Transparent Information

and Supplemental Privacy Notice for Trial Use

We are aware of the importance of the personal data that you entrust to us. We consider ensuring the confidentiality of your data to be one of our most important duties.

In line with the General Data Protection Regulation (GDPR), which has come into effect on 25 May 2018, we hereby fulfil our obligations regarding information to be provided where personal data are collected from the data subject and provide transparent information on the nature, scope and purposes of the collection of personal data while explaining your rights to you.

1. Contact Details of the Controller

The controller within the meaning of the General Data Protection Regulation is:

innovaphone AG
Contact person: Nicole Hofmeister
Umberto-Nobile-Str. 15
D-71063 Sindelfingen

Phone: +49 7031 73009 0
E-mail: privacy@innovaphone.com

The following data protection officer was appointed:

Mr Stephan Hartinger
Coseco GmbH
Phone: +49 8232 80988-70
E-mail: datenschutz@coseco.de

2. What Sources are Used to Collect Personal Data?

We process personal data that we receive directly from our customers in the scope of our business relationship. We further process personal data that we receive from other enterprises, for instance to carry out orders, to perform contracts or because you have given your consent. We further process personal data that we have lawfully obtained from publicly accessible sources (e.g., commercial register and register of associations, press, media, internet) and are authorised to process.

Personal data that may be relevant to us include:

Customer contact details
When establishing a business relationship and during the relationship, additional personal data, such as information on the contact channel, date, cause and result, (electronic) copies of written communication and information on participation in direct marketing measures, may be obtained through personal contact or communication by phone or mail either through your or at the instigation of one of our employees.

Credit rating information
Business-related credit rating documents: Profit calculations, balance sheets, financial business analysis, time and duration of self-employment.

3. For what Purposes and on which Legal Basis are Personal Data Processed?

We process the aforementioned personal data in accordance with the provisions of the General Data Protection Regulation (GDPR) and the new German Federal Data Protection Act (BDSG neu):

Processing of personal data, for which we have obtained the consent of the data subject, is based on point (a) of Art. 6 (1) General Data Protection Regulation.

Processing of personal data that is necessary for the performance of a contract to which the data subject is party, is based on point (b) of Art. 6 (1) GDPR. This provision also covers processing operations that are required prior to entering into a contract.

Processing of personal data that is necessary for compliance with a legal obligation to which our Company is subject, is based on point (c) of Art. 6 (1) GDPR.

If processing is necessary for the purposes of the legitimate interests pursued by our Company or by a third party, and where the interests or fundamental rights and freedoms of the data subject do not override the former interests, processing is based on point (f) of Art. 6 (1) GDPR. The legitimate interests of our Company refer to performing our business activities.

We process your data for the following purposes:

• for sending the newsletter, provided you have signed up to receive the newsletter on our website
• for establishing contact by email, post or telephone for offers, events or training measures that might interest you and to establish and foster a business relationship
• to understand the training level with respect to innovaphone products
• use of photos, logos and videos for public relations purposes.

This link takes you to our Data Privacy Policy.

4. Transmission of Data to Third Parties

Within our Company, your personal data will only be transmitted to those persons and business units who need the data to perform our contractual and legal obligations. We only transmit data to third parties if this is required to perform a contractual obligation. We do not transmit data to third parties beyond the purposes specified in item 3. We further transmit data to third parties if we are under a legal obligation to do so. Such obligations include written requests for information by public agencies (e.g., public authorities and offices), judicial orders or a legal provision that allows transmission of such data.

In case of advance performance on our part, like purchase against invoice, we reserve the right to obtain a credit ranking or identity check from specialised service providers (credit agencies) in order to safeguard our legitimate interest.

Your data may be transmitted to certain companies within our Company group when such companies contribute to performing a contractual obligation.

Data may be transmitted to the following companies within our Company Group:

innovaphone SAS
5, Rue de Helsinky
67300 Schiltigheim
France

innovaphone s.r.l.
Via Ospedaletto, 105/C
37026 Ospedaletto di Pescantina (VR)
Italy

innovaphone nordic AB
c/o Tysk-Svenska Handelskammarens
Box 27104
10252 Stockholm
Sweden

5. Transmission of Data to Third Countries

No personal data is transmitted to so-called third countries, i.e. countries outside the EU/EEA area.

6. Duration of Storage /Erasure Deadlines

We process and store your personal data as long as this is necessary for the performance of our contractual duties and all the other purposes stated in item 3 or as long as necessary in keeping with the preservation periods stipulated by the legislator.

Once the data is no longer required for fulfilling contractual or legal obligations, such data is restricted for processing or erased regularly and in keeping with the statutory provisions.

7. Rights of Data Subjects

Please do not hesitate to contact us in writing at any time when you have questions regarding the personal data concerning you.

Pursuant to GDPR, you have the following rights: right of access (Art. 15 GDPR)
You have the right to receive information on what categories and information with respect to the personal data concerning you we process, for which purpose and for how long and according to what criteria such data are stored and whether we use automated decision-making, including profiling, in this context. You further have the right to receive information on the recipients or categories of recipients to whom your data were or will be disclosed, in particular if this refers to recipients in third countries or international organisations. In this case, you have the right to receive information on appropriate safeguards taken in connection with the transmission of the personal data concerning you.

In addition to the right to lodge a complaint with a supervisory authority and the right to obtain information on the source of the data concerning you, you have a right to erasure, rectification and a right to restrict the processing of your data as well as the right to object against the personal data concerning you being processed.

You have the right, in all of the aforementioned cases, to request that the controller provide, free of charge, a copy of the personal data concerning you that we process. For any additional copies that you might request and that exceed the right to access by the data subject, we are entitled to charge an appropriate administration fee.

Right to rectification (Art. 16 GDPR)
You have the right to obtain from us without undue delay the rectification of inaccurate personal data concerning you. Taking in to account the purposes of the processing, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

if you wish to exercise your right to rectification, please do not hesitate to contact our data protection officer or the person responsible for processing the data.

Right to erasure (Art. 17 GDPR)
You have the right to obtain from the controller the erasure of personal data concerning you without undue delay (“right to be forgotten”), in particular, if storing the personal data is no longer necessary, you withdraw your consent to data processing, your data was unlawfully processed or collected or there is a legal obligation under EU or national law to erase such data.

The right to be forgotten does, however, not apply if an overriding right to freedom of expression and information exists, it is necessary to store the personal data for the performance of a legal obligation (e.g., preservation duties), archiving purposes conflict with the erasure or the data is stored for the establishment, exercise or defence of legal claims.

Right to restriction of processing (Art. 18 GDPR)
You have the right to obtain from the controller restriction of processing if the accuracy of the personal data is contested by you, the processing is unlawful, you oppose the erasure of the personal data and request the restriction of their use instead, the personal data are no longer needed for the purposes of processing or if you have objected to processing pursuant to Article 21 (1) pending the verification whether our legitimate grounds override your grounds.

Right to data portability (Art. 20 GDPR)

You have the right to receive the personal data concerning you, which you have provided to a controller, in a structured, commonly used and machine-readable format. Further, you have the right to transmit these data to another controller without hindrance from the controller to which the personal data have been provided, where:

the processing is based on given consent and
the processing is carried out by automated means.
In exercising your right to data portability, you further have the right to have your personal data transmitted directly from one controller to another, where technically feasible. The rights and freedoms of others may not be affected.

The right to data portability does not apply to the processing of personal data if this is necessary for the performance of duties, which is in public interest or is carried out in the exercise of official authority, assigned to the controller.

Right to object (Art. 21 GDPR)
You have the right to object to the processing of the personal data concerning you at any time, unless there are legitimate grounds for processing. Legitimate grounds for processing include, for instance, grounds that override the interests, rights and freedoms of the data subject or if processing is required for the establishment, exercise or defence of legal claims. In addition, you can exercise a specific, explicit right to object to the processing of your personal data for direct marketing purposes.

Right to lodge a complaint with the data protection supervisory authority (Art. 77 GDPR in conjunction with Section 19 German Federal Data Protection Act (BDSG).
You have the right to lodge a complaint with the competent supervisory authority if you believe that an infringement was committed in processing your personal data.

Right to withdraw consent under data protection law (Art. 7 (3) GDPR)
You may at any time withdraw your consent to processing of your personal data without stating any reasons. This also applies to the withdrawal of a declaration of consent that was given to us before the EU General Data Protection Regulation came into force.

8. Statutory or Contractual Provisions to Provide Personal Data and Consequences of not Providing such Data

We hereby inform you that, in certain circumstances, it is required by law to provide personal data (e.g., tax provisions) or that such an obligation may arise from a contractual provision (e.g., information regarding the other contractual party). The data subject/other contracting party may, for instance, be required to provide his or her personal data in order to conclude the contract and to put us in a position to actually deal with the data subject’s request (like an order). An obligation to provide personal data arises in particular whenever a contract is concluded. If no personal data are provided in such a situation, the contract with the data subject cannot be concluded. Before providing personal data, the data subject can contact our data protection officer or other person responsible for processing the data. The data protection officer or other person responsible for processing the data will then inform the data subject whether the provision of the required personal data is prescribed by law or contract or required in order to conclude the contract and whether the data subject’s request entails an obligation to provide personal data and what consequences it will have for the data subject if the data is not provided.

9. Statutory Existence of Automated Decision-Making (Including Profiling)

As a responsible company, we do not subject our business relationships to automated decision-making or profiling.

10. Supplemental Privacy Notice for Trial Use

In addition to the Transparency Notice of innovaphone, the following provisions apply to the use of trial accounts:

10.1. Purpose of Processing

Personal data processed within the scope of the trial use is processed for the purpose of providing, conducting, and evaluating the trial period, as well as to ensure the operation, IT security, and stability of the platform.

10.2. Scope of Use and User Responsibility

The functional scope of the trial use corresponds to the full version of a paid account. The user is responsible for ensuring the lawfulness of the data entered and processed. In particular, the user shall ensure that the processing of personal data is carried out in compliance with applicable data protection regulations, and that a valid legal basis is in place.

10.3. Access and Processing by innovaphone

innovaphone processes the data stored within the scope of the trial period exclusively to the extent necessary to conduct the trial period. Access to content is granted only to the extent necessary to ensure system operation, perform error analysis, provide support, or for legal reasons.

10.4. End of Trial and Deletion of Data

For the purposes of further processing and deletion of the data and content stored during the trial period, a distinction is made between guest access and portal access:

a) Guest Access

Upon expiry of the 14-day trial period, the use of the products provided within the scope of the trial period shall be restricted or discontinued. Access to the work environment may initially remain available. innovaphone shall be entitled to delete the data and content stored within the scope of the trial use no earlier than 30 days after the expiry of the trial period, provided that there are no statutory retention obligations or legitimate reasons for storing the data beyond that period.

b) Portal Access

When using portal access, the portal account shall remain active even after the expiry of the 14-day trial period. Data and content stored during the trial phase will not be deleted due to the expiry of the trial phase. In the event of subsequent paid use, the data and content stored during the trial phase may be transferred to productive operations and further processed therein. Further storage and deletion shall be governed by the contractual and data protection regulations applicable to the products used.

10.5. Premature Deletion

The user may request the deletion of their personal data at any time, provided that there are no statutory retention obligations or other statutory grounds to the contrary. Insofar as the relevant data is required to provide the trial access or the portal account, such deletion may result in the inability to continue with the trial period or the portal account, or in only a limited use thereof.

10.6. Contacting the User

innovaphone is entitled to contact the user during and after the trial period, in particular to ensure proper operation, to ensure user satisfaction, and — to the extent permitted by law — for its own promotional purposes. The e-mail address provided during registration may be stored and used beyond the trial period to the extent necessary to carry out pre-contractual measures, to protect legitimate interests, or to the extent permitted by law for the purpose of contacting the user, in particular in connection with the products tested.

10.7. Supplementary Provisions

In all other respects, the provisions of the Transparency Notice of innovaphone shall apply.

10.8. Hosting and Operation of the Platform

The trial environment provided within the scope of the trial use is operated in a cloud infrastructure. Data processing is carried out on systems belonging to innovaphone or commissioned service providers within the European Union.