On the WINGAS Website.

Data Privacy Statement of WINGAS GmbH in accordance with Articles 13 and 21 GDPR

The following Data Privacy Statement describes how and for what purpose WINGAS GmbH, Königstor 20, 34117 Kassel, Germany (hereinafter also referred to as “WINGAS” or “we”) processes personal data of its business partners and their employees.

1. Responsibility for data processing and contact data

The controller responsible for processing your personal data is:

WINGAS GmbH, Königstor 20, 34117 Kassel, Germany

You can contact our Data Protection Officer at:

WINGAS GmbH, Datenschutzbeauftragter (Data Protection Officer), Königstor 20, 34117 Kassel, Germany; E-mail: datenschutz@wingas.de

2. Type of data processed

We process the following personal data and categories of personal data we obtain from our business partners and their employees:

• Master data (e.g. surname, first name, title, function/post at the company, business phone number, business mobile phone number, business fax number, business e-mail address)
• Communications data (e.g. content of contact requests, records of conversations)
• Technical usage data in the case of communication by e-mail and phone
• Documentation of business transactions
• Voice recordings of calls/customer transactions
• Travel data and preferences with regard to food as part of events
• Declarations relating to data protection (consent to processing of personal data, exercise of rights to obtain access to and information on personal data, rectification, deletion and restriction of processing of it, and data portability under data protection law, including information you send us in this connection)

3. Length of data storage

In general, we process personal data only for as long as required to fulfill the specific purpose defined in the following.

Moreover, we are subject to various retention and documentation obligations under legislation such as the German Commercial Code (HGB) and the German Fiscal Code (AO). The retention and documentation periods stipulated by them range from two to ten years. 

Finally, the storage duration is also governed by the statutory limitation periods, which may be up to thirty years under Sections 195 et seq. of the German Civil Code (BGB), for example, with the standard limitation period being three years. 

4. Purposes of data processing and legal foundation

We process your personal data in compliance with the relevant data protection regulations, in particular the General Data Protection Regulation (GDPR) and German Data Protection Act (BDSG), for various purposes. In principle, the purposes for which we process your data are: Processing

• to perform contractual obligations or steps prior to entering into a contract (Article 6 paragraph 1 point (b) GDPR),
• to safeguard legitimate interests (Article 6 paragraph 1 point (f) GDPR),
• subject to your prior consent (Article 6 paragraph 1 point (a) GDPR) and/or
• to comply with statutory obligations (Article 6 paragraph 1 point (c) GDPR).

Specifically, we process your personal data for the following purposes and subject to the stated legal basis: 

5. Recipients and categories of recipient

Personal data can be passed on to the following recipients and categories of recipient: 

5.1 Processors

• We use service providers who process personal data on our behalf (termed “processors”; cf. Article 4 No. 8 and Article 28 GDPR). They include IT and telecommunications service providers.

5.2 Controllers

If we are authorized pursuant to contractual or statutory provisions or a declaration of consent, we also pass on the above data to other companies, which process the data under their own responsibility, as part of the business relationship with the client (Article 4 No. 7 GDPR):

• Gazprom Germania GmbH
• Wingas Sales GmbH
• Wingas Holding GmbH
• astora GmbH & Co. KG
• Gazprom Marketing & Trading Ltd 

6. Transfer of personal data to a third country or international organization

We transfer the above personal data to the following third countries (countries outside the European Economic Area (EEA)) or international organizations:

• PAO Gazprom (Russian Federation)
• OOO Gazprom Export (Russian Federation)

It is transferred only if an adequate level of protection for the data is guaranteed in the third country in question (Article 45 GDPR), there are appropriate safeguards (cf. Article 46 GDPR) or transfer is otherwise permitted by law (cf. Article 49 GDPR). 

7. Obligation to provide data

As part of our business relationship, you must only provide personal data that is required to initiate and conduct a business relationship or that we are obliged to collect by law. If we are not given this data, we will usually have to refuse to conclude a contract or perform an order or will no longer be able to continue performing, or will possibly have to terminate, a contract. 

8. Automated decision-making and profiling

We do not use your personal data for automated decision-making, including profiling.

9. Rights of data subjects

9.1 Access to and information on, rectification and deletion of data, restriction of processing, and data portability

Every data subject has the right to access personal data and obtain information on it (Article 15 GDPR), the right to rectification of data (Article 16 GDPR), the right to deletion of data (Article 17 GDPR), the right to restriction of processing (Article 18 GDPR), and the right to data portability (Article 20 GDPR). You can get in touch with us using the contact data specified in Section 1 “Responsibility for data processing and contact data” to exercise the above rights.

9.2 Right to object to processing in accordance with Article 21 of the General Data Protection Regulation (GDPR)

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Article 6 paragraph 1 point (f) GDPR (data processing based on a weighing of legitimate interests), including any profiling based on those provisions within the meaning of Article 4 No. 4 GDPR. If you object, we will no longer process the personal data concerning you unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defense of legal claims.

If we process your personal data for direct marketing purposes, you have the right to object at any time to processing of personal data concerning you for such marketing. If you object to processing for direct marketing purposes, we will no longer process your personal data for such purposes.

Your objection can be submitted without using a special form and should be sent to us using the contact data specified in Section 1 “Responsibility for data processing and contact data”. You will not incur any costs other than the basic costs of transmission for that.

9.3 Revocation of consent

If you have given us your consent to process your personal data, you can revoke such consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on your consent before you withdrew it.

Please send your revocation to us using the contact data specified in Section 1 “Responsibility for data processing and contact data”.

10. Right to lodge complaints with the supervisory authority 

Under Article 77 paragraph 1 GDPR, you have the right to issue a complaint with the supervisory authority if you consider that the processing of personal data concerning you infringes the law, in particular General Data Protection Regulation (GDPR). 

The address of the supervisory authority responsible for WINGAS is: 

Der Hessische Datenschutzbeauftragte (The Hessian Data Protection Commissioner (HDSB)), Postfach 3163, 65021 Wiesbaden, Germany
E-mail: Poststelle@datenschutz.hessen.de, phone: +49 611 1408 – 0, fax: +49 611 1408 – 900