Data protection declaration according to the GDPR

Information on the protection of your data – Data protection declaration | data protection

I. Name and address of the responsible party

The responsible party in the sense of the General Data Protection Regulation and other national data protection laws of the member states as well as other data protection provisions is:

BHS Spedition und Logistik GmbH
Ludwig Erhard Str. 38
DE-28197 Bremen
Deutschland/Germany

Tel.: +49 (0) 421-5952-0
E-Mail: info@bhs-spedition.com
Website: www.bhs-spedition.com

II. Name and address of the data protection officer

We have appointed a data protection officer for our company.

secopan gmbh
Am Schönblick 14
D-71229 Leonberg
Telefon: +497152-56958-0
E-Mail: datenschutz@secopan.de

III. General information on data processing

We, as BHS Spedition and Logistik GmbH, value your privacy. We understand that you trust us to handle your personal information responsibly. Our policy aims to provide comprehensive protection for your personal data. Please read on if you would like to learn more about our data protection policy. This privacy policy governs the collection, processing, and use (hereinafter collectively referred to as “processing”) of your personal data, as far as it arises in connection with the use of our website and/or our app or if you contact us in connection with the initiation or performance of a contract or request information from us. We handle your data in strict compliance with the applicable legal data protection regulations and the principles set out below. We comply with the principles of data processing in accordance with Article 5 of the GDPR. Your data is processed only for specified purposes, limited to the necessary extent, up to date, stored only for the duration of the collection purpose and processed with appropriate security measures.

1. Scope of processing of personal data

Wir erheben und verwenden personenbezogene Daten unserer Nutzer grundsätzlich nur, soweit dies zur Abwicklung unserer Verträge erforderlich ist. Nach Erfüllung der vertraglichen Pflichten verarbeiten wir diese Daten nur nach erteilter Einwilligung. Eine Ausnahme gilt in solchen Fällen, in denen eine vorherige Einholung einer Einwilligung aus tatsächlichen Gründen nicht möglich ist oder die Verarbeitung der Daten durch gesetzliche Vorschriften gestattet ist.

2. Legal basis for the processing of personal data:

If we obtain the consent of the data subject for processing of personal data, Article 6 (1) lit. a GDPR serves as the legal basis. For the processing of personal data necessary for the performance of a contract to which the data subject is party, Article 6 (1) lit. b GDPR serves as the legal basis. This also applies to processing operations necessary for carrying out pre-contractual measures. If the processing of personal data is necessary for compliance with a legal obligation to which our company is subject, Article 6 (1) lit. c GDPR serves as the legal basis. If the processing is necessary for the purposes of the legitimate interests pursued by our company or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, then Article 6 (1) lit. f GDPR serves as the legal basis for processing.

3. Erasure and storage period of data:

Personal data of the data subject will be deleted or blocked as soon as the purpose of storage ceases to apply. Storage may take place beyond this period if this has been provided for by the European or national legislator in Union regulations, laws or other provisions to which the controller is subject. Data will also be blocked or deleted if a storage period prescribed by the aforementioned norms expires, unless further storage of the data is necessary for conclusion of a contract or contract fulfilment.

4. Data processing in connection with the provision of transport and logistics services

The provision of transport and logistics services by BHS Spedition and Logistik GmbH requires the processing of personal data in some cases. Processing of personal data may be necessary by us even before the conclusion of a contract (e.g. in the context of preparing a quotation) as well as during the performance of the contract. Personal and business contact information (e.g. name, first name, company, physical address, email address, telephone number, and/or fax number) which is essential for the provision of our services, may include the following categories of data. However, in individual cases, the processing of further categories of data may be necessary, such as:

• Shipping-related contact details of carriers and recipients, their physical address, email address, and telephone number
• Signature of receipt confirmation
• Account information, as well as
• Other information that makes it easier for us to provide our services, and information that relates to goods being transported, but only to the extent that they are data with personal reference.
• Information that enables us to verify a person’s identity.
• Name, email address, and telephone number of a third person, if we are asked to provide this person with information regarding a transport or other service.
• Payment information as well as financial data (such as account connections)
• Tax information as far as you use services for which the processing of tax data is necessary.
• Further personal data that is communicated to us by you or third parties in the course of providing our services

If you transmit personal data to BHS Spedition and Logistik GmbH, please ensure that this data is relevant, accurate, and necessary for the initiation or execution of the business relationship. In particular, if you transmit data that refers to a third person, you are legally obliged to observe the general data protection principles. If we pick up freight, deliver goods, or provide other services, we may process address information. Such information for locating an address may also include GPS data, geocodes, latitude/longitude, and graphic representations/images in individual cases. Certain transportation information is transmitted to authorities in transit or destination countries, for example, for customs or tax reasons or to conduct a security check. This transmission is dependent on the legal provisions in the transit or destination country. In general, such data sets contain the following individual information, although there may be deviations in individual cases due to legal requirements: name and address of the shipper, name and address of the recipient, description of the transported goods, if applicable, number of pieces of goods, weight and value of the cargo. In individual cases, we may transfer personal data to another country than the one in which the data was collected. Data is primarily transferred for the purpose of providing our services, such as to other companies in the BHS Spedition and Logistik GmbH group, agents acting on behalf of BHS Spedition and Logistik GmbH, or other affiliated companies. Please note that BHS Spedition and Logistik GmbH works with a number of partners to provide you with the best possible service (e.g. subcontractors such as transport and logistics companies, ports, warehouses, etc.). This may also, within the legally permissible limits, require the transfer of personal information. Please also note that for technical and legal reasons, BHS Spedition and Logistik GmbH is not able to offer you our services if you partially or completely object to this data processing and transfer. The countries to which we transfer data may have data protection laws that differ from the standards of the legal system under which you have transferred the data to us. If we transfer data to other countries, we protect your data in accordance with this privacy policy and in compliance with applicable legal requirements. In case of transmission of personal data between legal systems with differing levels of protection, we will comply with the stricter legal requirements. We use specific contracts for the protection of personal data (e.g. model contracts of the European Commission for the transfer of data to third countries) and we regularly work with our partners and contractors to ensure compliance with all applicable legal requirements. For further information regarding the data processed during the installation or use of our website or the BHS Spedition and Logistik GmbH app, please refer to the corresponding section of this privacy policy.

IV. Provision of the Website and Creation of Log Files

1. Description and Scope of Data Processing

• Whenever our website is accessed, our system automatically records data and information from the calling computer system. The following data is collected:
• Information about the type and version of the browser
• The user’s operating system
• The user’s internet service provider
• The user’s IP address
• Date and time of access
• Websites that are accessed by the user’s system through our website

The data is also stored in the log files of our system. Storage of this data together with other personal data of the user does not take place.

2. Legal basis for data processing

The legal basis for the temporary storage of data and log files is Art. 6 para. 1 lit. f GDPR.

3. Purpose of data processing

The temporary storage of the IP address by the system is necessary to enable delivery of the website to the user’s computer. For this purpose, the user’s IP address must be stored for the duration of the session. The storage in log files is done to ensure the functionality of the website. In addition, the data is used to optimize the website and to ensure the security of our information technology systems. An evaluation of the data for marketing purposes does not take place in this context. These purposes also constitute our legitimate interest in data processing in accordance with Art. 6 para. 1 lit. f GDPR.

4. Duration of storage

The data will be deleted as soon as it is no longer necessary for the purpose of its collection. In the case of data collected for the provision of the website, this is the case when the respective session has ended. In the case of storage of data in log files, this is the case after a maximum of seven days. Further storage is possible. In this case, the IP addresses of the users are deleted or altered so that an assignment of the calling client is no longer possible.

5. Objection and removal option

Users do not have the right to object to the collection of data for the provision of the website and the storage of data in log files, as this is necessary for the operation of the website.

V. Use of Cookies

1. Description and Scope of Data Processing

Our website uses cookies. Cookies are text files that are stored in the internet browser or by the internet browser on the user’s computer system. When a user accesses a website, a cookie may be stored on the user’s computer system. This cookie contains a characteristic string of characters that enables unique identification of the browser when the website is accessed again. We use cookies to make our website more user-friendly. Some elements of our website require that the calling browser can also be identified after a page change. In addition, we use cookies on our website that allow us to analyze user surfing behavior.

In this way, the following data can be transmitted:

• Entered search terms
• Frequency of page views
• Use of website functions

The data collected from users in this way is pseudonymized through technical measures. Therefore, it is no longer possible to assign the data to the calling user. The data is not stored together with other personal data of the users.

When our website is accessed, the user is informed about the use of cookies for analysis purposes by an info banner. In this context, a reference is also made to this privacy policy.

2. Legal basis for data processing

The legal basis for processing personal data using technically necessary cookies is Art. 6 para. 1 lit. f GDPR. The legal basis

3. Purpose of data processing

The use of analysis cookies is for the purpose of improving the quality of our website and its content. By means of analysis cookies, we learn how the website is used and can continually optimize our offer.

In pursuing these purposes, we have a legitimate interest in the processing of personal data according to Art. 6 (1) lit. f GDPR.

4. Duration of storage, right to object and rectification

The cookies are stored on the user’s computer and transmitted to our site. As a user, you have full control over the use of cookies. By changing the settings in your internet browser, you can disable or restrict the transmission of cookies. Previously stored cookies can be deleted at any time, including through automated means. If cookies are disabled for our website, it may not be possible to use all website functions to their full extent.

Cookie consent with Borlabs Cookie

Our website uses the cookie consent technology from Borlabs Cookie to obtain your consent for the storage of certain cookies in your browser and to document this in compliance with data protection regulations. The provider of this technology is Borlabs – Benjamin A. Bornschein, Georg-Wilhelm-Str. 17, 21107 Hamburg (hereinafter referred to as “Borlabs”).

When you enter our website, a Borlabs cookie is stored in your browser, which stores the consents granted or revocation of these consents. This data is not shared with the provider of Borlabs Cookie.

The data collected is stored until you ask us to delete it, delete the Borlabs cookie yourself, or the purpose of the data storage no longer applies. Mandatory legal retention periods remain unaffected. Details on the data processing of Borlabs Cookie can be found at https://de.borlabs.io/kb/welche-daten-speichert-borlabs-cookie/ https://de.borlabs.io/kb/welche-daten-speichert-borlabs-cookie/

The use of the Borlabs Cookie Consent technology is to obtain the legally required consent for the use of cookies. The legal basis for this is Art. 6 para. 1 sentence 1 lit. c GDPR.

Here Ihre individuellen Borlabs-Einstellung anpassen you can adjust your individual Borlabs settings or deactivate all non-technically necessary cookies.

5. Google Analytics

This website uses Google Analytics, a web analytics service provided by Google Inc. (“Google”). Google Analytics uses “cookies”, which are text files placed on your computer, to help the website analyze how users use the site. The information generated by the cookie about your use of the website will generally be transmitted to and stored by Google on servers in the United States. However, if IP anonymization is activated on this website, your IP address will be truncated by Google within member states of the European Union or other parties to the Agreement on the European Economic Area before transmission.

Only in exceptional cases will the full IP address be transmitted to a Google server in the United States and truncated there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity, and to provide other services related to website activity and internet usage to the website operator. The IP address transmitted by your browser as part of Google Analytics will not be merged with other data from Google.

You can prevent the storage of cookies by adjusting your browser software settings; however, please note that if you do this, you may not be able to use all the features of this website to their fullest extent. You can also prevent Google from collecting and processing data generated by the cookie and related to your use of the website (including your IP address) by downloading and installing the browser plug-in available at the following link: http://tools.google.com/dlpage/gaoptout?hl=en

VI. Newsletter

We do not offer newsletter subscription or send newsletters. Therefore, relevant notices are unnecessary for us.

VII. Registration, among others, with Track & Trace or Internet shipment tracking

If registration serves the fulfillment of a contract, whose contracting party is the user, or the implementation of pre-contractual measures, additional legal basis for the processing of the data is Art. 6 para. 1 lit. b GDPR.

1. Purpose of data processing

Registration of the user is necessary to fulfill a contract (Track & Trace) with the user or to carry out pre-contractual measures.

2. Duration of storage

The data will be deleted as soon as they are no longer necessary for the purpose of their collection. This is the case for data collected during the registration process on our website when the registration is canceled or modified. This is also the case for data collected during the registration process to fulfill a contract or to carry out pre-contractual measures when the data is no longer necessary for the performance of the contract. Even after the contract has been concluded, there may be a need to store the contracting party’s personal data to comply with contractual or legal obligations.

3. Right to object and rectification

As a user, you have the right to dissolve your registration at any time. You can also request the modification of the personal data stored about you.

If the data is necessary for the fulfillment of a contract or for the implementation of pre-contractual measures, premature deletion of the data is only possible if contractual or legal obligations do not prevent such deletion.

VIII. Rights of the data subject

If personal data concerning you is processed, you are a data subject within the meaning of the GDPR and you have the following rights against the data controller:

1. Right to information

You can request confirmation from the controller as to whether personal data concerning you is being processed by us. If such processing exists, you may request the controller to provide you with the following information:

• the purposes for which the personal data are being processed;
• the categories of personal data being processed;
• the recipients or categories of recipients to whom the personal data concerning you have been or will be disclosed;
• the planned duration of the storage of the personal data concerning you or, if concrete information on this is not possible, the criteria for determining the storage period;
• the existence of a right to rectification or erasure of personal data concerning you, a right to restriction of processing by the controller, or a right to object to such processing;
• the existence of a right to lodge a complaint with a supervisory authority;
• all available information about the origin of the data, if the personal data were not collected from the data subject;
• the existence of automated decision-making, including profiling, in accordance with Art. 22(1) and (4) GDPR and, at least in these cases, meaningful information about the logic involved as well as the significance and the envisaged consequences of such processing for the data subject.

You have the right to obtain information as to whether personal data concerning you is being transferred to a third country or to an international organization. In this context, you may request to be informed about the appropriate safeguards pursuant to Art. 46 GDPR in connection with the transfer.

2. Right to rectification

You have the right to obtain from the controller without undue delay the rectification of inaccurate or incomplete personal data concerning you. The controller shall promptly correct any such data.

3. Right to restriction of processing

Under the following circumstances, you may request the restriction of processing of personal data concerning you:

• if you contest the accuracy of the personal data, for a period enabling the controller to verify the accuracy of the data;
• if the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;
• if the controller no longer needs the personal data for the purposes of the processing, but you require them for the establishment, exercise or defense of legal claims; or
• if you have objected to processing pursuant to Article 21(1) GDPR
• pending the verification whether the legitimate grounds of the controller override your grounds.

If the processing of personal data concerning you has been restricted, these data may only be processed, with the exception of their storage, with your consent or for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State. If the restriction of processing has been restricted under the aforementioned conditions, you will be informed by the controller before the restriction is lifted.

4. Right to erasure

a. Löschungspflicht

You may request the controller to erase without undue delay personal data concerning you, and the controller shall be obliged to erase such data without undue delay if one of the following reasons applies:

• The personal data concerning you are no longer necessary for the purposes for which they were collected or otherwise processed.
• You withdraw your consent on which the processing pursuant to Art. 6(1)(a) or Art. 9(2)(a) GDPR was based, and there is no other legal ground for the processing.
• You object to the processing pursuant to Art. 21(1) GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21(2) GDPR.
• The personal data concerning you have been unlawfully processed.
• The deletion of personal data concerning you is necessary to fulfill a legal obligation under Union law or the law of the Member States to which the controller is subject.
• The personal data concerning you were collected in relation to services offered by the information society pursuant to Article 8(1) of the GDPR. b. Information to third parties

If the controller has made the personal data concerning you public and is obliged to delete them pursuant to Article 17(1) GDPR, he shall, taking account of available technology and implementation costs, take reasonable steps, including technical measures, to inform controllers which are processing the personal data that you as the data subject have requested the erasure by such controllers of any links to, or copy or replication of, those personal data.

b. Exceptions

The right to erasure does not apply to the extent that processing is necessary:

• for exercising the right of freedom of expression and information;
• for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
• For reasons of public interest in the area of public health pursuant to Art. 9 para. 2 lit. h and i as well as Art. 9 para. 3 GDPR;
• for archiving purposes in the public interest, scientific or historical research purposes or for statistical purposes pursuant to Art. 89
• para. 1 GDPR, to the extent that the right referred to in Section a) is likely to render impossible or seriously impair the achievement of the objectives of that processing, or
• for the establishment, exercise or defense of legal claims.

5. Right to notification

If you have exercised your right to rectification, erasure or restriction of processing against the controller, he is obliged to notify all recipients to whom the personal data concerning you have been disclosed of this rectification or erasure of the data or restriction of processing, unless this proves impossible or involves a disproportionate effort. You have the right to be informed about these recipients from the controller.

6. Right to data portability

You have the right to receive the personal data concerning you, which you have provided to the controller, in a structured, commonly used and machine-readable format. You also have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where:
(1) the processing is based on consent pursuant to Article 6(1)(a) GDPR or Article 9(2)(a) GDPR or on a contract pursuant to Article 6(1)(b) GDPR; and
(2) the processing is carried out by automated means.
In exercising this right, you also have the right to have the personal data transmitted directly from one controller to another, where technically feasible. This shall not adversely affect the rights and freedoms of others. The right to data portability shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

7. Right to Object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data which is based on Article 6(1)(e) or (f) of the GDPR, including profiling based on those provisions. The controller shall no longer process your personal data, unless the controller demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defense of legal claims. If your personal data is processed for direct marketing
purposes, you have the right to object at any time to processing of your personal data for such marketing, which includes profiling to the extent that it is related to such direct marketing.
If you object to processing for direct marketing purposes, your personal data shall no longer be processed for such purposes. You have the right to exercise your right to object in relation to the use of information society services, without prejudice to Directive 2002/58/EC, by means of automated procedures using technical specifications.

8. Right to revoke the data protection consent declaration

You have the right to revoke your data protection consent declaration at any time. The revocation of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

9. Automated individual decision-making, including profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision:

• is necessary for entering into, or performance of, a contract between you and the data controller,
• is authorized by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests or
• is based on your explicit consent.

However, these decisions shall not be based on special categories of personal data referred to in Article 9(1) GDPR, unless Article 9(2)(a) or (g) GDPR applies and suitable measures to safeguard your rights and freedoms and legitimate interests have been taken.

Regarding the cases mentioned in (1) and (3), the controller shall implement suitable measures to safeguard your rights and freedoms and legitimate interests, which shall include at least the right to obtain human intervention on the part of the controller, to express your point of view, and to contest the decision.

10. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR. The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Article 78 GDPR.

IX. Social Media

There are no links to external social media (“social plugins”) on our website.

X. Marketing

Facebook

We do not use Facebook as a company account nor do we use their Lookalike Custom Audiences, and we do not transmit personal data or any other data to Facebook from our central IT systems (CRM, transport management systems, etc.).

LinkedIn

BHS Spedition und Logistik GmbH does not provide LinkedIn with personally identifiable data from our central operational IT systems (such as CRM or CSV data, transport management systems, etc.) and we do not have a so-called company account.

Other social media services

These are also not served by BHS.

XI. Third-party access to your personal data

The collection, processing, and use of personal data is carried out by ourselves and – unless we have expressly excluded this – also by other companies of the BHS Spedition und Logistik GmbH group (subsidiaries) or by external service providers commissioned by us and contractually and legally obliged to comply with data protection. In the latter two cases, we will ensure that group companies and external service providers comply with the relevant legal data protection rules and obligations arising from this data protection declaration. We comply with the legal requirements of the EU General Data Protection Regulation, unless stricter legal requirements are applicable, which must be given priority.
In addition, no third party has access to your personal data. We will not sell or otherwise exploit this data. We will only disclose data to competent authorities or in cases where there is a legal obligation to do so. This also applies in the event of a court order to disclose data. In the event of a legal, regulatory, or judicial obligation to disclose data, we will examine on a case-by-case basis whether such disclosure is in accordance with the principles of the EU General Data Protection Regulation and/or applicable national law, and, if necessary, take legal action.

XII. Security

We have implemented technical and organizational measures to protect your personal data against loss, alteration, theft, or unauthorized access by third parties. Our IT systems are designed to comply with the requirements of Art. 32 et seq. of the EU General Data Protection Regulation.

XIII. Children and Minors

We do not knowingly process personal data concerning minors under the age of 16, unless we are legally obliged to do so. If we become aware that data has been transmitted to us without the consent of the parents or other legal guardians outside of such a legal obligation, we will delete this data immediately.

XIV. Deletion and blocking

We will delete your personal data when the business purpose associated with the data has ceased or when the relevant data protection rules require us to do so. In the case of consent, we will delete your data after revocation or when the purpose of the consent (section 2) no longer applies.
At your request, we will block personal data in whole or in part, as long as this does not violate the overriding legal interests of BHS Spedition und Logistik GmbH in the processing. Please inform us of the extent and duration of the blocking. If technically possible, you can thus exclude the processing and use of your data for certain areas.

XV. Payment information

If BHS uses a third-party payment process, we do not store credit card data, but transfer the payment process entirely to the third-party service provider. Personal data relating to you will be processed by the third-party provider to provide the corresponding services.
Please inquire with the respective service provider about their relevant data protection regulations and compliance with applicable laws. If you have any questions about our use of payment service providers, please contact us. Contact details can be found in Section 16.

XVI. Hyperlinks

The BHS website may contain hyperlinks, i.e. electronic cross-references, to third-party websites. As BHS Spedition und Logistik GmbH is not responsible for the content and data protection compliance of third-party websites, we ask you to observe the respective privacy policy on third-party websites.