285 lines
17 KiB
HTML
285 lines
17 KiB
HTML
<!DOCTYPE html>
|
|
<html lang="en">
|
|
|
|
<head>
|
|
<meta charset="UTF-8">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
|
<title>Data Protection Information for the Remote Signature System signFLOW</title>
|
|
<link rel="stylesheet" href="css/privacy-policy.min.css">
|
|
</head>
|
|
|
|
<body>
|
|
<header>
|
|
<h1>Data Protection Information for the Remote Signature System signFLOW</h1>
|
|
<p><strong>As of:</strong> 19.09.2024</p>
|
|
</header>
|
|
<section>
|
|
<h2>1. General Information</h2>
|
|
<p>In today's fast-paced and increasingly digital world, personal data is an important resource. Your data is
|
|
valuable and must therefore be handled with the care required by various laws and regulations (GDPR, TDDDG,
|
|
...).</p>
|
|
<p>As a provider of local solutions (OnPremise), the manufacturer of signFLOW, Digital Data GmbH, places a clear
|
|
focus on data protection and data security. For you, this means that only the necessary data is collected
|
|
and stored (data minimization). Furthermore, current and secure technologies are used in processing.</p>
|
|
<p><strong>Contact details of the manufacturer:</strong></p>
|
|
<address>
|
|
Digital Data GmbH<br>
|
|
Ludwig-Rinn-Straße 16<br>
|
|
35452 Heuchelheim<br>
|
|
<a href="https://digitaldata.works">https://digitaldata.works</a><br>
|
|
<a href="mailto:info-flow@digitaldata.works">info-flow@digitaldata.works</a><br>
|
|
Phone: 0049 641 202360<br>
|
|
</address>
|
|
<p><strong>Contact the Data Protection Officer:</strong> <a
|
|
href="mailto:privacy-flow@digitaldata.works">privacy-flow@digitaldata.works</a></p>
|
|
</section>
|
|
|
|
<section>
|
|
<h2>2. Responsible Entity for Data Processing</h2>
|
|
<p>Your data is processed with confidence by:</p>
|
|
<address>
|
|
Digital Data GmbH<br>
|
|
Ludwig-Rinn-Straße 16<br>
|
|
35452 Heuchelheim<br>
|
|
<a href="https://digitaldata.works">https://digitaldata.works</a><br>
|
|
<a href="mailto:info-flow@digitaldata.works">info-flow@digitaldata.works</a><br>
|
|
Phone: 0049 641 202360<br>
|
|
</address>
|
|
<p><strong>Contact our Data Protection Officer:</strong> <a
|
|
href="mailto:privacy-flow@digitaldata.works">privacy-flow@digitaldata.works</a></p>
|
|
</section>
|
|
|
|
<section>
|
|
<h2>3. Data Collection</h2>
|
|
<h3>3.1 The following categories of personal data are processed</h3>
|
|
<ul>
|
|
<li>Names: First and last names as well as your digital signature</li>
|
|
<li>Contact details: Phone number, mobile phone number, and email address</li>
|
|
<li>Technical data: IP address, time of access, or access attempts</li>
|
|
</ul>
|
|
|
|
<h3>3.2 Source of the personal data</h3>
|
|
<p>You have previously provided the data mentioned under 3.1 to your business partner (the responsible entity).
|
|
This transmission may have occurred verbally over the phone, in personal contact, via email, or via a
|
|
contact form.</p>
|
|
<p>You transmit your digital signature independently when signing a document.</p>
|
|
|
|
<h3>3.3 Retention periods / Storage duration</h3>
|
|
<ul>
|
|
<li>Automatic email correspondence is stored for 6 years.</li>
|
|
<li>Signed contracts are retained for the duration of their term + 10 years.</li>
|
|
<li>The technical process is stored in the signFLOW software solution indefinitely, depending on the
|
|
document or contract type.</li>
|
|
</ul>
|
|
<p>Your personal data will generally be anonymized when:</p>
|
|
<ul>
|
|
<li>The contract has expired, and the statutory retention period is over.</li>
|
|
<li>The contract was rejected by you or never signed.</li>
|
|
</ul>
|
|
<p>The legal basis for these retention periods includes:</p>
|
|
<ul>
|
|
<li>Commercial Code (HGB)</li>
|
|
<li>Tax Code (AO)</li>
|
|
<li>Principles for the Proper Keeping and Retention of Books, Records, and Documents in Electronic Form and
|
|
for Data Access (GoBD)</li>
|
|
</ul>
|
|
<p>
|
|
Depending on the specific type of document, the retention period may vary. Additionally, the periods may be
|
|
extended in case of irregularities, such as a pending or ongoing legal dispute.
|
|
</p>
|
|
|
|
<h3>3.4 Purpose of processing</h3>
|
|
<p>The personal data defined under 3.1 is processed to:</p>
|
|
<ul>
|
|
<li>Support or provide the technically necessary process.</li>
|
|
<li>Enable you, as the end user, to sign a document digitally. This requires the identification of the
|
|
applicant, application verification and processing, billing, and compliance with documentation
|
|
requirements.</li>
|
|
</ul>
|
|
<p>In individual cases, data is processed separately by the IT department, particularly in response to support
|
|
requests, or possibly forwarded to the manufacturer for further processing.</p>
|
|
<p>Data processing also occurs to ensure information security, especially for the identification and prevention
|
|
of attacks, and for conducting internal and external audits, export controls, and sanctions list checks.
|
|
Information may also be transmitted to the relevant authorities in accordance with Section 8 (2) VDG.</p>
|
|
|
|
<h3>3.5 Legality of processing</h3>
|
|
<p>Your data is collected based on an impending or already existing business relationship.</p>
|
|
<p>The legal basis for the transmission to competent authorities is Section 8 (2) VDG. Requests from data
|
|
subjects are processed in accordance with Articles 12 to 23 of the GDPR and Sections 32 to 37 of the Federal
|
|
Data Protection Act (BDSG).</p>
|
|
|
|
<h3>3.6 Legitimate interests</h3>
|
|
<p>A legitimate interest of the responsible entity in accordance with Article 6 (1) (f) GDPR exists in the
|
|
following cases:</p>
|
|
<p>Measures are taken for information security, which include both preventive technical and organizational
|
|
measures as well as incident handling. The aim is to assess and avoid potential harm to the company, the
|
|
individuals affected by data processing, and the users of trust services.</p>
|
|
|
|
<h3>3.7 Necessity of data</h3>
|
|
<p>The collected data represents the minimum necessary for the digital signature. Without the data mentioned
|
|
under 3.1, the service cannot be operated.</p>
|
|
<p>It is particularly important to provide a mobile number or a German landline number, as this is used for
|
|
authentication and signature triggering as a second factor. Without this security mechanism, the service
|
|
cannot be provided.</p>
|
|
|
|
<h3>3.8 Data transfer</h3>
|
|
<p>Systematic data transmission does not take place.</p>
|
|
<p>Data is only forwarded to the manufacturer for support services in exceptional cases. A valid data processing
|
|
agreement (DPA) exists with the manufacturer, which ensures the security and integrity of the handling of
|
|
your data.</p>
|
|
</section>
|
|
|
|
<section>
|
|
<h2>4. Use of Cookies</h2>
|
|
<p>
|
|
When visiting certain pages, temporary cookies are used, which are necessary for the technical provision of
|
|
the services. These so-called session cookies do not contain any personal data and are automatically deleted
|
|
after the session ends. Methods such as Java applets or Active-X controls that could track user behavior are
|
|
not used.
|
|
</p>
|
|
</section>
|
|
|
|
<section>
|
|
<h2>5. Rights of Affected Persons</h2>
|
|
<p>
|
|
If you have questions about your data or wish to request correction, deletion, or restriction of processing,
|
|
please send your request by mail or email to the address provided above. This also applies if you wish to
|
|
object to the processing in accordance with Article 21 GDPR or request data portability.
|
|
</p>
|
|
<p>
|
|
If you have questions or complaints about a procedure, you can also contact us using the contact details
|
|
provided. If you have further grounds for complaint, you can contact our supervisory authority. You can find
|
|
out which supervisory authority is responsible for you here:
|
|
<a href="https://www.bfdi.bund.de/DE/Service/Anschriften/Laender/Laender-node.html">Laender-node.html</a>
|
|
</p>
|
|
</section>
|
|
|
|
<section>
|
|
<h2>6. Whistleblower System</h2>
|
|
<p>
|
|
Compliance with legal regulations and internal guidelines, including our Code of Conduct and the Code of
|
|
Conduct for Business Partners, is our (the data processing entity's) top priority. This applies both to our
|
|
own business operations and to our supply chains.
|
|
</p>
|
|
<p>
|
|
It is important to us to identify risks early and avoid violations. We aim to take appropriate measures in a
|
|
timely manner to prevent potential harm to affected persons, customers, employees, business partners, and
|
|
our corporate group.
|
|
</p>
|
|
<p>
|
|
For this reason, we have established an independent, neutral, and confidential whistleblower system that
|
|
enables internal and external whistleblowers to submit reports, including anonymously. Through our
|
|
transparent complaint procedure, we offer the greatest possible protection, especially to the affected
|
|
persons, whistleblowers, and employees involved in investigating reported incidents.
|
|
</p>
|
|
<p>
|
|
Under this procedure, any actual or alleged violations of legal requirements, our Code of Conduct, or the
|
|
Code of Conduct for Business Partners may be reported. Human rights or environmental risks, as well as
|
|
breaches of duty along the entire supply chain of our group companies and in our own business operations,
|
|
can also be the subject of a report.
|
|
</p>
|
|
<p>
|
|
Standardized and swift processes, as well as confidential and professional handling of the reports by
|
|
internal experts, form the basis of this fair procedure. Discrimination or punishment of whistleblowers and
|
|
individuals responsible for handling complaints and reports will not be tolerated.
|
|
</p>
|
|
|
|
<h3>6.1 Purpose and Legal Basis of Data Processing</h3>
|
|
<p>
|
|
The purpose of processing personal data is to manage the whistleblower system, which also includes
|
|
identifying serious violations or potential violations of applicable law and other serious matters. The
|
|
processing of this data is necessary to comply with legal obligations imposed on us, in accordance with Art.
|
|
6 para. 1 sentence 1 lit. c) GDPR. This refers to the law that enhances the protection of whistleblowers
|
|
(Whistleblower Protection Act - HinSchG).
|
|
</p>
|
|
<p>
|
|
Additionally, the processing serves the legitimate interest of identifying serious violations or potential
|
|
violations of applicable law and other serious matters, in accordance with Art. 6 para. 1 sentence 1 lit. f)
|
|
GDPR.
|
|
</p>
|
|
<p>
|
|
Regarding the processing of special categories of personal data, this is necessary based on the
|
|
Whistleblower Protection Act for reasons of significant public interest, in accordance with Art. 9 para. 2
|
|
lit. g) GDPR. The processing of such special data is carried out in accordance with Art. 9 para. 2 lit. f)
|
|
GDPR in conjunction with Art. 6 para. 1 sentence 1 lit. f) GDPR to establish, exercise, or defend legal
|
|
claims.
|
|
</p>
|
|
<p>
|
|
Affected persons are those about whom a report is made. These can be employees, contractors, or other
|
|
individuals in a business relationship with the data processing entity. Furthermore, we process personal
|
|
data of the whistleblower if they provide their contact details or other identifying information.
|
|
Whistleblowers should be aware that we may process personal data about them during the handling of the
|
|
reported case.
|
|
</p>
|
|
|
|
<h3>6.2 Categories of Personal Data</h3>
|
|
<p>
|
|
Reports can be made anonymously, in which case no personal data of the reporting person will be processed.
|
|
The type of personal data processed depends on the information provided. If the reporting person provides
|
|
personal data about another individual, including the reported individual or persons, that data will also be
|
|
processed. The following categories of personal data may be processed:
|
|
</p>
|
|
<ul>
|
|
<li>General personal data (e.g., first name, last name, address, email address, phone number, etc.)</li>
|
|
<li>Personal data related to criminal convictions or suspicions</li>
|
|
<li>Special categories of personal data (information about racial or ethnic origin, political opinions,
|
|
religious or philosophical beliefs, trade union membership, health data, and information about a
|
|
person's sex life or sexual orientation)</li>
|
|
</ul>
|
|
<p>
|
|
We ask the reporting person to only provide information relevant to the case and to avoid reporting
|
|
sensitive information unless it is essential for handling the reported case.
|
|
</p>
|
|
|
|
<h3>6.3 Obligation to Provide Personal Data</h3>
|
|
<p>
|
|
It is not mandatory to provide the personal data mentioned in section 6.2, as anonymous reporting is also
|
|
possible. However, please note that we may be unable to process the report if no personal data is provided.
|
|
</p>
|
|
|
|
<h3>6.4 Recipients of Personal Data</h3>
|
|
<p>
|
|
Reports are logged in the system of the data processing entity as cases. After evaluation, these cases are
|
|
forwarded internally to the relevant departments, and follow-up actions may be initiated. If a report
|
|
involves one of the group companies of the data processing entity, the relevant cases are forwarded to the
|
|
responsible individuals at the respective company, who will then conduct an internal evaluation and take
|
|
action if necessary. When transferring personal data, the principle of data minimization is observed,
|
|
meaning only the data strictly necessary for handling the report is shared.
|
|
</p>
|
|
<p>
|
|
Personal data of the whistleblower will be shared with authorities when necessary to address serious
|
|
violations or issues, or to safeguard the right to defense of the affected persons. In other cases, personal
|
|
data of the whistleblower will only be shared with their consent. Data about persons other than the
|
|
whistleblower will only be shared in connection with the investigation of a reported case or to address
|
|
serious violations or issues.
|
|
</p>
|
|
<p>
|
|
The reporting platform is provided by the processor WhistleB Whistleblowing Centre AB, based in Stockholm,
|
|
Sweden. Further information about WhistleB and the corresponding terms of use can be found at:
|
|
<a
|
|
href="https://report.whistleb.com/content/documents/whistleb_terms_of_use.pdf">whistleb_terms_of_use.pdf</a>
|
|
</p>
|
|
|
|
<h3>6.5 Retention Period</h3>
|
|
<p>
|
|
Personal data that is found to be irrelevant to the processing of a reported case, as well as reports deemed
|
|
unfounded, will be immediately classified as "not relevant." In this case, the personal reference is removed
|
|
unless the report was anonymous from the outset. To meet the legally required documentation obligations and
|
|
deletion periods pursuant to § 11 para. 1 and para. 5 HinSchG, the report is initially archived without
|
|
personal reference but is not yet deleted. Archived cases serve solely to fulfill these documentation
|
|
obligations and can no longer be used for further processing.
|
|
</p>
|
|
<p>
|
|
Reports and personal data collected during the processing of a report form the basis for further handling
|
|
and are anonymized as soon as possible. However, if it is necessary to take follow-up actions pursuant to §§
|
|
3 para. 8 and 18 HinSchG, it may be necessary to deviate from anonymization, whether due to official orders
|
|
or to protect legal claims. In such cases, pseudonymization is generally sought, unless other directives
|
|
apply, such as a court order. Documentation is deleted three years after the conclusion of the process, but
|
|
it may be retained longer if required to meet the requirements of this law or other legal provisions, as
|
|
long as it remains necessary and appropriate.
|
|
</p>
|
|
</section>
|
|
|
|
</body>
|
|
|
|
</html> |