Information Required under the EU GDPR for Consumers

1. Name and Contact Details of the Controller and of the Data Protection Officer

The controller within the meaning of Article 4(7) of the EU General Data Protection Regulation (GDPR) is Creditreform Boniversum GmbH, Hammfelddamm 13, 41460 Neuss, Germany, Tel.: +49 (0) 2131/109-501. You may contact our data protection officer at the above address or by email at datenschutz@boniversum.de.

2. Categories of Processed Personal Data

The name, title, sex, address, date of birth, birth name (if applicable), email address, telephone number, payment history, negative indicators, such as insolvency data and debtors’ list entries, and shareholdings of persons are stored in Creditreform Boniversum GmbH’s database.

3. Purpose of Data Processing

Creditreform Boniversum GmbH processes data to provide requested credit information about persons. A part of this data is also used for address trading/advertising purposes and fraud prevention purposes as permitted by law.

4. Legal Basis for Data Processing

When processing data for credit agency and address trading/advertising purposes purposes, the legal basis is Article 6(1)(f) of the GDPR. Information may only be provided to customers who plausibly demonstrate a legitimate interest in this information. Legitimate interests within the above meaning may include: credit decisions, entering into a business relationship, shareholdings, claims, credit checks, insurance policies, outstanding claims or enforcement information.

5. Data Sources

Our information and address marketing data comes from publicly-accessible sources, such as public registers and the Internet, but is also collected directly from the data subjects, including Boniversum customers, or may be taken from claims management.

6. Categories of Recipients of Personal Data

Boniversum customers include domestic and foreign credit agencies and leasing, insurance, telecommunications, shipping, wholesale, retail and other companies that provide goods or services for an invoice. Data is only transmitted to states outside of the EU on the basis of so-called standard contractual clauses which may be viewed and retrieved at:https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32021D0914&from=EN einsehen oder sich zusenden lassen können.

7. Storage Period

We store data for as long as necessary for the purposes for which it was collected which is normally after 3 years. We then check whether further storage is necessary. If not, the data will be erased. If the matter has been settled, the date will be erased after 3 years. In accordance with Section 882e of the German Code of Civil Procedure [Zivilprozessordnung (ZPO)], debtors’ list entries will be canceled exactly 3 years after the date on which the entry was ordered.

For more information, please see the “Code of Conduct for Review and Erasure Periods of Personal Data for German Credit Agencies” [Verhaltensregeln für die Prüf- und Löschfristen von personenbezogenen Daten durch die deutschen Wirtschaftsauskunfteien] of the German credit agency association, “Wirtschaftsauskunfteien e.V.,” at: https://www.die-wirtschaftsauskunfteien.de/code-of-conduct (German)

8. Data Subject Rights

Against Boniversum, every data subject has the right of access under Article 15 of the GDPR, the right to rectification under Article 16 of the GDPR, the right to erasure under Article 17 of the GDPR and the right to restriction of processing under Article 18 of the GDPR. If you consented to us processing the personal data stored on you, you have the right to withdraw this consent at any time. Withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal.

You may lodge a complaint about our processing of your personal data to the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia at: Der Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestr. 2-4, 40213 Düsseldorf, Germany, Tel.: +49 (0) 211/38424-0, Email: poststelle@ldi.nrw.de

You are not required to transmit data to us by law, contractually or to enter into a contract with us. Nor are you required to provide requested data to us.

Right to Object

We process stored data for the purposes of our legitimate interests in creditor and debtor protection, which override your interests, rights and freedoms, or for the establishment, exercise or defense of claims. You may only object to the processing of your data on grounds related to your particular situation which must be verified. If such grounds verifiably apply, we will no longer process your data.

If we process your data for address trading/advertising purposes, you can object to this at any time. Your data will then no longer be processed for this purpose.

9. Profiling/Scoring

To rate your credit risk, Creditreform Boniversum GmbH creates a score for your data. This score is determined by using data on your age, sex, address, and certain payment history. These factors may be weighted differently. Such scores assist Creditreform Boniversum customers when making credit decisions.