Data Processing Policy

You have followed a link to this page to find out how we handle your personal data. In accordance with the information obligations under Articles 12 et seq. of the EU General Data Protection Regulation (GDPR), our data protection information is set out below:

The controller for the purposes of data protection law is

VivaTec
Dirk Heidlindemann
Bünder Fußweg 4
32120 Hiddenhausen

Further company information, details of authorised representatives and additional contact options can be found in our website’s legal notice: https://vivatec.de/impressum/

Types of data and purposes of processing

Where we receive or collect your data, we generally process it only for the purposes for which it was received or collected.
Processing for other purposes is considered only where the legal conditions required under Article 6(4) GDPR are met. We will observe any information obligations arising under Articles 13(3) and 14(4) GDPR.

Legal basis for processing

Unless more specific legal provisions apply, the legal basis for processing personal data is generally Article 6 GDPR. In particular, the following bases may apply:

Consent (Article 6(1)(a) GDPR)
Processing for the performance of contracts (Article 6(1)(b) GDPR)
Processing to comply with a legal obligation (Article 6(1)(c) GDPR)
Processing based on a balancing of legitimate interests (Article 6(1)(f) GDPR)

Where personal data is processed on the basis of your consent, you have the right to withdraw that consent at any time with effect for the future.
Where data is processed on the basis of a balancing of interests, you have the right as a data subject to object to processing of your personal data, subject to Article 21 GDPR.

Retention of personal data

We process your data only for as long as necessary for the relevant purpose.
Where statutory retention obligations apply, for example under the German Commercial Code, Criminal Code or Fiscal Code, the relevant personal data is stored for the required retention period.
Once the retention period expires, we assess whether further processing is necessary. If it is no longer necessary, the data is deleted without delay and the deletion is recorded.
We regularly review whether continued processing is necessary. Due to the volume of data, these reviews generally focus on specific data types or processing purposes.

Disclosure of personal data to third parties

We generally disclose personal data to third parties only where necessary to perform a contractual relationship with you, where disclosure is permitted following a balancing of interests under Article 6(1)(f) GDPR, where we are legally obliged to disclose it, or where you have consented.
As a general rule, under the German Federal Registration Act we are obliged to forward the name, address and date to the competent registration authority when a rental agreement is concluded.
We are also legally obliged to disclose relevant data in response to requests from authorities and other entitled bodies, for example under state police legislation and the German Code of Criminal Procedure.
Your personal data is not transferred to a third country or an international organisation.

Data subject rights

You have the right to request access at any time to your personal data processed by us, in accordance with Article 15 GDPR.
For written access requests, please note that we require evidence of your identity for data protection reasons.

You have the right to have your personal data corrected or completed under Article 16 GDPR.
You also have the right to request erasure under Article 17 GDPR or restriction of processing under Article 18 GDPR at any time, insofar as you are legally entitled to do so.

You have the right to withdraw consent at any time under Article 7(3) GDPR.
You also have a right to data portability within the requirements of data protection law under Article 20 GDPR.

In particular, under Article 21(1) and (2) GDPR you have a right to object to processing of your data in connection with direct marketing where it is based on a balancing of interests.

We do not use processing based on automated decision-making, including profiling, within the meaning of Article 22 GDPR.

Right to lodge a complaint

Under Article 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority if you suspect that our processing of personal data infringes data protection law.