Data protection declaration

Art. 12, 13 ff. EU GDPR for visitors of our website

1. Name and address of the person responsible

Your contact person as the person responsible within the meaning of the European General Data Protection Regulation (“EU GDPR”) and other data protection regulations of other national EU member states is:

GAS German Aviation Service GmbH
Managing director: Andreas Becker
Cologne / Bonn Airport
P.O. Box 980 146
51147 Cologne

(hereinafter referred to as “we”, “us” or “our”)

2. Name and address of the data protection officer

Collegium Auditores GmbH
Wilhelmstrasse 74
53721 Siegburg

Please contact our data protection officer at Collegium Auditores directly if you have any questions about data protection and data security:

Email: datenschutz@collegium-auditores.de

3. Provision of the website and creation of log files

a. Legal basis

The legal basis for the processing of usage data in connection with the provision of the website and the creation of log files is Article 6 (1) (f) EU GDPR.

b. purpose

Each time you access our website, your web browser transfers usage data. These include your IP address and a description of the content accessed (URL). Without collecting the IP address of the accessing computer and the name of the accessed file, it is impossible to establish a connection to the server and to use the corresponding website. In addition, depending on the configuration, your browser transmits additional data (browser type, browser version, operating system used, referrer URL).
When you call up our website, your IP address is used by us – as when you call up any other website on the network – for the pure page structure, i.e., the technical connection to display our content. This is necessary to establish a connection between your computer and our website.

Our legitimate interest in data processing in accordance with Article 6 (1) (f) EU GDPR also lies in these purposes.

c. Storage period

Your personal data will be deleted as soon as they are no longer required to achieve the purpose for which they were collected. If your usage data is recorded for the provision of the website, this is the case as soon as the respective session has ended.

d. Object and erasure option

This data is technically necessary for us to display our website to you and to guarantee stability and security. There is consequently no option for you to object.

4. Use of technically necessary cookies

a. Legal basis

The legal basis for processing your usage data in the context of the use of technically necessary cookies is Article 6 (1) (f) EU GDPR.

b. purpose

The use of technically necessary cookies serves to simplify the use of our website for you. Some functions of our website cannot be offered without the use of cookies. For this it is necessary that your internet browser is recognized even after changing pages. The usage data collected by technically necessary cookies are not used to create user profiles.

c. Storage period

Your usage data will be deleted as soon as they are no longer required to achieve the purpose for which they were collected; this is especially the case when the cookies are deactivated.

d. Object and erasure option

Cookies are stored on your computer and transmitted from there to our website. You therefore have full control over the use of cookies. You can deactivate or restrict the transmission of cookies by changing the settings in your internet browser. You can delete cookies that have already been saved at any time. This can also be done automatically. If cookies are deactivated for our website, it is possible that not all functions of the website can be used in full.

The transmission of Flash cookies cannot be prevented via the settings of your Internet browser. This requires changes to the setting of the Adobe Flash Player.

5. Contact form and email contact

a. Legal basis

The legal basis for the processing of your personal data that is transmitted when you contact us is Article 6 (1) (f) EU GDPR. If the purpose of making contact is to conclude a contract, Article 6 (1) (b) EU GDPR is an additional legal basis for processing your personal data.

b. Purpose

The processing of your personal data when you contact us is used solely to process your request.

c. Storage period

Your personal data will be deleted as soon as they are no longer required to achieve the purpose for which they were collected. This is the case for the personal data sent as part of the establishment of contact if your request has been processed and statutory retention periods do not prevent deletion.

d. Object and erasure option

You have the option at any time to object to the processing of your personal data in the context of establishing contact for the future. In this case, however, we cannot process your request any further. In this case, all personal data stored in the course of contacting us will be deleted, unless statutory retention periods prevent deletion.

7. Google Analytics

a. Scope of processing

This website uses Google Analytics, the web analysis service of Google Inc. (hereinafter “Google”). Google Analytics uses so-called “cookies”, text suggestion files that are saved on your computer and that enable your use of the website to be analyzed. The information generated by the cookie about your use of this website is usually transferred to a Google server in the USA and stored there. If IP anonymization is activated on this website, your IP address will be shortened beforehand by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. The full IP address will only be transmitted to a Google server in the USA and shortened there in exceptional cases. On our behalf, Google will use this information to evaluate your use of the website, to compile reports on website activity and to provide us with other services relating to website activity and internet usage. The IP address transmitted by your internet browser as part of Google Analytics will not be merged with other Google data.

b. Legal basis

The legal basis for processing your personal data is Article 6 (1) (f) of the EU GDPR.

c. Purpose

The processing of your personal data enables us to analyze your usage behavior. By evaluating the data obtained, we are able to compile information about the use of the individual components of our website. This helps us to continuously improve our website and its user-friendliness. By anonymizing your IP address, your interest in the protection of personal data is adequately taken into account.

d. Storage period

Your personal data will be deleted as soon as they are no longer required for our aforementioned purposes.

e. Object and erasure option

If you do not want your data to be recorded by Google Analytics, do not tick the box in the “Statistics” cookiebot or you can install the browser add-on to deactivate Google Analytics. This add-on instructs the Google Analytics JavaScript (ga.js, analytics.js and dc.js) running on websites not to allow information to be sent to Google Analytics.

If you want to deactivate Google Analytics in this way, go to this page and install the add-on to deactivate Google Analytics for your internet browser. Detailed information on installing and uninstalling the add-on can be found in the relevant help resources for your Internet browser.

Browser and operating system updates can result in the deactivation add-on no longer working as intended. You can find more information about managing add-ons for Chrome here. If you do not use Chrome, you can find out directly from the manufacturer of your Internet browser whether add-ons work correctly in the browser version you are using.

The latest versions of Internet Explorer occasionally load the add-on to disable Google Analytics after data has been sent to Google Analytics. If you use Internet Explorer, the add-on will install cookies on your computer. These cookies ensure that any data collected is immediately deleted from the server that collected the data. Make sure that third-party cookies are not disabled for Internet Explorer. If you delete your cookies, these cookies will be reset by the add-on within a short time to ensure that your Google Analytics browser add-on continues to work without restriction.

The browser add-on for deactivating Google Analytics does not prevent data from being sent to the website or to other web analysis services.

For more information on terms of use and data protection, see

www.google.com/analytics/terms/de.html or under
support.google.com/analytics/answer/6004245.

IP anonymization is activated on this website.

8.   Use of Google and Adobe Fonts

a. Scope of processing

This website uses Google and Adobe Fonts, a service for providing fonts from Google Inc. (hereinafter “Google”) and Adobe Inc. (typekit.com, hereinafter “Adobe”). When you visit our website, your internet browser temporarily stores the required fonts in order to display the fonts that we use on our website in a uniform and appealing manner. For this purpose, the internet browser you are using must connect to the Google and Adobe servers in the USA. This gives Google or Adobe knowledge that our website has been accessed via your IP address. Your personal data will only be processed to display the fonts and will not be merged with other data from Google and Adobe.

b. Legal basis

The legal basis for processing your personal data is Article 6 (1) (f) of the EU GDPR.

c. Purpose

By using Google and Adobe Fonts, we can make our website more attractive for you and thus display our fonts uniformly, regardless of which device you access our website from.

d. Storage period

Your personal data will be deleted as soon as they are no longer required for our aforementioned purposes.

e. Object and erasure option

If you do not want your personal data to be recorded by Google Fonts or Adobe Fonts, you can make settings in your Internet browser (e.g., by installing plugins or add-ons) to prevent transmission to the Google servers. If your internet browser does not support Google or Adobe Fonts, the Google and Adobe servers will not be accessed and the text on our website will be displayed in the standard font of your system.

For more information on terms of use and data protection, see

developers.google.com/fonts/faq or under
www.google.com/intl/de-DE/privacy/
www.adobe.om/de/privay/policies/adobe-fonts.html

9. Facebook / Twitter / LinkedIN

The social links in the footer (Facebook, Twitter and LinkedIn) are pure links to the respective external pages. No short codes or interfaces are used by these platforms. It is a 1: 1 forwarding (external link). This means that we do not use a tracking code and therefore also no Facebook pixel. or similar.

11. Direct Marketing

(1) Legal basis

The legal basis for the processing of your personal data in the context of direct marketing measures is either the consent you have given in accordance with Article 6 (1) (a) of the EU GDPR or the legal permission under Article 6 (1) (f) of the EU GDPR or § 7 para. 3 UWG.

(2) Purpose

The purpose of processing your personal data in the context of direct marketing measures is to send information, offers and, if necessary, to promote sales through the sale of goods or services. This applies to your inquiries – handling requests via: www.germanaviation.com/handling-request, fuel requests via: www.germanaviation.com/fuel-request and your contact requests via www.germanaviation.com/kontakt and www.germanaviation.com/ contact

(3) Storage period

Your personal data will be deleted as soon as they are no longer required to achieve the purpose for which they were collected; this is particularly the case with receipt of the revocation or the objection.

(4) Object and erasure option

You can revoke your consent at any time for the future or object to the processing of your personal data in the context of direct marketing measures at any time for the future.
12. Data concerned according to Art. 12 ff. EU-GDPR

a. Legal basis

The legal basis for the processing of your personal data in the context of processing your data protection request (“data subject input”) is Article 6 (1) c in conjunction with Article 12 ff. EU GDPR. The legal basis for the subsequent documentation of the legally compliant processing of data subjects is Article 6 (1) (f) EU GDPR.

b. Purpose

The purpose of processing your personal data as part of the processing of data subject is to answer your data protection request. The subsequent documentation of the legally compliant processing of the respective data subject’s input serves to fulfill the legally required obligation to provide evidence, Art. 5 Para. 2 EU-GDPR.

c. Storage period

Your personal data will be deleted as soon as they are no longer required to achieve the purpose for which they were collected. In the case of the processing of data subjects, this is given in accordance with § 41 BDSG in conjunction with § 31 Paragraph 2 No. 1 OWiG three years after the end of the respective process.

d. Object and erasure option

You have the option at any time to object to the processing of your personal data as part of the processing of data subject for the future. In this case, however, we cannot process your data protection request any further.

The documentation of the legally compliant processing of the respective data subject is mandatory. There is consequently no option for you to object.
13. Legal Defense and Law Enforcement

a. Legal basis

The legal basis for the processing of your personal data in the context of legal defense and enforcement is Article 9 Paragraph 2 f lit. 6 Para. 1 lit. f EU GDPR.

b. Purpose

The purpose of processing your personal data in the context of legal defense and enforcement is the defense against unauthorized claims as well as the legal enforcement and assertion of claims and rights.

c. Storage period

Your personal data will be deleted as soon as they are no longer required to achieve the purpose for which they were collected.

d. Object and erasure option

The processing of your personal data in the context of legal defense and enforcement is essential for legal defense and enforcement. There is consequently no option for you to object.

14. Recipient categories

Within our company, those positions and departments receive personal data that need it to fulfill the aforementioned purposes. In addition, we sometimes use different service providers and transmit your personal data to other trustworthy recipients. These can be, for example:

– banks
– Scan service
– printing houses
– Letter shops
– IT service providers
– Lawyers and courts

15. Rights of the data subject

If your personal data is processed by us, you are the data subject within the meaning of the EU GDPR and you have the following rights towards us:

a. Right to information

You have the right to information as to whether and which personal data are processed by us. In this case we will also inform you about

(1) the purpose of the processing.
(2) the data categories.
(3) the recipients of your personal data.
(4) the planned storage period or the criteria for the planned storage period.
(5) your other rights.
(7) If you have not provided us with your personal data: All available information about its origin.
(8) if available: the existence of automated decision-making as well as information about the logic involved, the scope and the intended effects of the processing.

b. Right to rectification

You have a right to correction and / or completion if your personal data processed by us is incorrect or incomplete.

c. Right to restriction of processing

You have the right to restrict processing, provided that

(1) We check the accuracy of your personal data processed by us.
(2) the processing of your personal data is unlawful.
(3) You need your personal data processed by us after it is no longer intended for legal prosecution.
(4) You have lodged an objection to the processing of your personal data, and we are examining this objection.

d. Right to erasure

You have a right to deletion, provided

(1) we no longer need your personal data for its original purpose.
(2) you withdraw your consent and there is no further legal basis for the processing of your personal data.
(3) you object to the processing of your personal data and – unless it is a matter of direct marketing – there are no overriding reasons for further processing.
(4) the processing of your personal data is unlawful.
(5) the deletion of your personal data is required by law.
(6) Your personal data was collected as a minor for information society services.

e. Right to be informed

If you have asserted your right to correction, deletion, or restriction of processing, we will notify all recipients of your personal data of this correction, deletion of the data or restriction of processing.

f. Right to data portability

You have the right to receive your personal data processed by us on the basis of your consent or for the execution of the contract in a structured, common and machine-readable format and to transmit it to another person responsible. If this is technically feasible, you have the right that we transfer this data directly to another person responsible.

G. Right to object

In the case of special reasons, you have the right to object to the processing of your personal data. In this case, we will no longer process your personal data unless we can prove compelling legitimate reasons for the processing.

If your personal data is processed for the purpose of direct marketing, you have the right to object at any time

H. Right to withdraw

You have the right to revoke your consent at any time. Withdrawing your consent does not affect the legality of the processing carried out on the basis of your consent up to the point of withdrawal.

i. Right to complain to a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority if you are of the opinion that the processing of your personal data by us violates the EU GDPR.

The responsible supervisory authority for us is:

State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia
Kavalleriestr. 2-4
40213 Düsseldorf
Phone: 0211 / 38424-0
Fax: 0211 / 38424-10
Email: poststelle@ldi.nrw.de

The supervisory authority to which you have lodged a complaint will inform you of the status and the results of the complaint, including the possibility of a judicial remedy in accordance with Art. 78 EU GDPR.

Our data protection officer will be happy to answer any questions you may have at any time.

Information requirements according to Art. 12, 13 ff. EU-DSGVO for applicants and candidates (m/f/d)

Dear Lady, Dear Sir,
Dear Applicant, Dear Candidate,
Due to the legal regulations of the European General Data Protection Regulation (“EU-DSGVO”), we are obliged to provide you with comprehensive information about the processing of your personal data in the context of your application procedure, which we are more than happy to do.

Data protection and the handling of your personal data is very important to us, so we always ensure that your personal data is processed properly.

If you have any questions about your applicant data and its processing, our data protection officer will be happy to answer them at any time. He or she is not subject to any instructions, is independent in his or her position and is legally obligated to maintain secrecy and confidentiality, so that you can contact him or her with confidence.

Regarding the processing of your personal data in the context of your application procedure, we inform you of the following:

1. Name and address of the person responsible

Your contact person as the responsible party within the meaning of the European Data Protection Regulation (“EU-DSGVO”) and other national data protection laws of the member states as well as other data protection regulations is:

GAS German Aviation Service GmbH
Managing Director: Andreas Becker
Cologne/Bonn Airport
PO Box 980 146
51147 Cologne

(hereinafter referred to as “we”, “us” or “our”)

2. name and address of the data protection officer

Collegium Auditores GmbH
Wilhelmstr. 74
53721 Siegburg

Please contact our Collegium Auditores data protection officer directly with any questions you may have regarding data protection and data security at our company:

E-mail: datenschutz@collegium-auditores.de

3. General information on data processing
We process your personal data only to the extent necessary to establish the employment relationship. Further processing of your personal data is regularly only carried out if we have your prior consent to do so. An exception applies in those cases where it is not possible to obtain prior consent for justifiable reasons or where the processing of your personal data is permitted by law.
4. Data processing in the context of the application procedure
a. Legal basis for data processing
The legal basis for the processing of your personal data in the context of the application procedure is Section 26 (1) sentence 1, (3) BDSG.
If we have your consent to process your personal data, Section 26 (2) BDSG serves as our legal basis.
If the processing of your personal data is necessary for the fulfillment of a legal obligation to which we are subject, Art. 6 para. 1 lit. c EU-DSGVO serves as our legal basis.
If processing is necessary to protect a legitimate interest of us or a third party and your interests, fundamental rights and freedoms do not override the former interest, Art. 6 (1) lit. f EU-DSGVO serves us as the legal basis for the processing.
The legal basis for the processing of special categories of personal data, within the meaning of Article 9 (1) EU-DSGVO, is Section 26 (3) BDSG.
b. Purposes of data processing
The processing of your personal data is carried out for the purpose of establishing the employment relationship, in particular for the fulfillment of employment contractual, legal, and, if present, collective contractual and social security obligations arising therefrom.
c. Storage period
Your personal data will be deleted or blocked as soon as the purpose of storage no longer applies. Storage may also take place if this has been provided for by the European or national legislator in Union regulations, laws, or other provisions to which we are subject. Data will also be blocked or deleted if a storage period prescribed by the aforementioned standards expires, unless there is a need to continue storing the data for the conclusion or performance of a contract.
Thereafter, we store your personal data for the following periods, among others:
– Application documents, -data, after decision on non-occupation, up to 6 months.
– Application documents otherwise: In the event of dissolution, termination of the employment relationship.

d. Object and erasure option
The processing of your personal data as part of the application process is mandatory for the establishment of the employment relationship. Consequently, there is no possibility for you to object.
If the processing of your personal data is based on consent, you have the option to revoke your consent at any time.

5. Data processing in the context of a direct approach via social networks such as Xing and LinkedIn
a. Legal basis for data processing
The legal basis for processing your personal data from publicly available sources, from professional networks such as Xing or LinkedIn, is Art. 6 (1) lit f EU-DSGVO.
b. Purposes of the data processing
The processing of your personal data from publicly available sources, from professional networks such as Xing or LinkedIn, serves the purpose of finding suitable candidates for possible open job positions and, as a result, establishing an employment relationship with them.
c. Storage period
Your personal data will be deleted or blocked as soon as the purpose of storage ceases to apply. In the case of a direct approach via professional networks such as Xing or LinkedIn and the associated processing of your personal data, this is the case if the position is not filled, and no employment relationship is established with you after the direct approach. Storage may also take place if this has been provided for by the European or national legislator in Union regulations, laws, or other regulations to which we are subject. Data will also be blocked or deleted if a storage period prescribed by the aforementioned standards expires, unless there is a need to continue storing the data for the conclusion or performance of a contract.
d. Object and erasure option
You have the option to object to the processing of your personal data at any time. In this case, your personal data will be deleted.

6. Data subject input according to Art. 12 ff. EU-DSGVO
a. Legal basis
The legal basis for the processing of your personal data in the context of handling your data protection request (“data subject input”) is Art. 6 para. 1 lit. c in conjunction with. Art. 12 et seq. EU-DSGVO. The legal basis for the subsequent documentation of the lawful processing of data subject input is Art. 6 para. 1 lit. f EU-DSGVO.

b. Purpose
The purpose of processing your personal data in the context of processing data subject input is to respond to your data protection request. The subsequent documentation of the legally compliant processing of the respective data subject input serves to fulfill the legally required obligation to provide evidence, Art. 5 (2) EU-DSGVO.

c. Storage period
Your personal data will be deleted as soon as they are no longer required to achieve the purpose for which they were collected. In the case of the processing of data subject submissions, this is three years after the end of the respective process in accordance with § 41 BDSG in conjunction with § 31 para. 2 no. 1 OWiG.

d. Object and erasure option
You have the option at any time to object to the processing of your personal data in the context of the processing of data subject submissions for the future. In this case, however, we will not be able to further process your data protection request.

The documentation of the legally compliant processing of the respective data subject input is mandatory. Consequently, there is no possibility for you to object.

6. Legal defense and enforcement of rights

a. Legal basis

The legal basis for the processing of your personal data in the context of legal defense and enforcement is Art. 9 para. 2 f lit. f; 6 paras. 1 lit. f EU-DSGVO.

b. Purpose

The purpose of processing your personal data in the context of legal defense and enforcement is the defense against unjustified claims and the legal enforcement and assertion of claims and rights.

c. Storage period

Your personal data will be deleted as soon as they are no longer required to achieve the purpose for which they were collected.

d. Object and erasure option

The processing of your personal data in the context of legal defense and enforcement is mandatory for legal defense and enforcement. Consequently, there is no possibility for you to object.

7. Categories of recipients

Within our company, those offices and departments receive personal data that need it to fulfill the aforementioned purposes. The recipients in our company may be, for example:

– Human Resources Department
– Possible superiors
– Departments
– Financial accounting
– Works council
– Data Protection Officer
– Representative for severely disabled employees
– Equal Opportunity Officer
– Integration office in case of severe disability
– IT service provider
– Lawyers, courts, tax consultants
– Personnel service provider

8. Rights of the data subject

If your personal data is processed by us, you are a data subject within the meaning of Art. 4 (1) EU-DSGVO and you are entitled to the following rights against us:

a. Right to information

You have a right to information about whether and which of your personal data is processed by us. In this case, we will additionally inform you about.

(1) the purpose of processing.
(2) the categories of data.
(3) the recipients of your personal data.
(4) the planned storage period or the criteria for the planned storage period.
(5) your other rights.
(7) if we have not been provided with your personal data by you: Al-l available information about its origin.
(8) if available: the existence of automated decision-making and information about the logic involved, the scope and the intended effects of the processing.

b. Right to rectification

You have the right to rectification and/or completion if your personal data processed by us is inaccurate or incomplete.

c. Right to restriction of processing

You have a right to restriction of processing, provided that.

(1) we verify the accuracy of your personal data processed by us.
(2) the processing of your personal data is unlawful.
(3) you need your personal data processed by us for legal prosecution after the purpose has ceased to exist.
(4) you have objected to the processing of your personal data and we are reviewing this objection.

d. Right to erasure

You have a right to erasure if.

(1) we no longer need your personal data for its original purpose.
(2) you withdraw your consent and there is no further legal basis for processing your personal data.
(3) you object to the processing of your personal data and – unless it concerns direct marketing – there are no overriding reasons for further processing.
(4) the processing of your personal data is unlawful.
(5) the erasure of your personal data is required by law.
(6) your personal data was collected as a minor for Information Society services.

e. Right to information

If you have exercised your right to rectification, erasure, or restriction of processing, we will inform all recipients of your personal data of this rectification, erasure of data or restriction of processing.

f. Right to data portability

You have a right to receive your personal data processed by us on the basis of consent or for the performance of a contract in a structured, common and machine-readable format and to transfer it to another controller. If technically feasible, you have the right to have us transfer this data directly to another controller.

g. Right of objection

In case of special reasons, you have the right to object to the processing of your personal data. In this case, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing.

In the case of processing of your personal data for the purpose of direct marketing, you have the right to object at any time.

h. Right of revocation

You have the right to revoke any consent given to us at any time. The revocation of consent does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation.

i. Right to complain to a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data by us violates the EU GDPR.

The competent supervisory authority for us is:

State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia.
Kavalleriestr. 2-4
40213 Düsseldorf
Phone: 0211/38424-0
Fax: 0211/38424-10
E-mail: poststelle@ldi.nrw.de

The supervisory authority to which you have submitted a complaint will inform you about the status and outcome of the complaint, including the possibility of a judicial remedy pursuant to Article 78 EU-DSGVO.

If you have any questions, please do not hesitate to contact our data protection officer at any time. 

Information obligations pursuant to Art. 12, 13 et seq. EU-DSGVO for employees

Dear Sir,
Dear Sir,
Dear Employee

due to the legal regulations of the European Data Protection Regulation (“EU-DSGVO”), we are obliged to provide you with comprehensive information about the processing of your personal data within the scope of your employment, which we are very happy to do.

Data protection and the handling of your personal data is very important to us, so we always ensure that your personal data is processed properly.

If you have any questions about your employee data and its processing, our data protection officer will be happy to answer them at any time. He is not subject to any instructions, is independent in his position and is legally bound to maintain secrecy and confidentiality, so that you can contact him in confidence.

With regard to the processing of your personal data within the scope of your employment, we inform you of the following:

1. Name and address of the person responsible

Your contact person as the responsible person within the meaning of the European Data Protection Regulation (“EU GDPR”) and other national data protection laws of the member states as well as other data protection regulations is:

GAS German Aviation Service GmbH
Managing Director: Andreas Becker
Cologne/Bonn Airport
PO Box 980 146
51147 Cologne

(hereinafter referred to as “we”, “us” or “our”)

2. Name and address of the data protection officer

Collegium Auditores GmbH
Wilhelmstr. 74
53721 Siegburg

Please contact our Collegium Auditores data protection officer directly with any questions you may have regarding data protection and data security at our company:

E-mail: datenschutz@collegium-auditores.de

3 General information on data processing

As a matter of principle, we process your personal data only insofar as this is necessary for the establishment, implementation, and termination of the employment relationship. Further processing of your personal data will regularly only take place if we have your prior consent to do so. An exception applies in those cases in which obtaining prior consent is not possible for justifiable reasons or the processing of your personal data is permitted by law.

4. Data processing in the context of the employment relationship

a. Legal basis for data processing

1) Personal data

Insofar as we have your consent for the processing of personal data, we use Art. 6 para. 1 lit. a EU-DSGVO, Art. 88 para. 1 EU-DSGVO in conjunction with. § Section 26 (2) BDSG as the legal basis.

When processing personal data that is required for the establishment, implementation, or termination of the employment contract, we use Art. 6 para. 1 lit. b EU-DSGVO, Art. 88 para. 1 EU-DSGVO in conjunction with § 26 para. 1 BDSG. § Section 26 (1) BDSG, Section 611a BGB as the legal basis.

Insofar as the processing of personal data is necessary for the fulfillment of a legal obligation to which we are subject, Art. 6 para. 1 lit. c EU-DSGVO serves as our legal basis. We are subject to the following legal obligations, among others:

– § 28a SGB (Social Code) IV; §198 ff SGB V; § 190 ff., § 281c SGB VI DEÜV (Data Collection and Transmission Ordinance), to report to the authorities.
– Section 829 (2) sentence 1 ZPO (Code of Civil Procedure) with regard to salary garnishments
– § 16 para. 2 ArbZG (Working Hours Act) and § 7d para. 1 sentence 1 SGB IV (Social Code IV), for documentation of working time accounts
– §§ 16, 17 MiLoG (Minimum Wage Act), for the documentation of working time as well as for the fulfillment of the obligation to report to the authorities
– §§ 49, 50 JArbSchG (Youth Employment Protection Act), for the fulfillment of the duty to provide information and documentation to the authorities
– §§ 7, 17 b AÜG (Temporary Employment Act), for the fulfillment of documentation and information obligations vis-à-vis the authorities
– §§ 76, 88, 101 BBiG (Vocational Training Act), to fulfill the documentation and information obligations towards the authorities
– § 163 SGB IX (rehabilitation and participation of people with disabilities in working life) for the implementation of the cooperation between employer, employment agency and integration offices
– § 312 SGB III, for issuing the certificate of employment to the employment agency
– § 27 MuSchG, for the fulfillment of the notification and retention obligations vis-à-vis the authorities.

If the processing is necessary to protect a legitimate interest of us or a third party and your interests, fundamental rights and freedoms do not outweigh the first-mentioned interest, we use Art. 6 (1) lit. f EU-DSGVO as the legal basis for the processing.
2) Special categories of personal data

Insofar as we obtain your consent for the processing of special categories of personal data (Art. 9(1) EU GDPR), such as, among others, religious affiliation, nationality as well as health data, Art. 9(2)(a) EU GDPR serves as the legal basis.

If the processing of special categories of personal data is necessary to enable us to exercise the rights accruing to us under labor law and social security and social protection law and to fulfill our obligations in this regard, the legal basis for the processing follows from Art. 6 (1) lit. c EU-DSGVO, Art. 9 (2) lit. b EU-DSGVO, Art. 88 (1) EU-DSGVO in conjunction with. § 26 para. 3 BDSG. We are subject to the following legal obligations, among others:

– § 28a SGB (Social Code) IV; §198 ff SGB V; § 190 ff., § 281c SGB VI DEÜV (data collection and transmission ordinance), to report to the authorities
– Section 829 (2) sentence 1 ZPO (Code of Civil Procedure) with regard to salary garnishments
– § 16 para. 2 ArbZG (Working Hours Act) and § 7d para. 1 sentence 1 SGB IV (Social Code IV), for documentation of working time accounts
– §§ 16, 17 MiLoG (Minimum Wage Act), for the documentation of working time as well as for the fulfillment of the obligation to report to the authorities
– §§ 49, 50 JArbSchG (Youth Employment Protection Act), for the fulfillment of the duty to provide information and documentation to the authorities
– §§ 7, 17 b AÜG (Temporary Employment Act), for the fulfillment of documentation and information obligations vis-à-vis the authorities
– §§ 76, 88, 101 BBiG (Vocational Training Act), to fulfill the documentation and information obligations towards the authorities
– § 163 SGB IX (rehabilitation and participation of people with disabilities in working life) for the implementation of the cooperation between employer, employment agency and integration offices
– § 312 SGB III, for issuing the certificate of employment to the employment agency
– § 27 MuSchG, for the fulfillment of the notification and retention obligations vis-à-vis the authorities.

If the processing relates to special categories of personal data that have obviously been made public by you, the legal basis results from Art. 6 para. 1 lit. f EU-DSGVO, Art. 9 para. 2 lit. e EU-DSGVO, Art. 88 para. 1 EU-DSGVO in conjunction with. § Section 26 (1) BDSG.

If the processing of special categories of personal data is necessary for the purposes of preventive health care, occupational medicine or for the assessment of fitness for work, the legal basis follows from Art. 6 para. 1 lit. b EU-DSGVO, Art. 9 para. 2 lit. h EU-DSGVO, Art. 88 para. 1 EU-DSGVO in conjunction with. § Section 26 (1) BDSG.

b. Purposes of data processing

Your personal data is processed for the purpose of establishing, implementing and terminating the employment relationship, in particular for the fulfillment of contractual, legal, if applicable collective contractual, and social security obligations.

c. Storage period

Your personal data will be deleted or blocked as soon as the purpose of storage no longer applies. Data may also be stored if this has been provided for by the European or national legislator in Union regulations, laws or other provisions to which we are subject. Data will also be blocked or deleted if a storage period prescribed by the aforementioned standards expires, unless there is a need to continue storing the data for the conclusion or performance of a contract.

Thereafter, we store your data for the following periods, among others:

– Receipts for the payroll account for up to 10 years in accordance with § 147 Para. 1 No. 4,5 and Abs. 3 AO (German Fiscal Code); § 41 Abs. 1 S. 9 EStG (German Income Tax Act); § 257 Abs. 1 Nr. 1, 4 and § Section 238 (1) HGB (German Commercial Code)
– Warnings up to 2.5 years (according to case law)
– Application documents, data, after decision on non-occupation, up to 6 months, burden of proof of discrimination, deadline §§ 21 para. 5, 22 AGG (General Equal Treatment Act)
– Application documents otherwise: upon dissolution, termination of employment relationship
– Working time records 2 years according to § 16 para. 2 ArbZG (Working Time Act)
– Proof of working hours 2 years according to § 50 JArbSchG (Youth Employment Protection Act)
– Proof of working hours 2 years in accordance with § 17 Para. 1 MiLoG (Minimum Wage Act)
– Other proof of working hours 6 years, § 147 Para. 1 No. 5, Para. 3 AO
d. Object and erasure option

The processing of your personal data within the scope of the employment relationship is mandatory for the establishment, implementation and termination of the employment relationship. Consequently, there is no possibility for you to object.

If the processing of your personal data is based on consent, you have the option to revoke your consent at any time.

5. Data subject input according to Art. 12 ff. EU-DSGVO

a. Legal basis

The legal basis for the processing of your personal data in the context of handling your data protection request (“data subject input”) is Art. 6 para. 1 lit. c in conjunction with. Art. 12 et seq. EU-DSGVO. The legal basis for the subsequent documentation of the lawful processing of data subject input is Art. 6 para. 1 lit. f EU-DSGVO.

b. Purpose

The purpose of processing your personal data in the context of processing data subject submissions is to respond to your data protection-related inquiry. The subsequent documentation of the legally compliant processing of the respective data subject input serves to fulfill the legally required obligation to provide evidence, Art. 5 para. 2 EU-DSGVO.

c. Storage period

Your personal data will be deleted as soon as they are no longer required to achieve the purpose for which they were collected. In the case of the processing of data subject submissions, this is three years after the end of the respective process in accordance with § 41 BDSG in conjunction with § 31 para. 2 no. 1 OWiG.

d. Object and erasure option
You have the option at any time to object to the processing of your personal data in the context of the processing of data subject submissions for the future. In this case, however, we will not be able to further process your data protection request.

The documentation of the legally compliant processing of the respective data subject input is mandatory. Consequently, there is no possibility for you to object.

6. Legal defense and legal enforcement

a. Legal basis

The legal basis for the processing of your personal data in the context of legal defense and enforcement is Art. 9 para. 2 f lit. f; 6 paras. 1 lit. f EU-DSGVO.

b. Purpose

The purpose of processing your personal data in the context of legal defense and enforcement is the defense against unjustified claims and the legal enforcement and assertion of claims and rights.

c. Storage period

Your personal data will be deleted as soon as they are no longer required to achieve the purpose for which they were collected.

d. Object and erasure option
The processing of your personal data in the context of legal defense and enforcement is mandatory for legal defense and enforcement. Consequently, there is no possibility for you to object.
7. Categories of recipients

Within our company, those offices and departments receive personal data that need it to fulfill the aforementioned purposes. We transmit your data to interested customers and hirers in the context of employee leasing. In addition, we sometimes use different service providers and transfer your personal data to other recipients. The recipients both on our side and on the customer, hirer side can be, for example:

– Human resources department
– Supervisor of the employee concerned
– payroll accounting
– Financial accounting
– Works council
– Data Protection Officer
– Representative for severely disabled employees
– Equal opportunity representative
– Social insurance agencies: health insurance, doctors’ pension funds,
Pension insurance institutions
– employment agency
– Supervisory, occupational safety authorities
– Tax office
– Integration office in case of severe disability
– employers’ liability insurance association
– banking institutions
– insurance companies
– IT service providers such as TIMEINFO, EPORTAL.AERO, FBO1, MICROSOFT
TEAMWORKS, iSpring LMS, etc.
– Trainers and training platforms
– Lawyers, courts, tax consultants

8. Rights of the data subject

If your personal data is processed by us, you are a data subject within the meaning of Article 4(1) EU GDPR and you have the following rights against us:

a. Right to information

You have a right to information about whether and which of your personal data is processed by us. In this case, we will additionally inform you about.

(1) the purpose of processing.
(2) the categories of data.
(3) the recipients of your personal data.
(4) the planned storage period or the criteria for the planned storage period.
(5) your other rights.
(7) if we have not been provided with your personal data by you: Al-l available information about its origin.
(8) if available: the existence of automated decision-making and information about the logic involved, the scope and the intended effects of the processing.

b. Right to rectification

You have a right to rectification and/or completion if your personal data processed by us is inaccurate or incomplete.

c. Right to restriction of processing

You have a right to restriction of processing if.

(1) we verify the accuracy of your personal data processed by us.
(2) the processing of your personal data is unlawful.
(3) you need your personal data processed by us for legal prosecution after the purpose has ceased to exist.
(4) you have objected to the processing of your personal data and we are reviewing this objection.

d. Right to erasure

You have a right to erasure if.

(1) we no longer need your personal data for its original purpose.
(2) you withdraw your consent and there is no further legal basis for processing your personal data.
(3) you object to the processing of your personal data and – unless it concerns direct marketing – there are no overriding reasons for further processing.
(4) the processing of your personal data is unlawful.
(5) the erasure of your personal data is required by law.
(6) your personal data was collected as a minor for Information Society services.
e. Right to information

If you have exercised your right to rectification, erasure or restriction of processing, we will notify all recipients of your personal data, this rectification, erasure of data or restriction of processing.

f. Right to data portability

You have a right to receive your personal data processed by us on the basis of consent or for the performance of a contract in a structured, common and machine-readable format and to transfer it to another controller. If technically feasible, you have the right to have us transfer this data directly to another controller.

g. Right of objection

You have the right to object to the processing of your personal data in case of special reasons. In this case, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing.

In the case of processing of your personal data for the purpose of direct marketing, you have the right to object at any time.

h. Right of revocation

You have the right to revoke any consent given to us at any time. The revocation of consent does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation.

i. Right to complain to a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data by us violates the EU GDPR.

The competent supervisory authority for us is:

State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia.
Kavalleriestr. 2-4
40213 Düsseldorf
Phone: 0211/38424-0
Fax: 0211/38424-10
E-mail: poststelle@ldi.nrw.de

The supervisory authority to which you have submitted a complaint will inform you about the status and outcome of the complaint, including the possibility of a judicial remedy pursuant to Article 78 EU-DSGVO.

If you have any questions, please do not hesitate to contact our data protection officer at any time.

Information requirements according to Art. 12, 13 et seq. EU-DSGVO for customers and suppliers

Dear Sir,
Dear Sir,
Dear Customer

Due to the legal regulations of the European Data Protection Regulation (“EU-DSGVO”), we are obliged to provide you with comprehensive information about the processing of your personal data within the scope of our contractual relationship, which we are very happy to do.

Data protection and the handling of your personal data is very important to us, so we always pay attention to the proper processing of your personal data.

If you have any questions about your personal data and its processing, please do not hesitate to contact our data protection officer. He is not subject to any instructions, is independent in his position and is legally bound to maintain secrecy and confidentiality, so that you can contact him in confidence.

Regarding the processing of your personal data within the framework of our contractual relationship, we inform you of the following:

1. Name and address of the person responsible

Your contact person as the responsible party within the meaning of the European Data Protection Regulation (“EU GDPR”) and other national data protection laws of the member states as well as other data protection regulations is:

GAS German Aviation Service GmbH
Managing Director: Andreas Becker
Cologne/Bonn Airport
P.O. Box 980 146
51147 Cologne

(hereinafter referred to as “we”, “us” or “our”)

2. Name and address of the data protection officer

Collegium Auditores GmbH
Wilhelmstr. 74
53721 Siegburg

Please contact our Collegium Auditores data protection officer directly with any questions you may have regarding data protection and data security at our company:

E-mail: datenschutz@collegium-auditores.de / Tel.: +49 224 1957535
3. general information on data processing

a. Scope of processing personal data

As a matter of principle, we process your personal data and the personal data of your company’s contact persons only to the extent that this is necessary for the performance of our services. Your personal data is regularly processed only on the basis of the performance of a contract or for the implementation of a pre-contractual measure.

b. Legal basis for the processing of personal data

Insofar as we obtain the consent of the data subject for processing operations of personal data, Art. 6 (1) lit. a EU-DSGVO serves as the legal basis.

When processing personal data that is necessary for the performance of a contract between you and us, Art. 6 (1) lit. b EU-DSGVO serves as our legal basis. This also applies to processing operations that are necessary for the performance of pre-contractual measures.
If processing of personal data is necessary for compliance with a legal obligation to which we are subject, Art. 6 (1) c EU-DSGVO serves as the legal basis for us.

If the processing is necessary to protect a legitimate interest of us or a third party and if your interests or the interests, fundamental rights and freedoms of the contact persons of your company do not override the former interest, Art. 6 (1) lit. f EU-DSGVO serves us as the legal basis for the processing.

c. Data erasure and storage period

Your personal data as well as the personal data of your company’s contact persons will be deleted or blocked as soon as the purpose of storage ceases to apply. Storage may take place beyond this if this has been provided for by the European or national legislator in Union regulations, laws or other provisions to which we are subject. Data will also be blocked or deleted if a storage period prescribed by the aforementioned standards expires, unless there is a need to continue storing the data for the conclusion or fulfillment of a contract.

4.    Customer, supplier creation, business conclusion and ongoing business relationship.

a. Legal basis

The legal basis for the processing of your personal data as well as the personal data of the contact persons of your company within the scope of the customer, supplier creation, business conclusion and ongoing business relationship is Art. 6 para. 1 lit. b EU-DSGVO or Art. 6 para. 1 lit. f EU-DSGVO.

If you or the contact persons of your company have declared consent, Art. 6 (1) lit. a EU-DSGVO is an additional legal basis for the processing of your personal data and the personal data of the contact persons of your company.

b. Purpose

The purpose of the processing of your personal data as well as the personal data of the contact persons of your company within the scope of the customer, supplier creation, business conclusion and ongoing business relationship is the justification, execution and termination of the respective order as well as the consideration in future contract awards or tenders.

c. Origin

If we have not received your personal data directly from you, the contact person of your company has provided and named your personal data to us in the context of the customer, supplier facility.

d. Storage period

Your personal data as well as the personal data of the contact persons of your company will be deleted as soon as they are no longer required to achieve the purpose for which they were collected.

In the case of customer, supplier creation, business conclusion and ongoing business relationship, this is given when the contract underlying the order, or the offer has been fulfilled and all claims arising from the contractual relationship are time-barred or there are no longer any legal retention periods.

In the case of consideration for future contract awards or tenders, this is given when your company finally no longer has any interest in being considered for future contract awards, tenders or offers.

e. Object and erasure option
The processing of your personal data as well as the personal data of your company’s contact persons is absolutely necessary for the justification, execution and termination of the respective contract, order or offer. Due to legal retention periods, you or the contact person of your company consequently do not have the possibility to object.
If you or the contact persons of your company have given consent to the processing of your personal data, the consent can be revoked at any time for the future or the processing of the personal data, in the context of consideration for future orders or offers, can be objected to for the future.

5. Direct marketing by mail

a. Legal basis for data processing

The legal basis for the processing of your personal data and the personal data of your company’s contact persons in the context of direct marketing by mail is Art. 6 (1) lit. f EU-DSGVO.

b. Purpose of data processing

The purpose of processing your as well as the personal data of your company’s contact persons in the context of direct marketing by mail is to promote the sale of goods or services. In this purpose lies our legitimate interest in the data processing according to Art. 6 para. 1 lit. f EU-DSGVO.

c. Storage period

Your personal data as well as the personal data of your company’s contact persons will be deleted as soon as they are no longer required to achieve the purpose for which they were collected; this is the case in particular upon receipt of the objection.

d. Object and erasure option

You as well as the contact persons of your company can object to the processing of your personal data in the context of direct marketing by mail at any time for the future.

6. Contacting by e-mail

a. Legal basis for data processing

The legal basis for the processing of your personal data and the personal data of the contact persons of your company, which are transmitted to us in the course of sending an e-mail, is Art. 6 (1) lit. f EU-DSGVO. If the e-mail contact is aimed at concluding a contract, Art. 6 (1) lit. b EU-DSGVO is the additional legal basis for processing the personal data.

b. Purpose of the data processing

The processing of personal data in the event of contact by e-mail serves us solely to process the contact.
c. Storage period

Personal data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected. For personal data sent by e-mail, this is the case when the respective conversation with you or the contact persons of your company has ended. The conversation is ended when it is clear from the circumstances that the matter in question has been conclusively clarified between us.

d. Object and erasure option
It is possible at any time to object for the future to the processing of personal data in the context of contacting us by e-mail. In such a case, the conversation between us cannot be continued. All personal data stored in the course of contacting us will be deleted in this case.

8. Data subject input according to Art. 12 ff. EU-DSGVO

a. Legal basis

The legal basis for processing your personal data and the personal data of your company’s contact persons in the course of processing a data protection-related inquiry (“data subject input”) is Art. 6 para. 1 lit. c in conjunction with. Art. 12 et seq. EU-DSGVO. The legal basis for the subsequent documentation of the lawful processing of data subject input is Art. 6 (1) lit. f EU-DSGVO.

b. Purpose

The purpose of the processing of personal data in the context of the processing of data subject input is to respond to the data protection-related inquiry. The subsequent documentation of the legally compliant processing of the respective data subject input serves to fulfill the legally required obligation to provide evidence, Art. 5 (2) EU-DSGVO.

c. Storage period

Personal data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. In the case of the processing of data subject submissions, this is three years after the end of the respective process in accordance with § 41 BDSG in conjunction with § 31 para. 2 no. 1 OWiG.

d. Object and erasure option

You have the option at any time to object to the processing of your personal data in the context of the processing of data subject submissions for the future. In this case, however, we will not be able to further process your data protection request.

The documentation of the legally compliant processing of the respective data subject input is mandatory. Consequently, there is no possibility for you to object.

9. Legal defense and legal enforcement

a. Legal basis

The legal basis for the processing of your data and the personal data of your company’s contact persons in the context of legal defense and enforcement is Art. 9 para. 2 f lit. f; 6 paras. 1 lit. f EU-DSGVO.

b. Purpose

The purpose of the processing of personal data in the context of legal defense and enforcement is the defense against unjustified claims and the legal enforcement and assertion of claims and rights.

c. Storage period

The personal data will be deleted as soon as they are no longer required to achieve the purpose for which they were collected.

d. Object and erasure option
The processing of your personal data in the context of legal defense and enforcement is mandatory for legal defense and enforcement. Consequently, there is no possibility to object.

10. Categories of recipients

Within our company, those offices and departments receive personal data that need it to fulfill the aforementioned purposes. These may be, for example:

– Accounting
– Controlling / Auditing
– Supervisory / occupational safety authorities
– tax office
– banking institutions
– Insurance companies
– External service providers
– Scan service
– lettershops
– IT service providers
– Suppliers (subcontractors) and booking portals for air travel, tickets and
hotels, and rental cars
– customers
– Customer relationship service providers
– document shredders
– Tax consultants, lawyers and courts
11. Rights of the data subject

If your personal data and the personal data of the contact persons of your company are processed by us, you or the respective contact person of your company are a data subject within the meaning of Art. 4. para. 1 EU-DSGVO. Data subjects are entitled to the following rights vis-à-vis us:

a. Right to information

Data subjects have a right to information about whether and which personal data of theirs is processed by us. In this case, we will additionally inform about.

(1) the purpose of processing.
(2) the categories of data.
(3) the recipients of your personal data.
(4) the planned storage period or the criteria for the planned storage period.
(5) your other rights.
(7) if we have not been provided with your personal data by you: Any available information about its origin.
(8) if available: the existence of automated decision-making and information about the logic involved, the scope and the intended effects of the processing.

b. Right to rectification

Data subjects have a right to rectification and/or completion if the personal data we process is inaccurate or incomplete.

c. Right to restriction of processing

There is a right to restriction of processing for data subjects, provided that.

(1) we verify the accuracy of the personal data we process.
(2) the processing of the personal data is unlawful.
(3) we need the personal data we process for law enforcement purposes after the purpose has ceased to exist.
(4) the data subject has objected to the processing of the personal data and we are reviewing this objection.

d. Right to erasure

There is a right to erasure for the data subject, provided that.

(1) we no longer need the personal data for its original purpose.
(2) consent is withdrawn and there is no further legal basis for processing the personal data.
(3) the data subject objects to the processing of his or her personal data and, except in the case of direct marketing, there are no overriding reasons for the further processing.
(4) the processing of the personal data is unlawful.
(5) the erasure of the personal data is required by law.
(6) the personal data was collected as a minor for information society services.

e. Right to information

If the data subject has exercised his/her right to rectification, erasure or restriction of processing, we will notify all recipients of the personal data, of such rectification, erasure of data or restriction of processing.

f. Right to data portability

The data subject has a right to receive his or her personal data processed by us on the basis of consent or for the performance of a contract in a structured, common and machine-readable format and to transfer it to another controller. If technically feasible, he or she has the right to have us transfer this data directly to another controller.

g. Right to object

Data subjects have the right to object to the processing of their personal data in case of special reasons. In this case, we will no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing.

In the case of processing of personal data for the purpose of direct marketing, data subjects have the right to object at any time.

h. Right of withdrawal

Data subjects have the right to revoke consent given to us at any time. The revocation of consent does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation.

i. Right to complain to a supervisory authority

Without prejudice to any other administrative or judicial remedy, you as a data subject have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data by us violates the EU GDPR.

The competent supervisory authority for us is:

State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia.
Kavalleriestr. 2-4
40213 Düsseldorf
Phone: 0211/38424-0
Fax: 0211/38424-10
E-mail: poststelle@ldi.nrw.de

The supervisory authority to which the complaint was submitted will inform you about the status and outcome of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 EU-DSGVO.

If you have any queries, please do not hesitate to contact our data protection officer at any time at.