PRIVACY POLICY FOR CUSTOMERS, BUSINESS PARTNERS AND OTHER INTERESTED PARTIES

Latest update: June 2023

Privacy information concerning the processing of data of customers, business partners and other interested parties pursuant to Articles 13, 14 and 21 General Data Protection Regulation (GDPR)

1. Data controller pursuant to data protection legislation

Nürburgring 1927 GmbH & Co. KG
Otto-Flimm-Strasse
53520 Nürburg
Phone +49 (0) 2691 302 0
E-Mail: info@nuerburgring.de

2. Contact data of our data protection officer

b-pi sec GmbH
Kopenhagener Straße 6
65552 Limburg an der Lahn
E-Mail: datenschutz@nuerburgring.de

3. Purposes of processing and legal basis
We process your personal data in compliance with the provisions of the European General Data Protection Regulation (EU GDPR) and the Federal German Data Protection Act [“BDSG”] insofar as this is necessary to establish, perform and/or fulfil a contract and to take steps prior to entering into a contract. 

Insofar as it is necessary to state personal data for the preparation or performance of a contract or to take steps prior to entering into a contract, processing is lawful pursuant to Art. 6, Para 1, Point b GDPR. If you give us your explicit consent to the processing of your personal data for specific purposes (e.g. disclosure to third parties, creation of a customer account, evaluation for marketing purposes or promotional contact), the lawfulness of processing is given on the basis of your consent pursuant to Art. 6, Para 1, Point a GDPR.

You can withdraw your consent at any time with effect for the future (cf. Clause 9 of this Privacy Information). Insofar as necessary and legally permissible, we process your data over and beyond the actual contractual purposes to fulfil our legal obligations pursuant to Art. 6, Para 1, Point c GDPR.

Your data may also be processed to protect the legitimate interests of our company or third parties pursuant to Art. 6, Para 1, Point f GDPR.If appropriate we shall inform you separately, stating the legitimate interest, if this is prescribed by law.4.

4. Categories of personal data
We process only those data that are related to the establishment of a contract or to steps prior to entering into a contract.

This could be general personal data about you or persons in your company (name, address, contact details etc.), as well as any further data that you provide in connection with establishment of the contract.

5. Data sources
We process personal data that we have received when you contact us, in the course of establishing the contract or taking steps prior to entering into a contract.

6. Data recipients 
We shall disclose your personal data exclusively to those departments and persons within our company which require the data for performance of the contractual and legal obligations or for the enforcement of our legitimate interests.

We are entitled to disclose your personal data to our associated companies provided this is permissible in accordance with the purposes and legal basis stated in Clause 3 of this Privacy Information.

Your data will otherwise be disclosed to recipients outside the company only if this is permissible or required by statutory regulations, if disclosure is necessary to handle and thus perform the contract or, at your request, to take steps prior to entering into the contract, if you have given your consent or we are authorised to provide information.

Under the aforesaid circumstances, recipients of personal data could be, for example, 

•    public bodies and institutions (e.g. the public prosecutor, police, supervisory authorities, inland revenue) subject to the existence of a legal or official obligation, 
•    recipients to whom disclosure is strictly necessary to establish or perform the contract e.g. financial service providers, transport service providers 

7. Transmission to a third country
Transmission to a third country is not intended.

8. Duration of data storage
Insofar as necessary we process and store your personal data for the duration of our business relationship and/or to fulfil the objects of the contract. This includes, for instance, taking steps prior to entering into a contract and handling a contract. 

We are also bound by various storage and documentation obligations resulting from, for instance, the German Commercial Code [“HGB”] and the German Tax Code [“AO”].

The storage/documentation periods prescribed therein range from two to ten years. The duration of storage is ultimately determined by the statutory time limits, which are normally three years pursuant to Sections 195 ff German Civil Code [“BGB”], but in some cases may also be up to thirty years.

9. Your rights
Every data subject has the right to obtain information pursuant to Art. 15 GDPR, the right to rectification pursuant to Art. 16 GDPR, the right to erasure pursuant to Art. 17 GDPR, the right to restriction of processing pursuant to Art. 18 GDPR, the right to notification pursuant to Art. 19 GDPR and the right to data portability pursuant to Art. 20 GDPR. The data subject further has the right to lodge a complaint with a supervisory authority pursuant to Art. 77 GDPR if the data subject considers that the processing of personal data relating to him or her infringes the GDPR.

The foregoing right to lodge a complaint is without prejudice to any other administrative or judicial remedy.

If the data is processed on the basis of your consent, you are entitled to withdraw your consent to the use of your personal data at any time pursuant to Art. 7 GDPR. Please note that the withdrawal of your consent applies only to the future.

This will not affect any data processing which has taken place before you revoke your consent.

Please also note that we may be obliged to store certain data for a certain period in order to fulfil our statutory obligations (cf. Clause 8 of this Privacy Information).

Right to object
If the processing of your personal data is performed in order to protect legitimate interests pursuant to Art. 6, Para 1, Point f GDPR, you have the right to object to the processing of such data at any time on grounds relating to your particular situation pursuant to Art. 21 GDPR. We shall then no longer process such personal data unless we can demonstrate compelling legitimate grounds for the processing. These grounds must override your interests, rights and freedoms or processing must be necessary for the establishment, exercise or defence of legal claims. 

You can use the contact data provided in Clause 1 to protect your rights.

10. Necessity of the provision of personal data
As a rule, the provision of personal data for the establishment, performance and/or fulfilment of a contract or to take steps prior to entering into a contract is neither legally nor contractually prescribed. You are therefore not obliged to provide information on your personal data.

However, please note that we normally require such personal data to reach a decision on the establishment or fulfilment of a contract or for steps prior to entering into a contract.

If you do not provide us with any personal data, we may not be able to reach a decision concerning contractual measures. We advise you to provide only personal data that is necessary for the establishment or fulfilment of a contract or for steps prior to entering into a contract.

11. Automated decision-making
As a general principle, we do not use automated individual decision-making processes within the meaning of Art. 22 GDPR for the establishment, fulfilment or performance of business contracts or for steps prior to entering into a contract. If we do use such processes in any individual case, we shall inform you separately thereof or obtain your consent if this is prescribed by law.