ETTES Company gives high priority to the protection and security of personal data. The stipulations set out in the following are intended as information to our business partners when, against the background of the prevention of bribery and corruption, their personal data is processed in accordance with the requirements of the General Data Protection Regulation. If you have any further questions regarding this, please do not hesitate to contact the Data Privacy Officer at any time.
As a person whom the processing of the data concerns, you have the following rights (data subject rights):
1. Right of information:
You have the right to request information on whether the company processes data relating to your person or not. If your personal data is indeed being processed, you have the following rights:
- the right to know the purpose of processing.
- the right to know the category of personal data (data type) that is being processed.
- the right to know the recipient or category of recipient to whom your data has been or is to be disclosed; this particularly applies to data that has been or will be disclosed to recipients in third countries.
- the right to know the planned period of data retention, insofar as possible. If specification of the period of retention is not possible, you are entitled to know the criteria governing the period of retention.
- the right to have the data concerning you corrected or erased, including the right to restrict the processing thereof and/or raise an objection.
- the right to file a complaint with the supervisory authority.
- the right to know the origin of the data, if not collected directly from you.
You furthermore have the right to know whether your personal data has been used for the purpose of making an automated decision pursuant, if this is the case, to know the criteria on which the automated decision was based and the possible consequences and implications of that decision for yourself.
If personal data is transmitted to a third country outside the jurisdiction, you have right of access to information on whether adequate data protection is being provided by the data recipient in the third country, and, if so, on the basis of which guarantees.
You have the right to request a copy of your personal data. The company shall provide data copies in electronic format unless you specify otherwise. The first copy is free-of-charge. For further copies, a reasonable fee may be charged. Provision of the data is subject to any rights and freedoms of other persons who may be affected by its transfer.
2. Right to data correction:
You have the right to request that the company corrects your data insofar as it is incorrect, inaccurate and/or inadequate. The right to correct includes the right to have the data completed by further explanations or statements. Correction and/or completion must take place immediately i.e. without culpable delay.
3. Right to erasure of personal data:
You have the right to request that we erase your personal data insofar as:
- the personal data is no longer required for the purpose for which it was collected and processed.
- data processing took place on the basis of your declared consent which you have since withdrawn, and provided that no other legal reason exists for the processing of the data.
- you have lodged an objection to processing of the data pursuant and provided that there are no overriding legitimate reasons for further processing.
- You have lodged an objection against data processing for the purpose of direct marketing pursuant.
- your personal data was processed unlawfully.
- such data concerns a child and was collected in the context of information society services pursuant.
- The right to erasure of personal data does not obtain insofar as:
- the demand for erasure affects the right to freedom of expression and information.
- the processing of the data is required:
- to meet a legal obligation (such as statutory archiving requirements);
- to perform a task in the public interest or to protect public interests falling under China law and/or the law of a member state (including interests in the area of public health)
- for archiving and/or research activities;
- to assert, exercise or defend legal rights.
Erasure must take place immediately i.e. without culpable delay. In the event that personal data is placed by the company in the public domain (e.g. in the Internet), the company is responsible for ensuring inasfar as reasonable and technically feasible that third-party data controllers are also informed of the demand for erasure, including the erasure of links, copies or replicates.
4. Right to restrict data processing
You have the right to have processing of your personal data restricted in the following cases:
- If you have disputed the correctness of your personal data, you may restrict its further processing by requesting the company not to use the data for other purposes for the duration of the correctness check.
- In the event of unlawful data processing, you can request restriction of the use of the data pursuant.
- Should you require your personal data for the assertion, exercise or defense of legal rights, and if your personal data is no longer otherwise required, you may request the company to restrict data processing to the aforementioned pursuit of rights.
- Should you have lodged an objection to data processing pursuant, whereby it has not yet been established whether the interest of the company in data processing outweighs your own interests, you may restrict data processing to the extent that you request the company not to use your data for other purposes for as long as the above assessment is being made.
Personal data whose processing is being restricted at your request may only – apart from being stored – be processed as follows:
- for the assertion, exercise, or defense of legal rights
- for the purpose of protecting the rights of other natural persons or corporate entities
- for the sake of an important matter of public interest. Should a processing restriction be lifted, you will be informed thereof in advance.
5. Right to data portability
You have the right – on condition of the provisions set out below – to request that the data that concerns you be submitted in a commonly used electronic and machine-readable format. The right to data transfer includes the right to transmit the data to another controller. The company will therefore – at your request and as far as technically possible – transmit the data directly to a controller named or to be named by you. The right to data transfer only applies to data provided by you and is subject to the condition that the data was provided at your consent and is to be processed for performing a contract and that data transfer will take place using automated means. The right to data portability pursuant does not affect the right to data erasure pursuant. Data transfer is subject to the rights and freedoms of other persons in cases where these rights could be affected by transmission of the data.
6. Right to object to specific intentions in data processing
When personal data is processed for the performance of a task carried out in the public interest or for legitimate interests, you may object at any time to the data concerning yourself being processed, with future effect. In the event of an objection, we must refrain from any further processing of your data for the above purposes unless:
- there are compelling, legitimate grounds for processing which override your interests, rights and freedoms
- processing is required for the assertion, exercise, or defense of legal rights.
You may object to the use of your data for direct marketing purposes at any time, with future effect. This also applies to profiling insofar as it is related to such direct marketing. In the event of an objection the company must refrain from any further processing of your data for the purpose of direct marketing.
7. Prohibition of automated decision-making/profiling (insofar as relevant)
Decisions which have legal implications for you or otherwise significantly affect you must not be taken solely on the basis of the automated processing of personal data – including profiling. This shall not apply to the extent that the automated decision:
- is required for closing or implementing a contract with you.
- is permissible on the grounds of China or member state legislation, provided that this legislation includes reasonable provisions to protect the rights, freedoms and legitimate interests of your person.
- takes places with your express consent. Decisions solely based on the automated processing of special categories of personal data are prohibited in principle.
8. Exercising of data subject rights
To exercise data subject rights, contact the office named under 3. Inquiries submitted in electronic format will, as a rule, be answered in electronic format, unless otherwise specified in your inquiry. The provision of information and notifications and the taking of action pursuant, including the exercising of data subject rights, will, in principle, be free-of-charge. Only in the event of requests that are manifestly unfounded or excessive will the company be entitled to charge a reasonable fee for processing, or to refrain from taking action. In the case of justified doubt with respect to your identity, the company is entitled to request additional information from you – as far as is necessary – for the purpose of identification. If identification is not possible for the company, it shall be entitled to refuse to process your inquiry. The company shall – as far as possible – notify you separately if it is not in a position to make identification. Information requests are usually processed immediately, within one month of receipt. This period may be extended for another two months as necessary in respect of complexity and/or the number of inquiries received. The company shall inform you of the extension of the time limit within a month of receipt of your inquiry, stating the reasons for the delay. Should the company fail to act in response to an inquiry, it shall inform you thereof immediately, within one month of receiving your inquiry, stating the reasons and shall also inform you of the possibility of lodging a complaint with a supervisory authority or of seeking legal redress. Please note that you may only exercise your data subject rights within the scope of any limits and restrictions imposed by China or its member states.
9. Obligation to inform third parties
Should the company of Ettespower have disclosed personal data to other offices or recipients, it is obliged, insofar as technically possible and reasonable, to inform them of any correction, erasure and/or restriction on processing of the said data. The company shall inform you of such data recipients on request (see 1. above).
10. Management of data protection infringements
The company of Ettes Power shall notify you immediately of data protection infringements that could put your personal rights and freedoms seriously at risk. However, notification might not be made in cases applicable. Notification shall particularly contain the following information:
- A description of the data protection infringement.
- The name and contact data of the Data Privacy Officer or of another office that will provide information on or a description of the probable consequences of the data protection infringement.
- A description of the measures taken or suggested by Ettespower to rectify the data protection infringement including measures to attenuate its negative effects.
11. Legal protection
In the event of objections you are entitled at all times to contact the relevant supervisory authority in China or member states. The supervisory authority mentioned under 2. is responsible for our company of Ettes Power. For reasons of space, further clauses and provisions which usually form a standard part of data protection regulations and/or works agreements have not been included here.
