The protection of your personal data is important to EFESC.
This privacy statement offers detailed information concerning the protection of your personal data by EFESC (“we”).
As data controller, we are responsible for processing your personal data in the context of our activities. The aim of this Privacy Statement is to inform you about which personal data we process about you, the reasons why we process and share these data, how long we store them and how you can exercise your rights.
Have you reached the age of majority, or are you, as an adult, responsible for minors, or are you a minor? Please read this Privacy Statement carefully. For any questions and/or remarks in connection with this Privacy Statement, please refer to the contact details at the bottom of this Privacy Statement.
1. WHAT PERSONAL DATA DO WE USE ABOUT YOU, AND WHEN?
§1. Personal data are data that can be used to identify you or to contact you (e.g. name, address, e-mail address, legal records, profession, etc.).
To the extent necessary for the performance of our activities – in particular, the management and monitoring/tracking of national certification processes for specific skills and competences of outdoors professions such as forestry, landscape architecture, trees and horticulture – we (may) collect and process specific personal details about you (e.g. via our website or its database).
We may obtain your personal data directly from you, or via another person, for example the assessment centres and/or our national agencies.
§2. You are under no obligation to provide the personal data we request. If you should, however, choose not to do so, we shall, in many cases, be unable to offer our products and/or services, or answer any questions you may have.
Where required, you should therefore state that you agree to your personal details being stored and processed in our database(s) – or those of our partners – and further guarantee that the data you have submitted to us belong to you, or that you have permission to use them and to communicate them to us.
2. DO WE ALSO MAKE USE OF SPECIAL PERSONAL DATA ABOUT YOU?
§1. Special personal data are on the one hand data concerning health, and on the other, data which are by their nature particularly sensitive with respect to fundamental rights and freedoms, in particular those revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, and genetic and biometric data as well as data concerning sexual orientation or behaviour.
Unless mandated by law or arising from the services we provide, we do not process any personal data relating to your racial or ethnic origins, political opinions, religious or philosophical beliefs, trade union membership, genetic data or data concerning your sex life or sexual orientation.
§2. We only collect data about your health if this information is necessary and only if we have received your permission for this in advance.
3. HOW DO WE PROCESS YOUR PERSONAL DATA?
§1. The personal data provided shall only be processed by us for the purposes stated in this Privacy Statement.
Should we, however, consider it desirable to process your personal data for purposes other than those stated in this Privacy Statement, we shall request your express permission for this, whereby you are entitled to oppose this use of your personal data for alternative purposes.
This requirement to obtain prior consent does not apply if we were to process your personal data for (other) purposes compatible with those stated in the Privacy Statement.
§2. We take appropriate security measures to prevent unauthorised access to, publication, amendment or deletion of your personal data without permission.
The processing of the personal data we have at our disposal shall, in the first instance, take place with the use of computers and/or IT tools, whereby we adhere to organisational procedures and methods that closely reflect the indicated purposes.
§3. Notwithstanding Art. 5 of this Privacy Statement, only those persons who are connected to us through an employment relationship have access, in principle, to your personal data. This on the understanding that this access is restricted to the degree in which the persons concerned need these data for the performance of their function and/or assignment.
For the record, we would emphasise that our national agencies – in the context of our activities – can also obtain access to your personal data.
In addition, the personal data can, in certain cases, also be accessible for certain persons charged with the processing, or persons appointed by us as processor (such as external technical service providers, mail programs, hosting providers, IT companies, communication agencies). A list of these parties may be requested at any time.
We may also provide third parties with access to your personal data held by us, pursuant to Art. 5 of this Privacy Statement and, specifically, if this is mandated by law or is at the request of the judicial authorities or the competent police forces.
§4 In order to guarantee the availability of specific personal data, back-ups are maintained of these personal data. We do this by making use of back-ups provided by third parties, with whom we have concluded a processing agreement.
4. WHY AND ON WHAT BASIS DO WE PROCESS YOUR PERSONAL DATA?
Each processing of personal data shall rely on (at least) one of the legal principles stated in Article 6 of the General Data Protection Regulation.
Our primary principles for the processing of your Personal data:
- legal obligation: the processing of your Personal Data is prescribed by or subject to a legal obligation/order;
- public interest: the processing of your Personal Data is necessary for performing a task of public interest or on the instructions of a public authority;
- agreement: the processing of your Personal Data is necessary for the performance of an agreement you enter(ed) into or in order to take at your request the steps necessary for concluding an agreement;
- permission: you actively, specifically, unambiguously and with full knowledge, give us your consent for the processing of your Personal Data.
The possible processing of Special Personal Data shall additionally rely on one of the legal exceptions provided for that purpose (e.g. permission).
We are prepared to clarify the specific legal basis and aforementioned legal exception(s) applicable to the processing in question.
5. DO WE SHARE YOUR PERSONAL DATA AND, IF SO, WITH WHOM?
§1. We may, for example to serve the purposes stated above, exchange your personal data with/via our partners (e.g. the certification centres) and use them in accordance with this Privacy Statement. For this, your personal data could, possibly, be combined with other information in order to offer our services and improve them.
Your personal data – which are necessary to demonstrate your level of certification – may be displayed on our website.
Otherwise, your personal data will only be passed on to third parties, to the extent necessary for the performance of our purposes, if this is legally mandated and/or if you have granted permission for this.
§2. In any case, we shall not actively pass on personal data to third parties for use for commercial and/or promotional purposes.
6. DO WE ALSO SHARE YOUR PERSONAL DATA OUTSIDE THE EUROPEAN ECONOMIC AREA (EEA)?
§1. In the event of international transfer of data from the EEA to a country outside the EEA, which the European Commission has recognised as a country with a suitable level of data protection, your data will be transferred on this basis.
For transfers to countries outside the EEA that are not recognised by the European Commission as countries with a suitable level of data protection, we shall either rely on a derogation that is applicable to a special situation (e.g. when the transfer proves necessary to perform our agreement with you) or implement one of the following guarantees to ensure that your personal data are protected:
- Standard provisions on data protection, as approved by the European Commission;
- Binding operating rules;
§2. To receive a copy of these guarantees or for more details about where you can find them, please refer to the contact information at the bottom of this Privacy Statement.
7. HOW LONG DO WE STORE YOUR PERSONAL DATA?
§1. Personal data are processed and stored for as long as necessary for the purpose for which they were collected. Accordingly, the following applies in principle:
- Personal data collected for purposes connected with the performance of an agreement we have concluded with you will be kept (at least) until this agreement has been performed in its entirety;
- Personal data collected for our legitimate interests are stored for as long as required to achieve these purposes.
When such is required operationally, the personal data may be retained longer, for such things as answering legal claims or questions from supervisory authorities.
§2. Personal data may additionally be retained for a longer period when permission has been granted for such processing, and as long as the consent has not been withdrawn by the person concerned.
Furthermore, we may be bound to retain your personal information longer if this is required to meet the applicable laws and regulations, or on the instructions of a public authority.
§3. After the retention period has lapsed, your personal data will, in principle, be deleted.
For this reason, the right of access, the right of deletion, the right of rectification and the right of data transfer cannot be exercised once the retention period has lapsed.
8. WHAT ARE YOUR RIGHTS AND HOW CAN YOU EXERCISE THEM?
§1. Under the applicable regulations, anyone whose personal data we process is entitled to:
- Perusal: you are entitled to receive a decision on the processing or non-processing of your personal data and, if affirmative, to peruse and/or to receive of a copy of (inter alia) these personal data;
- Rectification: should you believe that the personal data we have at our disposal are incorrect or incomplete, you may request a correction or completion of these personal data;
- Deletion: you may request the deletion of your personal data;
- Restriction: under certain circumstances, you may request the restriction of the processing of your personal data. In that case, we shall not process your personal data further for purposes other than their retention;
- Objection: you may lodge an objection to any processing of your personal data if this processing relies on a legal basis other than permission.
Where your personal data are processed in the public interest, in the context of exercising public order or with our legitimate interests in mind, you may lodge an objection to this processing, stating a reason for the objection that relates to your specific situation.
If your personal data were to be processed for direct marketing purposes, you may, at any time and without giving any reasons, object to the processing in question.
- Withdrawal of your consent: should any processing require your consent, you are always entitled to withdraw this consent, on the understanding that this does not affect the lawfulness of the processing based on your consent before its withdrawal.
- Data transfer: where legally permissible, you are entitled to have the personal data you have submitted to us transferred, to the extent that this is technically possible, to a third party in a structured, standard and machine-readable form.
The exercise of these rights is in principle free of charge and shall be dealt with as quickly as possible and within the term laid down by law at the latest.
§2. If you wish to exercise one of the rights listed here, you may send a letter or e-mail to the address given in the contact information at the bottom of this Privacy Statement.
Please always enclose a scan/copy of the front of your identity document, so that we can identity you.
§3. Pursuant to the applicable regulations, you are entitled, in addition to the rights stated above, to lodge a complaint with the competent supervisory authority.
If, in the context of the aforementioned processing, your personal data, including pseudo-anonymous data, is processed by an external party, a processing agreement will be concluded with that (external) party.
We take all necessary steps to comply with the applicable directives/regulations, (in particular) in the context of the aforementioned processing operations.
10.HOW CAN YOU MONITOR CHANGES TO THIS PRIVACY STATEMENT?
In a world of constant technological change, we shall regularly need to update this Privacy Statement.
We invite you to consult the latest version of this Privacy Statement online and we shall – wherever this is technically and legally possible – keep you updated via our website or other usual channels of communication.
The date of the last change is displayed at the bottom of the page,
11.DO YOU HAVE ANY QUESTIONS, OR WOULD YOU LIKE TO CONTACT US?
If you have any questions regarding the processing of your personal data as described in this Privacy Statement, please contact Joachim Morat, by letter to the attention of the GDPR controller, or by e-mail Joachim.Morat@kwf-online.de.
Last amended on 01.09.’18