Privacy Policy

Privacy Notice for Business Partners

In accordance with the EU General Data Protection Regulation (GDPR)

The purpose of this privacy notice is to inform you about how we process, collect and store your personal data and the rights and controls you have over your data.

Contact
contact@volkswagen-climatepartner.com
Volkswagen ClimatePartner GmbH
St.-Martin-Str. 63
D-81669 Munich

Scope of data processing and categories of data
We process the following personal data that you provided to us in connection with the initiation, establishment and performance of our contractual relationship:

a. Personal and contact data, e.g. first and last name, business address, phone number, mobile phone number, e-mail address and fax number.
b. Financial information, e.g. bank account data and other relevant information required for the processing of payment transactions or prevention of fraud including credit card number and credit card verification number. In addition to this, any information collected from public sources, information databases or credit reporting agencies.
c. Historical data and information required to manage a project or business relationship, e.g. past orders or enquiries, proof of qualification or project details.
d. Personal data that we legitimately obtain from public sources (e.g. company publications, media reports, public records and registers including sanction and watch lists, and the internet. This also includes information about relevant court proceedings or other litigation in which a business partner may be involved.
e. Sensitive personal data collected and processed for the performance of Know your Business Partner (KYBP) and due diligence activities. This includes the receipt and monitoring of relevant documents relating to a business partners’ identity, insights into the business and its structure, as well as assessing the business partners’ risk potential.

Purpose and legal basis for data processing
We process your personal data on the basis of the following:

a. Your consent (Art. 6 (1(a) GDPR)
Where you have provided your consent to the processing of your personal data. You may revoke your consent at any time. Revoking consent applies only for the future and does not affect the lawfulness of processing based on consent before its withdrawal.
b. In the context of our business relationship (Art. 6 (1(b) GDPR) Where personal data is necessary for the initiation, performance and termination of a contract, as well as any activities leading to a contract, e.g. under non-disclosure agreements, participation in tenders, and/or evaluation of projects and partnerships.
c. For the fulfilment of our legal obligations (Art. 6 (1(c) GDPR)
Where personal data is required for the fulfilment of legal obligations, e.g. retention obligations, legal proceedings, or where the disclosure is strictly necessary to comply with government authorities’ orders; law enforcement bodies, or for the fulfilment of obligations to provide evidence in compliance with the respective legal regulations.
d. Safeguarding our legitimate interests (Art. 6 (1(f) GDPR)
Where we have a legitimate interest in processing personal data for carrying out credit checks, legal disputes, maintaining IT Security within the organisation and optimising our business processes. We may also process your data to perform business partner due diligence and background checks as well as maintaining and/or updating our business partner databases and directories.
e. Use of special category of data (Art. 9 (f) GDPR)

Where personal data is essential for performing KYBP and due diligence activities.
Sensitive personal data will only be collected, used, or disclosed on the basis of your explicit consent, or other legal basis permitted by law where applicable. Sensitive Data which we may collect includes:

(i) Date and place of birth, nationality, gender, employment details, copies of identity documents (passport, national ID cards, identification numbers, marital status).
(ii) Determining PEP (politically exposed person) status.
(iii) Bank notices, tax residency.
(iv) Details of shareholdings and other assets which are legally or beneficially owned by the data subject.
(v) Details of people and organisations which may be connected to the data subject, e.g. directors, ultimate beneficiary owners (UBO’s), authorised representatives, mandated staff and/or in some cases family members.
(vi) Details of previous employment/ownership through CV’s or other documents.
(vii) Data about criminal convictions.

Please note that a failure to provide mandatory information required to carry out our
KYBP or due diligence activities will result in the termination of the business
relationship.

Transfer and disclosure of personal data
We may only disclose your personal data under the following circumstances:

a. Based on your consent
Personal data may be disclosed where you have expressly consented to the transfer.
b. Customers and /or suppliers
Personal data may be transferred to customers and/ or suppliers in order to fulfil a contract or other pre-contractual activities.
c. Legal obligation
Disclosure of personal data may be required by law or requested by law enforcement bodies, regulators or other competent authorities in accordance with legal requirements and good practice.
d. External service providers
Personal data may be transferred to external law firms or agencies for the execution of certain tasks, e.g. IT or other services based on legal obligations in relation to the prevention of a crime, sanctions screenings and other required checks.

Personal data about others
If you provide us with personal data about employees, directors, shareholders or beneficial owners of your company or an affiliated company, you must ensure that you have obtained their consent and that you have provided them with appropriate notice of any disclosure of their personal data to us.

Retention period for personal data
When determining the appropriate retention period for personal data, we consider the purpose for which it was collected, its volume, nature and sensitivity, as well as any potential risk of unauthorised use or disclosure of your personal data, and applicable legal requirements.

In some instances, we may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

Security
Although we use reasonable physical, technical and administrative safeguards to protect your personal data, the transmission of information over the Internet is not always completely secure. As a result, we cannot guarantee the security of the personal data you transmit, and you will do so at your own risk.

Your rights
You may withdraw your consent to the processing of your personal data at any time with effect for the future, although the withdrawal will not affect the lawfulness of any processing carried out before the withdrawal. After such withdrawal, we may only continue processing personal data on another lawful basis. (Art. 7 GDPR)

You may withdraw your consent by contacting:
compliance@volkswagen-climatepartner.com

In addition to the above, you have the following rights under the GDPR and other data
protection regulations:

a. Right of access to information (Art. 15 GDPR)
b. Right to rectification (Art. 16 GDPR)
c. Right to erasure (Art. 17 GDPR)
d. Right to restrict the processing (Art. 18 GDPR)
e. Right to data portability (Art. 20 GDPR)

We, of course, take your concerns very seriously, but in any event, you always have the right to lodge a complaint with the Bavarian data protection authority should you wish to do so.

Restrictions to your rights
Due to legal requirements, we may not always be able to provide you with information
about all of your data. However, if this is the case, we will let you know the reasons for this.

Version: August 2024