Data privacy

I. Name and address of the responsible organisation
The responsible organisation with regard to the General Data Protection Regulation and other data privacy laws of member states as well as for other data protection provisions is:

CTS Cremerius-Transport-Service GmbH
Am Parallelhafen 30
D-47059 Duisburg
Tel.: + 49 203 / 710 10 - 49
Fax: + 49 203 / 710 10 - 90
E-Mail: infodu@ctsduffo.de
Website: www.ctsduffo.de

1. Name and address of the Data Protection Officer
The Data Protection Officer of the responsible organisation is:

Stefan König
BLH Consulting, a branch of Beratungs Ltd.
Johann-Maas-Strasse 6
47559 Kranenburg
Germany
Tel.: -49 (0) 172 6783230
E-Mail: info@blh-consulting.de

2. General notes on data processing

1. The scope and processing of personal data

We collect and use the personal data of our users only to the extent that it is required for making a functioning website and our content and services available. The collection and use of person-related data of our users is carried out regularly, only after the consent of the user. In such cases, an exception is when a prior permission with regard to consent is not possible due to practical reasons and when the processing of the data is permitted by legal regulations.

3. Legal basis for the processing of person-related data

As long as we collect person-related data for processing purposes with the permission of the concerned person, Section 6, Para. 1 lit. a of the EU-Datenschutzgrundverordnung (DSGVO) (General Data Protection Regulation [GDPR]) is the legal basis.

At the processing of person-related data, which is meant for the fulfilment of a contract whose contracting party is the person himself, then Section 6, Para 1 lit. b of the DSGVO (GDPR) is the legal basis. This is also applicable for processing procedures which are required for the execution of contractual measures. As far as the processing of person-related data is required for the fulfilment of a legal obligation, which our company is subject to, Section 6 Para. 1 lit. c of the DSGVO is the legal basis. In the case that the vital interests of the affected person or another individual person makes the processing of person-related data necessary, then Section 6 Para. 1 lit. d of the DSGVO is the legal basis. If the processing is required for the legitimate interests of our company or of a third party and if these interests do not outweigh the interests, the fundamental rights and the fundamental freedoms of the first-mentioned interest, then Section 6 Para. 1 lit. f of the DSGVOs is the legal basis for the processing.

4. Deletion of data and duration of storage

The person-related data of the affected person is deleted or blocked as soon as the objective of the storing is not present any more. Storing can still take place if this is permitted by the European or national laws in directives, laws or other regulations concerning the Union, which the responsible organisation is subject to. A blocking or deletion shall also occur when the prescribed storage notice period expires according to the laws mentioned above, unless there is a requirement for further storing of the data, due to a future end of the contract or for the fulfilment of the same, still exists.

5. Making the website available and the creation of log files

1. Description and scope of the data processing
Every time our website is called up, our system automatically captures data and information from the computer system of the accessing computer. The following data is collected in such a case:

IP address
Date and time of access
Page(s) and file(s) called up
Transmitted agent identification
Referrer‘s URL
Transmitted data quantity
Status of the access

The data is also stored in the log files of our system. Storing this data together with other person-related data of the user does not take place.

6. Legal basis for the data processing

The legal basis for the temporary storing of the data and the log files is Section 6 Para. 1 lit. f of the DSGVO.

7. The purpose of data processing

The temporary saving of the IP address by the system is required to deliver the website to the user’s computer. In order to do this, the IP address of the user must be stored for the duration of the access. The storing in log files occurs in order to ensure the functioning of the website. Additionally, the data helps us to optimise the website and to ensure the safety of our information technology systems. An evaluation of the data for the purpose of marketing does not take place in this context. In this context, there is our justified interest in the processing of the data according to Section 6 Para. 1 lit. f of the DSGVO.

8. Duration of the storage

The data shall be deleted as soon as the purpose for its collection has been achieved and it is no longer required. In the case that the capture of the data is for making the website available, then this shall occur as soon as the visit to the website has ended. In the case of the storage of the data in log files, this shall occur after seven days at the latest. A storage beyond that is possible. In such a case, the IP addresses of the users are deleted or altered so that an allocation to the visiting client is no longer possible.

9. Possibility to appeal and eliminate

The capture of data for making the website available and the storage of the data in log files is a necessary requirement for the operation of the website. Thus, there is no appeal possible against that by the user of the website.

10. Use of cookies

1. Description and scope of the data processing Our website uses cookies. Cookies are text files which are stored in the internet browser of by the internet browser on the user’s computer system. If the user calls up a website, a cookie can be stored on the operating system of the user. This cookie contains a characteristic sequence of characters which make it possible to uniquely identify the browser when the website is called up again. We utilise cookies in order to make our website more user friendly. Some elements of our internet page require that the accessing browser can be identified when a page is changed. While doing this, the following data is stored and transmitted in the cookies: An anonymous session identification of an accessing user (encrypted).

2. Legal basis for the data processing
The legal basis of the processing of person-related data while using cookies is Section 6 Para. 1 lit. f of the DSGVO.

3. Purpose of the data processing The purpose for the use of the technical requirement of cookies is to make using the website easier for the user. Some functions of our internet pages cannot be offered without the use of cookies. For these functions, it is necessary that the browser is still recognised after a page change. We require cookies for the following reasons: Session cookies. The user data collected by the technologically necessary cookies are not used to create user profiles. It is for these reasons that there is our justified interest in the processing of person-related data according to Section 6 Para. 1 lit. f of the DSGVO.

4. Duration of the storage, possibility to appeal and eliminate Cookies are stored on the user’s computer and transferred to our page by it. Therefore, you as the user have complete control of the use of cookies. By changing the settings of your internet browser, you can deactivate or limit the transmission of cookies. Already stored cookies can be deleted at any time. This can also be done automatically. If the cookies for our website are deactivated, it is possible that all the functions of our website may not be usable to you to their fullest extent.

11. The rights of the affected persons

In the case that your person-related data is being processed, then you are the affected party according to the DSGVO and you have the following rights against the responsible organisation:

1. Right to information
From the responsible organisation, you can demand a confirmation if person-related data, which affect you, is being processed by us. In the case that such a processing is being carried out, you can demand the following information from the responsible organisation:

(1) The purpose as to why the person-related data is being processed
(2) The categories of the person-related data that are being processed
(3) The receivers and the categories of receivers to whom the person-related data belonging to you is was declared or will be declared
(4) The planned duration of the storage of your person-related data or, if specific information is not possible to be provided, criteria for the regulation of the duration of the storage
(5) The existence of a right to rectification or deletion of your person-related data, a right to a limitation of the processing by the responsible organisation or of a right to object to this processing
(6) The existence to a right to appeal to a regulatory authority
(7) All the available information with regard to the source of the data, if the person-related data was not collected from the affected person
(8) The existence of automated decision making including profiling according to Section 22 Para. 1 and 4 of the DSGVO and – at least in these cases – meaningful information with regard to the logic involved as well as the extent and the intended effects of such a processing for the affected person. You have the right to demand information as to whether your person-related data will be transmitted to another country or to an international organisation. In this regard, you can demand to be informed of suitable guarantees according to Section 46 of the DSGVO relating to the transmission of the same.

12. Right to rectification

You have a right to the rectification and/or making the data complete by the responsible organisation, as long as the processed person-related data, which relates to you, is incorrect or incomplete. The responsible organisation must carry out the correction immediately.

13. Right to the limitation of the processing

Subject to the following prerequisites, you can demand that the processing of your person-related data is limited:

(1) If you dispute the correctness of the person related data relating to you for a duration, which makes it possible for the responsible organisation to check the correctness of the person-related data.
(2) The processing is illegal and you refuse the deletion of the person-related data and, instead of that, demand the limiting of the use of the person-related data.
(3) The responsible organisation no longer requires the person-related data for the purpose of processing, however you require it for the assertion, exercising or defending of legal claims, or
(4) If you raised objection to the processing according to Section 21 Para. 1 of the DSGVO and it has not been decided if the justified reasons of the responsible organisation prevail over your reasons.

If the processing of the person-related data relating to you was limited, this data may – except for their storage –only be processed with your consent or for the assertion, exercising or defending of legal claims or for the protection of rights of another natural or legal person or for reasons of substantial interest of the Union or of a member state. If the limitation of the processing was limited for the above mentioned reasons, you will be informed by the responsible organisation before the limitation is lifted.

14. Right to deletion

a) Obligation to delete
You can demand of the responsible organisation that the person-related data relating to you be immediately deleted and then the responsible organisation is obliged to delete this data as long as the following reasons apply:

(1) Your person-related data is no longer required for the purpose that it was collected or otherwise processed
(2) You withdraw your consent on which the processing was based according to Section 6 Para 1 lit. a or Section 9 Para 2 lit. a of the DSGVO and any other legal basis for the processing does not exist
(3) You enter an objection according to Section 21 Para 1 of the DSGVO against the processing and there exist no overriding justified reasons for the processing, or if you enter objection according to Section 21 Para 2 of the DSGVO against the processing
(4) The person-related data relating to you is being processed illegally
(5) The deletion of your person-related data is required for fulfilling a legal obligation according to the laws of the Union or the rights of the member states, which the responsible organisation is subject to
(6) Your person-related data was collected in connection with the offered services of the information society according to Section 8 Para 1 of the DSGVO

15. Information to third parties

If the responsible organisation has made your person-related data public and if the organisation is obliged to delete it according to Section 17 Para 1 of the DSGVO, then it must inform the responsible organisation that is processing the data that you, as the affected person, have demanded the deletion of all links to the person-related data and of copies and reproductions of the person-related data. This is subject to taking into account the available technologies and the cost of implementation of appropriate measures, also technological, for the responsible organisation for the data processing to do so.

16. Exceptions

The right to deletion shall not exist as long as the processing is required
(1) For exercising the right to free speech and to information
(2) For fulfilling a legal obligation which requires the processing according to the laws of the Union or of the member states which the responsible organisation is subject to, or for the performance of a task that is in the public interest, or that results in the exercising of public authority, which was transferred to the responsible organisation.
(3) For reasons of public interest in the field of public health according to Section 9 Para 2 lit. h and i as well as Section 9 para 3 of the DSGVO
(4) For archival purposes that are in the public interest, scientific or historical research purposes or for a statistical reason according to Section 89 Para 1 of the DSGVO, as long as the right given in Section a) makes the achievement of the objectives of this processing provisionally impossible or seriously limits it, or
(5) For the establishment, exercising or defence of legal claims

17. Right to information

If you have asserted your right to rectification, deletion or limitation of the processing against the responsible organisation, it is obliged to inform all the recipients to whom your person-related data has been made public, of the rectification, or deletion of the data or of the limitation of the processing. This is unless this turns out to be impossible or it is associated with a disproportionate expense. You have the right to be informed of these recipients by the responsible organisation.

18. Right to data portability

You have the right to receive the person-related data relating to you, which you have made available to the responsible organisation, in a structured, established and machine-readable format. Aside from that, you have the right to transfer this data to another responsible organisation without being hindered by the responsible organisation to which the person-related data was given in the first place. This shall apply as long as
(1) the processing is based on a consent according to Section 6 Para. 1 lit. a of the DSGVO or Section 9 Para. 2 lit. a of the DSGVO or a contract according to Section 6 Para. 1 lit. b of the DSGVO and
(2) the processing is carried out by an automatic process.

While exercising this right, you also have the right to assert that your person-related data is transmitted to you directly by a responsible organisation of another responsible organisation, as long as this is technologically possible. The freedoms and rights of other persons may not be impaired by this. The right to data portability does not apply for the processing of person-related data, which is required for the perception of a task, which is in the public interest or in the exercise of official authority, which was transferred to the responsible organisation.

19. Right to object

You have the right for reasons, which arise from your special situation, to exercise your objection at any time, against the processing of your person-related data, which is carried out based on Section 6 Para. 1 lit. e or f of the DSGVO. This is also applicable for a profiling based on these provisions. The responsible organisation may not process your person-related data, unless it can prove that there are compelling legitimate grounds for the processing that outweigh your rights and freedoms, or if the processing is for the establishment, exercise or defence of legal claims. If your person-related data is being processed for direct marketing purposes, you have the right to exercise your objection against the processing of your person-related data for the purpose of this type of marketing; this also applies to profiling, as long as it is connected to such direct marketing. In the case that you object to the processing for the purpose of marketing, then your person-related data will not be processed for this purpose. You have the opportunity, together with the use of information society services - notwithstanding Directive 2002/58/EG – to exercise your right to object through an automated process, for which technological specifications are used.

20. Right to withdrawal of the data privacy declaration of consent

You have the right to withdraw your data privacy declaration of consent at any time. Through the withdrawal of the consent, the legality of the processing that occurred due to the consent remains untouched.

21. Automated decision in individual cases including profiling

You have the right to be subject to a decision based not only on an automated processing – including profiling – that produces legal effects for you or that significantly impairs you in a similar way.
This is not applicable in the case that the decision
(1) is required for the conclusion or the fulfilment of a contract between you and the responsible organisation
(2) are permitted based on the laws of the Union or of the member states, who the responsible organisation is subject to and these laws contain appropriate measures for the preservation of your rights and freedoms as well as your rightful interests, or
(3) they occurred due to your express permission.
However, these decisions may not be based on special categories of person-related data according to Section 9 Para. 1 of the DSGVO, as long as Section 9 Para. 2 lit. a or g of the DSGVO are not applicable and appropriate measures for the protection of your rights and freedoms as well as of your rightful interests have been taken. With regard to the cases given in (1) and (3), the responsible organisation shall take appropriate measures to preserve your rights and freedoms as well as your rightful interests, which includes at least the right to obtaining the intervention of a person from the responsible organisation to present your own point of view and to appeal against the decision.

22. Right of complaint to a regulatory authority

Irrespective of another administrative or judicial legal remedies, you have the right to complain to a regulatory authority, in particular in the member state where you reside, your workplace or the place of the alleged infringement, if you are of the opinion that the processing of your person-related data violates the DSGVO. The regulatory authority to whom the complaint was submitted, informs the complainant of the status and the results including the possibility of judicial legal remedy according to Section 78 of the DSGVO.