1. Name and contact details of the data controller
Bayerische Milchindustrie eG
Represented by the Management Board members Dr. Thomas Obersojer and Mr. Winfried Meier
2. Contact details of the data protection officer
You can reach our data protection officer Alexander Bugl at:
Bugl & Kollegen GmbH
1. Storage period
We process and store your personal data for as long as necessary to fulfill our contractual and legal obligations. Even without a specific request from our customers, we naturally comply with our obligations to delete personal data. Such obligations arise, for example, from Art. 17 GDPR. According to this, deletion is required, among other things, if the personal data is no longer necessary for the purposes for which it was collected or otherwise processed.
However, there are personal data that are exempt from this obligation to delete and where we are even obliged by other laws to continue to store them. For example, there are obligations to store data in accordance with Section 257 of the German Commercial Code (HGB) and Section 147 of the German Fiscal Code (AO). We only continue to store this data to fulfill legal retention obligations. When the retention periods expire, we will delete this data immediately without you having to request us to do so.
2. Processing purposes and legal basis
The processing of your data by us is carried out for the fulfillment and performance of our contractual obligations, pursuant to Art. 6 para. 1 p.1 b) GDPR. In doing so, we partly also use other business partner companies if this is necessary for the fulfillment of the contract. These may be, for example: logistics or shipping companies. In this context, necessary personal information such as name, address, invoices and other billing and financial data such as tax number, commercial register number, etc. will be forwarded.
Should it be necessary, we process your data beyond the actual fulfillment of the contract to protect legitimate interests of us or third parties, according to Art. 6 para. 1 p.1 f) GDPR. This is necessary, for example, for the assertion of legal claims and defense in legal disputes, for the prevention or investigation of criminal acts for consultation and data exchange with credit agencies or for measures for business management and further development of services and products.
If you have given us consent to process personal data for specific purposes, the lawfulness of this - purpose-related - processing is given on the basis of your consent in accordance with Art. 6 (1) sentence 1 a) GDPR. Consent given can be revoked at any time. The revocation of consent only takes effect for the future and does not affect the lawfulness of the data processed until the revocation.
Under certain circumstances, the provision of personal data is required by law or contract. The processing is then necessary in accordance with Art. 6 para.1 p.1 c) GDPR for the fulfillment of a legal obligation to which we are subject.
3. Obligation to provide and possible consequences of failure to provide
In the context of our business relationships, you are obliged to provide those personal data that are necessary for the establishment, execution and termination of a business relationship and for the fulfillment of the associated contractual obligations or which we are legally obliged to collect. Without this data, we are regularly unable to conclude a contract with you, to execute it or to terminate it.
4. Existence of automated decision-making
The processing, of the data related to you by us, is not in connection with an automated decision-making or profiling.
1. Recipients / categories of recipients
In order to execute the contract concluded with you, your data has also been or will be transferred - if necessary - to the following categories of recipients:
Internal persons, i.e. employees of Bayerische Milchindustrie eG who urgently require the data for further processing. Order processors with whom corresponding contractual agreements have been concluded in advance and, where necessary, external third parties. These can be, for example, as already mentioned above, logistics or shipping companies, authorities or offices.
2. Intention of the transmission in third country
Transfers from us to recipients in so-called third countries, that is, in countries outside the European Union (EU), or to international organizations are not made by us on principle. The following exceptions apply:
- An adequate level of data protection exists in the third country in accordance with Art. 45 GDPR
- Standard data protection clauses are concluded according to Art. 46 DS-GVO, if the data processing is not permitted according to Art. 45 GDPR
You have the following rights vis-à-vis us regarding the personal data concerning you:
1. Right of access pursuant to Art. 15 GDPR
The data subject may request confirmation from the controller as to whether personal data concerning him or her are being processed there. If this is the case, the data subject has the right to obtain specific information regarding this personal data.
2. Right to rectification pursuant to Art. 16 GDPR
The data subject has the right to obtain from the controller the rectification without delay of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject has the right to request the completion of incomplete personal data.
3. Right to erasure pursuant to Art. 17 GDPR
The data subject has the right to require the controller to erase personal data concerning him or her without undue delay, and the controller is in principle obliged to erase personal data without undue delay There are, however, personal data that are exempt from this obligation to erase and where we are even obliged by other laws to continue to store them.
4. Right to restriction of processing according to Art. 18 GDPR
The data subject has the right to request the controller to restrict processing, provided that certain conditions are met.
5. Right to object pursuant to Art. 21 GDPR
The data subject has the right to object at any time, on grounds relating to his or her particular situation, to the processing of personal data concerning him or her carried out on the basis of Article 6(1)(e) DSGVO (data processing in the public interest) and Article 6(1)(f) GDPR (data processing on the basis of a balance of interests); this also applies to profiling based on this provision within the meaning of Article 4 No. 4 GDPR.
If she objects, we will no longer process her personal data unless we can demonstrate compelling legitimate grounds for the processing which override her interests, rights and freedoms, or the processing serves the assertion, exercise or defense of legal claims.
6. Right of withdrawal in case of consent pursuant to Art. 7 (3) GDPR.
The data subject has the right to revoke his or her consent at any time. The revocation of consent shall not affect the lawfulness of the processing carried out on the basis of the consent until the revocation.
7. Right of complaint to the authority
If you are of the opinion that the processing of personal data concerning you by us is unlawful or, if applicable, that we are violating data protection law for other reasons, you may lodge a complaint with the supervisory authority responsible for us:
Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)