Data protection declaration according to the GDPR
Information on the protection of your data – Data protection declaration | data protection
I. Name and address of the responsible party
The responsible party in the sense of the General Data Protection Regulation and other national data protection laws of the member states as well as other data protection provisions is:
BHS Spedition und Logistik GmbH
Ludwig Erhard Str. 38
Tel.: +49 (0) 421-5952-0
II. Name and address of the data protection officer
We have appointed a data protection officer for our company.
Am Schönblick 14
III. General information on data processing
1. Scope of processing of personal data
Wir erheben und verwenden personenbezogene Daten unserer Nutzer grundsätzlich nur, soweit dies zur Abwicklung unserer Verträge erforderlich ist. Nach Erfüllung der vertraglichen Pflichten verarbeiten wir diese Daten nur nach erteilter Einwilligung. Eine Ausnahme gilt in solchen Fällen, in denen eine vorherige Einholung einer Einwilligung aus tatsächlichen Gründen nicht möglich ist oder die Verarbeitung der Daten durch gesetzliche Vorschriften gestattet ist.
2. Legal basis for the processing of personal data:
If we obtain the consent of the data subject for processing of personal data, Article 6 (1) lit. a GDPR serves as the legal basis. For the processing of personal data necessary for the performance of a contract to which the data subject is party, Article 6 (1) lit. b GDPR serves as the legal basis. This also applies to processing operations necessary for carrying out pre-contractual measures. If the processing of personal data is necessary for compliance with a legal obligation to which our company is subject, Article 6 (1) lit. c GDPR serves as the legal basis. If the processing is necessary for the purposes of the legitimate interests pursued by our company or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, then Article 6 (1) lit. f GDPR serves as the legal basis for processing.
3. Erasure and storage period of data:
Personal data of the data subject will be deleted or blocked as soon as the purpose of storage ceases to apply. Storage may take place beyond this period if this has been provided for by the European or national legislator in Union regulations, laws or other provisions to which the controller is subject. Data will also be blocked or deleted if a storage period prescribed by the aforementioned norms expires, unless further storage of the data is necessary for conclusion of a contract or contract fulfilment.
4. Data processing in connection with the provision of transport and logistics services
The provision of transport and logistics services by BHS Spedition and Logistik GmbH requires the processing of personal data in some cases. Processing of personal data may be necessary by us even before the conclusion of a contract (e.g. in the context of preparing a quotation) as well as during the performance of the contract. Personal and business contact information (e.g. name, first name, company, physical address, email address, telephone number, and/or fax number) which is essential for the provision of our services, may include the following categories of data. However, in individual cases, the processing of further categories of data may be necessary, such as:
- Shipping-related contact details of carriers and recipients, their physical address, email address, and telephone number
- Signature of receipt confirmation
- Account information, as well as
- Other information that makes it easier for us to provide our services, and information that relates to goods being transported, but only to the extent that they are data with personal reference.
- Information that enables us to verify a person’s identity.
- Name, email address, and telephone number of a third person, if we are asked to provide this person with information regarding a transport or other service.
- Payment information as well as financial data (such as account connections)
- Tax information as far as you use services for which the processing of tax data is necessary.
- Further personal data that is communicated to us by you or third parties in the course of providing our services
IV. Provision of the Website and Creation of Log Files
1. Description and Scope of Data Processing
- Whenever our website is accessed, our system automatically records data and information from the calling computer system. The following data is collected:
- Information about the type and version of the browser
- The user’s operating system
- The user’s internet service provider
- The user’s IP address
- Date and time of access
- Websites that are accessed by the user’s system through our website
The data is also stored in the log files of our system. Storage of this data together with other personal data of the user does not take place.
2. Legal basis for data processing
The legal basis for the temporary storage of data and log files is Art. 6 para. 1 lit. f GDPR.
3. Purpose of data processing
The temporary storage of the IP address by the system is necessary to enable delivery of the website to the user’s computer. For this purpose, the user’s IP address must be stored for the duration of the session. The storage in log files is done to ensure the functionality of the website. In addition, the data is used to optimize the website and to ensure the security of our information technology systems. An evaluation of the data for marketing purposes does not take place in this context. These purposes also constitute our legitimate interest in data processing in accordance with Art. 6 para. 1 lit. f GDPR.
4. Duration of storage
The data will be deleted as soon as it is no longer necessary for the purpose of its collection. In the case of data collected for the provision of the website, this is the case when the respective session has ended. In the case of storage of data in log files, this is the case after a maximum of seven days. Further storage is possible. In this case, the IP addresses of the users are deleted or altered so that an assignment of the calling client is no longer possible.
5. Objection and removal option
Users do not have the right to object to the collection of data for the provision of the website and the storage of data in log files, as this is necessary for the operation of the website.
1. Description and Scope of Data Processing
In this way, the following data can be transmitted:
- Entered search terms
- Frequency of page views
- Use of website functions
The data collected from users in this way is pseudonymized through technical measures. Therefore, it is no longer possible to assign the data to the calling user. The data is not stored together with other personal data of the users.
2. Legal basis for data processing
The legal basis for processing personal data using technically necessary cookies is Art. 6 para. 1 lit. f GDPR. The legal basis
3. Purpose of data processing
The use of analysis cookies is for the purpose of improving the quality of our website and its content. By means of analysis cookies, we learn how the website is used and can continually optimize our offer.
In pursuing these purposes, we have a legitimate interest in the processing of personal data according to Art. 6 (1) lit. f GDPR.
4. Duration of storage, right to object and rectification
Cookie consent with Borlabs Cookie
Our website uses the cookie consent technology from Borlabs Cookie to obtain your consent for the storage of certain cookies in your browser and to document this in compliance with data protection regulations. The provider of this technology is Borlabs – Benjamin A. Bornschein, Georg-Wilhelm-Str. 17, 21107 Hamburg (hereinafter referred to as “Borlabs”).
When you enter our website, a Borlabs cookie is stored in your browser, which stores the consents granted or revocation of these consents. This data is not shared with the provider of Borlabs Cookie.
The data collected is stored until you ask us to delete it, delete the Borlabs cookie yourself, or the purpose of the data storage no longer applies. Mandatory legal retention periods remain unaffected. Details on the data processing of Borlabs Cookie can be found at https://de.borlabs.io/kb/welche-daten-speichert-borlabs-cookie/ https://de.borlabs.io/kb/welche-daten-speichert-borlabs-cookie/
Here Ihre individuellen Borlabs-Einstellung anpassen you can adjust your individual Borlabs settings or deactivate all non-technically necessary cookies.
5. Google Analytics
This website uses Google Analytics, a web analytics service provided by Google Inc. (“Google”). Google Analytics uses “cookies”, which are text files placed on your computer, to help the website analyze how users use the site. The information generated by the cookie about your use of the website will generally be transmitted to and stored by Google on servers in the United States. However, if IP anonymization is activated on this website, your IP address will be truncated by Google within member states of the European Union or other parties to the Agreement on the European Economic Area before transmission.
Only in exceptional cases will the full IP address be transmitted to a Google server in the United States and truncated there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity, and to provide other services related to website activity and internet usage to the website operator. The IP address transmitted by your browser as part of Google Analytics will not be merged with other data from Google.
You can prevent the storage of cookies by adjusting your browser software settings; however, please note that if you do this, you may not be able to use all the features of this website to their fullest extent. You can also prevent Google from collecting and processing data generated by the cookie and related to your use of the website (including your IP address) by downloading and installing the browser plug-in available at the following link: http://tools.google.com/dlpage/gaoptout?hl=en
We do not offer newsletter subscription or send newsletters. Therefore, relevant notices are unnecessary for us.
VII. Registration, among others, with Track & Trace or Internet shipment tracking
If registration serves the fulfillment of a contract, whose contracting party is the user, or the implementation of pre-contractual measures, additional legal basis for the processing of the data is Art. 6 para. 1 lit. b GDPR.
1. Purpose of data processing
Registration of the user is necessary to fulfill a contract (Track & Trace) with the user or to carry out pre-contractual measures.
2. Duration of storage
The data will be deleted as soon as they are no longer necessary for the purpose of their collection. This is the case for data collected during the registration process on our website when the registration is canceled or modified. This is also the case for data collected during the registration process to fulfill a contract or to carry out pre-contractual measures when the data is no longer necessary for the performance of the contract. Even after the contract has been concluded, there may be a need to store the contracting party’s personal data to comply with contractual or legal obligations.
3. Right to object and rectification
As a user, you have the right to dissolve your registration at any time. You can also request the modification of the personal data stored about you.
If the data is necessary for the fulfillment of a contract or for the implementation of pre-contractual measures, premature deletion of the data is only possible if contractual or legal obligations do not prevent such deletion.
VIII. Rights of the data subject
If personal data concerning you is processed, you are a data subject within the meaning of the GDPR and you have the following rights against the data controller:
1. Right to information
You can request confirmation from the controller as to whether personal data concerning you is being processed by us. If such processing exists, you may request the controller to provide you with the following information:
- the purposes for which the personal data are being processed;
- the categories of personal data being processed;
- the recipients or categories of recipients to whom the personal data concerning you have been or will be disclosed;
- the planned duration of the storage of the personal data concerning you or, if concrete information on this is not possible, the criteria for determining the storage period;
- the existence of a right to rectification or erasure of personal data concerning you, a right to restriction of processing by the controller, or a right to object to such processing;
- the existence of a right to lodge a complaint with a supervisory authority;
- all available information about the origin of the data, if the personal data were not collected from the data subject;
- the existence of automated decision-making, including profiling, in accordance with Art. 22(1) and (4) GDPR and, at least in these cases, meaningful information about the logic involved as well as the significance and the envisaged consequences of such processing for the data subject.
You have the right to obtain information as to whether personal data concerning you is being transferred to a third country or to an international organization. In this context, you may request to be informed about the appropriate safeguards pursuant to Art. 46 GDPR in connection with the transfer.
2. Right to rectification
You have the right to obtain from the controller without undue delay the rectification of inaccurate or incomplete personal data concerning you. The controller shall promptly correct any such data.
3. Right to restriction of processing
Under the following circumstances, you may request the restriction of processing of personal data concerning you:
- if you contest the accuracy of the personal data, for a period enabling the controller to verify the accuracy of the data;
- if the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;
- if the controller no longer needs the personal data for the purposes of the processing, but you require them for the establishment, exercise or defense of legal claims; or
- if you have objected to processing pursuant to Article 21(1) GDPR
- pending the verification whether the legitimate grounds of the controller override your grounds.
If the processing of personal data concerning you has been restricted, these data may only be processed, with the exception of their storage, with your consent or for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State. If the restriction of processing has been restricted under the aforementioned conditions, you will be informed by the controller before the restriction is lifted.
4. Right to erasure
You may request the controller to erase without undue delay personal data concerning you, and the controller shall be obliged to erase such data without undue delay if one of the following reasons applies:
- The personal data concerning you are no longer necessary for the purposes for which they were collected or otherwise processed.
- You withdraw your consent on which the processing pursuant to Art. 6(1)(a) or Art. 9(2)(a) GDPR was based, and there is no other legal ground for the processing.
- You object to the processing pursuant to Art. 21(1) GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21(2) GDPR.
- The personal data concerning you have been unlawfully processed.
- The deletion of personal data concerning you is necessary to fulfill a legal obligation under Union law or the law of the Member States to which the controller is subject.
- The personal data concerning you were collected in relation to services offered by the information society pursuant to Article 8(1) of the GDPR. b. Information to third parties
If the controller has made the personal data concerning you public and is obliged to delete them pursuant to Article 17(1) GDPR, he shall, taking account of available technology and implementation costs, take reasonable steps, including technical measures, to inform controllers which are processing the personal data that you as the data subject have requested the erasure by such controllers of any links to, or copy or replication of, those personal data.
The right to erasure does not apply to the extent that processing is necessary:
- for exercising the right of freedom of expression and information;
- for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
- For reasons of public interest in the area of public health pursuant to Art. 9 para. 2 lit. h and i as well as Art. 9 para. 3 GDPR;
- for archiving purposes in the public interest, scientific or historical research purposes or for statistical purposes pursuant to Art. 89
- para. 1 GDPR, to the extent that the right referred to in Section a) is likely to render impossible or seriously impair the achievement of the objectives of that processing, or
- for the establishment, exercise or defense of legal claims.
5. Right to notification
If you have exercised your right to rectification, erasure or restriction of processing against the controller, he is obliged to notify all recipients to whom the personal data concerning you have been disclosed of this rectification or erasure of the data or restriction of processing, unless this proves impossible or involves a disproportionate effort. You have the right to be informed about these recipients from the controller.
6. Right to data portability
You have the right to receive the personal data concerning you, which you have provided to the controller, in a structured, commonly used and machine-readable format. You also have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where:
(1) the processing is based on consent pursuant to Article 6(1)(a) GDPR or Article 9(2)(a) GDPR or on a contract pursuant to Article 6(1)(b) GDPR; and
(2) the processing is carried out by automated means.
In exercising this right, you also have the right to have the personal data transmitted directly from one controller to another, where technically feasible. This shall not adversely affect the rights and freedoms of others. The right to data portability shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
7. Right to Object
You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data which is based on Article 6(1)(e) or (f) of the GDPR, including profiling based on those provisions. The controller shall no longer process your personal data, unless the controller demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defense of legal claims. If your personal data is processed for direct marketing
purposes, you have the right to object at any time to processing of your personal data for such marketing, which includes profiling to the extent that it is related to such direct marketing.
If you object to processing for direct marketing purposes, your personal data shall no longer be processed for such purposes. You have the right to exercise your right to object in relation to the use of information society services, without prejudice to Directive 2002/58/EC, by means of automated procedures using technical specifications.
8. Right to revoke the data protection consent declaration
You have the right to revoke your data protection consent declaration at any time. The revocation of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
9. Automated individual decision-making, including profiling
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision:
- is necessary for entering into, or performance of, a contract between you and the data controller,
- is authorized by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests or
- is based on your explicit consent.
However, these decisions shall not be based on special categories of personal data referred to in Article 9(1) GDPR, unless Article 9(2)(a) or (g) GDPR applies and suitable measures to safeguard your rights and freedoms and legitimate interests have been taken.
Regarding the cases mentioned in (1) and (3), the controller shall implement suitable measures to safeguard your rights and freedoms and legitimate interests, which shall include at least the right to obtain human intervention on the part of the controller, to express your point of view, and to contest the decision.
10. Right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR. The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Article 78 GDPR.
IX. Social Media
There are no links to external social media (“social plugins”) on our website.
We do not use Facebook as a company account nor do we use their Lookalike Custom Audiences, and we do not transmit personal data or any other data to Facebook from our central IT systems (CRM, transport management systems, etc.).
BHS Spedition und Logistik GmbH does not provide LinkedIn with personally identifiable data from our central operational IT systems (such as CRM or CSV data, transport management systems, etc.) and we do not have a so-called company account.
Other social media services
These are also not served by BHS.
XI. Third-party access to your personal data
The collection, processing, and use of personal data is carried out by ourselves and – unless we have expressly excluded this – also by other companies of the BHS Spedition und Logistik GmbH group (subsidiaries) or by external service providers commissioned by us and contractually and legally obliged to comply with data protection. In the latter two cases, we will ensure that group companies and external service providers comply with the relevant legal data protection rules and obligations arising from this data protection declaration. We comply with the legal requirements of the EU General Data Protection Regulation, unless stricter legal requirements are applicable, which must be given priority.
In addition, no third party has access to your personal data. We will not sell or otherwise exploit this data. We will only disclose data to competent authorities or in cases where there is a legal obligation to do so. This also applies in the event of a court order to disclose data. In the event of a legal, regulatory, or judicial obligation to disclose data, we will examine on a case-by-case basis whether such disclosure is in accordance with the principles of the EU General Data Protection Regulation and/or applicable national law, and, if necessary, take legal action.
We have implemented technical and organizational measures to protect your personal data against loss, alteration, theft, or unauthorized access by third parties. Our IT systems are designed to comply with the requirements of Art. 32 et seq. of the EU General Data Protection Regulation.
XIII. Children and Minors
We do not knowingly process personal data concerning minors under the age of 16, unless we are legally obliged to do so. If we become aware that data has been transmitted to us without the consent of the parents or other legal guardians outside of such a legal obligation, we will delete this data immediately.
XIV. Deletion and blocking
We will delete your personal data when the business purpose associated with the data has ceased or when the relevant data protection rules require us to do so. In the case of consent, we will delete your data after revocation or when the purpose of the consent (section 2) no longer applies.
At your request, we will block personal data in whole or in part, as long as this does not violate the overriding legal interests of BHS Spedition und Logistik GmbH in the processing. Please inform us of the extent and duration of the blocking. If technically possible, you can thus exclude the processing and use of your data for certain areas.
XV. Payment information
If BHS uses a third-party payment process, we do not store credit card data, but transfer the payment process entirely to the third-party service provider. Personal data relating to you will be processed by the third-party provider to provide the corresponding services.
Please inquire with the respective service provider about their relevant data protection regulations and compliance with applicable laws. If you have any questions about our use of payment service providers, please contact us. Contact details can be found in Section 16.