal requirements.
• Third parties (including courts, tax authorities, supervisory authorities), insofar as this is legally permissible and necessary to comply with applicable law or to assert, exercise or defend legal claims.

Your data protection rights:

In the case of legitimate interest, you have the right of objection at any time in accordance with Art. 21. For more information on this, but also on the other rights you have, please see Section B – Point 5 of this Privacy Policy.

• Web Shop / Sale

If you wish to purchase our products / services directly and use our web shop, the following personal data will be processed by us:

• Name, first name, title (optional)
• Customer number – if already available
• Availability by telephone
• E-mail address
• Address
• Log files / logging data
• Contract master data
• Bank/ – financial data (including information on the method of payment, VAT identification number)
• Information on the intended use of the product (optional)

The above-mentioned personal data is processed for the following purposes:

• Sale and distribution of goods and services
• Execution and processing of payment

Legal basis for the processing of your personal data:

The processing of your personal data is based on the legal basis of pre-contractual measures pursuant to Art. 6 (1) lit. b GDPR and is therefore necessary. Apart from this, there are a number of laws that oblige us to process your personal data; these include:

Furthermore, in the context of the fulfilment of contractual, as well as legal obligations, there is a legitimate interest in accordance with Art. 6 para. 1 lit. f GDPR to process your personal data and is therefore necessary.

Storage period:

After the purpose has ceased to apply, your personal data in this context will be stored for 7 years due to statutory retention periods (including §132 of the Federal Tax Code), but processing will be restricted.

Recipients:

• IT service providers (e.g. for maintenance and support of the data processing equipment used here) An order processing agreement has been concluded with these service providers, which obliges them to comply with legal requirements. If a service provider we use is based in a third country (non-EU/EEA), we have concluded standard contractual clauses of the EU Commission https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc/standard-contractual-clauses-international-transfers_de to ensure the protection of your personal data in the context of an ad hoc transfer to a third country.
• Third parties if this is necessary to comply with applicable law or to assert, exercise or defend legal claims (including courts, authorities, and legal advisors).
• Service providers (e.g. for the dispatch of products ordered by you or for the processing of payment transactions PayPal.

PayPal (Europe)

If you purchase a product from us, we offer PayPal as one of the payment options. PayPal is a service of the provider of the same name, PayPal (Europe) S.à.r.l. et Cie, (S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg); hereinafter “PayPal”. In this case, we pass on the following personal data to PayPal:

• First name, last name
• Address
• E-mail address
• Telephone number
• Bank account data

Note: PayPal acts as a data controller in the sense of Art. 4 No. 7 GDPR. For more information regarding the processing of your personal data by PayPal, please see PayPal Privacy Policy.

Legal basis:

The legal basis for the processing of your personal data is the legitimate interest pursuant to Art. 6 Para. 1 lit. f GDPR. The legitimate interest on our part is the provision of an efficient and secure payment method.

Note: The processing of the data provided in this section is not required by law or contract. However, we cannot carry out a payment via PayPal without the transmission of your personal data.

Storage period

Your personal data will be processed and stored until the payment process has been completed. This includes the processing of refunds, claims and fraud prevention. Subsequently, your personal data will be stored for a limited period of 7 years due to legal retention periods (including §132 Bundesabgabenordnung-BAO) and subsequently deleted.

Recipient:

Apart from PayPal itself, no data is transferred to third parties unless you have given your express consent.

Your data protection rights:

In the case of legitimate interest, you have the right to object at any time in accordance with Art. 21 GDPR. You can find more information under section B point 5 – Individual right of objection of this data protection declaration.

• Virtual meetings (video conferences)

In the context of meetings, XeelTech also makes use of virtual means of communication (Microsoft Teams web conferences), in which your voice is transmitted via microphone and, if necessary, your image is also transmitted via webcam to all other meeting participants (hereinafter referred to as “online meetings”). For this purpose, we use service providers with whom – if necessary – corresponding data protection agreements have been concluded.

We would also like to point out that the type and amount of personal data that is processed depends, on the one hand, on the functional scope of the video conferencing system itself and, on the other hand, on you as a user or meeting participant, i.e. which data you provide.

The following personal data may be processed:

• Display name
• E-mail address
• Status (optional)
• Status messages (optional)
• Profile picture (optional)
• Language
• Date and time
• Duration of the meeting
• Meeting ID
• Phone number – event related
• Location data – event-related
• Text, audio, video and other multimedia data
• Audio or video recordings
• Shared content (e.g. links, documents)

Note: During a videoconference, data from the microphone, a webcam or a screen display of your terminal (using the screen/content sharing function) is processed for the display of video signals, the playback of audio signals and multimedia data; e.g. if you are giving a presentation. The meeting participant can independently switch the microphone and/or the camera on and off at his or her terminal device at any time; furthermore, the screen/content sharing function must also be actively activated and terminated by the user. In addition, the user may also have recourse to the chat function.

Your personal data is processed for the following purpose:

• Ensuring smooth communication and implementation of telephone conferences, online meetings, video conferences, training courses and webinars (“online meetings”).
• Documentation and logging of questions to be clarified or results during the online meeting or for training purposes, in order to train persons who could not participate in the online meeting afterwards or for self-study.

Legal basis:

The legal basis for the processing of your personal data is the legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR. The legitimate interest in this case lies, among other things, in ensuring functionality, smooth communication and the implementation of online meetings with our business partners, and subsequently also contractual obligations.

The processing of your personal data in the context of recordings is based on the legal basis of your consent pursuant to Art. 6 (1) lit. a GDPR. If a recording is planned, we will inform you of this in a transparent manner and obtain your consent in advance.

Storage period:

Your user data will be stored by us for as long as, for example, a business relationship with you exists and subsequently no legal retention periods or any legal claims conflict with a deletion.

Meeting data and text, audio or video data, insofar as no recording took place but there was processing apart from this, are automatically deleted after 90 days following the end of the online meeting.

If the online meeting was recorded with your consent, we store this data after the end of the online meeting until the purpose no longer applies and delete it afterwards, unless there are legal retention periods or any legal claims or you have revoked your consent in advance.

Automated decision-making pursuant to Art. 22 GDPR is not used.

Recipients:

• STIWA companies / Inventus Development GmbH, insofar as this is necessary to achieve the above-mentioned purpose: Please note here that in this case, data may also be transferred to companies in a third country (United States of America / China) on an ad hoc basis. A transfer to a third country is only permitted if suitable guarantees are in place to protect your personal data. For this reason, we have recourse to standard contractual clauses of the European Commission: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc/standard-contractual-clauses-international-transfers_de
• IT service providers who may be required to conduct online meetings or to maintain and support the data processing equipment used here. Corresponding agreements were concluded with these
• Third parties; (e.g. external participants, courts) if we are legally obliged to do so or you have given your express consent.

Note: Within our technical possibilities, we have limited the storage locations to data centres within the EU/EEA. Thus, the processing of your personal data does not take place outside the borders of the EU/EEA. However, we cannot technically completely rule out routing or storage on servers outside the European Union at the processor Microsoft.

Note / information in line with the use of Microsoft Teams (“MS Teams”):

If you call up the corresponding Microsoft website (https://teams.microsoft.com/) to download the necessary MS Teams software, “Microsoft” is responsible for data processing. Calling up this website is only necessary for the download if use should/cannot be made directly and without a download via an Internet browser.

“Microsoft Teams” is a service of Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, United States of America.

The use of MS Teams is generally subject to the usage and data protection provisions of “Microsoft”, over which XeelTech itself has no influence. If recourse is made to MS-Teams, the user must accept the terms of use and data protection provisions of “Microsoft”. If this is not done, the use of MS-Teams is not possible.

You can find Microsoft’s data protection regulations here: https://privacy.microsoft.com/de-de/privacystatement

The terms of use can be found here: https://www.microsoft.com/de-de/servicesagreement/

You can also find further information about Microsoft online services here: https://www.microsoft.com/de-at/trust-center/privacy/customer-data-definitions.

Microsoft Corporation, as one of our IT service providers, receives personal data from the above-mentioned in the context of the online meeting, insofar as this is provided for in the context of our order processing agreement with MS-Teams. With the help of the concluded order processing, on the basis of EU standard contractual clauses, Microsoft is obliged to comply with the legal requirements of the applicable data protection law. A current version can be found at the following link: Licensing Documents (microsoft.com).

Your Data Protection Rights:
In the case of legitimate interest, you have the right to object at any time in accordance with Art. 21, and in connection with your consent, the right of revocation in accordance with Art. 7 (3) GDPR. You can find more information on this, but also on the other rights you have, in section B of this data protection declaration.