bvl image

Information for

Employee

Information for persons affected about the processing of their personal data as per Articles 13 and 14 GDPR by Bernard van Lengerich Maschinenfabrik GmbH

Category: Employee (M/F/X)
 

To comply with our information obligations as per Art. 13 and 14 of the General Data Protection Regulations (GDPR), we are pleased to provide you with the following information about data protection:

I. Name and contact details of the Controller

In accordance with Art. 4(7) GDPR and other national data protection laws of Member States and other data protection regulations, the Controller is:

Bernard van Lengerich Maschinenfabrik GmbH & Co. KG
Grenzstraße 16
48488 Emsbüren, Germany
Tel.: +49 5903 951 0
Fax: +49 5903 951 34
Email: info@bvl-group.de
Website: https://www.bvl-group.de/
 

II. Contact details of the Data Protection Officer

Email: datenschutzbeauftragter@bvl-group.de

or our postal address with the addition of “F.A.O. The Data Protection Officer”:

Bernard van Lengerich Maschinenfabrik GmbH & Co. KG (hereinafter referred to as BvL)
Grenzstraße 16
48488 Emsbüren, Germany
 

III. Purposes for processing your personal data

  1. The necessary scope for establishing, executing and concluding your employment relationship
  2. To process employee photographs on a voluntary basis
    a. To share on our company intranet
    b. To use in internal company communications
    c. To list you as a contact person on our company website
    d. To publish in our company print media
  3. To exercise or fulfil the rights and obligations to represent the interests of employees resulting from a law or wage agreement, or a works or service agreement (collective agreement)
  4. To detect criminal offences within the employment relationship
  5. Managing the data-protection rights of Data Subjects
  6. To assert, exercise or defend potential legal claims against you or against third parties
     

IV. Legal grounds for processing your personal data

Re. 1: Section 26(1.1.) of the German Federal Data Protection Act (BDSG) sets out the legal grounds for processing your personal data.

Re. 2: Section 26(2) of the German Federal Data Protection Act (BDSG) sets out the legal grounds for your voluntary declaration of consent.

Re. 3: Section 26(2.1.) of the German Federal Data Protection Act (BDSG) sets out the legal grounds for processing your personal data.

Re. 4: Section 26(1.2.) of the German Federal Data Protection Act (BDSG) sets out the legal grounds for processing your personal data.

Re. 5: Processing occurs to adhere to and meet the legal commitment that BvL as Controller as per Art. 4(7) GDPR must comply with to honour the data-protection rights of the Data Subject stipulated in Chapter III (Art. 12-22) GDPR. The legal grounds for processing are those listed in point (c) of Art. 6(1.1.) GDPR.

Re. 6: We may use your personal data we have obtained to assert, exercise or defend potential legal claims against you or against third parties. The legal grounds for processing are those listed in point (f) of Art. 6(1) GDPR. For the above-mentioned reasons, BvL has a legitimate interest to use personal data.
 

 

V. Description of the personal data categories

Re. 1: Key data, such as last name, first name, address, title, tax ID number, nationality, religious denomination, bank details, professional title, time recording data, leave entitlements, periods of incapacity to work, education/qualification data, social insurance number, pension insurance number, salary data

Re. 2: First and last name, professional title/role within the company, personnel number

Re. 3: The personal data required to exercise or fulfil the rights and obligations to represent the interests of employees resulting from a law or wage agreement, or a works or service agreement (collective agreement).

Re. 4: The personal data to be processed to the extent necessary to detect criminal offences within the employment relationship in compliance with the principle of proportionality.

Re. 5: Declaration of withdrawal of any of the declarations of consent you may have made; statements of objection that you may have made relating to the processing of your personal data; explanations and information that we have obtained from you to assert the data-protection rights of the Data Subject stipulated in Chapter III (Art. 12-22) GDPR.

Re. 6: The necessary personal data to be processed to assert, exercise or defend potential legal claims against you or against third parties.
 

 

VI. Categories of recipients with whom personal data was shared or will be shared

Within our company, only those persons and specialist areas (management, specialist departments, advisory board, representative for severely disabled persons, work safety expert, etc.) will obtain your personal data that they need for the purposes listed under III. to process your personal data to the required extent. Furthermore, under certain circumstances, the contractual processors we have appointed – having concluded appropriate contracts to protect your personal data – may also obtain your personal data. Moreover, we transfer your personal data to third parties outside our company if this is required to fulfil legal or contractual obligations, in compliance with applicable data-protection legislation.

Third parties include:

  • Authorities (pension insurance institutions, professional pension institutions, statutory and private health insurance funds, social insurance institutions, tax authorities, etc.)
  • Your bank in association with payroll accounting
  • Entities that guarantee entitlement to the company pension scheme or protect against insolvency
  • Entities that ensure your contributions to capital formation are paid out.
  • Creditors in the event of wage and salary garnishment
  • Insolvency administrators
  • Authorities to clarify any criminal investigations.
     

VII. No transfer to third countries and no transfer to an international organisation

Your personal data is not transferred to a third country or an international organisation, and is not intended.

VIII. Deletion periods of different data categories and storage criteria

Your data will be deleted as soon as the purposes for which it was retained or processed in any way are no longer applicable. Where required, our company processes and stores your personal data for the duration of your employment relationship. Furthermore, our company stores your personal data if we are legally obliged to do so or you can make claims against us. Corresponding evidence and retention requirements are stipulated by the German Commercial Code and General Fiscal Law. The time limits specified for retention and documentation are six years as per the commercial law provisions in accordance with Section 257 of the German Commercial Code and up to ten years in the case of fiscal provisions in accordance with Section 147 of the General Fiscal Law.

IX. Rights of persons affected

If your personal data is processed, you are considered a Data Subject as per GDPR and you are entitled to the following rights vis-à-vis BvL:

1. Right of access 
Under the provisions of Art. 15 GDPR, you shall have the right to obtain from the Controller at any time confirmation as to whether or not, and how, your personal data is being processed by us.

2. Right to rectification
Under the provisions of Art. 16 GDPR, you shall have the right to obtain from the Controller the rectification and/or completion of incomplete data, provided the processed personal data that affects you is incorrect or incomplete. The Controller must rectify the data without undue delay.

3. Right to restriction of processing 
Under the provisions of Art. 18 GDPR, you shall have the right to obtain from the Controller restriction of processing.

4. Right to erasure and the “right to be forgotten"
Under the provisions of Art. 17 GDPR, you shall have the right to obtain from the Controller the erasure of your personal data and to exercise the right to be forgotten.

5. Right of notification 
If you have exercised your right to obtain from the Controller rectification, erasure or restriction of processing, they are obligated to communicate any rectification or erasure of personal data or restriction of processing to each recipient to whom the personal data has been disclosed, unless this proves impossible or involves disproportionate effort. Under the provisions of Art. 19 GDPR, you shall have the right to be informed of those recipients.

6. Right to data portability 
Under the provisions of Art. 20 GDPR, you shall have the right to receive your personal data, which you provided to the Controller, in a structured, commonly used and machine-readable format.

7. Right to object 
Under the provisions of Art. 21 GDPR, you shall have the right to object, on grounds relating to your particular situation, at any time to processing of your personal data which is based on point (e) or (f) of Art. 6(1) GDPR. As the Controller, BvL shall no longer process your personal data unless BvL demonstrates legitimate grounds for the processing which override your interests, rights and freedoms as the Data Subject or for the establishment, exercise or defence of legal claims.

8. Right to revoke the data-protection declaration of consent 
You have the right to revoke your data-protection declaration of consent at any time. The consent-based lawfulness of the processing that has taken place up until this revocation will not be affected by the withdrawal.

9. Right to lodge a complaint with a supervisory authority 
Without prejudice to any other administrative or judicial remedy, you shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your residence, place of work or place of the alleged infringement if your consider that the processing of your personal data infringes GDPR. The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Art. 78 GDPR.

The State Data Protection Supervisory Authority responsible for BvL is:
The State Data Protection Commissioner for Lower Saxony
Prinzenstraße 5 
30159 Hanover, Germany
Telephone: +49 511 120 45 00
Fax: +49 511 120 45 99
E-Mail: poststelle@lfd.niedersachsen.de 
 

X. Data origin

In principle, your personal data is collected from you directly as part of the appointment process or during the employment relationship. Under certain circumstances and due to statutory requirements, your personal data is also gathered from other sources. This includes queries relating to tax-relevant information lodged with the responsible tax office and queries relating to periods of incapacity to work lodged with the appropriate health insurance scheme.

XI. Requirement to provide data

As part of your employment relationship, you must provide the necessary personal data that is required – or mandated by law in order for us to process this data – to establish, execute and conclude the employment and working relationship, and to fulfil the associated statutory requirements. Without this data, we are unable to establish an employment or working relationship with you.

 

XII. No automated decision-making or profiling

No automated decision-making or profiling occurs as per Art. 22 GDPR.