Information pursuant to Art. 13 and Art. 21 of the General Data Protection Regulation (GDPR)

Dear stakeholders, customers, and vendors,
We are informing you below in accordance with Art. 13 of the GDPR about the processing of your data and your rights arising from data protection legislation.

Who is responsible for data processing and who can you turn to?
CAS Software AG, CAS-Weg 1-5, 76131 Karlsruhe, Germany
You can contact our data protection officer at:
Thomas Heimhalt, DATENSCHUTZ perfect e.K.

Why do we process the data and on what legal basis?
Data is processed in the context of a pre-contractual measure or for the purpose of concluding and executing a contract. The processing of your data is necessary according to Art. 6 par. 1 b) of the GDPR to enable us to carry out the pre-contractual measure or to conclude and fulfill the contract with you. Furthermore, the processing of data is necessary according to Art. 6 par. 1 f) of the GDPR to protect our legitimate interests. Our legitimate interests relate to the fulfillment of mutual obligations arising from the contract between us and you. If you have given us your consent to do so, data is also processed for advertising and marketing purposes. You are entitled to reject the use for advertising and marketing purposes at any time.

What types of data do we process?
We process the following categories of data in particular: master data (e.g. name, address), communication data (e.g. telephone num-ber, e-mail address), contractual data (e.g. start and end of contract), receivables data, any relevant payment information (e.g. bank de-tails, outstanding receivables)

To whom do we pass your data?
Within CAS Software AG and its affiliated companies, your data is shared with those offices that require it to fulfill our obligations. Insofar as it is necessary for us to do so to execute the contract, we will pass your data to credit agencies, other service providers, attor-neys, and, where applicable, courts, debt collection agencies and court bailiffs.

Will data be transmitted to a third country or to an international organization?
Your data is not normally transmitted to a country outside of the EU. If service providers in a third country are used to carry out pro-cessing on our behalf, these providers are obligated to maintain the same data protection standards as the EU.

For how long do we store your data?
Following the expiry of the respective contract between us and you, we will check after three years whether we still need your data and whether its deletion contradicts any legal retention obligations.

Am I obliged to provide data?
The processing of the collected data is necessary for the conclusion and execution of the contract between us and you. If we are not permitted to process the data, we are unable to fulfill our contrac-tual obligations to you. If you decide to reject the processing of data, we would be forced to terminate the contract. This does not apply if you only reject processing for advertising and marketing purposes.
What data protection rights do you have?
Subject to the relevant legal conditions, you have the following rights in accordance with Art. 15 to 22 of the GDPR:
The right to information, rectification, deletion, restriction of pro-cessing, and data portability. In accordance with Art. 13 par. 2 b) in conjunction with Art. 21 of the GDPR, you also have a right to object to processing based on Art. 6 par. 1 f) of the GDPR.
According to Art. 77 of the GDPR, you have the right to lodge a complaint with a supervisory authority if you believe that the pro-cessing of your data is unlawful.
The address of the supervisory authority with responsibility for our company is:
Der Landesbeauftragte für den Datenschutz
und die Informationsfreiheit Baden-Württemberg
Postfach 10 29 32, 70025 Stuttgart, Germany
Lautenschlagerstraße 20, 70173 Stuttgart
Tel.: +49 (0)711/61 55 41 – 0 | Fax: +49 (0)711/61 55 41 – 15

Information about your right to object according to Art. 21 of the GDPR:
For reasons that arise from your particular situation, you have the right to object at any time to the processing of your personal data due to Art. 6 Par. 1 f) of the GDPR (data processing based on the weighing of interests). If you submit an objection, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for such processing which override your interests, or if processing serves the establishment or defense of legal claims. You have the right to object at any time to the processing of your personal data for advertising purposes. If you object to the pro-cessing for advertising purposes, we will no longer process your personal data for these purposes.
The objection may be submitted in any form to the following ad-dresses:
Tel.: +49 (0)721 9638-0
Fax.: +49 (0)721 9638-299