Responsible is

CADENAS Konstruktions-,
Softwareentwicklungs-
und Vertriebs GmbH

Schernecker Str. 5
86167 Augsburg
GERMANY
Phone +49 821 2 58 58 0-0
Fax +49 821 2 58 58 0-999
info@cadenas.de
www.cadenas.de

You can reach our external Data Protection Officer at

CADENAS Konstruktions-,
Softwareentwicklungs-
und Vertriebs GmbH

Att. Data Protection Officer
Schernecker Str. 5
86167 Augsburg
GERMANY

dataprotection@cadenas.de
www.cadenas.de

We process personal data we receive in the course of our business relationship with our members or others concerned. In addition, we process – as far as necessary to render our services – personal data that we permissibly obtain from publicly accessible sources (e.g. press, Internet) or other third parties (e.g. manufacturers of product catalogs CAD models) from which we are entitled.

Relevant personal data consists of personal details (last name, first name, (company) address, e-mail address and other contact details) and other data voluntarily provided by our members (e.g. profile photo). Moreover, the data can also come through the fulfillment of our contractual obligations (e.g. by download or e-mail related CAD model, number and time of the download and/or  e-mail), advertising and sales data (incl. advertising scores) as well as other data comparable with the above-mentioned categories.

We process personal data in accordance with the provisions of the basic EU data protection regulation (DSGVO) and the Federal Data Protection Law (BDSG)

a. to meet contractual obligations (Art. 6(1)(b)  DSGVO)

Data processing is done for the rendering of host services in the course of performing our contracts with our members or to take pre-contract measures as a result of requests. The purposes of data processing are oriented in the first place towards concrete database research and the resulting requesting and collecting of data (e.g. CAD models) and can include, among other things, the transferring of your data to the respective manufacturer of requested product catalogs due to our license agreements. For further details about data processing purposes, see the relevant contract documents as well as the terms and conditions of use.

b. in the course of balancing the interests of parties (Art. 6(1)(f)  DSGVO)

We will process your data as needed beyond the fulfillment of the contract to safeguard our legitimate interests or those of third parties. Examples:

• Testing and optimizing of methods for a requirement analysis in order to address members directly.
• to satisfy legal claims and for defense in legal disputes,
• to safeguard IT security and the company's  IT operations,
• prevention and investigation of criminal offences
• Measures for business management and the further development of services and products,
• Risk management in the company.

c. subject to your consent (Art. 6(1)(a)  DSGVO)

Insofar as you have consented to the processing of your personal data for certain purposes (e.g. the volunteering of your profile picture, newsletter, advertising or market and opinion research), the legality of that processing is given on the basis of your consent.  Your given consent can be withdrawn at anytime. This also applies to the withdrawal of consents which were given to us before the application of the GDPR, that is before 15th May 2018. The withdrawal of a consent applies to the future and has no affect on the legality of data processed up to the withdrawal.

The areas within the company which have access to your data if needed to meet our contractual and legal obligations. Services providers and agents we use for order processing can receive the data for that purpose, sofar as they observe data secrecy. Those are companies in the categories of IT services, logistics, print services, telecommunication, collection, consultation as well as sales and marketing.

Other data recipients can be those places for which you gave us your consent to transfer data or for those due to our contractual relationship with you and a third party who are authorized to transfer personal data within a balancing of interests. We are authorized to do so in meeting our contractual obligations (Art. 6(1)(b) DSGVO) and, if necessary, in the course of a balancing of interests (Art. 6(1)(f) DSGVO) to transfer your personal data (e.g. e-mail address and the information of the CAD model you obtained) to the respective manufacturer of the requested product catalog so that he can run an invoice control of the delivery order and also contact you to inform you of faulty and/or updated CAD models.

Moreover, we provide for each manufacturer of the product catalog requested statistics of usage behavior (e.g. number of downloads, sector, location). The manufacturer can process your data for advertising, marketing or opinion research as an independent person responsible i.S.d. DSGVO within his justified interests according to Art. 1 f DSGVO, provided you have not objected to the use of your data for these purposes. An objection in this case is to be made directly to the manufacturer

A data transfer to countries outside of the European Union (so-called third countries) will take place if

• it is necessary for the providing of CAD models from our database which have been ordered,
• it is prescribed by law (e.g. fiscal reporting obligations) or
• you have given us your consent

In addition, a transfer to places in third countries is foreseen in the following cases:

• If necessary in individual cases, your personal data might be transferred to an IT provider in the USA or another third country to ensure the company's IT operations in compliance with the European level of data protection.
• CADENAS subsidiaries in third countries will receive your personal data only if they have obligated themselves to maintain a suitable level of data protection in EU standard contractual clauses.

We will process and store your personal data as long as needed to meet our contractual and legal obligations.

If the data is no longer needed to meet contractual or legal obligations, the data will be deleted at regular intervals, unless further processing, for a limited time, is necessary for the following purposes:

• Fulfillment of commercial and fiscal retention obligations resulting, for example, from: commercial code (HGB), tax code (AO). The specified deadlines for retention and documentation are usually six to ten years.
• Keeping of evidence according to the statute of limitations. As per §§ 195 of the Civil Code (BGB), statutes of limitation can be up to 30 years, although the regular statute of limitations is 3 years.

Each person concerned has the right to information as per Article 15 DSGVO, the right to correction as per Article 16 DSGVO, the right to cancellation as per Article 17 DSGVO, the right to limitation of processing as per Article 18 DSGVO, the right to contradiction as per Article 21 DSGVO as well as the right to data portability as per Article 20 DSGVO. For the right to information and cancellation, the limitations as per §§ 34 and 35 BDSG apply. Moreover, there is a right of appeal to a responsible data protection supervisory authority (Article 77 DSGVO in  conjunction with § 19 BDSG).

Consent given for the processing of personal data can be revoked at anytime. This also applies to the withdrawal of consents which were given to us before the application of the DSGVO, that is before 25th May 2018. Please note that the revocation becomes effective only for the future. Processings that took place before the revocation are not affected.

Detailed information about your data protection rights can be obtained from our general data protection declaration starting at chapter XIV.

Within the scope of our business relationship, you must provide personal data needed for the start, performing and end of a business relationship and to meet contractual obligations necessary thereby or if we are legally required to collect the data. Without the data, we will normally not be able to conclude, perform and end a contract with you. You conclude a use / license agreement when requesting CAD models on our portal.

When entering and implementing a  business relationship, in principle no fully-automated decision making is used as per Article 22 DSGVO. Should we use such methods in individual cases, we will inform you of the same and separately about your rights, provided this is legally mandated.

We process your data in part automatically with the aim to evaluate certain personal aspects (profiling). We use profiling in the following cases:

• We use evaluation tools to be able to inform and give advice about products. They enable needs-based communication and advertising, including marketing and opinion research.