Information to be provided pursuant to Art. 13 of the General Data Protection Regulation (GDPR) when personal data are collected from the data subject

The controller’s contact information

Controller (per Art. 4 No. 7 GDPR)

Isaria München Projektentwicklungs GmbH
Leopoldstraße 8
80802 Munich, Germany
Phone: +49 89 38 99 84-0
Fax: +49 89 38 99 84-790
E-mail: info@isaria-muc.com
Internet: https://www.isaria-muc.com

Data protection officer’s contact information

Data protection officer

Data Protection Officer of Isaria München Projektentwicklungs GmbH
c/o activeMind AG
Management- und Technologieberatung
Potsdamer Str. 3
80802 Munich
Phone: +49 89 919 294-900
E-mail: isaria-muc@activmind.de
Internet: https://www.isaria-muc.com

Purposes of and legal bases for processing

Intended purpose

Lawfulness of the processing, Art. 6 GDPR

• Consent
• Contract, contract initiation, contractual performance
• Fulfillment of a legal obligation
• Protection of the legitimate interests of the controller or of a third party
• Other (provisions of law)

Necessity and proportionality, Art. 5 GDPR

The lawfulness of data processing is determined according to the following principles:

Source of the data

“Proportionality” (point (b) of Art. 5(1)), “transparency” (point (a) of Art. 5(1)), “data minimization” (point (c) of Art. 5(1)), “accuracy” (point (d) of Art. 5(1)), “storage limitation” (point (e) of Art. 5(1)) and “integrity and confidentiality” (point (f) of Art. 5(1)) and in accordance with the principle of “restriction to purpose” (point (b) of Art. 5(1)).

Contract, contractual performance or contract initiation with the data subject
Consent of the data subject
Overriding provisions of law

Recipients or categories of recipients of personal data

Internal recipients
(within the data controller)

Recipients within the controller and all internal entities involved in the communication necessary to achieve the stated purpose:
e.g. purchasing, sales, accounting, processors, cooperating partners, service providers

External recipients and third parties
(all other recipients, including those in group companies if they are not processors)

External entities involved in communication, public entities that receive the data on the basis of provisions of law, and third parties who are not processors:
e.g. contractors, cooperating partners, group companies, suppliers, service providers, banks, auditors, tax consultants, financial authorities

Transfer of personal data to a third country

Non-Member States/international organizations

Data transfer neither takes place nor is planned

Duration of storage of personal data

Storage period

The legal requirements applicable to the various preservation periods (under commercial and tax law) are complied with.
Data are deleted when they are no longer relevant to business operations.

Rights of data subjects

Right of access, Art. 15 GDPR

If your personal data are being processed, then you have the right to information concerning the data pertaining to your person that have been stored.

Right to rectification, Art. 16 GDPR

Should personal information be processed that is inaccurate, you have the right to have that information corrected.

Right to erasure, right to limit processing, Art. 17 and 18 GDPR

Subject to certain legal conditions, you have the right to have your data erased and to limit the processing of your data.

Right to data portability, Art. 20 GDPR

If you have consented to data processing or there exists a contract for data processing and the data processing is performed with the aid of automated processes, then you have a right to data portability.

Right to object, Art. 21 GDPR

You have the right to object at any time to the processing of your personal data.

Right to lodge a complaint with a supervisory authority, Art. 77 GDPR

You have the right to lodge a complaint with an additional supervisory authority (Bayerisches Landesamt für Datenschutzaufsicht, Promenade 18, 91522 Ansbach oder Postfach 1349, 91504 Ansbach; phone: +49 (0)981 180093-0; fax: +49 (0)981 180093-800; https://www.lda.bayern.de/de/beschwerde.html)

Right to revocation, Art. 7(3) GDPR

If the processing of your personal data is based on point (a) of Art. 6(1) or point (a) of Art. 9(2) GDPR, then you have the right to revoke your consent at any time. Your revocation will not affect the lawfulness of the processing that occurred on the basis of your consent before that consent was revoked.

Duty to provide data

For the purposes of our business relationship, you must provide those personal data that are necessary for the initiation and conduct of a business relationship or performance of the associated contractual duties or that we are required by law to collect. If we lack these data, we usually must decline to enter into a contract with you or to carry out an order, or we will no longer be able to perform, or may be compelled to terminate, an existing contract.

Change of purpose

No change of purpose is planned.