Privacy notice
Markant Handels- und Industriewaren-Vermittlungs AG («Markant») processes your personal data in accordance with the applicable statutory data protection provisions, in particular the EU General Data Protection Regulation (GDPR) and the national data protection laws applicable to us.
This privacy notice informs you about your rights and about the processing of your personal data in connection with the use of this platform (the «Markant Platform»; see II. below) and, beyond the use of the Markant Platform, in connection with the provision and improvement of Markant services to our clients (see III. below). In addition, you will receive general information on the processing of your personal data and your rights in this regard, which are relevant in both contexts (see I. and IV. et seq.).
I. Responsible Person and Data Protection Officer
The data controller for the processing of your personal data in connection with the use of the Markant Platform and in connection with the provision of services by the controller to its clients is:
Markant Handels- und Industriewaren-Vermittlungs AG
Churerstrasse 166
8808 Pfäffikon SZ
Switzerland
The data protection officer of the data controller can be contacted at the following e-mail: datenschutz@markant.com
The representative of the responsible person in the EU is:
Markant Services International GmbH
Hanns-Martin Schleyer-Strasse 2
77656 Offenburg
Germany
The data protection officer of the EU Representative can be contacted at the following e-mail address: datenschutzbeauftragter@de.markant.com
II. Processing of Personal Data in connection with the Use of the Markant Platform
1. Purposes and Legal Bases of Data Processing
In the following, we would like to give you an overview of the purpose for which and the legal basis on which we process your personal data in connection with your visit to the Markant Platform.
1.1 Visit to the Markant Platform
When you visit our Markant Platform, server log files are automatically processed.
These are in particular:
- Browser type and version
- Operating system used
- Referrer URL
- Host name of the accessing computer
- Time of the server request
- Domain name of your Internet Service Provider
- IP address
As a matter of principle, this data is not merged with other data sources. This data is used to ensure the technical provision and functionality of the Markant Platform. We reserve the right to check this data retrospectively if we become aware of specific indications of illegal use or other misuse of the Markant Platform or if this is otherwise necessary to identify or rectify technical problems. We may also anonymise this data and use it anonymously for statistical purposes and to improve the Markant Platform.
The provision of the Markant Platform and the protection of its functionality, including against unlawful use and/or misuse, as well as the anonymisation for further use of the anonymised data for statistical purposes and to improve the Markant Platform constitute legitimate interests. The legal basis for the data processing is art. 6(1)(f) GDPR.
The provision of this data takes place automatically as described. However, if you prevent the processing of this data, you will not be able to use the Markant Platform.
1.2 Contact and Support Forms
You have the possibility to contact us through our contact form.
We process your name, your contact details (e.g. email or telephone number), your company affiliation and activity as well as other data contained in your request and so-called meta data about your request (e.g. date and time of your request) in order to process your request.
As a registered user, it is also possible for you to request support using our support form and to send us enquiries via this form. In this case, we also process the above-mentioned data in order to process your request.
The processing of your request is carried out for the performance of a contract or for the implementation of pre-contractual measures upon request of the data subject in accordance with art. 6(1)(b) GDPR if it concerns a contract directly between you and Markant. In other cases, the legal basis for the processing is art. 6(1)(f) GDPR.
The provision of the above data is voluntary. However, if you do not provide this data, we will not be able to process any enquiries from you.
1.3 Newsletter
If you would like to receive the e-mail newsletter offered on the Markant Platform, we require an e-mail address from you as well as information that allows us to verify that you are the owner of the e-mail address provided and that you agree to receive the newsletter.
We process the data you entered when registering for the newsletter and the data generated during this process and when sending the newsletter, in particular name, company affiliation (if applicable), email address and content/date/time of the newsletter, on the basis of your consent (art. 6(1)(a) GDPR). After registration, the data is initially stored in the system for a period of 30 days until you agree to the sending of the newsletter by confirming the link in the welcome email (so-called double opt-in). If you do not agree within this period, your request will be automatically deleted by the system. We technically coordinate the newsletter dispatch via our MS Dynamics customer relationship management system.
We also process the email address, date/time of newsletter registration and registration confirmation for the purpose of documenting that you have effectively consented to receive the newsletter, as this verifiability is required by law and is therefore in our legitimate interest. The legal basis for this processing is art. 6(1)(f) GDPR.
You can revoke your consent to receive the newsletter for the future at any time and unsubscribe via the link in the newsletter.
The provision of the above data is voluntary. However, if you do not provide this data, you will not be able to receive the newsletter.
1.4 Registration on and further Use of the Markant Platform
To order the services offered via the Markant Platform, a registration of our client is required, within which a contact person must also be indicated.
If you are this contact person, your title, first name and surname, your company position and affiliation and your business contact data are collected and further processed during registration. If you are our client, further data on your identification (e.g. tax number, registration information) and on your business activities (e.g. line of business, products, size) will be collected and further processed during registration.
In addition, our clients can specify persons who may use the Markant Platform as part of their work for the client. In order to use the Markant Platform, these persons can log in at any time by providing their business email address and the password they have selected.
Providing the Markant Platform for use by our clients and their employees in a secure manner, which includes authentication of access, is in our legitimate interest to pursue and protect our commercial and legal interests. The legal basis for this processing is art. 6(1)(f) GDPR.
The provision of the above data is necessary so that you or the Markant client, for whom you work, can use the Markant Platform.
2. Use of Cookies
We use cookies when you visit the Markant Platform. These are small text files that are stored on your (end) device and saved by your browser. They are used in particular to determine the frequency of use and the number of users of the Markant Platform and to make the Markant Platform more effective and secure.
When you access the Markant Platform, you will be informed via a cookie banner that technically necessary cookies are set on the basis of our legitimate interest pursuant to art. 6(1)(f) GDPR in order to be able to provide you with our services in a technically error-free and optimal manner.
Furthermore, you will be informed which performance cookies and/or marketing cookies you can consent to on the basis of art. 6(1)(a) GDPR.
To revoke the consent you have already given and to obtain an overview of the cookies offered in use, you can revoke your consent or change your settings at any time under the cookie settings.
2.1 Storage Period of Cookies
If necessary, you can read about the individual storage periods of the cookies at any time under cookie settings.
2.2 Use of a Consent Management Tool
In order to control the use of the cookies you have consented to, we use a service provider on the Markant Platform that is commissioned by us and bound by instructions to operate the Consent Management Tool. You can read or change the settings you have made in the cookie settings at any time.
2.3 Tracking Tool & Web Analytics Service
We use web analytics services as tracking tools. These tools also use cookies, small text files that are stored on your (end) device and enable us to analyse the use of the Markant Platform. For example, information is collected about your most recent visits or how you move around the Markant Platform. This data is stored on servers in Germany and compiled anonymously in reports. This data processing is intended to provide you with an optimal platform experience and is only used with your consent on the basis of art. 6(1)(a) GDPR. You can revoke this consent at any time. You can also read or change your cookie settings and the storage period of the cookies under cookie settings.
III. Processing of Personal Data in connection with the Provision of Markant Services
1. Purposes and Legal Bases of Data Processing
In the following, we would like to give you an overview of the purpose for which and the legal basis on which we process your personal data in connection with the provision of Markant services.
1.1 Registration to order Markant Services
For information on the processing of personal data when registering to order Markant services, please refer to section II.1.4 above.
1.2. Ordering and Providing Markant Services
If you yourself are our client, when you order Markant services via the Markant Platform, information about the ordered service (e.g. the use of our partner pool, the digital product showcase, the GDSN or eInvoicing) and the corresponding costs, payment data and other contractual data are processed in particular in order to conclude and execute a corresponding contract with you.
The legal basis for the processing of data when ordering Markant services is art. 6(1)(b) GDPR.
If you belong to one of our clients (e.g. as an employee), we may process your title, first and last name, your business contact details and your company position and affiliation, insofar as this is necessary to maintain a business relationship with our client to which you belong, in particular to provide the Markant services ordered.
The legal basis for this data processing is art. 6(1)(f) GDPR, because it is in our legitimate interest to maintain the business relationship with the client and, in particular, to fulfil our contractual obligations towards the client or to exercise our contractual rights.
In order to provide some of our Markant services, we also process, in particular, the names, business contact details and company affiliation of persons who are themselves in business contact with our clients or who belong to companies that do so. For example, such data may be included in invoices that we process to provide our eInvoicing service.
The legal basis for this data processing is art. 6(1)(f) GDPR, because it is in our legitimate interest to fulfil our contractual obligations towards the client.
1.3 Supply Chain Due Diligence Act-Data Stream
In the following circumstances, we may process personal data about you in order to provide and, where appropriate, improve our so-called Supply Chain Due Diligence Act-Data Stream («LkSG Data Stream»; In German: Lieferkettensorgfaltspflichtengesetz [LkSG]) service:
1. You are our client or are our contact person at one of our clients;
2. You are a supplier to one of our clients, i.e., a provider of goods and/or services that the client purchases from you, or belong to the supplier (e.g. as an employee).
In this case, Markant processes the following categories of personal data in particular for the above-mentioned purpose:
- Company master data such as name, legal form, contact details, tax number, branches, turnover, global location number and DUNS number;
- Commodity group data on product categories, countries of production of commodity groups;
- Names and business contact details;
- Data on assessments with regard to compliance with requirements relevant under the Supply Chain Sourcing Obligations Act, e.g. corresponding certificates, ratings, reports, indices etc.;
- Information on self-evaluation questionnaires with regard to risks related to the Supply Chain Due Diligence Act.
If you are not a supplier of goods or services yourself, but only belong to a company (e.g. as its employee), only your name and business contact details (e.g. e-mail address and telephone number) will generally be processed when you fill in the above-mentioned self-evaluation questionnaire for the company to which you belong.
To the extent that Markant does not collect the above data directly from you as the data subject, Markant collects the data from the client or supplier to which the data subject belongs or with which the data subject or supplier has a business relationship, from third party providers of information about requirements relevant under the Supply Chain Due Diligence Act, or from public sources.
Insofar as you provide this data, this is done voluntarily in relation to Markant. You may be obliged to provide this data to your employer (for example, because you complete the self-evaluation questions for them as part of your employment contract obligations) or this data may be collected and processed without your involvement.
The processing of the above data for Markant's business purposes, in particular the commercial provision of Markant services via the Markant Platform, is in our legitimate interest. The legal basis for processing by Markant for the performance of a contract or for the implementation of pre-contractual measures upon client’s request is art. 6(1)(b) GDPR insofar it concerns a contract with you. In other cases, the legal basis for the processing is art. 6(1)(f) GDPR.
1.4 Direct Marketing
If Markant receives names and/or business e-mail addresses of a client or a data subject belonging to the client (e.g. as an employee) in connection with an order for a Markant service, Markant may process this e-mail address for direct marketing purposes, in particular for sending by e-mail offers and information on Markant's own similar products and services, as long as this has not been objected to.
This use of the name and/or e-mail address can be objected to at any time by sending a message to datenschutz@markant.com or by clicking on the unsubscribe link in the relevant e-mails from Markant.
The legal basis for this processing of personal data is art. 6(1)(f) GDPR.
IV. Recipients and Categories of Recipients of the Data in General
We may also share your personal data within the Markant Corporate Group for the purposes set out in this privacy notice. In particular, Markant Services International GmbH (Hanns-Martin Schleyer-Strasse 2, 77656 Offenburg, Germany) processes personal data on our behalf and according to our instructions, insofar as this is necessary for the provision of certain technical services.
Other recipients of personal data are in particular:
- Processors for the support of IT applications, organisation of client relationship management, support requests, online agencies, data destruction and auditing services
- Credit and financial services institutions
- Public bodies and institutions (e.g. tax authorities, tax office)
- Payment gateways
- Lawyers, auditors or similar specialised advisers
The personal data processed within the scope of the LkSG Data Stream Service may also be passed on to (other) clients of Markant who purchase the LkSG Data Stream Service.
We would like to point out at this point that we only work with processors who have concluded a data processing agreement with us in accordance with art. 28 GDPR and thus commit themselves in writing to compliance with data protection and the instructions of Markant.
V. Storage Period
We store your data for as long as it is needed for the respective processing purpose. In doing so, we observe legally prescribed retention periods. If there are no further retention obligations, the data is routinely anonymised or deleted after the purpose has been achieved or no longer applies. In addition, the information on the storage period provided in this data protection declaration in connection with the respective processing purposes shall apply.
Your data may also be retained by Markant's clients who are required to comply with the Supply Chain Due Diligence Act. Under the Supply Chain Due Diligence Act, documentation of compliance must be retained for at least seven years.
VI. Your Rights
First of all, we would like to inform you at this point about your rights as a data subject according to art. 15-22 GDPR. These include:
- the right of access (art. 15 GDPR)
- the right to rectification (art. 16 GDPR)
- the right to erasure or the right to be «forgotten» (art. 17 GSPR)
- the right to restriction of processing (art. 18 GDPR)
- the right to data portability (art. 20 GDPR)
- the right to object (art. 21 GDPR)
In connection with the right of objection, please note the following information:
In the case of data processing for the purpose of safeguarding our legitimate interests, you may object to this processing at any time on grounds relating to your particular situation. We will then no longer process your personal data unless we can demonstrate compelling legitimate reasons for the processing which override your interests, rights and freedoms, or the processing serves the assertion, exercise or defence of legal claims (art. 21(1) GDPR).
You may object to the processing of personal data for direct marketing purposes at any time (art. 21(2) GDPR).
If the data processing is based on your consent, you can revoke your consent with effect for the future at any time.
To exercise your rights as a data subject, you can contact datenschutz@markant.com or the address mentioned in I. above.
You also have the right to complain to a data protection supervisory authority.