Data privacy policy for customers and business partners

The WAY Group* takes the protection of your privacy and personal data very seriously. We would therefore like to let you know what personal data we collect and process, when we do so and for what purpose.

About the data controller:

Depending on the type of business relationship you might have with us, one of the following WAY Group companies is responsible for the collection and processing of your personal data:

WAY Business Solutions GmbH

WAY People+ GmbH

WAY Engineering GmbH

WAY HR Professionals & Experts GmbH

WAY Digital Solutions GmbH

 

Company headquarters and contact details of all data controllers**:

Frankfurter Ring 150
80807 Munich

Phone: +49 (0) 89 264831-600
E-mail: info@waygroup.de


Scope of application

This data protection information clarifies the type, scope and purpose of the collection and use of personal data by our company. The term processing includes the collection, storage, use, transmission or deletion of personal data.

The legal basis for data protection can be found in the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications Telemedia Data Protection Act (TTDSG).

 

Handling of personal data

Personal data is information that relates to an identified or identifiable natural person (data subject).
The processing of such data is only lawful if at least one of the following conditions is met:

  • the data subject has consented to the processing of their personal data for one or more purposes (e.g. declaration of consent for advertising communication),
  • the processing is necessary for the performance of a contract or in order to take steps prior to entering into a contract (concluded contract, handling of complaints and warranty claims, delivery of products, remote maintenance),
  • processing is necessary for compliance with a legal obligation to which the controller is subject (e.g. disclosure of data to public authorities),
  • processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party and such interests are not overridden by the interests of the data subject (e.g. disclosure of data to debt collection agencies and lawyers, video surveillance).

Description of the groups of data subjects and the categories of data concerned

The processing of your personal data in our company is carried out for the purpose of proper contract processing, for contract initiation, on the basis of the legitimate interest of the company and on the basis of legal obligations.

Use of data for own purposes:

  • Personal data e.g. first and last name, address, date of birth, place of birth
  • Contact details e.g. telephone number, cell phone number, e-mail address
  • Contract master data e.g. documentation of orders, sales figures
  • Billing data e.g. account details, VAT ID number
  • IP addresses
  • Other data e.g. supplier data / creditor data (IT services, consulting services, freight forwarders)

The personal data of our customers, interested parties and business partners listed above are processed by us on the basis of your consent (Art. 6 para. 1 lit. a GDPR), for the purpose of proper contract fulfillment or contract initiation (Art. 6 para. 1 lit. b GDPR) or on the basis of our legitimate interest (Art. 6 para. 1 lit. f GDPR).

Data recipients

Data is passed on for the purpose of proper contract processing, contract initiation and on the basis of the company’s legitimate interest:

  • For the proper fulfillment of the contract in accordance with Art. 6 para. 1 lit. b GDPR, we pass on your data e.g. to credit institutions, forwarding agents, remote maintenance software.
  • Furthermore, we pass on your data to authorities if we are legally obliged to do so in accordance with Art. 6 para. 1 lit. c GDPR.
  • Disclosure on the basis of a legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR is made, for example, to lawyers, tax consultants, etc. to pursue our legal interests.
  • The transfer of data to arbitration boards for out-of-court settlement is based on your declaration of consent pursuant to Art. 6 para. 1 lit. a GDPR
  • Data processing on the basis of Art. 6 para. 1 lit. f GDPR may only take place insofar as this is necessary to safeguard the legitimate interests of the company and does not outweigh the interests or fundamental rights and freedoms of the data subject which require the protection of personal data.

 

Transfer of personal data to a third country

As a rule, personal data is not transferred to a third country. Should this still be the case, the data transfer is regulated on the basis of an adequacy decision (e.g. Canada), consent, binding corporate rules or concluded EU standard data protection clauses.

Standard deadlines for the erasure of personal data

The deletion of personal data takes place after expiry of the statutory and contractual retention periods in accordance with ä 257 of the German Commercial Code and # 147 of the German Fiscal Code.

If personal data is not subject to any retention periods, it will be deleted as soon as the stated purposes no longer apply.

 

Your rights under the GDPR

Right to information

As a data subject, you have the right to request information free of charge from us as the controller as to whether and which personal data concerning you is being processed. For this purpose, we will provide you with an overview of the processing purposes, the categories of personal data processed and the respective recipients or categories of recipients.

Rights to rectification, erasure and restriction of processing

Pursuant to Art. 16 GDPR, the data subject has the right to obtain without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject also has the right to request the completion of incomplete personal data.

Pursuant to Art. 1 7 GDPR, the data subject has the right to obtain from the controller the erasure of personal data concerning him or her without undue delay, provided that no other legal requirement precludes such erasure.

In accordance with Art. 1 8 GDPR, the data subject has the right to request the restriction of processing if

  • the accuracy of the personal data is contested,
  • the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead,
  • the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defense of legal claims,
  • the data subject objects to the processing pursuant to Art. 21 GDPR.

Right to data portability

You have the right to receive the personal data that you have provided to us from our company in a structured, commonly used and machine-readable format. If you wish to transfer this data to another controller, we must not prevent this transfer.

Right of objection

If we process your personal data on the basis of our legitimate interest pursuant to Art. 6 (1) lit. f GDPR, you have the right to object to the processing of your personal data at any time. Our company will then no longer process your personal data unless it can demonstrate compelling legitimate grounds that outweigh the interests, rights and freedoms of the data subject.

Right of withdrawal

If we process your personal data on the basis of your consent, you have the right to withdraw your consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

Right of appeal

If you are of the opinion that the processing of your personal data in our company violates the GDPR, you have the right to lodge a complaint with a supervisory authority. To do so, you can contact the competent supervisory authority or our data protection officer.

Data Protection Officer

We have appointed a data protection officer who works for the companies of the WAY Group in accordance with Art. 37 GDPR. Their contact details are as follows:

aigner business solutions GmbH
Goldener Steig 42
94116 Hutthurm
Phone: +49 8505 91927-0
E-mail: datenschutz@waygroup.de


Status of the data privacy policy

Constant development makes it necessary to adapt our data protection principles from time to time. We reserve the right to make corresponding changes at any time.
This data privacy policy has been updated in 11/2023

*        The WAY Group is a brand of the companies listed below:
WAY Business Solutions GmbH | registered office: Munich | Munich Registry Court | HRB 164739 | Management: Gerd Otto

WAY People+ GmbH | registered office: Munich | Munich Registry Court | HRB 201037 | Management: Gerd Otto

WAY Engineering GmbH | registered office: Munich | Munich Registry Court | HRB 230904 | Management: Gerd Otto

WAY HR Professionals & Experts GmbH | registered office: Munich | Munich Registry Court | HRB 232533 | Management: Gerd Otto

WAY Digital Solutions GmbH | registered office: Munich | Munich Registry Court | HRB 231140 | Management: Gerd Otto

**      For data protection inquiries, in particular for exercising your rights under the General Data Protection Regulation, please use the contact details provided, naming the respective controller. If you are not sure which of our companies is responsible for processing your data, we will be happy to help you.