Information on the Use of Your Personal Data
Controller
For all data that is obtained in connection with the conclusion, performance and termination of your contract, the controller within the meaning of Article 4, no. 7, of the EU General Data Protection Regulation (GDPR), i.e. the person or entity responsible, is
m2p-labs GmbH
Arnold-Sommerfeld-Ring 2
52499 Baesweiler, Germany
(“m2p-labs”).
Processing of your Personal Data
The personal data processed by m2p-labs includes your particulars (name, gender, position, employer and comparable data), work address and contact data (telephone number, e-mail address and comparable data) as well as information about your customer history (ordered products, points discussed in sales conversations and comparable data) and information about your product and contract interests which is deduced from that data.
Insofar as that data is necessary for the conclusion, performance and termination of the contracts, m2p-labs processes it on the basis of Article 6, paragraph 1, point b, of the GDPR.
The data necessary for the performance of the contract, especially the particulars as well as the work address and contact data, are necessary for the conclusion of the contract. If the customer does not provide that data, the contract cannot be concluded. There will be no other consequences of any failure to provide the above personal data.
m2p-labs also processes that personal data of customers in order to get to know its customers better and be able to offer them products and services that are suitable for them. The legal basis of this data processing is Article 6, paragraph 1, point f, of the GDPR or, if a consent has been given, Article 6, paragraph 1, point a, of the GDPR. If you have given a consent, you may revoke it at any time; however, the revocation will not affect the legality of the data processing that took place on the basis of the consent until the time of the revocation. If the processing of your personal data is based on Article 6, paragraph 1, point f, of the GDPR, our legitimate interest lies in our economic interest in the advancement of our business operations and specifically in the optimization of our sales activities.
If you do not want us to use your personal data for the above-mentioned purposes (advertising), you may object to it at any time (Article 21 paragraph 3 of the GDPR). Please send your objection by e-mail to public(a)m2p-labs.com or by mail to m2p-labs GmbH, Privacy, Arnold-Sommerfeld-Ring 2, 52499 Baesweiler, Germany. Of course, your objection will not affect your contracts with m2p-labs.
Automatic decision-making pursuant to Article 22 paragraphs 1 and 4 of the GDPR does not take place at m2p-labs GmbH.
Deletion of Data
Personal data will be deleted by m2p-labs if they are no longer needed for the purpose of their processing and any legal retention periods have expired. As a rule, data of accounting transactions is deleted ten years after the transaction was carried out, and all other personal data is deleted six years after the termination of all contracts of the customer with m2p-labs.
Disclosure of Your Personal Data
For the performance of contracts, m2p-labs cooperates closely with internal and external sales partners. To enable your m2p-labs-internal sales partner to advise you adequately and support you in all matters related to your existing contracts with m2p-labs, the adviser in charge of you is given access to the data described above. A disclosure of personal data to external sales partners only takes place on particular occasions and only for the data that is necessary for the performance of the contracts. This concerns, for example, disclosures to logistics service providers or to service partners. The legal basis of such disclosures of your personal data is Article 6, paragraph 1, point b, of the GDPR.
In addition, we may also transfer your data to the appropriate national company of the m2p-labs Group (see also the section “Data Transfer Abroad”) if you use offers that are provided jointly by several companies of the m2p-labs Group. The legal basis of such disclosures of your personal data is Article 6, paragraph 1, point b, of the GDPR.
Besides, we disclose your personal data to the appropriate national company if it is in charge of the country in which you operate. In those cases, the legal basis of the data transmission is Article 6, paragraph 1, point f, of the GDPR. Our legitimate interest in such data transmissions lies in our business’s interest in the effectiveness of its sales organization.
In addition, we may give service providers that are bound by instruction access to your data. These so-called processors within the meaning of Article 28 of the GDPR must not process the data for their own purposes but only in the manner defined by m2p-labs. They are chosen carefully and are obliged, by law and by contract, to ensure a high level of data protection. For example, an IT administrator sent by an IT service provider might maintain m2p-labs databases and, in the course of this work, theoretically have the possibility to access personal data of our customers. As further examples, we may assign third parties with hosting our website, operating the different functions available on the website, sending e-mails, analyzing data, making available search results or links and supporting us with executing your orders.
For purposes other than those mentioned in this letter, we will only disclose your personal data to third parties if we are obliged to do so by law (e.g. to provide information to supervisory authorities in certain cases) or if you have given us your express consent to doing so. In addition, we may disclose your data if we are entitled to do so by law. In those cases, however, we will inform you separately (in case the disclosure is not described in this document already).
Data Transfer Abroad
In the course of the disclosure of data described above, we may share your personal data with companies that are based outside the European Economic Area. For example, our subsidiary companies are based within and outside the European Economic Area. m2p-labs GmbH is part of the globally active m2p-labs Group
If your personal data is transferred to territories outside the European Economic Area, m2p-labs will adhere to the requirements of the GDPR, particularly Article 44 et seq. of the GDPR. This means that, when transferring data, m2p-labs will ensure that the level of protection guaranteed by the GDPR will not be undermined.
The transfer to third countries has one of the following legal bases as regards the international data transfer:
- The adequacy decisions of the European Commission within the meaning of Article 45 paragraph 3 of the GDPR; or
- Standard data protection clauses within the meaning of Article 46 paragraph 2, point c, of the GDPR.
The standard data protection clauses of the European Commission can be found here (as of 30/04/2018): https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/model-contractstransfer-personal-data-third-countries_de.
Information, deletion and porting of your personal data
If you wish to be given detailed information about the personal data that m2p-labs has stored about your person, please contact m2p-labs GmbH, Privacy, Arnold-Sommerfeld-Ring 2, 52499 Baesweiler, Germany or public(a)m2p-labs.com. On request, we can also provide you with a copy of the data that m2p-labs has stored about your person.
Besides, you may receive the data which you have provided to us in a structured standard machine-readable format from us or require us to transfer that data to a third party named by you. If you find that data stored about your person is incorrect or incomplete, you can require the immediate correction or completion of that data at any time. Provided that the prerequisites described in Article 17 and 18 of the GDPR are fulfilled, you may require the deletion of your data or the restriction of its processing.
If you should not agree to the data processing performed by us or the information provided by us, and if you have any questions about the processing of your personal data by m2p-labs, do not hesitate to contact our responsible person for Data Protection at the e-mail address public(a)m2p-labs.com or the postal address m2p-labs GmbH, Privacy, Arnold-Sommerfeld-Ring 2, 52499 Baesweiler, Germany.
Baesweiler, May 25, 2018