I acknowledge the following privacy policy.
Privacy Information for Prospective Customers / Customers and Other Contractual Partners
Information on data protection concerning our processing of personal data pursuant to Articles 13, 14 and 21 of the General Data Protection Regulation (GDPR)
Dear customers,
Dear prospective customers,
Dear contractual partners,
In accordance with Articles 13, 14 and 21 of the General Data Protection Regulation (GDPR), we hereby inform you below about the processing of your personal data and the rights associated with such processing.
The specific data processed and the manner in which it is processed depend largely on the services requested by you or agreed with us.
These privacy notices are intended to provide you with comprehensive and transparent information about how we process your personal data in the context of pre-contractual measures and for the performance of contractual obligations.
Please take a moment to read the following information.
1. Controller within the meaning of data protection law
Avantgarde Experiences GmbH
Atelierstraße 10
81671 Munich
Further information and contact details can also be found on the website: https://inradius.io/
2. Contact details of our Data Protection Officer
Mr Dr Ralf Heine
Aulinger Datenschutz & Consulting GmbH
Josef-Neuberger-Str. 4
44787 Bochum
+49 201 9598662
datenschutz.preferred-experience@inradius.io
3. Purposes and legal bases of processing
We process your personal data in accordance with the provisions of the European General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG), insofar as this is necessary for the establishment, implementation, performance and termination of a contractual relationship as well as for the performance of pre-contractual measures. To the extent that personal data is required for initiating or carrying out a contractual relationship or in the context of pre-contractual measures, processing is lawful pursuant to Art. 6(1)(b) GDPR.
In addition, we process your data within a customer relationship management system (CRM system) in order to: manage and maintain customer relationships, document communication histories, process enquiries and matters efficiently, improve and personalise our services, and continue existing customer relationships. Processing in the CRM system is based on: Art. 6(1)(b) GDPR insofar as it is necessary for the performance of the contract, and Art. 6(1)(f) GDPR (legitimate interest) in efficient customer administration, customer support and internal organisation.
If you give us your express consent to process personal data for specific purposes (e.g. disclosure to third parties, analysis for marketing purposes or promotional contact by email), the lawfulness of such processing is based on your consent pursuant to Art. 6(1)(a) GDPR. Any consent given may be withdrawn at any time with effect for the future.
Where necessary and legally permissible, we process your data beyond the actual contractual purposes in order to comply with legal obligations pursuant to Art. 6(1)(c) GDPR. In addition, processing may take place to safeguard legitimate interests of ours or of third parties, as well as for the assertion, exercise or defence of legal claims pursuant to Art. 6(1)(f) GDPR. Where required by law, we will inform you separately of the relevant legitimate interest.
4. Categories of personal data
We process only such data as is connected with the establishment of the contract or pre-contractual measures. This may include general data about you or persons within your company (name, address, contact details, etc.) as well as any other data you provide to us in the course of establishing the contractual relationship.
5. Sources of the data
We process personal data that we receive from you in the context of contact or the establishment of a contractual relationship or in the context of pre-contractual measures, or that has been passed on to us via our cooperation partners.
6. Recipients of the data
We disclose your personal data within our company only to those departments and persons who need it to fulfil contractual and legal obligations or to implement our legitimate interests.
We may transfer your personal data to affiliated companies, insofar as this is permissible within the scope of the purposes and legal bases set out under section 3 of this privacy notice.
Your personal data will be processed on our behalf on the basis of data processing agreements pursuant to Art. 28 GDPR. In such cases, we ensure that the processing of personal data complies with the provisions of the GDPR. The categories of recipients in this case are providers of internet services as well as providers of customer management systems and software.
Otherwise, data will only be transferred to recipients outside the company where this is permitted or required by law, where the transfer is necessary for processing and therefore for performance of the contract or, at your request, for the implementation of pre-contractual measures, where we have your consent, or where we are authorised to provide information. Under these conditions, recipients of personal data may include, for example:
- Cooperation partners and affiliated companies in connection with joint offers and marketing measures.
- Marketing, PR and communications service providers as well as providers of marketing systems.
- IT and cloud service providers (e.g. hosting providers, CRM systems, Microsoft 365) in the context of data processing on behalf.
- Payment service providers and banks.
- Travel service providers and contractual partners (e.g. airlines, hotels, car rental companies, shuttle companies, activity providers, restaurants, insurers) for the performance of booked services.
- Photographers, videographers and media agencies in connection with the creation and processing of content.
- Public authorities and institutions (e.g. tax authorities, supervisory authorities, law enforcement authorities) where there is a legal or official obligation.
- External tax advisers and auditors.
- Lawyers, consultants and other professional service providers.
7. Transfer to a third country
A transfer of personal data to countries outside the European Union (EU) or the European Economic Area (EEA) is generally not intended.
However, in the course of using IT systems, cloud services and marketing and communication tools, it cannot be excluded that data may be transferred to providers located in third countries or processed there.
Where such a transfer takes place, we ensure that appropriate safeguards pursuant to Art. 44 et seq. GDPR are in place, in particular through:
- the conclusion of EU Standard Contractual Clauses (SCCs),
- adequacy decisions of the European Commission, or
- other appropriate safeguards within the meaning of the GDPR.
8. Duration of storage
Where necessary, we process and store your personal data for the duration of our business relationship or for the performance of contractual purposes. This also includes, among other things, the initiation and execution of a contract.
In addition, we are subject to various retention and documentation obligations arising, among other sources, from the German Commercial Code (HGB) and the Fiscal Code (AO). The statutory retention or documentation periods specified therein range from two to ten years.
Finally, the storage period is also determined by statutory limitation periods, which under Sections 195 et seq. of the German Civil Code (BGB) are generally three years, but in certain cases may be up to thirty years.
9. Your rights
Every data subject has the right of access pursuant to Art. 15 GDPR, the right to rectification pursuant to Art. 16 GDPR, the right to erasure pursuant to Art. 17 GDPR, the right to restriction of processing pursuant to Art. 18 GDPR, the right to notification pursuant to Art. 19 GDPR, and the right to data portability pursuant to Art. 20 GDPR.
In addition, you have the right to lodge a complaint with a data protection supervisory authority pursuant to Art. 77 GDPR if you believe that the processing of your personal data is not lawful. This right to lodge a complaint is without prejudice to any other administrative or judicial remedy.
If the processing of data is based on your consent, you are entitled under Art. 7 GDPR to withdraw your consent to the use of your personal data at any time. Please note that withdrawal only takes effect for the future. Processing carried out before withdrawal is not affected. Please also note that we may be required to retain certain data for a certain period in order to comply with legal requirements (see section 8 of this privacy notice).
Right to object
Where the processing of your personal data is based on Art. 6(1)(f) GDPR for the purposes of legitimate interests, you have the right under Art. 21 GDPR to object at any time, on grounds relating to your particular situation, to the processing of such data. We will then no longer process this personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
In individual cases, we process your personal data for direct marketing purposes. You have the right to object at any time to the processing of your personal data for such advertising purposes. This also applies to profiling to the extent that it is related to such direct marketing.
If you object to processing for direct marketing purposes, we will no longer process your personal data for these purposes.
To safeguard your rights, you may contact us using the contact details stated in section 1.
10. Necessity of providing personal data
The provision of personal data for the decision on whether to conclude a contract, for contract performance or for the implementation of pre-contractual measures is voluntary. However, we can only make a decision within the framework of contractual measures if you provide those personal data that are necessary for the conclusion of the contract, the performance of the contract or pre-contractual measures.
11. Automated decision-making
For the establishment, performance or execution of the business relationship and for pre-contractual measures, we generally do not use fully automated decision-making within the meaning of Art. 22 GDPR. If we use such procedures in individual cases, we will inform you separately or obtain your consent, where required by law.