We, Vanderbilt International GmbH, would like to inform you about the processing of your personal data as your or your employer’s supplier or customer the following Data Protection Statement.
§ 1 Details of the controller and data protection officer
Vanderbilt International GmbH
Borsigstr. 34
65205 Wiesbaden
Germany
Our data protection officer‘s details are:
Data Protection Officer
@yet GmbH,
Tel: +49 173 416 2933
dpo@acre-int.com
§ 2 Which personal data is being processed by us (categories of personal data concerned)?
As your or your employer’s supplier or customer we will collect or have collected certain personal data about you. This shall include in particular:
- first name(s) and family name, possibly birth name
- business address, telephone number(s) and email address(es)
- gender
- language
- profession and academic title(s)
- employer, position and/or job title at the employer
- VAT ID number
You are not obligated to provide any personal data to us before entering into a binding contract with us. However, the provision of your personal data is usually a requirement necessary to enter into a contract with us, since we otherwise cannot process your or your employer’s order or request.
§ 3 Where does your personal data come from (sources of your personal data)?
Most of your personal data we process was or will be collected directly from you, in particular when you were or will be negotiating and conducting your or your employer’s order or request. Some of your personal data were or will be assigned from ourselves to your data set for administration purposes, for example, your internal customer identification number. And some of your personal data we process will be obtained from third parties we may contact in order to conduct our contract with you or your employer or to comply with applicable laws and regulations.
§ 4 What do we do with your personal data (purposes of the processing as well as the legal basis)?
We process your personal data to execute and conduct our contract with you or your employer. In particular, this includes administering, requesting or effecting payments as well as keeping track of our or your deliveries or services, as the case may be. We may also disclose your personal data or parts thereof to our suppliers for the purpose of processing and performing our deliveries or services to you or your employer, or – respectively – to our customers for the purpose of processing and be performing our deliveries or services to them.
We may also disclose your personal data or parts thereof to our tax advisors, lawyers and accountants to enable them to advise and represent us, provided, they are subject to a professional confidentiality obligation under the law or to an equivalent contractual obligation. We process your personal data to also comply with applicable laws and regulations.
Processing your personal data is based on Art. 6 para. 1. (b) GDPR.
§ 5 How do we process your personal data within the Vanderbilt group of companies (still purposes of the processing as well as the legal basis)?
We are part of a group of undertakings affiliated to a central body, the Moose Hold Co (UK) Ltd, Suite 7, Castlegate Business Park, Caldicot, Monmouthshire, NP26 5AD, United Kingdom, which is ultimately owned by Access Control Related Enterprises (ACRE) OPERATING GROUP, LLC, 10161 Park Run Drive, Suite 150, Las Vegas, NV 89145, United States., Delaware, USA. This group of undertakings shall be referred to as the Vanderbilt group. A full and current list of all entities of the Vanderbilt group can be requested from acresecurity.com/contact-us.
As a group of undertakings affiliated to a central body we have a legitimate interest in transmitting personal data within the group for internal administrative purposes, including the processing of customer’s or supplier’s personal data. In particular, those purposes are the following:
Like with other corporations our production sites, service centers and administration departments at Vanderbilt group are distributed across our member companies. We collaborate with other member companies of the Vanderbilt group in order to provide our products and services to you or your employer, if you or your employer are our customers, or – if you or your employer are our suppliers – in order to receive your products and services from you or your employer. Hence, processing personal data of customers or suppliers and their employees across member companies in the Vanderbilt group is part of its inheritance, including to and by our holding companies, the Moose Hold Co (UK) Ltd as well as the Moose Enterprises Ltd. (UK), both residing in the United Kingdom, and ultimately the ACRE LLC, which resides in the Delaware, USA.
To limit and secure personal data processing, we do the following:
Only those employees working at your order, even if he may be employed by another member of the Vanderbilt group, have access to your personal data and are, of course, obligated to obey any and all legal requirements when processing your personal data, which includes a confidentiality obligation.
To enable you to exercise your rights regarding your personal data all members of the Vanderbilt group mutually agreed to honour such rights directly from and towards you, even if you should not have a contractual relationship with that particular member company. This enables you to exercise your rights regarding your personal data, in particular, those mentioned under §§ 7-9 of this statement, directly against any member of the Vanderbilt group concern. Intercompany arrangements are in place as well.
We shall hereby inform you of your right to object at any time to the processing of your personal data for aforementioned legitimate interests, based on grounds relating to your particular situation. In this event, we shall no longer process your personal data, unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms or for the establishment, exercise or defense of legal claims. In order to object, you may contact:
Vanderbilt International GmbH
Borsigstr. 34
65205 Wiesbaden
Germany
email: gdpr-info@vanderbiltindustries.com
Processing your personal data in the Vanderbilt group is based upon Art. 6 para. 1 (f) GDPR, additionally to the legal basis mentioned above under § 4, last sentence.
§ 6 For how long do we store your personal data (storage period)?
We store your personal data for as long as we are obligated to do so by applicable laws and regulations, or, in lack of the foregoing, until the purpose of processing your personal data has been reached.
In event we enter into a contract with you, we will store your personal data until the ending of this contract and beyond, in as far as we are obligated to do so by applicable laws and regulations, or an event we need this data to fulfil our post-contractual duties under the business relationship, for example for purposes of providing or receiving warranty, or to allege or rebut claims raised by or against us.
Where processing your personal data is based purely on your consent, we store your personal data until the purpose of processing your personal data has been reached or you should withdraw your consent, whichever will occur first unless we are obligated to store your personal data for a longer period by applicable laws and regulations.
If members of the Vanderbilt group undertake or are involved in any merger, acquisition, reorganization, sale of assets, bankruptcy, or insolvency event, then they may sell, transfer or share some or all of their assets, including your information in connection with such transaction or in contemplation of such transaction (e.g., due diligence). In this event, we will notify you before your personal information is transferred and becomes subject to a different privacy policy.
§ 7 Your rights to request access, rectification or erasure as well as data portability
We shall hereby inform you about the existence of your rights under the law to request from our access to and rectification or erasure of your personal data or restriction of processing, to receive notification thereof and to object to processing as well as your right to data portability.
If you so requested, we shall inform you about the personal data concerning you and provide you a copy of your personal data undergoing processing. If, despite our efforts to hold correct and up-to-date data, incorrect data was stored by us, we shall correct this immediately upon your request.
In order to exercise your aforementioned rights, you may contact:
Vanderbilt International GmbH
Borsigstr. 34
65205 Wiesbaden
Germany
email: gdpr-info@vanderbiltindustries.com
As mentioned above under § 5, in as far as your personal data is being processed by any other members of the Vanderbilt group, you shall be entitled to exercise any and all of the aforementioned rights against the member company in concern. This does not affect your rights towards us.
§ 8 Your right to revoke your consent
Where processing of your personal data is based on your consent, you shall have the right to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal. To do so, please contact:
Vanderbilt International GmbH
Borsigstr. 34
65205 Wiesbaden
Germany
email: gdpr-info@vanderbiltindustries.com
§ 9 Your right to lodge a complaint with a supervisory authority
We shall hereby inform you about your right to lodge a complaint with the supervisory authority, which would be:
Der Hessische Datenschutzbeauftragte
Gustav-Stresemann-Ring 1
65189 Wiesbaden
Germany
Tel. 0611/1408-0
Fax 0611/1408-900 or -901
§ 10 Security measures to protect the personal data stored by us
We undertake to protect your personal data. To prevent a loss or unauthorized use of the personal data stored by us, we take extensive technical and organizational security precautions that are checked regularly and are adapted to technological progress. For example, we make use of firewalls, data encryption as well as access control and even physical measures to protect your personal data. A more current and more detailed outline on the security precautions adopted by us can be retrieved from Vanderbilt International GmbH in Wiesbaden.
We are required to inform you that an adequacy decision of the European Commission regarding an adequate level of data protection exists neither for the United Kingdom nor for the USA, in which countries we may be processing your personal data within the Vanderbilt group. Instead, we at Vanderbilt group adhere to the EU-US Privacy Shield Framework as well as standard data protection clauses adopted by the Commission. You shall be entitled to receive a copy of those guarantees safeguarding the protection of your personal data at any time from Vanderbilt International GmbH in Wiesbaden
§ 11 Changes and Amendments
As changes in legislation or our internal processes may render it necessary to modify this data protection statement, we must reserve the right to do so from time to time. The current data protection statement can be retrieved, saved and printed out at any time by accessing this page. (https://acresecurity.com/legal/vanderbilt-data-protection-for-customers-and-suppliers) Please check regularly.
Nordenstadt, on April 2018
General Data Protection Regulation; REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation.