Data protection notice pursuant to Article 13 GDPR

Data protection notice pursuant to Article 13 GDPR

The protection of your personal data is of the utmost importance to us. We therefore only process your personal data (“data”) on the basis of the statutory provisions. We have prepared this privacy policy to inform you in detail, in accordance with Article 13 of the European General Data Protection Regulation (EU GDPR), about how we process your data within our company and also about the data protection rights and remedies available to you under data protection law.

Carl Beutlhauser Baumaschinen GmbH
Tittlinger Straße 39
94034 Passau
Phone: +49 (0)851 7000-0
Fax: +49 (0)851 7000-6139
Senior management team: Dr. Thomas Burgstaller, Matthias Burgstaller, Oliver Sowa

The internal data protection officer is
Christian Volkmer
Projekt 29 GmbH & Co. KG
Ostengasse 14
93047 Regensburg
Phone: +49 (0)941 2986930


2. Which data are processed and from what sources do these data originate?

We process the data that we have received from you when contracts are being initiated or processed, on the basis of consents, or as part of your job application process with us and/or within the context of your employment with us.

The personal data include:

Your master/contact data. For customers, this includes, for example, first name and surname, address, contact data (email address, phone number, fax), bank data.

For job applicants and employees, this includes, for example, first name and surname, address, contact data (email address, phone number, fax), date of birth, data from your CV and job references, bank data, religious faith.

For business partners, this includes, for example, the names of the persons authorized to represent your company in legal transactions, your company name, commercial register number, VAT ID number, company number, address, contact details of contact persons (email address, phone number, fax), bank data.

We also process the following other personal data:

  • Information on the type and content of contract data, order data, sales and document data, customer and supplier history, as well as discussion documents,
  • Advertising and sales data,
  • Information from your electronic communications with us (e.g. IP address, log-in data),
  • Other data that we have received from you within the context of our business relationship (e.g. in customer meetings),
  • Data which we ourselves generate from master/contact data as well as other data, such as, for example, through customer requirements and customer potential analyses,
  • The documentation relating to your declaration of consent concerning the receipt of e.g. newsletters.


3. For what purposes and on what legal basis are the data processed?

We process your data in accordance with the provisions of the General Data Protection Regulation (GDPR) and the Federal Data Protection Act of 2018 (Bundesdatenschutzgesetz 2018), as amended:

  • In order to fulfill (pre-)contractual obligations (Article 6 (1) (b) GDPR):
    When processing contracts, your data are processed online or in one of our branches; when processing contracts relating to your employment your data are processed within our company. Data are in particular processed when initiating business and when executing contracts with you.
  • In order to comply with legal obligations (Article 6 (1) (c) GDPR):
    It is necessary to process your data in order to fulfill different legal obligations (e.g. under the German Commercial Code [Handelsgesetzbuch] or the German Fiscal Code [Abgabenordnung]).
  • In order safeguard legitimate interests (Article 6 (1) (f) GDPR):
    Due to a balancing of interests, data can be processed beyond the actual performance of a contract in order to safeguard our legitimate interests or those of third parties. The following are examples of cases where data are processed to safeguard legitimate interests:
    – Advertising or marketing (see 4.),
    – Measures in the context of business management and the further development of services and products,
    – Maintenance of a group-wide customer database to improve customer service
    – In the context of legal proceedings.
  • Within the context of consent granted by you (Article 6 (1) (a) GDPR):
    If you have granted us consent to process your data, e.g. for the purpose of sending our newsletter.

Processing of personal data for advertising purposes

You may object to the use of your personal data for advertising purposes at any time, either on an overall basis or for individual measures, without incurring any costs other than the transmission costs in accordance with the basic tariffs.

In accordance with the statutory requirements under Section 7 (3) of the German Act against Unfair Competition [Gesetz gegen den unlauteren Wettbewerb, UWG], we are entitled to use the email address that you provided upon conclusion of the contract in order to carry out direct advertising for our own similar products or services. You receive these product recommendations from us irrespective of whether you have subscribed to a newsletter. If you do not wish to receive such recommendations from us by email, you can object to the use of your address for this purpose at any time, without incurring any costs other than the transmission costs in accordance with the basic tariffs. A notification in text form is sufficient in such case. An unsubscribe link is of course also provided in every email.


5. Who receives my data?

If we use a service provider for contracted data processing, we nevertheless remain responsible for protecting your data. All external processors are contractually obligated to treat your data confidentially and to process them only within the context of providing performance. The external processors commissioned by us receive your data where they require them in order to provide their respective performance. These include, for example, IT service providers that we require for the operation and security of our IT system, as well as advertising and mailing companies that we use for our own advertising campaigns.
Your data are processed in our customer database. The customer database helps enhance the quality of the available customer data (duplicate cleansing, distorted/defunct indicators, correction of addresses) and enables enrichment with data from public sources.
These data are made available to the group companies where this is required for contract processing. Customer data are stored separately and at company level, whereby our parent group acts as service provider for the individual participating companies.
Your data may be received by authorities and courts as well as by external auditors where a statutory obligation exists and also for the purpose of legal proceedings.
In addition, insurance companies, banks, credit reference agencies and service providers may receive your data for the purpose of contract initiation and contract fulfillment.


6. How long are my data stored for?

We process your data until the business relationship ends or until the valid statutory retention periods (for example under the German Commercial Code, the German Fiscal Code, the German Residential Home Act [Heimgesetz] or the German Working Hours Act [Arbeitszeitgesetz) expire. We also process them until any legal disputes where the data are needed as evidence have been concluded.


7. Are personal data transmitted to a third country?

In principle, we do not transmit any data to a third country. If they are transmitted in an individual case, they are transmitted only on the basis of an adequacy decision of the European Commission, standard contract clauses, suitable guarantees, or your express consent.


8. What data protection rights do I have?

You have a right to information on, rectification of and erasure of your saved data, a right to restrict its processing, a right to object to its processing and a right to data portability and to lodge a complaint in accordance with data protection law.

Right to information:
You can demand information from us as to whether and to what extent we process your data.

Right to rectification:
If we process your data and it is incomplete or incorrect, you can demand from us at any time that we rectify it or complete it.

Right to deletion:

You can demand from us that we delete your data if we are processing it unlawfully or the processing of your data impinges unduly on your legitimate interests. Please note that there may be reasons not to delete the data immediately, for example in order to comply with statutory data retention provisions. Regardless of the exercising of your right to deletion, we will delete your data completely and without delay as long as there is no transactional or statutory obligation to retain the data.

Right to limitation of processing:
You can demand that we limit the processing of your data if

  • you dispute that the data is correct and allow us enough time to check that the data is correct.
  • the processing of the data is unlawful, but you refuse to allow it to be deleted and instead demand that its use be limited,
  • we no longer require the data for the intended purpose, but you still need this data to assert or defend legal claims; or
  • you have objected to the processing of the data.

Right to data portability:
You can demand from us that we make the data you have provided to us available in a structured, common, machine-readable format and that you can transmit this data to a different controller without hindrance from us provided

  • we are processing this data on the basis of your revocable approval or to fulfill a contract between us; and
  • the data is being processed with the help of automated procedures.

If it is technically feasible, you can demand that we transmit your data directly to a different controller.

Right to object:
If we are processing your data on the basis of legitimate interests, you can object to this at any time; this would also apply to profiling based on these provisions. We then no longer process your data unless we can establish that there are compelling legitimate grounds for processing the data that outweigh your interests, rights and freedoms or that processing the data serves to assert, exercise or defend legal claims. You can object to the processing of your data for the purpose of direct mail at any time without specifying reasons.

Right of appeal:
If you are of the opinion that we are infringing German or European data protection law by processing your data, we request that you contact us to resolve any issues. You do of course also have the right to contact supervisory authority with responsibility for you, which in Germany is the relevant federal state office for data protection supervision.

If you want to assert the above rights against us, please contact our data protection officer. In cases of doubt, we may request additional information to confirm your identity.


9. Am I obliged to provide data?
We need to process your data in order to conclude and/or fulfill the contract you enter into with us. If you do not provide these data to us, then as a general rule we will have to refuse to conclude the contract or we will no longer be able to continue to execute an existing contract and will thus be obliged to terminate it. However, you are not obliged to consent to the processing of data that are not relevant to contract fulfillment or that are not required by law.