Privacy Notice for Our Suppliers and Service Providers

1.1 YOUR PERSONAL DATA THAT WE PROCESS

KBC processes personal data from suppliers and service providers. This is necessary for business operations. The following data is processed in this context:

First name
Last name
Titles and academic degrees
Company Name
Position within the company
Business address
Bank account information
Your email address
Your cell phone number
Your landline number
Your fax number
All personal data provided to us in the course of our communications

KBC collects data from prospective customers and clients in the following ways:

Collection of personal data directly from the data subject through contact initiated by suppliers or service providers
Collection of personal data directly from the data subject through contact initiated by KBC
Searching in business directories or on websites

1.2 PURPOSES OF DATA PROCESSING

We process your data for the following purposes:

Initiation, Execution, and Termination of a Contractual Relationship
Review and Optimization of Demand Analysis Methods
Consultation with and data exchange with credit bureaus to assess creditworthiness and default risks
Asserting, exercising, or defending legal claims
Measures for business management and the further development of our products

1.3 LEGAL BASIS FOR DATA PROCESSING

Processing of Your Personal Data Based on Consent
To the extent that we obtain your consent for the processing of your personal data, such processing is based on Article 6(1)(a) of the GDPR in conjunction with Articles 5 and 7 of the GDPR.

Processing for the purpose of performing the contract with you
To the extent that we process your personal data for the purpose of performing the contract, our legal basis is Article 6(1)(b) of the GDPR. This also applies to processing operations necessary for the implementation of pre-contractual and post-contractual measures.

Processing to Comply with a Legal Obligation
To the extent that the processing of your personal data is necessary to comply with a legal obligation to which our company is subject, Article 6(1)(c) of the GDPR serves as our legal basis. Our legal obligation to process data arises, for example, from tax and/or commercial law retention requirements.

Processing based on legitimate interest
The legal basis for direct marketing purposes may be Article 6(1)(f) of the GDPR, provided that our legitimate interests are present and do not override the interests or fundamental rights and freedoms of the data subject that require the protection of personal data. The legitimate interests we pursue in this context—in addition to the purposes listed under b.—include:

to provide you with the best possible information about our products, offers, and services through direct marketing;  
In our communications with you, particularly to respond to your inquiries via email, phone, and/or fax;
In order to conduct due diligence on our potential business partner

The legal basis for processing activities related to the assertion, exercise, or defense of legal claims is also our legitimate interest pursuant to Article 6(1)(f) of the GDPR.

2. RECIPIENTS OR CATEGORIES OF RECIPIENTS OF PERSONAL DATA

In the course of processing your personal data, we may disclose your personal data to the following recipients. We will only transfer your personal data to external recipients if you have given your consent or if it is permitted by law.

External recipients of your personal data include, in particular:

Data processor
Tax advisor
Certified Public Accountant
IT Administrator
Potential business partners
Government agencies
External accountant
Bank / Financial Institution
Parcel delivery service
Mail service provider
Project participants
Affiliated companies

In addition, your personal data may be transferred to the following service providers, which are located in a country outside the EU/EEA:

Kemény Boehme Consultants, Inc. – 615 South College Street, Charlotte, NC 28202, USA

To ensure that data transfers to third countries are as privacy-friendly as possible, standard contractual clauses pursuant to Article 46(2)(c) of the GDPR have been entered into with service providers in third countries that are not considered safe.

3. RETENTION PERIOD FOR PERSONAL DATA

We do not retain your personal data for longer than is necessary for the purpose for which it was collected. This means that data in our systems is destroyed or deleted as soon as it is no longer needed. We take appropriate measures to ensure that your personal data is processed only under the following conditions:

As required by applicable law, contract, or in light of our legal obligations
Only for as long as is necessary for the purpose for which the data was collected, or longer if required by contract or applicable law, provided that appropriate safeguards are in place.

Such a requirement may exist, in particular, if the data is still needed to fulfill contractual obligations or to assess, grant, or defend against warranty and, where applicable, guarantee claims. If the data is no longer required to fulfill contractual or legal obligations, it is regularly deleted, unless its—temporary—retention remains necessary, in particular to comply with statutory retention periods of up to ten years (including those under the German Commercial Code, the German Fiscal Code, and the Money Laundering Act). In the case of statutory retention obligations, deletion is only considered after the respective retention obligation has expired.

4. Obligation to Provide Data

In order to enter into (or finalize) and perform the contract with you, you must provide the personal data necessary for establishing and performing the contractual relationship and fulfilling the associated contractual obligations, or which we are legally required to collect (see, in particular, the provisions listed under “III.3.”). This obligation also arises from the law, e.g., Section 14 of the German Value Added Tax Act (UstG). Without this data, we will generally not be able to conclude and perform the contract with you.