General information
Transparency and a trustworthy handling of your personal data is an important basis for good cooperation. We therefore would like to inform you, in accordance with the provisions of Art. 13, 14 and 21 of the General Data Protection Regulation (“GDPR”), how we process your data in accordance with the statutory provisions and how you can exercise your rights.
1. Data controller
RWE Supply & Trading GmbH („RWEST“)
RWE Platz 6
45141 Essen
T: +49 201 5179 1999
E-mail: [email protected]
is the data controller pursuant to Art. 4 No. 7 GDPR.
2. Contact details of the Data Protection Officer
If you have any questions or suggestions regarding data protection, please contact our Data Protection Officer at:
RWE AG
Group Data Protection Officer
RWE Platz 6
45141 Essen
E-Mail: [email protected]
3. Categories of your personal data
We process personal data within the scope of our business relationship or its initiation. It includes general information about your person such as name, business address and contact data as well as the contents of communication with you.
If necessary, phone calls are also recorded in connection with the performance of the contract, provided that we have contractually agreed this with your employer or with the company you work for (in particular if purchases or sales can be processed by phone).
4. Data sources
We process personal data which we have received from you within the scope of our business relationship or its initiation. In addition, we may receive your data from other group companies or third parties, in particular from other business partners, or information may be publicly available or provided by your company to the relevant contact person on request.
5. Purposes and legal basis of data processing
We process your personal data in accordance with the provisions of the GDPR and the Federal Data Protection Act (“BDSG”), insofar as these are ecessary for the establishment, execution and performance of a contract and for the implementation of pre-contractual measures. To the extent that personal data are required for the initiation or execution of a contractual relationship or within the framework of the implementation of pre-contractual measures, processing is lawful pursuant to Art. 6 para. 1 lit. b GDPR.
If you grant us your consent to process personal data for specific purposes (e. g. disclosure to third parties, evaluation for marketing purposes or advertising via e-mail, in particular sending information in the form of analyses, current topics on the energy market etc. or sending invitations to trade fairs and customer events), the lawfulness of this processing is based on your consent pursuant to Art. 6 para. 1 lit. a GDPR or Art. 6 para. 1 lit. f GDPR for direct advertising. Consent can be withdrawn at any time with effect for the future (see no 10 lit. f of this Privacy Policy).
Where necessary and legally permissible, we process your data in addition to the actual contractual purposes to fulfil legal obligations in accordance with Art. 6 para. 1 lit. c GDPR. Furthermore, your data may be processed for the purposes of our legitimate interests or those of third parties and to defend and assert legal claims pursuant to Art. 6 para. 1 lit. f GDPR. Insofar as this is required by law, we will inform you separately, stating the legitimate interest.
6. Automated decision making, including profiling.
Automated decision making including profiling does not take place.
7. Data recipients
Your personal data will be passed on within the company and, under certain circumstances, to carefully selected and commissioned external service providers and exclusively to those areas and persons who require this data to fulfil their contractual and legal obligations or to pursue our legitimate interest.
We may transfer your personal data to companies of the RWE Group and service providers to the extent permitted within the framework of the purposes and legal bases set out in Section 5 of this Privacy Policy.
Your personal data will be processed on our behalf on the basis of data processing agreement contracts in accordance with Art. 28 GDPR. In these cases, we ensure that the processing of personal data is carried out in accordance with the provisions of the GDPR.
Otherwise, data will only be passed on to recipients outside the company if this is permitted or required by law, if it is necessary for processing and thus for the fulfilment of the contract or, at your request, for the implementation of pre-contractual measures, if we have your consent or if we are authorised to provide information. Under these conditions, recipients of personal data may be, for example:
- External tax advisors/auditors
- Public bodies and institutions (e. g. public prosecutor’s office, police, supervisory authorities, tax office) if there is a legal or official obligation
- Recipients to whom the transfer is directly required for the purpose of establishing or fulfilling the contract such as external accounting, IT or other external service providers .
8. Data transfer to countries outside the European Union and the European Economic Area (so-called “third countries”)
Certain companies of the RWE Group are based outside the European Union and the European Economic Area. For the processing of your personal data, we also use service providers located in third countries. The third-country transfer of personal data is carried out in full compliance with the Chapter V of the GDPR and the relevant national data protection legislation. In the absence of an adequacy decision by the European Commission pursuant to Art. 45 GDPR – a list of countries with an adequacy decision can be found here –, appropriate safeguards that ensure an adequate level of data protection are provided. As a standard procedure we enter into contracts with data importers that include standard data protection clauses also known as the “standard contractual clauses”. A copy of the model data protection clauses approved by the European Commission is available under: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32010D0087
You have the option to request further information and to receive copies of the relevant agreements at any time. You can contact our Data Protection Officer by using the options listed under no. 2.
9. Data retention
After the purpose for which the data was collected has ceased to exist, we will only store your personal We store your personal data after the purpose for which the data was collected has ended, only as long as this is required by law. In doing so, we are subject to various storage and documentation obligations, including those arising from the German Commercial Code (HGB) and the German Fiscal Code (AO). The periods of retention or documentation stipulated there are two to ten years. Finally, the storage period also depends on the statutory limitation periods, which, for example, according to §§ 195 ff. of the German Civil Code (BGB), are usually three years, but in certain cases also up to thirty years.
Furthermore, we store your data which we process out of legitimate interest as long as the legitimate interest exists and the storage is necessary for the purpose of processing.
10. Your rights
a. Right of access
You are entitled to request – at any time, within the scope of statutory provisions and at no cost to you – information on your personal data we process.
You also have the right to request information on whether personal data concerning you is transferred to a third country or an international organisation. In this context, you may request to be informed of the appropriate safeguards in accordance with Art. 46 GDPR in relation to the transfer.
b. Right to rectification
If your personal data we process is inaccurate or incomplete, you are entitled to have it rectified or completed without undue delay.
c. Right to erasure
You have the right to obtain from us without undue delay the erasure of your personal data, unless a statutory exception applies.
d. Right to restriction of processing
Under the conditions defined in the GDPR, you have the right to request that the processing of your personal data be restricted.
e. Right to data portability
You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format or to request that this be transmitted to a third party designated by you, where technically feasible, if the processing of this data is carried out by automated means and based on your consent or on a contract with you. Freedoms and rights of other persons must not be affected by this.
f. Right to withdraw a declaration of consent
You have the right to withdraw your consent at any time. The withdrawal of your consent does not affect the lawfulness of the processing based on consent before its withdrawal. This also applies to the withdrawal of declarations of consent given to us prior to the application of the GDPR, i. e. before 25 May 2018. In this case, all your personal data stored on the basis of the consent given will be deleted unless there is another legal basis for further storage according to the law.
g. Exercising your rights
To exercise your rights, please contact us using the options listed under no. 1 or 2.
