Data Protection Informationfor business partners

Information on the processing of personal data in the context of our business relationship with customers, suppliers and other business contacts

1. What information does this document contain for you?

tk accelis Processing Europe GmbH (‘we’) has a business relationship with you or your employer/client, e.g. the initiation or execution of a contractual relationship as part of our business activities (a Europe-wide network of steel and aluminium service centres, which provides bespoke services relating to flat steel and non-ferrous metals to a wide range of industries, drawing on its long-standing expertise in procurement, consultancy, pre-fabrication and supply chain management).

In this context, we process your personal data to the extent necessary. In doing so, we ensure that we comply with the requirements of the applicable data protection laws. Below, we provide you with a detailed overview of how we handle your data and your rights.

2. Who is the data controller and who is the Data Protection Officer?

The data controller is

tk accelis Processing Europe GmbH
Heidbergsweg 102
47809 Krefeld

Telephone: +49 2151 6168-0
Fax: +49 2151 6168-199
Email: info.acpe@tkaccelis.com

You can contact our Data Protection Officer at

Data Protection Officer

tk accelis Processing Europe GmbH
Heidbergsweg 102
47809 Krefeld

Telephone: +49 2151 6168-0
Email: dsgvo.acpe@tkaccelis.com

3. What categories of data do we process and where do they come from?

We process personal data that you provide to us as part of our business relationship. If our business relationship is with your employer or client, we also collect personal data either from you directly or from your employer or client. This includes the following data or categories of data:

• Master data (e.g. name and title, job title/position)

• Contact details (e.g. telephone number, fax number, email address, postal address)

• Communication data (e.g. content of personal, telephone or written communication, language of communication)

• Multimedia (e.g. photos and videos)

In addition, we process the following categories of personal data, which we generate ourselves or receive from third parties (group companies, credit reference agencies, (HR) service providers):

• Master data (e.g. customer number)

• Contract data (e.g. contract reference, contract history)

• Communication data (e.g. consultation records)

• Payment data (e.g. payment history, information on payment behaviour, creditworthiness)

If you voluntarily choose to waive your anonymity in customer surveys, we also obtain personal information regarding your opinions and responses.

If you take part in customer events or receive non-monetary benefits from us, we process the following personal data or categories of data:

• Type of benefit (e.g. date, location, event, type of benefit, value)

If you use at least one of our customer portals, ‘mpe connect’ or ‘mpe control tower’, we process the following personal data or categories of data:

• User identification data (username, IP address, computer name)

• Usage data (change and history logs)

4. For what purposes and on what legal basis is data processed?

We process your data in accordance with the provisions of the EU General Data Protection Regulation (GDPR) and all other relevant legislation.

We process personal data primarily to fulfil contractual obligations (Article 6(1)(b) of the GDPR), more specifically for the purpose of initiating, performing or fulfilling a contract. This includes, for example, placing orders, internal sales activities, the dispatch and payment of goods, contract negotiations and customer surveys.

If you are not a contracting party yourself – for example, if you are an employee of a business partner – processing is carried out for the same purposes on the basis of a legitimate interest pursuant to Article 6(1)(f) of the GDPR. We are in the process of entering into or performing a contractual relationship with your employer or client as part of our business activities. We process your personal data for this purpose on the basis of your work for your employer or client.

In addition, we process personal data to safeguard the following legitimate interests (Article 6(1)(f) of the GDPR):

• Maintaining business relationships with existing customers

• Organising events (e.g. admission control)

• Asserting legal claims and defending against legal disputes

• Inclusion in our contact database; maintaining contact following a business interaction (e.g. after you have provided your business card)

• Direct marketing to customers or customers’ employees (e.g. information about products and events, newsletters)

• Publication of photos illustrating specific situations

• The use of our customer portals ‘mpe connect’ or ‘mpe control tower’ is for operational purposes and the analysis of system logs to detect, diagnose and rectify faults and relevant incidents

In addition, we may process personal data for which we have been granted consent (Article 6(1)(a) of the GDPR). We obtain this consent separately and in the following cases:

• Direct marketing to prospective customers/other business contacts (e.g. information about products and events, newsletters)

• Publication of portraits, explicit photographs of individuals, and anniversary dates

We also process personal data, where necessary, to comply with legal requirements (Article 6(1)(c) of the GDPR) for the following purposes:

• Application for and authorisation of events, ticket purchases and non-monetary benefits

• and their recording in accordance with Section 37b of the Income Tax Act

• Health and safety training in accordance with Section 4 of the Occupational Safety and Health Act (ArbSchG)

• Compliance with statutory retention obligations

• Compliance with statutory reporting and documentation obligations

5. Who receives your data?

Your data is processed within tk accelis Processing Europe GmbH by staff involved in establishing and maintaining the business relationship and in carrying out the relevant business processes.

Within our group of companies, your data is transferred to specific companies where these carry out centralised data processing tasks on behalf of the affiliated companies within the group (e.g. centralised contact data management, centralised contract management, disposal of files).

In addition, to fulfil our contractual and legal obligations, we sometimes use various external service providers who are bound by data protection obligations under data processing agreements, in accordance with Article 4(8) of the GDPR.

tk accelis GmbH
thyssenkrupp Allee 1
45143 Essen
Germany

tk Services GmbH
thyssenkrupp Allee 1
45143 Essen
Germany

Dapresy Deutschland GmbH
Engersche Str. 176
33611 Bielefeld

Telephone: +49 (0) 521/44814640
Email: germany@dapresy.com

secova GmbH & Co. KG
Max-Born-Str. 4
48431 Rheine

Telefon: +49 (0) 5971/7937020
E-Mail: info@secova.de

 Other data processors

Agencies, graphic designers and similar data processors whom we engage to provide services, e.g. the creation of publications, presentations and similar marketing materials. These service providers may only use the data for the purposes specified by us.

In addition, we transfer your data to other recipients outside the company who process your data under their own responsibility, in accordance with Article 4(7) of the GDPR. These may include, for example, the following categories of data controllers:

• Subsidiaries

Further information on this can be found on our website:

www.tkaccelis-processing.com/europe

6. How long will your data be stored?

We process your personal data for as long as it is necessary for the purposes set out above. Once the business relationship has ended, your data will be retained for as long as we are legally obliged to do so. This is generally due to legal obligations regarding the retention of evidence and records, which are governed, amongst other things, by the German Commercial Code and the German Fiscal Code. The retention periods are therefore up to ten years. Furthermore, it may be necessary to retain personal data for the period during which claims can be brought against us (statutory limitation period of up to thirty years).

7. Are you obliged to provide your data?

There is no contractual or statutory obligation to provide personal data. However, without processing your personal data, we are unable to carry out the necessary pre-contractual measures or fulfil the contractual relationship with you or your employer/client.

8. What data protection rights can you exercise as a data subject?

You have the right to request information about the personal data held about you, under Article 15 of the GDPR. Furthermore, you may request the rectification or erasure of your data, under Articles 16 and 17 of the GDPR. You may also have the right to restrict the processing of your data and the right to receive the data you have provided in a structured, commonly used and machine-readable format, provided that this does not adversely affect the rights and freedoms of others (Articles 18 and 20 of the GDPR).

If you have given us your consent to the processing of your personal data, you may withdraw this consent at any time. The lawfulness of the processing carried out on the basis of your consent up until its withdrawal remains unaffected.

To exercise these rights, please contact the controller or data protection officer named in section 2.

You also have a right to object, which is explained in more detail at the end of this privacy notice.

You also have the option of lodging a complaint with a data protection supervisory authority, Article 77 of the GDPR. The right to lodge a complaint is without prejudice to any other administrative or judicial remedy. The data protection supervisory authority responsible for us is:

The State Commissioner for Data Protection and Freedom of Information, North Rhine-Westphalia

PO Box 20 04 44, 40102 Düsseldorf