DATA PROTECTION NOTICE FOR BUSINESS PARTNERS

SECTION 1 INFORMATION ON THE CONTROLLER AND THE DATA PROTECTION OFFICER / DATA PROTECTION POINT OF CONTACT

(1) Burger Söhne Trading AG and the affiliated companies of Burger Group ("Burger Söhne Trading AG", "we" or "our") provides this Business Partner Data Protection Notice ("Notice") to explain our practices as the responsible controller regarding the processing of personal data relating to our vendors, customers, suppliers, and other business partners (collectively, "Business Partners") and our Business Partners' employees.

(2) The information contained herein applies to you if you are a Business Partner of as an individual (e.g., a consultant or sole entrepreneur) or if you are an employee of a Business Partner who interacts with Burger Söhne AG on such Business Partner's behalf.

(3) The entity legally responsible for processing your personal data is the group company or our group you have entered into a contract with or are discussing a contract.

(4) The contact information for the data protection officer at Burger Söhne Trading AG and data protection contact for other group companies is as follows: datenschutz@dannemann.com.

(5) The representative of Burger Söehne Trading AGin the European Union is: DANNEMANN El Noble Cigarro GmbH, Rahdener Straße 147, 32312 Lübbecke (Germany), datenschutz@dannemann.com.

SECTION 2 CATEGORIES OF PERSONAL DATA AND SOURCE

Burger Söhne Trading AG processes the following categories of personal data about you that we have obtained from you or from authorized third parties (e.g., your supervisor, public authorities or public resources):

  • Personal data relating to Business Partners who are individuals: name, business contact details, services or goods provided or offered, contract details, content of communication (such as email or business letters), payment information, invoice information, and business relationship history
  • Personal data relating to an employee of a Business Partner: name, business contact details, employer name, title/position, and content of communication (such as email or business letters)

SECTION 3 PROCESSING PURPOSES, LEGAL BASIS AND CONSEQUENCES

(1) Your personal data is processed for purposes of performing the contractual relationship with the Business Partner (including fulfilling the contractual obligations, invoice processing, communication, and legal and compliance activities), for purposes of marketing and CRM activities, and for security and fraud prevention activities. Burger Söhne Trading AG relies on the following legal bases for such processing activities:

  • Performance of the contractual relationship with the Business Partner (Art. 6 lit. b GDPR);
  • legitimate interest of Burger Söhne Trading AG, affiliates or other third parties (such as governmental bodies or courts) (Art. 6 lit. f GDPR). The legitimate interest could be in particular group-wide information sharing, marketing and CRM activities, prevention of fraud, misuse of IT systems, or money laundering, operation of a whistleblowing scheme, physical security, IT and network security, internal investigations, or potential merger and acquisition activities;
  • consent (Art. 6 lit. a GDPR); and
  • compliance with legal obligations (Art. 6 lit. c GDPR).

(2) The provision of personal data is necessary for the conclusion and/or performance of the Business Partner contract, and is voluntary. However, if you do not provide the personal data, the affected Business Partner management and administration processes might be delayed or impossible.

SECTION 4 CATEGORIES OF RECIPIENTS

(1) Burger Söhne Trading AG may engage service providers, acting as processors, in order to provide IT and other administrative support (e.g., service providers who provide account payable support or IT hosting and maintenance support). Those service providers may have access to your personal data to the extent necessary to provide such services.

(2) Furthermore, Burger Söhne Trading AG may transfer your personal data to its parent entity, Burger Holding AG, in Switzerland and to other group companies within the EU/EEA for purposes of assisting its affiliates as a processor with the operation of information systems for management and analysis of customer relationships and interactions and related general IT support. All recipients are located within the EU/EEA or in countries, such as Switzerland, that provide for an adequate level of data protection within the meaning of Article 45 (1) GDPR as per adequacy decision by the Commission.

(4) Any access to your personal data is restricted to those individuals that have a need to know in order to fulfill their job responsibilities.

(5) Burger Söhne Trading AG may also disclose your personal data as required or permitted by applicable law to governmental authorities, courts, external advisors, and similar third parties.

SECTION 5 RETENTION PERIOD

Your personal data is stored by Burger Söhne Trading AG and/or our service providers, to the extent necessary for the performance of our obligations and for the time necessary to achieve the purposes for which the information is collected, in accordance with applicable data protection laws. When Burger Söhne Trading AG no longer needs to use your personal data to comply with contractual or statutory obligations, we will remove it from our systems and records and/or take steps to properly anonymize it so that you can no longer be identified from it, unless we need to keep your information, including personal data, to comply with legal or regulatory obligations to which Burger Söhne Trading AG is subject.

SECTION 6 AUTOMATED DECISION-MAKING

Burger Söhne Trading AG does not engage in automated decision-making in the context of the buiness relationship.

SECTION 7 DATA SECURITY

We maintain current technical measures to ensure data security, and in particular to protect your personal data against risks in the event of data transfers as well as against it becoming known to third parties. These are appropriately adapted to the current state of technological development in each case.

SECTION 8 YOUR RIGHTS

(1) You have the right to request from us – at any time and free of charge – access to the personal data we have stored concerning you, as well as its origin, the recipients or categories of recipients to whom these personal data are transferred, and the purpose of storage.

(2) In addition, you have the right at any time to request that we rectify, erase or restrict the processing of your personal data. You also have the right to data portability.

(3) You also have the right to object to our processing of your personal data at any time.

(4) If you have provided us with your consent to use personal data, you may withdraw this consent at any time without stating grounds.

(5) If you would like to assert the rights stated above, please send an email to datenschutz@dannemann.com.

(6) You have the right also to file with your competent regulatory authority at any time a grievance against particular instances of data processing

(7) Please note that these aforementioned rights might be limited under the applicable national data protection law.

SECTION 9 AMENDMENTS

We will also adapt this notice on an ongoing basis in the context of the further technical development of our service offering as well as the legal framework. Amendments to this Notice will be published to this end. For this reason we recommend that you read the current version of this Notice on a regular basis. Subject to applicable legal specifications, all amendments to this Notice come into effect as soon as the updated Notice is published. If we have already collected data concerning you and/or we are subject to a legal obligation to inform, we will also inform you of material amendments to Notice and ask for your approval should this be legally required.