Data Protection Information

The information below provides you with an overview of the processing of your personal data (hereinafter "data") by the Arvato Systems Group* as well as your data protection rights.

Who Is Accountable (Data Controller) for the Processing of My Data?

The Arvato Systems Group* as Controller in terms of data protection is accountable for the herein covered processing activity/ activities and addressee of your rights as a data subject. In any use of the words "we" or "us" in the following, the Arvato Systems Group is always referred to. We process personal data by the European General Data Protection Regulation (GDPR) and laws locally applicable.

You can contact our data protection officer via the postal address of the respective legal entity noting "Attn: Data Protection Department" or via the e-mail address datenschutz@arvato-systems.de, phone: +49-5241-80 70785.

What Are the Purposes of My Data Being Processed and What Is the Legal Basis?

The purposes for processing personal data accord with the statutory conditions for their permitted usage at the time of their collection. We use your personal data to pursue, establish, and conduct a business relationship between you and our corporate group. The data are only processed for other purposes if there are legal grounds for doing so.

The legal basis for processing by our company is Article 6 I item A GDPR, for which we obtain consent for specific processing purposes. If the processing of personal data is necessary to pursue or fulfill a contract, the grounds for processing are as per Article 6 I item b GDPR. If our company has a legal obligation necessitating the processing of personal data, such as to fulfill tax obligations, the grounds for processing are as per Article 6 I item c GDPR. In exceptional cases, the processing of personal data may be necessary to protect the data subject's vital interests of another natural person. In such a case, the grounds for processing are as per Article 6 I item d GDPR. Lastly, the grounds for processing may be as per Article 6 I item f GDPR. On this legal basis, processing that does not fall under any of the above legal grounds is performed as necessary to uphold the legitimate interests of our company or a third party unless the interests, basic rights, and basic freedoms of the data subject prevail. If the grounds for the processing of personal data are as per Article 6 I item f GDPR, our legitimate interest is in conducting our business to satisfy our customers and staff.

Am I Obligated to Provide Data?

It is unavoidably necessary for personal data to be collected for the processing purposes outlined above according to contractual and legal requirements. Without this data, we will generally be unable to perform processing.

Who Receives My Data?

For the provision of our services, we involve sub-providers for our assistance (data processors). These data processors are contractually bound to our instructions. Their access to data is strictly limited to what is necessary to perform the assistance. Our sub-provider is located outside the European Union, and your data are transferred to a country that potentially has no level of data protection equivalent to the European level. For the continued protection of your data, all our sub-providers are bound by mechanisms according to Art. 46 GDPR to maintain a level that is equivalent to the one in the European Union.

How Long Will My Data Be Stored?

Data we process will be deleted by Articles 17 and 18 GDPR as soon as they are no longer required for their intended purpose unless their deletion is not permitted according to legal retention requirements. If data are not deleted due to being required for other legally permissible purposes, the data are held in restriction and may not be processed for other purposes.

What Rights Do I Have Respecting My Data?

You have the right to request access to your personal data, which we currently store. Where these data are incorrect or not up to date, you have the right to request rectification. In addition, you can request erasure and/or restriction of your data where the criteria are set out in Art. 17 and 18 of the GDPR are met. Where our processing of data provided by you is based on your consent or is subject to a contract, you may request a copy of these data in a structured, common, and machine-readable format (right to data portability).

You have the right to object to the processing of your data, Art. 21 GDPR. If you have given us consent to process your personal data for specific purposes, you have the right to withdraw this consent at any time with effect for the future.

If you wish to exercise your rights or have general questions regarding data protection within the Arvato Systems Group, you may contact us at any time via the above contact details. You also have the option of contacting a data protection authority and filing a complaint.

Is my data processed using automated decision-making, including profiling?

Your collected data is not utilized for automated decision-making or profiling.

*The Arvato Systems Group can be contacted via the e-mail address: info@arvato-systems.de for matters concerning the following companies:

• Arvato Systems GmbH, Reinhard-Mohn-Straße 18, 33333 Gütersloh, Germany
• Arvato Systems Digital GmbH, Riebeckstraße 62, 04317 Leipzig, Germany
• Arvato Systems National Cloud GmbH, Reinhard-Mohn-Straße 18, 33333 Gütersloh, Germany
• Arvato Systems Schweiz AG, Technoparkstrasse 1, 8005 Zürich, Switzerland
• Arvato Systems IT S.R.L., Ionescu Crum no. 1, Brasov – 500446, Romania
• Arvato Systems North America Inc., 1745 Broadway, 20th Floor, New York, NY 10019, USA
• Arvato Systems Malaysia Sdn. Bhd., Suite 26-10, Level 26, GTower, 199, Jalan Tun Razak, 50400 Kuala Lumpur, Malaysia
• SIA Arvato Systems Latvia, Skanstes iela 25, Riga LV-1013, Latvia