Dear Sir or Madam,
Below, we would like to inform you, in accordance with Articles 13 and 14 of the General Data Protection Regulation (GDPR), about the processing of personal data attributable to you and/or your employees – where applicable – within our company.
As a precaution, we would like to point out that our company only processes business contact details that originate from public sources or have been provided by you.
Business contact details are generally not considered personal data, but may under certain circumstances relate to natural persons. This may particularly be the case when contact details of contact persons, case handlers, legal representatives, etc., are provided or arise from correspondence.
Controller responsible for data processing
Hoist Finance AB (publ) Germany Branch
Schifferstraße 80
D-47059 Duisburg
Contact details of the Data Protection Officer
Hoist Finance AB (publ) Germany Branch
– Data Protection Officer –
Schifferstraße 80
D-47059 Duisburg
or by email: datenschutzbeauftragter@hoistfinance.com
Purposes of processing and legal basis
Data is processed exclusively for the purpose of conducting correspondence and related purposes, such as claim realisation, claims management, legal defence/enforcement, payment processing, invoicing, and handling your request or that of your client/principal/mandator.
The processing of your data is required under Article 6(1)(b) GDPR for the handling of the respective claim matter, or under Article 6(1)(f) GDPR to safeguard our legitimate interest in orderly and efficient correspondence with you.
Categories of data
We may process the following categories of data: personal master data, communication data, payment information, account data, company data, as well as special categories of data (e.g. legal guardianship).
Source of data
Data from the categories mentioned – where applicable – has been obtained from public sources such as business websites, industry directories, public registers, etc., and stored. Where necessary, correspondence exchanged between you and our company was used to complete your data or identify a direct contact person.
Retention period
After completing the processing of the relevant matter, we review after three years whether your data is still required and whether statutory retention obligations prevent deletion.
Immediate deletion is usually not possible due to statutory retention periods that our company is required to observe. These retention periods are set out, among other things, in the German Fiscal Code (AO) §147 and the German Commercial Code (HGB) §257 and range from six to ten years after the completion of the respective matter.
Categories of recipients
In the course of conducting correspondence, we may transfer personal data to the following categories of recipients, where necessary for proper processing: address service providers, credit agencies, guardians, service providers, third-party debtors, municipal registration offices, law enforcement authorities, courts, bailiffs, insolvency administrators, lawyers, other authorised representatives, and other entities authorised to receive data.
Data transfers to third countries
As a rule, your personal data is processed exclusively within the EU or EEA, or in countries that the European Commission has assessed as providing an adequate level of data protection.
However, your data may also be processed outside the EU/EEA in countries whose current level of data protection does not correspond to that of the GDPR.
In any situation involving a third‑country transfer, our company has implemented appropriate technical, organisational, and contractual safeguards to ensure data security and an adequate level of protection at all times. Contractually, such transfers to countries outside the EU/EEA or countries without an adequacy decision by the European Commission are carried out using the so‑called Standard Contractual Clauses adopted by the Commission. A copy of these Standard Contractual Clauses can be provided upon request.
General data subject rights
Right of access: Under Article 15 GDPR, you have the right to obtain information about the personal data concerning you that is processed by our company. We kindly request that any access requests be submitted by post to the Data Protection Officer (see above).
Right to rectification: Under Article 16 GDPR, you have the right to request the correction or completion of inaccurate or incomplete data processed by our company.
Right to erasure & restriction of processing: If the requirements of Articles 17 or 18 GDPR are met, you have the right to request the erasure or restriction of processing of your personal data.
Right to data portability: You also have the right to data portability.
Right to object: In addition, under Article 21 GDPR, you have the right to object to the processing of your personal data, unless the processing is carried out pursuant to Article 21(1) GDPR for compelling legitimate reasons that override the interests, rights, and freedoms of the data subject or the processing serves the establishment, exercise, or defence of legal claims.
Automated decision-making including profiling
Our company does not use any processes for automated individual decision‑making, including profiling, within the meaning of Article 22 GDPR.
Right to lodge a complaint with a supervisory authority
Under Article 77 GDPR, you have the right to lodge a complaint with the competent supervisory authority if you believe that the processing of your personal data is unlawful. Complaints should be addressed to:
The State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia
Kavalleriestr. 2–4
40213 Düsseldorf
You may also lodge a complaint with another data protection authority, such as the data protection authority of your federal state (if applicable).
Internal complaint procedure
You may submit your request or complaint via:
Email: Beschwerde-Management@hoistfinance.com
Telephone: +49 (0)203 7569-1260
Address: Hoist Finance AB (publ) Germany Branch
Schifferstraße 80
D-47059 Duisburg
