As part of our business relationships with our suppliers and customers, we process personal data that is necessary for conducting and managing our business dealings.

I. THE DATA CONTROLLER IS:

VOLLMER WERKE Maschinenfabrik GmbH
Ehinger Straße 34
88400 Biberach / Riß
Germany
Tel.: +49 (0) 7351 / 571 - 0
Fax: +49 (0) 7351 / 571 - 130
E-Mail:INFO@VOLLMER-GROUP.COM

Registered office: Biberach
Ulm Local Court HRB 640007
VAT ID number: DE 144889422
Tax number: 54001/00142
Managing Directors authorised to represent the company: Heinz Verfürth, Tobias Trautmann
Chair of the Supervisory Board: Andreas Böhm

Our data protection officer can be contacted using the following details:
VOLLMER WERKE Maschinenfabrik GmbH
Datenschutzbeauftragter
Ehinger Straße 34
88400 Biberach/Riss
Germany

E-Mail: DATENSCHUTZ@VOLLMER-GROUP.COM

II. SCOPE AND PURPOSE OF DATA PROCESSING

1. Contact details/contact person

• Last name, first name, title, position, business e-mail address, business phone number, business fax number, company name, company address, company legal form, business bank details, VAT ID number, tax number, credit rating information (if applicable)
   

Legal basis for this data processing:

For data relating to suppliers and customers (businesses): Entering into a contract or taking pre-contractual measures in accordance with Article 6(1b) GDPR. For data relating to employees or contact persons of the supplier/customer: Overriding legitimate interest in accordance with Article 6(1f) GDPR. In this case, our legitimate interest lies in processing relevant master data and contact details of our suppliers and customers, thereby enabling us to contact the correct people when necessary.

2. Payment of invoices and complaints

Data processing in connection with settling invoices and complaints is carried out in order to record and post payments correctly, and to verify that all payments have been received on time and correctly. In the event of complaints, the relevant data (e.g. incorrect invoices or products) is processed in order to identify the problems and find solutions.

Data processed:

• Contact details of the contact persons: First name and last name, company address, e-mail address, phone number, position of the contact person
• Invoice details: Invoice number, invoice amount, payment terms, bank details, payment methods
• Complaints data: Reason for the complaint, communication relating to complaints (e.g. complaints or enquiries), proposed solutions
   

Legal basis for this data processing:

Article 6(1b) GDPR (performance of a contract): The processing of data is necessary for the performance of a contract, i.e. to enable the payment of invoices. Article 6(1f) GDPR (legitimate interest): In some cases, there may also be a legitimate interest in processing data, for example, to ensure the proper processing of payments or to resolve disputes relating to complaints, thereby maintaining the business relationship.

3. Supplier assessment/audits/supplier self-declaration

Business partner checks and audits are carried out to assess the suitability and reliability of potential and existing suppliers and business partners. Among other things, the audit covers aspects such as financial stability, the lawfulness of management practices and compliance with relevant legal provisions (e.g. the German Supply Chain Duty of Care Act).

Data processed:

• Contact details of the contact persons: First name and last name, company address, e-mail address, phone number, position of the contact person
• Company details: Company name, legal form, commercial register number, group affiliation/owners, registered office, tax number, VAT ID number, year of incorporation, number of employees, financial data such as company, group and VOLLMER turnover for the two previous financial years, as well as forecasts, turnover by market and sector, balance sheets, creditworthiness information, bank details, information on existing business relationships and contractual arrangements, products, production sites, processes and specific features, major customers, including the relevant country and share of turnover
• Audit-specific data: Information on the partner’s business practices (e.g. ethical standards, working conditions, environmental practices, management system standards and guidelines, organisational charts, process owners, areas of responsibility), evidence of regulatory compliance (e.g. certificates, compliance reports), documentation on the results of audits carried out (e.g. audit reports, interviews with relevant contacts)
   

Legal basis for this data processing:

Article 6(1c) GDPR (compliance with legal obligations): The processing of data is necessary to comply with our legal obligations.
Article 6(1f) GDPR (legitimate interest): The processing is necessary in order to unambiguously identify suppliers or their beneficial owners and to assess the supplier’s or contracting party’s performance and default risk.

4. Coordination of service provision/delivery

As part of the coordination of service provision and deliveries, various data is processed which is necessary for the efficient and timely performance of services or deliveries. The data processed on a regular basis includes:

• Contact details of the contact persons: First name and last name, company address, e-mail address, phone/mobile/fax number, position of the contact person
• Logistics and dispatch details: Dispatch methods, tracking numbers, delivery times and schedules
• Communication data: Correspondence relating to the delivery (e.g. requests for changes, delays), delivery notes
   

Legal basis for this data processing:

Article 6(1b) GDPR (performance of a contract) and Article 6(1f) GDPR (legitimate interest): We have a legitimate interest in ensuring that the coordination of deliveries and the provision of services runs efficiently and smoothly, particularly with regard to the management of orders, dispatch, tracking and communication.

5. Getting in touch to amend or enter into a new business relationship, and managing contact details

When getting in touch to make changes or to register as a new customer, data is processed in order to contact existing or potential customers or suppliers, to amend an existing business relationship or to establish a new one. This covers all aspects of communication (including the VOLLMER newsletter), clarifying queries , negotiations and amendments to agreements or contracts.
Managing contact details ensures that the correct contact persons within the company or at business partners can be reached, thereby guaranteeing efficient communication.  

Data related to getting in touch for amending or establishing a new business relationship:

• Contact details of the contact persons: First name and last name, company address, e-mail address, phone/mobile/fax number, position
• Conversation and communication data: Notes and minutes relating to conversations (e.g. telephone notes, e-mails, meeting minutes), information on planned contract amendments or new agreements, information on further requirements of the potential or existing business partner (e.g. product requirements, services, payment terms)
• Statistical collection and analysis: Our newsletter contains a “web beacon”, i.e. a pixel-sized file that is retrieved from the mailing service provider’s server when the newsletter is opened. As part of this retrieval, technical information, such as details about your browser and your system as well as your IP address and the time of access, is collected. This information is used to improve the services technically, based on technical data or on the target groups and their reading behaviour, as determined by their location (which can be identified using the IP address) or the access times. The statistical data collection also includes information on whether the newsletters are opened, when they are opened and which links are clicked. While this information can be linked to individual newsletter recipients for technical reasons, it is neither our intention nor that of the delivery service provider to monitor individual users. Rather, the analyses are used to help us identify our users’ reading habits and tailor our content to them, or to send out different content based on our users’ interests.

Legal basis for this data processing:

Article 6(1f) GDPR (legitimate interest): Our legitimate interest lies in amending the contractually agreed services or re-tendering them. Existing or potential customers should be kept informed of developments relating to the range of services we offer in a way that both serves our business interests and meets users’ expectations.

Furthermore, we have a legitimate interest in keeping contact details up to date in order to ensure efficient communication.

Please also refer to the further information in our Privacy Policy on our website at www.vollmer-group.com/en/common/privacy-notice.

III. RECIPIENTS OF YOUR DATA

Within our company, your data will be shared with those internal departments or organisational units that require it in order to fulfil our contractual and legal obligations or in connection with the processing and pursuit of our legitimate interests.nbsp;

Any further disclosure of your data to other recipients will take place exclusively:

• If you have given us your consent to disclose your data to third parties.
• In connection with the performance of the contract.
• For the purposes of complying with legal requirements under which we are obliged to disclose data (e.g. to public prosecutors’ offices, courts).
• On the basis of our legitimate interest or the legitimate interest of a third party in relation to the purposes set out (e.g. auditors, solicitors).

Processors

Where necessary and permitted by law, we transfer personal data to carefully selected external service providers who assist us in providing certain services. This includes but is not limited to service providers entrusted with organisation, documentation and administration relating to the purposes set out above. These service providers act exclusively in accordance with our instructions.

The necessary data processing agreements in accordance with Article 28 GDPR have been concluded with all service providers to ensure that the protection of your personal data is guaranteed at all times. When using these service providers, personal data may also be transferred to third countries. We have implemented appropriate security measures for these transfers in accordance with the legal requirements. In the absence of an adequacy decision by the European Commission pursuant to Article 45 GDPR, other appropriate safeguards will be put in place to ensure the protection of your data.

Credit assessment

We transfer relevant data (including, among other things, the company name, legal form, address and, where applicable, information on beneficial owners) to credit agencies as part of the contractual or business relationship, on the basis of our legitimate interest (Article 6(1f) GDPR), for the purpose of credit assessments and obtaining information to assess the risk of payment default, which has been determined using mathematical and statistical methods on the aforementioned data.

We use the following credit agency for this purpose:
Verband der Vereine Creditreform e. V., Hammfelddamm 13, 41460 Neuss, DE
(Webseite: https://www.creditreform.de/datenschutz)

Disclosure to subsidiaries

Personal data is only disclosed to affiliated companies where there is an appropriate legal basis for doing so and only if it is necessary for the specific purposes of the data processing. This may, in particular, involve the disclosure of contact details.
The purpose of sharing this data is to ensure a consistent standard for business processes within the Group and to enable other companies within the Group to identify the correct points of contact internally.
Access to this information is restricted to companies of VOLLMER WERKE Maschinenfabrik GmbH.

The provision of data is based on our legitimate interest pursuant to Article 6(1f) GDPR, with a view to establishing a centralised and uniform standard for procurement and business processes across the Group.

IV. DURATION OF PROCESSING

We process personal data only for as long as is necessary for the purposes set out above, i.e. generally for the duration of the business relationship and for the full performance and fulfilment of the contractual relationship. Furthermore, we comply with statutory retention requirements, including but not limited to the provisions of the German Commercial Code (HGB) and the Fiscal Code of Germany (AO).
Under Sections 195 et seq. of the German Civil Code, limitation periods may be up to thirty years; the standard limitation period is three years. In addition, the statutory retention obligations under tax law, commercial law, public finance law and other legislation must be observed. The retention and documentation periods specified for this purpose generally range from six to eight years.

V. OBLIGATION TO PROVIDE DATA

As part of our business relationship, you are only required to provide personal data that is necessary for the conclusion, performance and termination of a contract, or for pre-contractual measures, or where we are legally obliged to collect such data. Without this data, we will generally have to refuse to enter into the contract or carry out the order, or we will no longer be able to fulfil an existing contract and may have to terminate it.

VI. AUTOMATED DECISION-MAKING, INCLUDING PROFILING

No automated decision-making, including profiling, takes place in connection with the processing of personal data.

VII. RIGHTS OF THE DATA SUBJECT/strong>

As a data subject, you have the following rights: ;

• Right of access (Article 15 GDPR),
• Right to rectification (Article 16 GDPR),
• Right to erasure (Article 17 GDPR),
• Right to restriction of processing (Article 18 GDPR),
• Right to data portability (Article 20 GDPR) and
• Right to withdraw your consent to data processing at any time (Article 7(3) GDPR).

Withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Similarly, any further processing of this data on another legal basis, such as to comply with legal obligations (e.g. statutory retention periods), shall remain unaffected.

Right to object (Article 21 GDPR)

You have the right to object to the processing of your personal data at any time on grounds relating to your particular situation. This is particularly the case where the processing of data is not necessary for the performance of a contract.

Should you wish to exercise your right to object, please state your reasons. We will then no longer process your personal data unless we can demonstrate to you that there are compelling legitimate grounds for processing the data which override your interests and rights.

Exercising your rights as the data subjects

To exercise the rights set out above, please contact us at the address given in Section I.

Enquiries submitted electronically are usually answered electronically.

If there are reasonable grounds to doubt your identity, we may ask you to provide additional information for the purposes of identification. If we are unable to verify your identity, we are entitled to refuse to process your enquiry. Where possible, we will notify you separately if we are unable to identify you (see Article 12(6) and Article 11 GDPR).

Requests for information are generally dealt with without delay, within one month of receipt of the request. The deadline may be extended by a further two months if this is necessary, taking into account the complexity and/or the number of enquiries. In this case, we will inform you of the reasons for the delay within one month of receiving your enquiry.

Should we not act on a request, we will inform you of the reasons for this without delay, within one month of receiving the request, and will inform you of your right to lodge a complaint with a supervisory authority or to seek a legal remedy (see Article 12(3) and (4) GDPR).

Please note that you may only exercise your rights as a data subject within the frames and restrictions laid down by the Union or the Member States. (Article 23 GDPR).

If you believe that the processing of your data infringes data protection law or that your rights under data protection law have otherwise been infringed, you may contact the supervisory authority for your usual place of residence, your place of work or our registered office (Baden-Württemberg State Commissioner for Data Protection and Freedom of Information) (Article 77 GDPR).

VIII. CHANGES AND UPDATES TO THE PRIVACY NOTICE

We reserve the right to amend our Privacy Policy should this be necessary due to new data processing activities on our part, new technologies or legal requirements. Please ensure that you have the latest version.

Letzte Änderung: 07.04.2026