Information on the processing of your personal data pursuant to Articles 13, 14 and 21 GDPR
Dear customers,
Dear prospective customers,
Dear contractual partners,
Pursuant to Articles 13, 14 and 21 of the General Data Protection Regulation (GDPR), we are required to inform you about the processing of your personal data and your associated data protection rights. The specific personal data we process and how we use it depends on the services you have requested or that we have agreed to provide. To ensure you are fully informed about how we handle your personal data in the context of fulfilling contracts or conducting pre-contractual measures, please take note of the following details.
1. Controller under data protection law
Inradius GmbH
Atelierstraße 10
81671 Munich
Germany
AvantExperiences GmbH
Atelierstraße 10
81671 Munich
Germany
You can find further details and contact information on our website: https://inradius.io/
2. Data Protection Officer contact details
The joint controllers have jointly appointed a Data Protection Officer:
Inradius GmbH
Data Protection Officer
Atelierstraße 10
81671 Munich
Germany
E-mail: datenschutz@avantgarde.de
3. Purposes and legal bases of processing
We process your personal data in accordance with the GDPR and the German Federal Data Protection Act (BDSG) where this is necessary for establishing, performing and fulfilling contracts or carrying out pre-contractual measures. Processing is lawful under Article 6(1)(b) GDPR to the extent personal data is required for these purposes.
Where you have given us your express consent to process personal data for specific purposes (e.g., sharing with third parties, marketing analysis or email promotions), such processing is based on your consent under Article 6(1)(a) GDPR. You may withdraw consent at any time with future effect (see section 9 below).
We may also process your data to comply with legal obligations (Article 6(1)(c) GDPR), to pursue legitimate interests of ours or third parties (e.g., for claims management under Article 6(1)(f) GDPR), or where legally required. We will separately notify you of any specific legitimate interests as mandated by law.
4. Categories of personal data processed
We only process personal data relevant to establishing the contract or pre-contractual measures. This typically includes basic personal and company details (e.g., name, address, contact information) and any additional data you provide during contract negotiations.
5. Sources of data
We receive personal data directly from you (e.g., during initial contact or contract initiation) or via our cooperation partners in the context of pre-contractual measures or contractual relationships.
6. Recipients of personal data
Within our companies, personal data is shared only with authorised departments and personnel who need it to meet contractual, legal or legitimate interest-based obligations.
We may disclose data to affiliated companies where permitted under the purposes and legal bases outlined in section 3.
Your data is processed on our behalf by processors under data processing agreements (Article 28 GDPR), such as internet service providers and customer relationship management (CRM) software providers. We ensure full GDPR compliance in these arrangements.
Data is otherwise only shared externally where legally permitted or required, necessary for contract performance or pre-contractual steps (at your request), based on your consent, or where we are authorised to disclose. Examples of recipients include:
- External tax advisors;
- Public authorities (e.g., prosecutors, police, regulators, tax offices) upon legal or official request;
- Third parties essential for contract performance, such as travel service providers (hotels, car rentals, insurers).
7. International data transfers
No transfers to third countries (outside the EU/EEA) are planned.
8. Data storage periods
We retain your personal data for the duration of our business relationship or as necessary to fulfil contractual purposes, including contract initiation and settlement.
Additional retention arises from statutory obligations under the German Commercial Code (HGB) and Fiscal Code (AO), with periods ranging from 2 to 10 years.
Storage may also align with statutory limitation periods under §§ 195 et seq. German Civil Code (BGB), typically 3 years, but up to 30 years in specific cases.
9. Your data protection rights
You have the following rights under the GDPR:
- Right of access (Article 15);
- Right to rectification (Article 16);
- Right to erasure (Article 17);
- Right to restriction of processing (Article 18);
- Right to data portability (Article 20);
- Right to object (Article 21).
You may also lodge a complaint with a data protection authority (Article 77 GDPR) if you consider processing unlawful. This does not affect other remedies.
Withdrawal of consent:
If processing is consent-based (Article 7 GDPR), you may withdraw it anytime, prospectively. Past processing remains valid, and legal retention requirements apply (see section 8).
Right to object (Article 21 GDPR):
Where processing is based on legitimate interests (Article 6(1)(f) GDPR), you may object on grounds of your specific situation. We will cease processing unless we demonstrate compelling overriding grounds or it is needed for legal claims.
For direct marketing (including related profiling), you may object at any time; we will then stop such processing.
Contact:
Reach out using the details in section 1. Either joint controller can handle or forward your request.
10. Obligation to provide personal data
Providing personal data for contract decisions, performance or pre-contractual measures is voluntary but necessary for us to proceed. Without required data, we cannot enter into or perform the contract.
11. Automated decision-making
We do not engage in fully automated decision-making (Article 22 GDPR) for business relationships or pre-contractual measures. If used exceptionally, we will inform you separately and obtain consent where required.