Information pursuant to Articles 13, 14 and 21 of the General Data Protection Regulation (GDPR)
We hereby inform you about our processing of your personal data and your claims and rights under data protection regulations.
1. Controller within the meaning of Article 4(7) GDPR
The controller within the meaning of the GDPR is the Waskönig+Walter company with which you have a contractual or business relationship. An overview of the companies in the group, including their names, addresses and contact details, can be found here: https://www.waskoenig.de/de/datenschutzhinweise-gesellschaften
If you have any questions regarding data protection, please contact our data protection officer:
Carla Holterhus
Email: datenschutz[at]waskoenig.de
2. Purpose and legal basis of data processing
Contract execution
We process personal data that you voluntarily provide to us in the context of initiating and executing a contractual relationship on the basis of Art. 6 (1) lit. b GDPR. This includes, in particular, contact details, contract master data, payment and billing information. Any further processing is based on your express consent in accordance with Art. 6 (1) (a) GDPR. The storage period is based on the statutory retention periods, in particular § 147 AO (German Fiscal Code) and § 257 HGB (German Commercial Code), and is generally ten years after the end of the contract.
Application process
As part of the application process, we process your personal data (e.g. master data, communication data, application documents) for the purpose of deciding on the establishment of an employment relationship in accordance with Section 26 (1) BDSG in conjunction with Art. 6 (1) lit. b GDPR. In the event of rejection, we store your data for six months after completion of the process to safeguard legitimate interests in accordance with Art. 6 (1) lit. f GDPR, in particular to defend against any legal claims under the AGG. Longer storage only takes place with your consent to be included in our applicant pool (Art. 6 (1) lit. a GDPR).
Customer and prospect data
We process your contact details, quotation, order and billing information in accordance with Art. 6(1)(b) GDPR for the purpose of implementing pre-contractual measures and fulfilling contracts. In addition, we use your data for direct marketing for our own products and services on the basis of our legitimate interest in accordance with Art. 6 (1) lit. f GDPR. You can object to this processing at any time (Art. 21 GDPR). Any further use will only take place with your consent (Art. 6 (1) lit. a GDPR). The data is stored in accordance with the statutory retention periods, usually ten years.
Employee data
Within the framework of the employment relationship, we process your personal data for the purpose of implementing the employment contract in accordance with Section 26(1) BDSG in conjunction with Art. 6(1)(b) GDPR. Further processing is carried out on the basis of consent in accordance with Art. 6 (1) (a) GDPR or to fulfil legal obligations in accordance with Art. 6 (1) (c) GDPR. The storage period is based on the statutory retention obligations, usually ten years after the end of the employment relationship.
Supplier data
We process personal data of our business partners and suppliers, in particular contact details, order and payment information, for the purpose of initiating and executing contractual relationships. Processing is carried out on the basis of Art. 6 (1) lit. b GDPR. Additional data processing is carried out on the basis of your consent in accordance with Art. 6 (1) lit. a GDPR. The storage period is generally ten years in accordance with Section 147 of the German Fiscal Code (AO) and Section 257 of the German Commercial Code (HGB).
3. Recipients of your personal data
Personal data is only passed on within our company to those departments that need it to fulfil contractual and legal obligations or in the context of processing and implementing our legitimate interests. In addition, external recipients will only receive your data to the extent that this is permissible for the fulfilment of a contract, on the basis of legal regulations, consent or a legitimate interest. This applies in particular to the following categories of recipients:
Public authorities (e.g. tax authorities, social security institutions, law enforcement authorities) in the event of overriding legal obligations pursuant to Art. 6(1)(c) GDPR,
External service providers and processors pursuant to Art. 28 GDPR who act on our behalf in accordance with our instructions, in particular in the areas of IT services and hosting, accounting, payroll accounting, payment processing, shipping and logistics, printing and shipping services, insurance, applicant management and marketing,
Other third parties, provided that the data subject has given their consent in accordance with Art. 6 (1) (a) GDPR or that a transfer is permissible in accordance with Art. 6 (1) (f) GDPR on the basis of an overriding legitimate interest.
4. Data transfer to third countries
If personal data is transferred to processors or other recipients in third countries (outside the European Union or the European Economic Area), this will only be done in compliance with the provisions of Art. 44 ff. GDPR. This includes, in particular, the conclusion of standard contractual clauses of the European Commission in accordance with Art. 46(2)(c) GDPR or the existence of an adequacy decision in accordance with Art. 45 GDPR. Data will only be transferred to service providers in the USA if they are certified under the EU-U.S. Data Privacy Framework or if equivalent protective measures are in place.
5. Your rights as a data subject
In accordance with Art. 12 et seq. GDPR, you have the following rights at any time with regard to the processing of your personal data:
Right to information pursuant to Art. 15 GDPR: You have the right to request confirmation as to whether personal data concerning you is being processed. If this is the case, you have the right to information about this data and to further information pursuant to Art. 15 (1) GDPR.
Right to rectification pursuant to Art. 16 GDPR: You have the right to request the immediate rectification of inaccurate personal data or the completion of incomplete personal data.
Right to erasure pursuant to Art. 17 GDPR (‘right to be forgotten’): You have the right to request the immediate erasure of your personal data, provided that the legal requirements are met, in particular if the data is no longer necessary for the purposes for which it was collected or otherwise processed.
Right to restriction of processing pursuant to Art. 18 GDPR: You have the right to request the restriction of the processing of your personal data if one of the conditions specified in Art. 18 GDPR is met.
Right to data portability pursuant to Art. 20 GDPR: You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format and to transmit this data to another controller.
Right to object pursuant to Art. 21 GDPR: You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6(1)(e) or (f) GDPR. In the case of processing for direct marketing purposes, you have a general right to object, which applies without specifying a particular situation.
Revocation of consent granted in accordance with Art. 7(3) GDPR: You have the right to revoke your consent at any time with effect for the future. The lawfulness of the processing carried out until the revocation remains unaffected by this.
To assert your rights, please contact: datenschutz[at]waskoenig.de
Right to lodge a complaint with the supervisory authority: If you believe that the processing of your personal data violates data protection regulations, you have the right to lodge a complaint with a competent data protection supervisory authority in accordance with Art. 77 GDPR. This right exists without prejudice to other administrative or judicial remedies.
6. No automated decision-making
We do not carry out any automated decision-making or profiling within the meaning of Art. 22 GDPR.
7. Changes to this information
We reserve the right to amend this information in the event of changes to data processing or legal requirements. The current version can always be found here or on our website.
Status: 01.09.2025