Data protection at TÜV SÜD Akademie GmbH

Your rights as data subject
If you have any questions about the processing of your personal data by us, we will of course be happy to provide you with information about the data concerning you (Art. 15 GDPR). In addition, if the legal requirements according to the GDPR are met, you have the
right to correction (Art. 16 GDPR), restriction of processing (Art. 18 GDPR), objection to processing (Art. 21 GDPR) and the right to data transferability (Art. 20 GDPR). Finally, you have the right to complain to a competent data protection supervisory authority (Art. 77 GDPR, Section 19 Federal Data Protection Act).

Your right of objection
If you wish to revoke a granted consent or object to the processing of your personal data for advertising purposes or due to your special situation, a short message to our data protection officer by e-mail to [email protected] or by post to TÜV SÜD Business Services GmbH, AKD Datenschutz, Westendstr. 199, 80686 Munich is sufficient at any time.

We process your data for the purpose of providing services in connection with the execution of the respective legal transaction and for invoicing (Art. 6 section 1 b DSGVO, Art. 6 section 1 f DSGVO). In addition, we process your personal data in order to inform you by post about products, services and specialist events for training and further education and personal certification as well as due examinations from these areas and for customer analyses (Art. 6 section 1 f DSGVO).

With your consent, which can be revoked at any time, we will also inform you about these topics by e-mail (§7 section 2 no. 3 UWG, Art. 6 section 1 a GDPR). We also inform our business customers about this by telephone (§ 7 section 2 no. 2 UC).

In individual cases, your personal data is transmitted to licensing and examination bodies (e.g. public authorities, accreditation bodies, Federal Employment Agency) as part of examinations conducted by TÜV SÜD Akademie GmbH.
For bookings / purchases in the TÜV SÜD Business Assurance Store - depending on the product – personal contact details may be transmitted to the TÜV SÜD company providing the service.

We use service providers by way of order processing in the provision of services within the EU, in particular for the provision, maintenance and servicing of IT systems.

We store your contract data and the associated documents for 10 years after termination of the business relationship (§ 147 section 3 General Fiscal Law), other trade and business letters for 6 years (§ 257 section 4 German Commercial Code), unless other legal provisions or regulations apply.

When conducting online training courses or digital events in which you participate, the information above under 2. Privacy policy according to Art. 13 and Art. 14 GDPR for customers and seminar participants (open, in-house and online) also applies in addition to the information below. Such events are generally not recorded.

The processed data is your registration data (surname, first name, email address) from the event. If you activate the camera and / or the microphone of your device, we also process the transmitted data. If you take part in chats, whiteboards or voting, this data will also be processed.

The legal basis for the processing of data from participants in events is Art. 6 section 1 b GDPR (contract for the implementation of the event), Art. 6 section 1 f GDPR (legitimate interest of the person responsible to provide his service to third parties such as the employer of participants) and Art. 6 section 1 c GDPR (legal obligations, in particular tax and commercial regulations). The legal basis for possible data processing in third countries when using Microsoft Teams is your consent (Art. 6 section 1 a GDPR). In the USA there is no data protection level comparable to the requirements of the GDPR. It is possible for government agencies to access personal data without us or you knowing about it. An effective enforcement of your rights is probably not possible in the USA.
By joining the online event, the participant consents to the processing of his or her personal data.

We use processors (service providers) in particular for the provision, maintenance and care of IT systems.

We store your contract data and the associated documents for 10 years after termination of the business relationship (§ 147 section 3 General Fiscal Law), other trade and business letters for 6 years (§ 257 section 4 German Commercial Code), unless other legal provisions or regulations apply.

The specification of the registration data is contractually binding for the participation in digital events.

We process your personal data for the purposes of trainer accreditation and trainer management as part of the implementation of contractual or pre-contractual measures (Art. 6(1b) GDPR, Art. 6(1f) GDPR).

Further we process your data to inform you by mail about products, services, subject specific events and due examinations regarding training, professional development and personnel certification as well as for customer analysis purposes (Art. 6(1f) GDPR).

With your consent, which is revocable at any time, we additionally inform you about this topics via email (section 7 (2.3) of the Law against unfair Competition [UWG], Art. 6(1a) GDPR). Our business clients are additionally informed by telephone (section 7 (2.2) of the Law against unfair Competition [UWG]).

If you order products or services from us, or when you attend subject specific events organised by us, our service providers and we will process your personal data in order to carry out the respective transaction and for the purposes of invoicing (Article 6 (1b) GDPR).

In individual cases, as part of checks carried out by TÜV SÜD Akademie GmbH, your personal data will be passed on to accreditation and review bodies (e.g. authorities, accreditation bodies, German Federal Labour Office).
We use processors (service providers) in particular for the provision, maintenance and care of IT systems.

Personal data is not transfered to third countries.

We will store your contract data and any related documents for a period of 10 years (section 147 (3) of the German General Tax Code [AO]) and other trade and business correspondence for a period of 6 years (section 257 (4) of the German Commercial Code [HGB]), unless there are other statutory provisions or regulations that apply.

When conducting online training courses or digital events, the following information also applies:

The processed data is your registration data (last name, first name, email address) from the event. If you activate the camera and / or the microphone of your device, we also process the transmitted data transmitted. If you take part in chats, whiteboards or voting, this data will also be processed. Such events are generally not recorded.

We process the personal data of interested parties and communication partners for the purpose of communicating with those affected. There are no plans to change these purposes.

The legal basis for the processing of data from interested parties and communication partners is Art. 6 section 1 f GDPR (legitimate interest of the person responsible to contact interested parties and communication partners).

We use processors (service providers) in particular for the provision, maintenance and care of IT systems.

Inquiries and communications are automatically deleted after two calendar years.

We are represented on several social media platforms with a company page. We would like to offer further possibilities to inform about our company and for interaction.

If you visit or interact with a profile on a social media platform, personal data about you may be processed. The information associated with a social media profile used also regularly represents personal data. This also includes messages and statements made using the profile. In addition, certain information is often automatically collected during your visit to a social media profile, which can also represent personal data.

Facebook
When you visit our Facebook page, through which we present our company or individual products, certain information about you is processed. Facebook Ireland Ltd (Ireland / EU - “Facebook”) is solely responsible for this processing of personal data. Further information on the processing of personal data by Facebook is available at https://www.facebook.com/privacy/explanation.

Facebook offers the possibility to object to certain data processing; Related information and opt-out options can be found at https://www.facebook.com/settings?tab=ads.

Facebook provides us with statistics and insights for our Facebook page in anonymised form, by which we obtain information about the types of actions that people take on our page (so-called "page insights"). These page insights are created on the basis of certain information about people who have visited our site. This processing of personal data is carried out by Facebook and us as Joint controllers according to GDPR. The processing serves our legitimate interest in evaluating the types of actions taken on our site and improving our site based on this knowledge. The legal basis for this processing is Art. 6 Para. 1 lit.f GDPR. We cannot assign the information obtained via the page insights to individual Facebook profiles that interact with our Facebook page.
We have an agreement with Facebook about processing as Joint controllers, in which the distribution of data protection obligations between us and Facebook is specified. For details about the processing of personal data for the creation of page insights and the agreement concluded between us and Facebook, please visit https://www.facebook.com/legal/terms/information_about_page_insights_data.

With regard to this data processing, you have the opportunity to assert your rights as a data subject (see “Your rights”) against Facebook. Further information can be found in Facebook's data protection declaration at https://www.facebook.com/privacy/explanation.

Please note that in accordance with Facebook's data protection regulations, user data is also processed in the USA or other third countries. Facebook only transfers user data to countries for which the European Commission has issued an adequacy decision in according to Art. 45 GDPR or on the basis of appropriate safeguards under Art. 46 GDPR.

TÜV SÜD Akademie GmbH uses plugins from the social network facebook.com, which is operated by Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA (“Facebook”). Communication tools from the social network Facebook may also be used on this website, in particular the website Custom Audiences product. This product generates a non-reversible, non-personal checksum (hash value) from your usage data, which can be transmitted to Facebook for analysis and marketing purposes. With Facebook Custom Audience, we can show you targeted advertising content via Facebook if you use Facebook. To do this, we compare your email address with Facebook Ireland Limited, encrypted as a hash value. If there is a match - i.e. if you use Facebook with the same email address - you will be shown advertising on Facebook in order to provide you with the best possible user experience. Facebook Ireland Limited transmits your hashed email address to Facebook, Inc. in the USA. Facebook stores your email address for a maximum of 180 days. Further information is available here: www.facebook.com/about/privacy/ and www.facebook.com/business/a/custom-audiences. You can find out how you can object to the processing of your personal data here: www.facebook.com/ads/preferences/?entry_product=ad_settings_screen.
In addition, the Facebook Retargeting service from Facebook Ireland Limited Hanover Reach, 5-7 Hanover Quay, Dublin 2 Ireland is used to target users of our website with advertising on our partner's website. This is done using cookies and analyzing user behavior.
For more information about the purpose and scope of the data collection and the further processing and use of the data by Facebook as well as your setting options to protect your privacy, please refer to the Facebook data protection guidelines, which can be found at www.facebook.com/ads/website_custom_audiences/ and www.facebook.com/privacy/ explanation can be found. If you would like to object to the use of Facebook Website Custom Audiences, you can do so at www.facebook.com/ads/website_custom_audiences.


Xing
New Work SE (Germany / EU) is controller for the processing of personal data when you visit our XING profile. Further information on the processing of personal data by New Work SE is available at https://privacy.xing.com/de/datenschutzerklaerung.

We process your personal data for the purpose of performing online exams on the online platform ‚TÜV SÜD CertBay‘ as part of the implementation of contractual or pre-contractual measures (Art. 6 Paragraph 1 b GDPR, Art. 6 Paragraph 1 f GDPR).

We use cookies on the “TÜV SÜD CertBay” online platform. A cookie is a small data package (text file) that your browser saves on your device when instructed by a website you visit in order to “remember” information. These cookies are set by us and are referred to as first-party cookies. In the case of CertBay, these are so-called session cookies (a random string consisting of numbers and letters).
These cookies are necessary for the website to function and cannot be deactivated in your systems. As a rule, these cookies are only set in response to actions you have taken that correspond to a service request, such as setting your data protection settings, logging in or filling out forms. You can set your browser to block these cookies or to notify you about these cookies. However, some areas of the website will not work after being excluded. These cookies do not save any personal data.
Other cookies for the purposes of performance analytics or marketing are not used.

In individual cases, your personal data will be transmitted to approval and testing bodies (e.g. authorities, accreditation bodies, Federal Employment Agency) as part of tests by TÜV SÜD Akademie GmbH.
We use service providers for the provision of services by way of order processing, in particular for the provision, maintenance and care of IT systems.

A transfer of your personal data to third countries does not take place.
Exceptions are data from participants and clients who are based in third countries.

If the data are no longer required for the fulfillment of contractual or legal obligations and rights, they are regularly deleted, i. d. Usually after 10 years, unless their - limited - further processing is necessary for the fulfillment of the purposes out of an overriding legitimate interest.

Online surveys by TÜV SÜD Akademie GmbH are always anonymous, i. e. without personal reference. Exceptions are voluntary information provided by the participants, which allows personal reference (e.g. personal data such as naming in free text fields).

In the context of online surveys, personal data is processed by the service provider Microsoft using the Microsoft Forms application. Please note that this privacy information only informs you about the processing of your personal data by TÜV SÜD Akademie GmbH. If you require information about the processing by Microsoft, please refer to the relevant statement.

Microsoft Privacy Statement: https://privacy.microsoft.com/de-de/privacystatement

The legal basis for possible data processing in third countries when using Microsoft Forms is your consent (Art. 6 section 1 a GDPR). In the USA there is no data protection level comparable to the requirements of the GDPR. It is possible for government agencies to access personal data without us or you knowing about it. An effective enforcement of your rights is probably not possible in the USA.
By joining the online survey, the participant consents to the processing of his or her personal data.

We use processors (service providers) in particular for the provision, maintenance and care of IT systems.