Privacy notice

Below we inform you about the processing of your personal data by ITC.

1. Who is responsible for the data processing and whom you can contact

IT-Consulting Vidal
Lörzweiler Straße 16
55299 Nackenheim
Phone: +49 6135 7168262
Email: info@itc-vidal.de
Owner: Nico Vidal Lago

2. Purposes of processing

2.1 Visiting the website

Our system automatically records data and information that your web browser transmits to us while you visit one of our websites. The following information is recorded without any action on your part and stored until it is automatically deleted:

• the IP address of the requesting internet-enabled device
• the name and URL of the file retrieved
• the date and time of access
• if you reach our website via a link, the page from which you are visiting us (referrer URL)
• the browser you are using, and
• where applicable, the operating system of your internet-enabled computer and the name of your access provider.

Recording this data in order to provide the websites, and storing it in what are known as log files, is strictly necessary for operating the websites.

Temporarily storing the IP address is necessary in order to deliver the website to your computer. The purpose of storing data in log files is to ensure the website functions correctly and remains stable. We also use the data for statistical purposes, to optimise the website and to ensure the security of our information technology systems.

The data is deleted as soon as it is no longer required for the purpose for which it was collected.

2.2 Further purposes

ITC also processes data to the extent necessary to deal with your request. In particular, data is processed in order to perform contracts or pre-contractual measures and to carry out orders, as well as for all activities required to operate and administer the business. As part of this process, your details are also used to keep our records up to date. In addition to the aforementioned purposes, ITC processes personal data for internal purposes such as billing, making contact, asserting legal claims and defending against them, ensuring IT security and IT operations, exercising domestic authority, and the further development of services and products.

2.3 Contact form

If you write to us using the contact form, we process the details you enter – name, email address, the subject you selected and your message, plus optionally your company and telephone number – solely in order to handle your enquiry and to contact you.

The legal basis is your consent pursuant to Art. 6 (1) (a) GDPR and, insofar as your enquiry is directed at concluding or performing a contract, Art. 6 (1) (b) GDPR. You may withdraw your consent at any time with effect for the future; an informal message to info@itc-vidal.de is sufficient.

To protect against automated submissions, we additionally store a cryptographic hash of your IP address and your browser identification. The IP address itself is not stored in plain text. The legal basis is our legitimate interest in preventing misuse pursuant to Art. 6 (1) (f) GDPR.

The details submitted via the form are deleted automatically no later than 180 days after receipt, unless they are required for the further handling of an order or statutory retention periods apply. The data is not passed on to third parties.

3. Categories of personal data

Identification data (for example surname, any previous names, first name, date of birth, address, previous addresses and contact details); tax data (for example tax identification number). This may also include transaction and financial data (for example account number, transfers and their timing, invoices, payment arrears, credit notes).

3.1 Special categories of data (Art. 9 GDPR)

This covers the processing of personal data revealing racial and ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, as well as the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, health data, or data concerning a person’s sex life or sexual orientation.

As a rule, ITC does not process such data.

3.2 Children’s data

As a rule, ITC does not process children’s data.

4. Legal basis for the processing

ITC processes personal data in accordance with the provisions of the European General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG):

4.1 Performance of contractual obligations (Art. 6 (1) (b) GDPR)

Personal data (Art. 4 no. 2 GDPR) is processed in order to provide IT services and consulting, in particular to perform contracts or pre-contractual measures and to carry out your orders, as well as for all activities required to operate and administer an IT services and consulting business.

4.2 On the basis of a balancing of interests (Art. 6 (1) (f) GDPR)

Where necessary, ITC processes your data to safeguard legitimate interests of its own or of third parties, for example in the following cases:

• asserting legal claims and mounting a defence;
• ensuring IT security and IT operations;
• advertising or market and opinion research, insofar as you have not objected to the use of your data;
• measures for building and site security (for example access controls);
• measures to exercise domestic authority;
• measures for risk and business management and for the further development of services and products.

4.3 On the basis of your consent (Art. 6 (1) (a) GDPR)

Insofar as you have given ITC consent to process your personal data for particular purposes (for example passing data on to sales partners, or creating customer profiles in order to offer suitable products, services or advertising), the lawfulness of that processing is based on your consent. Consent once given may be withdrawn at any time.

Please note that a withdrawal only takes effect for the future. Processing that took place before the withdrawal is not affected.

4.4 On the basis of statutory requirements (Art. 6 (1) (c) GDPR)

Data processing may take place in the course of fulfilling tax-related monitoring and reporting obligations.

5. Categories of recipients

Within ITC, access to your data is granted to those units that need it in order to fulfil contractual and statutory obligations, or to assert legal claims and mount a defence in legal disputes. In certain cases it is also necessary to transmit information to insurance companies. Service providers engaged by us may likewise receive data from us in order to fulfil the stated purposes. These may be companies in categories such as IT services, printing services, marketing, sales or telecommunications.

Further recipients may be external contractors within the meaning of Art. 28 GDPR as well as external and internal bodies.

ITC may only pass on information about you where statutory provisions require it or where you have consented to the disclosure. Subject to these conditions, recipients of personal data may for example be:

• public authorities and institutions (for example tax authorities) where a statutory or official obligation exists.
• financial services institutions or comparable bodies to which ITC transmits personal data in order to conduct the business relationship with you (for example your bank).

6. Is data transferred to a third country or to an international organisation

Data is transferred to third countries (countries outside the European Economic Area – EEA) only where this is necessary to carry out your order or is required by law, where you have given ITC your consent, or where applicable within the framework of processing on our behalf. Where service providers in a third country are engaged, we ensure that the necessary safeguards are in place. These include the obligation to comply with the European level of data protection and, where applicable, the conclusion of standard contractual clauses.

7. Retention period

Where necessary, ITC processes and stores your personal data for the duration of the business relationship, which also includes, for example, the initiation and settlement of a contract.

In addition, ITC is subject to various retention and documentation obligations arising, among others, from the German Commercial Code (HGB) and the German Fiscal Code (AO). The retention and documentation periods laid down there range from two to ten years.

Finally, the retention period is also determined by the statutory limitation periods, which under §§ 195 et seq. of the German Civil Code (BGB), for example, are generally three years but may in certain cases be up to thirty years.

As soon as personal data is no longer necessary for the purposes for which it was collected or otherwise processed, it is deleted or anonymised in accordance with the applicable laws and regulations.

8. Your data protection rights

Every data subject has the right of access under Art. 15 GDPR, the right to rectification under Art. 16 GDPR, the right to erasure under Art. 17 GDPR, the right to restriction of processing under Art. 18 GDPR and the right to data portability under Art. 20 GDPR. The restrictions under §§ 34 and 35 BDSG apply to the right of access and the right to erasure. There is also a right to lodge a complaint with the data protection supervisory authority (Art. 77 GDPR in conjunction with § 19 BDSG). The supervisory authority responsible for ITC is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz (the State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate).

9. Is there an obligation to provide data

Within our business relationship we require the following personal data from you:

• data needed to enter into and conduct a business relationship
• data necessary to fulfil the associated contractual obligations
• data we are legally obliged to collect

Without this personal data we are generally not in a position to enter into or perform a contract with you.

10. Automated decision-making

ITC does not currently use any such procedure.

11. Right to object

11.1 Right to object in individual cases

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your data. This requires that the processing is carried out in the public interest or on the basis of a balancing of interests. In the event of a valid objection, we will no longer process your personal data. Unless,

• we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or
• your personal data serves to establish, exercise or defend legal claims.

11.2 Right to object to processing for advertising purposes

In individual cases ITC processes your personal data in order to carry out direct advertising. You have the right to object at any time to the processing of personal data concerning you for the purposes of such advertising.

If you object to processing for direct advertising purposes, ITC will no longer process your personal data for these purposes.

The objection may be made informally and can be addressed to the telephone number +49 6135 7168262 or the email address info@itc-vidal.de.