V. Recipients

Internal recipients:
Access to your personal data is restricted, to the extent needed, to those persons at Kloeckner who require such access in order to fulfill the purposes mentioned above.

External recipients:
We pass on your personal data to external recipients only if it is necessary to do so in order to process and respond to your inquiries and orders, it is expressly allowed by law or you have given us your consent to doing so.
External recipients may be the following:

a) Processors
Kloeckner Group companies or external service providers that we use to provide services, such as in connection with technical infrastructure and maintenance and with the provision of content under contract.

b) Public bodies
Public authorities and government institutions, such as prosecutors, courts or tax authorities, to which we are under a binding obligation to disclose personal data by law.
c) Other recipients
We pass on your personal data to other recipients only if it is necessary for contract fulfillment, you have given your consent or it is expressly allowed by law. Other recipients may notably include Group companies, payment service providers, credit reporting agencies, banks, debt collection agencies or special-purpose entities and service providers (ABS).

VI. Transfer of personal data outside of the EU

Where applicable, we also transfer personal data processed in connection with the processes described above to recipients who are domiciled, or who process your personal data, outside the territory of the European Union/the European Economic Area. If the European Commission has not adopted an adequacy decision for the countries concerned, we ensure adequate protection of your personal data with the recipients by means of appropriate safeguards as stipulated in the GDPR. You can request a copy of the safeguards from us (see heading I for contact details).

VII. Your rights

Your rights as a data subject under the General Data Protection Regulation (GDPR) – subject to the applicable legal requirements being met – are as follows:

You have the right of access to personal data concerning you that we process.

You have the right to obtain rectification of your personal data. You also have the right to have incomplete personal data completed.

In certain instances, you have the right to obtain erasure of your personal data.

Restriction of processing:
In certain instances, you have the right to have us restrict the processing of your personal data.

Data portability:
If you have provided us with data on the basis of a contract or consent, you have the right to receive the data you have provided in a structured, commonly used and machine-readable format or to have us transmit it to another controller.

Revocation of consent:
If you have given us consent to the processing of your data, you can revoke it at any time with effect for the future. This does not affect the lawfulness of the processing of your data prior to the revocation.

Right to object
Right to object in individual cases:

Where we process your personal data on the basis of our legitimate interests pursuant to Article 6(1)(f) of the GDPR, you have the right at any time to object to processing of your personal data, on grounds relating to your particular situation; this includes profiling based on those provisions. We will then no longer process the personal data for the stated purposes unless we can demonstrate compelling legitimate grounds for processing that override your interests, rights and freedoms, or the processing is for the purpose of establishing, exercising or defending legal claims.

Right to object to processing of data for direct marketing purposes:
You have the right to object at any time to the processing of your personal data for direct marketing purposes. If you object to processing, your personal data will no longer be processed for those purposes. This includes profiling to the extent that it is related to such direct marketing.

Exercising your rights:
To exercise any or all of your rights as described above, please contact your customer service representative or contact us using the contact details provided under heading I above. Alternatively, you can also contact the Data Protection Officer (see heading II for contact details). Please make sure that we can clearly identify you.

Right to lodge a complaint with a supervisory authority:
You have the right to lodge a complaint with a supervisory authority – in particular, in the Member State of your habitual residence, place of work or place of the alleged infringement – if you consider that the processing of personal data concerning you is unlawful.

As of January 2022