Enquirers

Duty to provide information to enquirers in accordance with Articles 13 and 14 of the GDPR

1. Processing activity

This data protection notice is provided in connection with telephone, postal mail or email requests made by parties concerning any and all activities/tasks of the DIHK. We are unable to respond to your request without processing your data.

2. Identity and contact details of the controller

Deutsche Industrie- und Handelskammer (DIHK)
(German Chamber of Commerce and Industry [DIHK])
Breite Straße 29
D-10178 Berlin
Phone +49 (0)30 20308-0
E-Mail: info@dihk.de

3. Contact details of the controller's Data Protection Officer

Kei-Lin Ting-Winarto
Deutsche Industrie- und Handelskammer (DIHK)
(German Chamber of Commerce and Industry [DIHK])
Breite Straße 29
D-10178 Berlin
Phone +49 (0)30 20308-2717
E-Mail: datenschutz@dihk.de

4. Purposes of and legal basis for the processing

We process your data in order to take receipt of and respond to your request.

We process your data on the basis of Article 6(1)(a) of the GDPR.

5. Recipients or categories of recipients of the personal data

The recipients or categories of recipients of your personal data are as follows:

• The DIHK staff responsible for processing your request
• As required, DIHK colleagues/heads of department to consult on the response
• As required, the applicable Chamber of Commerce and Industry (Industrie- und Handelskammer; IHK) to clarify the matter or for it to respond
• As required, expert working groups for legal appraisal
• As required, German Chambers of Commerce Abroad (Aulandshandelskammern ( AHKs) for them to respond
• As required, the competent federal ministry for legal appraisal follow-up
• As required, the German Protective Association against Economic Crime (Deutscher Schutzverband gegen Wirtschaftskriminalität; DSW) or the Centre for Protection against Unfair Competition (Wettbewerbszentrale) for legal action
• Our service providers for application technical support.

6. Transfer of personal data to a third country

It is not planned for your personal data to be transferred to a third country or international organisation. An exception may arise if a response is needed from a German Chamber of Commerce Abroad outside of the European Economic Area (EEA).

7. Period for which the personal data will be stored

The retention period is the period that applies for any resulting course of action; otherwise, a retention period of three years applies for the event of any follow-up requests.

8. Your rights as a data subject

You have the following rights under the EU General Data Protection Regulation:

If your personal data is processed, you have the right to obtain information about the personal data concerning you that is stored (Article 15 of the GDPR).

If incorrect personal data is processed, you have a right of rectification (Article 16 of the GDPR).

If the statutory requirements are met, you can obtain erasure of the data or restriction of processing and have the right to object to the processing (Articles 17, 18 and 21 of the GDPR).

If you have consented to processing or there is a contract for data processing and the processing is carried out by automated means, you may have the right to data portability (Article 20 of the GDPR).

In the event that you exercise the aforementioned rights, DIHK will determine whether the statutory requirements are met.

To exercise your rights, please contact the Data Protection Officer.

If you have any complaints concerning data protection, you may contact the competent supervisory authority:

BfDI Federal Commissioner for Date Protection and Freedom of Information
Graurheindorfer Straße 153
3117 Bonn
Germany
Phone: +49 (0)228 997799-0
Mail: poststelle@bfdi.bund.de

9. Source of data

Data concerning third parties may be stated in information requests and processed for the purpose of responding to the request.

Events

Duty to provide information to interested participants in events in accordance with Art. 13 GDPR and Art. 14 GDPR

1. Description of the processing activity

The data protection information is provided in connection with the processing of your personal data for registration for our events. Without your data, we are unfortunately unable to process your registration.

This information obligation applies to both online and in-person events.

2. Name and contact details of the controller 

3. Contact details of the official and company data protection officers

4. Purpose and legal basis for processing of personal data

Your data will be processed in order to receive your registration for events and to organise and run the event.

a) Presence event

Your data for the registration for the event will be processed on the basis of Art. 6 (1) (b) GDPR – contract.

We would like to point out that there will be photography and/or filming at the event. The photos will be used for the purpose of documenting the event and as part of our public relations work (print, online, social networks, etc.). If you do not wish to be photographed, please avoid the areas where photography and filming will be taken and/or please speak directly to the photographer so that your request can be taken into account.

The legal basis for the above-mentioned data processing is Art. 6 (1) (e), (2) and (3) GDPR in conjunction with Section 3 BDSG for the DIHK and Art. 6 (1) (f) GDPR (legitimate interest) for DIHK Service GmbH and DIHK DE International GmbH.

b) Online event

We use Microsoft Teams for online events. In the process, your personal data in the form of video or audio as well as the login data are processed. You can decide for yourself whether the camera and microphone are switched on or off. In addition, you have the option to share content. If you participate in the chat function, we process your personal data contained in the chat texts, and the other participants also have knowledge of this content. As a matter of principle, we do not record online events. If exceptionally a recording is made the participants will be notified of this in advance.  

After the team meeting has taken place, the organizer receives an attendance report with information about the duration of the meeting as well as the name and e-mail of the persons who participated.

Your data will be processed on the basis of Art. 6 (1) (b) GDPR – contract.

c) Recording of the online event

Insofar as a recording is made, we have obtained consent from you in advance. In this regard, the data is processed on the basis of Art. (6) (1) (c) GDPR – consent.

5. Recipients or categories of recipients of the personal data

Your personal data will be transmitted to:

• The employees of the DIHK, DIHK Service GmbH or DIHK DEinternational GmbH who are in charge of organising and operating the event,
• cooperating partners,
• speakers,
• external service providers for organising and operating the event,
• security authorities in case of corresponding requirements,
• internal service providers for the entrance control which involves video control,
• where necessary partners of the respective event from politics and ministries,
• where necessary social media, press,
• and to our service providers for the technical support of the application.

In the case of the use of Microsoft Teams, your personal data will be transferred to the service provider. For details on data processing by Microsoft, please refer to Microsoft's privacy policy at https://privacy.microsoft.com/de-de/privacystatement.

6. Transfer of personal data to a third country

a) Presence event

In the case of presence events, it is generally not planned to transfer your personal data to a third country outside of the EEA or to an international organisation.

b) Online event

When using Microsoft services, personal data may also be processed in the USA. The transfer is based on standard data protection clauses (SCC) as appropriate safeguards. 

The provision of your data takes place via a web application on the Internet. The confidentiality, the integrity (inviolability), the authenticity and the availability of personal data cannot be guaranteed. Your data can also be accessed via the web application in third countries that do not have data protection regulations comparable to those in the Federal Republic of Germany.

7. Data deletion and storage

Retention periods result from tax regulations (10 years).

An automatic deletion of chat messages from the team sessions is currently not possible. However, the author has the option of deleting his/her own contributions. Currently, Microsoft does not provide for the possibility of deleting attendance reports.

8. Users' rights

According to the EU General Data Protection Regulation, you have the following rights:

• If your personal data is processed, you have the right to access the data stored concerning you (Art. 15 GDPR).
• If inaccurate personal data is processed, you have the right to rectification
  (Art. 16 GDPR).
• If the legal requirements are met, you may request the erasure or restriction of processing as well as object to processing (Art. 17, 18 and 21 GDPR). However, we will then no longer be able to communicate with you as a participant in the event.
• If you have consented to the data processing and the data processing is carried out with the help of automated procedures, you may have a right to data portability
  (Art. 20 GDPR).

Should you make use of your above-mentioned rights, the DIHK, DIHK Service GmbH or DIHK DEinternational GmbH will check whether the legal requirements for this are met.

To exercise your rights, please contact the respective person responsible for data protection in accordance with section 3.

In the event of data protection complaints, you may contact the relevant authority:

for DIHK

BfDI Federal Commissioner for Date Protection and Freedom of Information
Graurheindorfer Straße 153
3117 Bonn
Telefon: +49 228 997799-0
E-Mail: poststelle@bfdi.bund.de

for DIHK Service GmbH and DIHK DEinternational GmbH

Commissioner's Office:
Berliner Beauftragte für Datenschutz und Informationsfreiheit
Friedrichstr. 219
10969 Berlin
telephone +49 30 13889-0
fax +49 30 2155050
e-mail mailbox@datenschutz-berlin.de

9. Source of data

If your employer / institution has registered you for the event, we have received your data from this source.

To invite for specific events, we use existing data from our data base. 

Use of Canva

Information requirements regarding the use and application of Canva for websites and social media in accordance with Articles 13 and 14 of the GDPR

1. Description of the processing activity

We use the ‘Canva’ service to present quotations, images and related information in an appealing and creative way for the purpose of reinforcing our economic policy statements and topics on our channels such as websites, social media and newsletters. Canva is a service provided by Canva Pty Ltd, Level 1, 110 Kippax St, Surry Hills NSW 2010, Australia. You can view Canva's privacy policy at www.canva.com/de_de/richtlinien/privacy-policy. The data collected will not be used for any other purposes

2. Name and contact details of the controller

German Chamber of Commerce and Industry (DIHK)
Breite Straße 29
D-10178 Berlin
Telephone 030 20308-0
info@dihk.de

3. Contact details of the data protection officer

Kei-Lin Ting-Winarto
German Chamber of Commerce and Industry (DIHK)
Breite Straße 29
D-10178 Berlin
Phone 030 20308-2717
datenschutz@dihk.de

4. Purposes and legal basis of processing

The legal basis is Art. 6(1)(a) GDPR, your consent. You may revoke your consent at any time with future effect.

5. Recipients or categories of recipients of personal data

Exclusively internal departments of the DIHK and its subsidiaries, in particular the Communications and IT departments.

The following personal data is stored: quote, image, first and last name, position, company, and, if applicable, role in the IHK organisation.

6. Transfer of personal data to a third country

As far as we are aware, no data is transferred to a third country within the application.

7. Duration of storage of personal data

The storage period is until you request us to no longer use the quotes, otherwise 5 years after the last contact.

8. Rights of data subjects

You have the right to withdraw consent, to information, to rectification, to notification, to data portability and to object in accordance with Articles 7 to 15 and 22 of the GDPR.

You can contact our data protection officer at datenschutz@dihk.de.

If you have any complaints regarding data protection, you can contact the competent supervisory authority:

BfDI Federal Commissioner for Data Protection and Freedom of Information
Graurheindorfer Straße 153
3117 Bonn
Telephone: 0228 997799-0
poststelle@bfdi.bund.de

9. Right of withdrawal in the case of consent

If you have consented to processing by the DIHK by means of a corresponding declaration, you can withdraw your consent at any time for the future. This does not affect the legality of the data processing carried out on the basis of the consent until withdrawal.

Microsoft 365

DIHK's information obligations towards external parties regarding the use of M365

1. Description of the processing activity

The data protection information is provided to external parties in connection with the use of Microsoft 365 (M365) at the DIHK. M365 enables external parties to work together in virtual teams (Microsoft Teams), share files and communicate with external parties via email.

2. Name and contact details of the controller

German Chamber of Commerce and Industry (DIHK)
Breite Straße 29
D-10178 Berlin
Telephone 030 20308-0
info@dihk.de

3. Contact details of the data protection officer

Kei-Lin Ting-Winarto
German Chamber of Commerce and Industry (DIHK)
Breite Straße 29
D-10178 Berlin
Phone 030 20308-2717
datenschutz@dihk.de

4. Purposes and legal basis for processing

M365 is an interactive platform that enables modern working. It allows users to work together – including with external partners – on files or in virtual teams (Microsoft Teams), for example.

The following categories of personal data are processed when using Microsoft 365:

• Email address
• If available, data from a personal Microsoft account or a business or school account shared by an external party
• Video and audio communication after explicit approval by the user
• Screen sharing after explicit approval by the user
• Appointment and resource management data
• Content data from emails, documents, presentations and spreadsheets
• Log files with access data (e.g. authentication data)
• System-generated log data
• Optional: telephone number, if the external user opts for authentication via SMS rather than via the Authenticator app

Your data is collected and processed for the following purposes on the following legal bases:

• Ensuring an IT infrastructure that complies with data protection regulations and the security of personal data processing – Art. 6(1)(e) GDPR in conjunction with Section 3 BDSG
• Identification of users (e.g. licensing, authentication and authorisation) – Art. 6(1)(e) GDPR in conjunction with Section 3 BDSG
• Data processing for the fulfilment of IHK tasks, in particular legal obligations or tasks in the public interest
• Legal basis: Art. 6(1)(c) GDPR or Art. 6(1)(e) GDPR, Section 10a IHKG in conjunction with special legal provisions or in conjunction with Section 3 BDSG (including to ensure IT security)
• Consent: Legal basis: Art. 6(1)(a) GDPR
• Contract or for the implementation of a pre-contractual measure: Legal basis: Art. 6(1)(b) GDPR

General settings – Technical data protection (data protection-friendly default settings)

The DIHK only uses or permits the use of M365 software and services covered by these licences (privacy by design or privacy by default) to the extent that this is possible in accordance with data protection law and where Microsoft is the processor. Applications that do not comply with data protection regulations are deactivated centrally by IT or set to comply with data protection regulations.

5. Recipients or categories of recipients of personal data

Our service providers involved in order processing (current status) have access to the following data:

Email address, surname, first name, MFA and information actively generated by the user. (including file uploads, chat)

Microsoft Ireland Operations Limited
One Microsoft Place
South County Business Park
Leopardstown
Dublin 18
Ireland

Microsoft Enterprise Service Privacy (Processor 2 Processor / P2P)
Microsoft Corporation
One Microsoft Way
Redmond, Washington 98052, USA

Purpose: Access to Microsoft multi-factor authentication for the purpose of providing services in the Germany or Europe georegion; furthermore, access to documents and communication via M365 services and software.

Itacs GmbH
Elisabeth-Schwarzhaupt-Platz 5
10115 Berlin

abtis GmbH
Wilhelm-Becker-Straße 11b
75179 Pforzheim

Purpose: Administration of the system environment

The following services are currently identified as existing third-country transfers that cannot be deactivated:

Azure B2B and B2C: Only in relation to the exception when external parties are invited (initial link)

The data centres used by the DIHK are primarily located in Germany and elsewhere in the EU.

Third-country transfers are prohibited except for the exceptions mentioned above.

Remaining third-country transfers are GDPR-compliant and supported by Microsoft Enterprise Service Privacy based on a data processing agreement (Data Processing Addendum/DPA) and standard contractual clauses (SCC) with Microsoft Enterprise Service Privacy (P2P, i.e. between the processor and subcontractor) and by additional safeguards from Microsoft, unless data protection does not apply here either due to the anonymisation of the data. These include extended information obligations, liability clauses and agreements that Microsoft will have requests from US authorities clarified in court in advance.

When data is transferred to third countries, Microsoft always uses state-of-the-art encryption. Microsoft guarantees that, even if it is legally obliged to disclose the data to security authorities, it will not reveal the encryption key or enable the encryption to be circumvented.

6. Duration of storage of personal data

Login logs are stored for one year.

Otherwise, personal data is deleted when it is no longer required for the purposes for which it was processed.

7. Rights of data subjects

Under the EU General Data Protection Regulation, you have the following rights:

• If your personal data is processed, you have the right to obtain information about the data stored about you (Art. 15 GDPR).
• If incorrect personal data is processed, you have the right to have it corrected (Art. 16 GDPR).
• If the legal requirements are met, you can request the deletion or restriction of processing and object to processing (Art. 17, 18 and 21 GDPR).
• If you have consented to data processing and the data processing is carried out using automated procedures, you may have a right to data portability (Art. 20 GDPR).
• If you exercise your above-mentioned rights, the DIHK will check whether the legal requirements for this are met.
• To exercise your rights, please contact the official data protection officers.

If you have any complaints regarding data protection, you can contact the competent supervisory authority:

BfDI Bundesbeauftragter für Datenschutz und Informationsfreiheit
Graurheindorfer Straße 153
3117 Bonn
Telefon 0228 997799-0
poststelle@bfdi.bund.de

8. Right of withdrawal in the case of consent

If you have consented to the processing of your personal data by the DIHK by means of a corresponding declaration, you can withdraw your consent at any time with future effect. This does not affect the lawfulness of the data processing carried out on the basis of your consent until withdrawal.

9. Automated decision-making, profiling

The DIHK does not use any tools that enable automated decision-making, including profiling, in accordance with Art. 22 GDPR.

Processing of address data

Information obligation pursuant to Articles 13 and 14 GDPR regarding the processing of address data

1. Description of the processing activity

The data protection information is provided in connection with the processing of address data for the purpose of communicating with you.

2. Name and contact details of the controller

German Chamber of Commerce and Industry (DIHK)
Breite Straße 29
D-10178 Berlin
Telephone 030 20308-0
info@dihk.de

3. Contact details of the data protection officer

Kei-Lin Ting-Winarto
German Chamber of Commerce and Industry (DIHK)
Breite Straße 29
D-10178 Berlin
Phone 030 20308-2717
datenschutz@dihk.de

4. Purposes and legal basis of processing

Your data is collected for the fulfilment of our statutory tasks in order to

invite you to events, meetings of committees, commissions, working groups or task forces,

contact you by telephone,

send you information, political positions and statements on legislative proposals in written or text form.

Your data is processed on the basis of Art. 6 (1) (a) GDPR in conjunction with the statutes of the DIHK.

5. Source of the data

The data we process for communication with you has been provided to us directly by you, or it comes from directories that list specific groups of people (e.g. members of the German Bundestag), or it is based on our own internet research, or it has been provided to us by chambers of commerce and industry and chambers of commerce abroad.

6. Recipients or categories of recipients of personal data

Your personal data will be transferred

• within the framework of committees, working groups and task forces to their members
• within the IHK and AHK organisation upon request or in the event of new appointments
• within the DIHK
• to our service providers so that they have access to the data.

7. Transfer of personal data to a third country

In certain cases, data may also be transferred to chambers of commerce abroad outside the EEA, for example in the context of delegation trips.

8. Duration of storage of personal data

Once collected by the DIHK, your data will be stored for as long as necessary to fulfil the respective task.

9. Rights of data subjects

Under the EU General Data Protection Regulation, you have the following rights:

• If your personal data is processed, you have the right to obtain information about the data stored about you (Art. 15 GDPR).
• If incorrect personal data is processed, you have the right to have it corrected (Art. 16 GDPR).
• If the legal requirements are met, you can request the deletion or restriction of processing and object to the processing (Art. 17, 18 and 21 GDPR).
• If you have consented to data processing and the data processing is carried out using automated procedures, you may have a right to data portability (Art. 20 GDPR).
• If you exercise your above-mentioned rights, the DIHK will check whether the legal requirements for this are met.
• To exercise your rights, please contact the company data protection officer.

If you have any complaints regarding data protection, you can contact the competent supervisory authority:

BfDI Bundesbeauftragter für Datenschutz und Informationsfreiheit
Graurheindorfer Straße 153
3117 Bonn
Telefon: 0228 997799-0
E-Mail: poststelle@bfdi.bund.de

10. Right of revocation in the case of consent

If you have consented to processing by the DIHK by means of a corresponding declaration, you may revoke your consent at any time with future effect. This does not affect the lawfulness of data processing carried out on the basis of your consent prior to revocation.

Participants in the EPDU

Information obligations towards participants in the EPdU in accordance with Article 13 GDPR

1. Description of the processing activity

The data protection information is provided in connection with registration as a participant in the German delegation to the European Parliament of Enterprises (EPdU) and as a participant in the German framework programme.

2. Name and contact details of the controller

German Chamber of Commerce and Industry (DIHK)
Breite Straße 29
D-10178 Berlin
Telephone 030 20308-0
info@dihk.de

3. Contact details of the data protection officer

Kei-Lin Ting-Winarto
German Chamber of Commerce and Industry (DIHK)
Breite Straße 29
D-10178 Berlin
Phone 030 20308-2717
datenschutz@dihk.de

4. Type of data collected

The data collected in the registration form, divided into mandatory and optional fields, will be processed. Further enrichment and processing will take place exclusively for the purpose of efficient event organisation, see the following purposes. 

5. Purposes and legal basis of processing

Your data is collected in order to

• ensure your participation in the German framework programme for the EPdU and to organise the programme accordingly;
• pre-register you as a participant in the German delegation to the EPdU at the European Parliament by passing on your name, email address and participant category;
• communicate directly with you as a participant before and after the event, for example to send you briefings (preparations) and other important information or follow-up information.

Your data will be processed on the basis of Art. 6 (1) (e) GDPR in conjunction with § 10a IHK, § 3 BDSG. The organisation of this event serves and complies with our legal mandate. Without providing this data, participation in the event is not possible.

For the optimal organisation of the supporting events, information on late or early arrival and departure, selected hotel accommodation, possible food intolerances, etc. is also necessary. This data is processed on the basis of Art. 6 (1) (a) GDPR (consent).

Please note that photographs and/or videos will be taken during the event. The photographs will be used for the purpose of documenting the event and as part of our public relations work (print, online, social networks, etc.). If you do not wish to be photographed, please avoid the areas where photographs and videos are being taken and/or speak to the photographer directly so that your request can be taken into account.

6. Recipients or categories of recipients of personal data

Your personal data will be transferred to

• the DIHK employees responsible for processing, as well as other DIHK colleagues, department heads and management for the purpose of preparing the relevant briefings
• the respective regional working group (LAG) of the sending IHKs – to compare the registration status and allocate speaker slots
• press officers or employees of the sending IHKs, if applicable – for communication work
• the office of the German Junior Chamber (WJD) – to compare the registration status and allocate speaker slots
• the German Confederation of Skilled Crafts (ZDH) – for the joint organisation of the event
• Eurochambres – primarily for allocating speaker slots
• The European Parliament – for pre-registration for the main event

Where applicable, institutions that provide event venues and require certain participant data for this purpose (e.g. for security checks)

Our service providers for technical support have access to the data.

Purpose (see above, point 5):

In order to pre-register for the EPdU with the European Parliament, the DIHK must provide the name, email address and participant category. Participants can then complete their registration themselves with their personal data. The DIHK cannot view this data, but can delete your registration if you cancel your participation.

For the organisation of the German framework programme, the DIHK must therefore collect the data of the German participants separately, such as basic contact details and information about the company, IHK membership and function within the IHK.

7. Transfer of personal data to a third country

There are no plans to transfer your personal data to a third country or international organisation.

Your data is provided via a web application on the Internet. The confidentiality, integrity (inviolability), authenticity (genuineness) and availability of personal data cannot be guaranteed. Your data can also be accessed via the web application in third countries that do not have data protection regulations comparable to those of the Federal Republic of Germany.

8. Duration of storage of personal data

The following data will be stored for a maximum of three years after collection: name, company, Chamber of Industry and Commerce (IHK) membership and function, federal state. This enables us to provide information about your participation in previous editions of the EPdU in the event of any queries from the management or the IHK organisation.

All other data will be deleted within three months of the event.

9. Rights of data subjects

Under the EU General Data Protection Regulation, you have the following rights:

• If your personal data is processed, you have the right to obtain information about the data stored about you (Art. 15 GDPR).
• If incorrect personal data is processed, you have the right to have it corrected (Art. 16 GDPR).
• If the legal requirements are met, you can request the erasure or restriction of processing and object to the processing (Articles 17, 18 and 21 GDPR). If you do not provide the required data, your registration for the EPdU and the supporting programme cannot be processed.
• If you have consented to data processing or if a contract for data processing exists and the data processing is carried out using automated procedures, you may have a right to data portability (Art. 20 GDPR).
• If you exercise your above-mentioned rights, the DIHK will check whether the legal requirements for this are met.

To exercise your rights, please contact the company data protection officer.

If you have any complaints regarding data protection, you can contact the competent supervisory authority:

Bundesbeauftragte für Datenschutz und Informationsfreiheit
Graurheindorfer Straße 153, 53117 Bonn 
Telefon: +49 (0)228-997799-0
poststelle@bfdi.bund.de

10. Right of withdrawal in the case of consent

If you have consented to processing by the DIHK by means of a corresponding declaration, you can withdraw your consent at any time for the future by sending an email to events-bruessel@dihk.de. This does not affect the legality of the data processing carried out on the basis of the consent until withdrawal.

11. Source of data

The data we process for the organisation of the German framework programme and communication with you has been provided to us directly by you via the registration form (Sweap).

In exceptional cases, some of the data was provided to us by chambers of commerce and industry or regional working groups of chambers of commerce and industry (if the regional working groups provided us with the names of the designated participants from their federal state). In this case, the chambers of commerce and industry or regional working groups are responsible for ensuring that the data is transferred in accordance with data protection regulations.