Privacy Policy

Thank you for your interest in our company. Data protection is especially important to the management of Bavaria Yachtbau GmbH. In principle, use of the Internet pages of Bavaria Yachtbau GmbH is possible without the entry of any personal data. However, to the extent that a data subject wishes to make use of special services of our company via our Internet page, the processing of personal data may be required. If the processing of personal data is required and no legal basis exists for suchprocessing, we generally obtain the consent of the data subject.

The processing of personal data, for example, the name, address, email address or telephone number of a data subject, is always carried out in compliance with the requirements of the GeneralData Protection Regulation and in accordance with the country-specific data protection provisions applicable to Bavaria Yachtbau GmbH. Through this Privacy Policy, our company seeks to inform the public regarding the nature, scope and purpose of the personal data we collect, use and process. In addition, data subjects are provided with an explanation of the rights to which they are entitled under this Privacy Policy.

As data controller, Bavaria Yachtbau GmbH has implemented comprehensive technical and organizational measures to ensure the fullest possible protection of the personal data processed via this website. Nevertheless, Internet-based data transfers are subject in principle to security gaps, and absolute protection cannot be guaranteed. For this reason, each data subject has the option to transmit personal data to us through alternative means such as by telephone.

1. Definitions

The Bavaria Yachtbau GmbH Privacy Policy is based on the terms used by the European authority issuing directives and regulations when enacting the General Data Protection Regulation (GDPR). Our Privacy Policy must be easily readable and understandable by the public as well as by our customers and business partners. To guarantee this, we wish to provide prior explanation of the terms used.

In this Privacy Policy, we use the following terms among others:

a) Personal data

Personal data is defined as any information relating to an identified or identifiable natural person (hereinafter „data subject“). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

b) Data subject

A data subject is an identified or identifiable natural person whose personal data are processed by the data controller responsible for the processing.

c) Processing

Processing is defined as any process carried out with or without the assistance of automated procedures or each such series of processes in connection with personal data such as the collection, capture, organization, arrangement, storage, adjustment or amendment, selection, retrieval, use, disclosure by transmission, distribution or other form of provision, matching or linking, restriction, erasure or destruction.

d) Restriction of processing

Restriction of processing is defined as the labeling of stored personal data with the objective of limiting their future processing.

e) Profiling

Profiling is defined as any type of automated processing of personal data, where such personal data are used to evaluate specific personal aspects relating to a natural person, in particular to analyze or predict aspects of the work performance, financial circumstances, health, personal preferences, interest, reliability, conduct, whereabouts or change of location of this natural person.

f) Pseudonymization

Pseudonymization is defined as the processing of personal data in such a way that the personal data can no longer be assigned to a specific data subject without the need for additional information, provided that such additional information is kept separate and subject to technical and organizational measures, which ensure that the personal data cannot be assigned to an identified or identifiable natural person.

g) Controller or party responsible for processing

The controller or party responsible for processing is the natural or legal person, public authority, institution or other entity that, whether jointly with others or by itself, makes decisions concerning the purpose and means of the processing of personal data. If the purposes and means of such processing are determined by EU or Member State law, the controller or the specific criteria for the appointment of the controller may be provided in accordance with EU or Member State law.

h) Processor

The processor is defined as a natural or legal person, public authority, institution or other entity that processes personal data on behalf of the controller.

i) Recipient

Recipient refers to a natural or legal person, public authority, agency or other entity to which the personal data are disclosed, whether this be a third party or not. However, authorities that may receive personal data in the context of a specific investigational duty under EU law or the law of a Member State do not fall under the definition of recipient.

j) Third party

Third party means a natural or legal person, public authority, agency or entity other than the data subject, controller, processor and the persons authorized to process the personal data under the direct authority of the controller or the processor.

k) Consent

Consent is defined as any specific, informed and unambiguous statement of intent in the form of a declaration or another unambiguous affirming action freely given by the data subject in which the data subject states that he/she agrees to the processing of the personal data in question.

2. Name and address of the party responsible for processing

Within the meaning of the General Data Protection Regulation, other data protection laws that apply in the EU Member States and other provisions relating to data protection, the controller responsiblefor data processing is:

Bavaria Yachtbau GmbH
Bavariastraße 1
97232 Giebelstadt
Germany
Phone: +49 9334 942 0
Email: info@bavariayachts.com
Website: www.bavariayachts.com

3. Name and address of the data protection officer

You may contact the controller’s data protection officer at:

datenschutz@bavariayachts.com

Any data subject may contact our data protection officer directly at any time with any questions and suggestions relating to data protection.

4. Cookies

The Internet pages of Bavaria Yachtbau GmbH use cookies. Cookies are text files deposited and stored on the computer system of the website visitor by means of an Internet browser.

Many Internet pages and servers use cookies. Many cookies contain a ’cookie ID’. A cookie ID is a unique identifier of the cookie. This is a unique identifier used by websites and servers to associate themselves with the specific Internet browser in which the cookie was stored. This enables the visited websites and servers to distinguish the individual browser of the data subject from other internet browsers that contain other cookies. A specific internet browser can be recognized and identified via a unique cookie ID.

The use of cookies therefore enables Bavaria Yachtbau GmbH to provide its users of our website with more user‐friendly services that would not be possible without setting cookies.

It is thus possible to optimize information and offers on our website with the user in mind. As discussed, cookies allow us to recognize returning users of our Internet page. The purpose of this recognition is to make it easier for users to make use of our Internet page. For example, the user of a website that uses cookies does not have to re‐enter his or her login data during each visit to the website, because the identification of the individual concerned is carried out by the website and the cookie is deposited on the computer system of the user. Another example is the cookie of a shopping basket in an online shop. The online shop takes note of the items a customer places into a virtual shopping basket by means of a cookie.

At any time, the data subject can prevent our website from setting cookies by using the appropriate setting of the browser employed and thus can lodge a permanent objection to the setting of cookies. Furthermore, cookies already set may be erased at any time via an Internet browser or other programs. This is possible in all popular internet browsers. If the data subject deactivates the setting of cookies in the internet browser that is being used, it may not be possible to use all functions of our website to their full extent.

5. Collection of general data and other information

Our Bavaria Yachtbau GmbH website collects a series of general data as well as other information each time a person or an automated system accesses the website. This general data and information is stored in the server’s logfiles. The collected data include (1) types and versions of browsers used, (2) the operating system used by the accessing system, (3) the website from which an accessing system gained access to our Internet page (the ’referrer’), (4) the sub‐websites to which a system accessing our Internet page is directed, (5) the date and time of an access to the Internet page, (6) an internet protocol address (IP address), (7) the Internet service provider of the accessing system and (8) other similar data and information that assist us with protection in the event of hacking attacks on our IT systems.

When Bavaria Yachtbau GmbH uses these general data and other information, it does not draw any conclusions about the specific individual concerned. This information is used to (1) correctly deliver the contents of our Internet page, (2) optimize the contents and advertisements of our Internet page for this purpose, (3) ensure the functionality of our IT systems and the technology of our Internet page over the long term, and (4) make information relevant to criminal prosecution available to criminal prosecutors in the event of a cyber‐attack. In this case, the legal basis for data processing is Bavaria Yachtbau GmbH’s justified interest in the proper presentation of the Internet pages and prevention of attacks against the website (hacking), Art. 6 Par. 1 lett. f) EU GDPR. Such anonymously collected data are therefore evaluated by Bavaria Yachtbau GmbH statistically and with the aim to improve data protection and data security in our company, so that an optimum level of protection for the personal data processed by us can be guaranteed. The anonymous data from the server’s logfiles are stored separately from all personal data provided by the individual concerned.

6. Legal basis of the processing

Art.6 Par. 1 lett. a) GDPR forms the legal basis for processing operations in our company, for which we obtain the consent of the individual concerned for a specific processing purpose. Where the processing is necessary for the performance of a contract to which the data subject is party, which could be the case, for example, for processing operations where a delivery of goods or the delivery of a performance or counter‐performance is necessary, the legal basis for data processing is Art. 6 Par. 1 lett. b) GDPR. The same applies to such processing operations as are required for the implementation of preliminary measures such as in cases of inquiries regarding our products or services. If our company is subject to a legal obligation that necessitates the processing of personal data ‐for example, to fulfill tax‐related requirements ‐the legal basis for data processing is Art. 6 Par. 1 lett. c) EU GDPR. In rare cases, the processing of personal data is required to protect vital interests of the data subject or another natural person. This would be the case, for instance, if a visitor to our facilities were to be injured and the person’s name, age, health insurance information or other vital information would need to be passed on to a physician, hospital or other third parties. The legal basis for data processing would then be Art. 6 Par. 1 lett. d) GDPR. In the end, the legal basis for processing operations could be Art. 6 Par. 1 lett. f) EU GDPR. If processing operations are necessary to safeguard the legitimate interests of our company or a third party, and if the interests, fundamental rights and freedoms of the data subject do not outweigh the latter, Art. 6 Par. 1 lett. f) GDPR serves as legal basis forprocessing operations not covered by any of the aforementioned legal bases. We are specifically permitted to engage in such processing operations because they were specifically mentioned by the European authority. To this extent, it took the position thata justified interest could be assumed if the data subject is a customer of the controller (Recital 47 sentence 2 GDPR).

7. Duration for which the personal data will be stored

The criterion for the duration of the storage of personal data is the respective legal retention period. After expiration of this period, the corresponding data will be routinely erased unless they are no longer required for the fulfilment or initiation of the contract.

Furthermore, we can retain data if you have granted your permission for us to do this or in the event of a legal dispute and we use the evidence in the context of legal limitation periods that can extend up to thirty years; the standard limitation period amounts to three years.

8. Registration at our Internet site

Thedata subject has the option to register at the controller’s website by providing personal data. Precisely which personal data are transmitted to the controller depends on the respective input mask used for the registration. The personal data entered by the data subject are collected and stored exclusively for internal use by the controller and for internal purposes. In this case, the legal basis for data processing is Art. 6 Par. 1 letts. a), b) EU GDPR. The controller can permit the data to be shared withone or more service providers who must be exclusively to internal use of the data, which is attributable to the controller. The prescribed data protection contract has been concluded with all service providers.

In the process of registering at the controller’s website, the IP address provided by the data subject’s internet service provider (ISP), is stored along with the date and time of registration. These data are stored based on the assumption that the misuse of our services can be prevented only in this way and that these data, if needed, facilitate detection when criminal acts are committed. To this extent, storage of these data is required to protect the controller. In principle, sharing of these data with third parties will not take place unless there is a legal obligation to share the data or the data sharing facilitates criminal prosecution.

Registration of the data subject through voluntary provision of personal data allows the controller to offer the data subject contents or services that can onlybe offered to registered users based on the nature of these contents or services. Registered persons have the option at any time to modify the personal data they have provided or to have these completely erased from the controller’s data inventory.

Upon the data subject’s request, the controller will provide him or her with information concerning storage of the specific personal data relevant to the data subject. Moreover, the controller will rectify or erase personal data upon the request or instruction of the data subject to the extent that such action does not conflict with legal retention obligations. In this context, all employees of the controller are available to the data subject as points of contact.

9. Subscribing to our newsletter

At the Bavaria Yachtbau GmbH website, users are given the opportunity to subscribe to our company newsletter. In the newsletter subscription process, precisely which personal data are transmitted to the controller depends on the respective input mask used for the registration.

In this process, the principle of data economy is followed, and the sole absolute requirement when you subscribe to the newsletter is for your email address. All other information is voluntary and not required when you subscribe to the newsletter.

Bavaria Yachtbau GmbH periodically uses its newsletter to inform its customers and business partners regarding company offers. In principle, our company newsletter can only be received by data subjects if (1) the data subject has a valid email address and (2) the data subject is registered to receive the newsletter. For legal purposes, a confirmation email is sent to the data subject in connection with the initial sending of the newsletter by means of a double opt‐in procedure. This confirmation email servesto check whether the owner of the email address as the data subject has authorized the reception of the newsletter. The legal basis for data processing and the distribution of the newsletter is your consent, Art. 6 Par. 1 lett. a) EU GDPR.

In the newsletter registration process, we also store information from the IP address issued by the internet service provider (ISP) related to the computer system used by the data subject at the time of registration as well as the date and time of registration. Collection of these data is required to be able recognize any (possible) later misuse of a data subject’s email address, and it therefore serves as a legal protection for the data controller.

The personal data collected in the context of registration for the newsletter are used exclusively to send our newsletter. Moreover, newsletter subscribers may be informed by email as required for the operation of the newsletter service or a related registration regarding what could happen in the case of changes to the newsletter offer or changes in technical factors. No personal data are shared with third parties in the context of the newsletter service. Subscription to our newsletter can be cancelled by the data subject at any time. Consent to the storage of personal data thatthe data subject has provided us in connection with the sending of the newsletter can be revoked at any time. Every newsletter contains a link that can be used to revoke consent. A further option exists to unsubscribe from the newsletter directly at the controller’s website or to communicate this request to the controller in other ways.

10. Newsletter tracking

Bavaria Yachtbau GmbH newsletters contain ‘tracking pixels’. A tracking pixel is a miniature graphic embedded in emails sent in HTML format to enable log filerecording and log fileanalysis. In this way, a statistical evaluation of the success or failure of on-line marketing campaigns can be performed. Through the use of the embedded tracking pixel, Bavaria Yachtbau GmbH can recognize whether and when an email from a data subject was opened and which links contained in the email were followed by the data subject.

The personal data collected by means of the tracking pixels contained in the newsletters are stored and evaluated by the data controller for the purpose of optimizing the sending of the newsletter and modifying the content of future newsletters for a better match with the data subject’s interests. The legal basis for data processing is Art. 6 Par. 1 lett. a) EU GDPR. These personal data are not shared with third parties. Data subjects are entitled at any time to revoke the consent they have separately provided via the double opt‐in procedure. Following revocation, these personal data will be erased by the data controller. Bavaria Yachtbau GmbHautomatically regards any unsubscription from receipt of the newsletter as a revocation.

11. How to reach us using the website

Due to legal requirements, the Bavaria Yachtbau GmbH website contains information that facilitates rapid electronic contact with our company and direct communication with us by means of a general email address. If a data subject contacts the controller via email or a contact form, the personal data provided by the data subject are automatically stored. Such personal data provided voluntarily by a data subject to the controller are stored for the purpose of processing or to contact the data subject. The legal basis for data processing is Art. 6 Par. 1 letts. a), b) EU GDPR.

To the extent required to respond to your concerns, we will share your request with our dealers as necessary.

You also have the option to use our website to search for a dealer near you. For this purpose, you can display the nearest dealer on an interactive map by entering your postal code. We display this by using the Google Maps service. The functioning of this service is described in detail below under the item „Data protection policy on the use and application of Google Maps”.

Our website also offers the option to conduct a sample credit calculation for thepurposes of financing. No personal data are collected or stored to perform this calculation. To protect our website, however (see Item 5), your IP address is collected. Credit financing and the offer take place via the website of our cooperating partner, go boating Finanzierungsmakler GmbH, to which you can connect by clicking on „Request a sample quote now.”

12. Routine erasure and blocking of personal data

The controller may process and store the personal data of the data subject only for the period of time necessary to achieve the required storage purpose or where provided for by the European authority issuing directives and regulations or any other legislator under the laws or regulations to which the controller is subject.

If the purpose of storage nolonger applies or if a storage period prescribed by the European authority issuing directives and regulations or another permissible legislator expires, the personal data will be blocked or erased routinely and in accordance with the statutory provisions.

Furthermore, we can retain data if you have granted your permission for us to do this or in the event of a legal dispute, and we use the evidence in the context of legal limitation periods that can extend up to thirty years; the standard limitation periodamounts to three years.

13. Rights of the data subject

a) Right to confirmation

Every person subject to the processing of personal data has a right guaranteed by the European authority issuing directives and regulations to demand confirmation by the data controller regarding whether it is processing data related to the data subject.

b) Right to information

Every person subject to the processing of personal data has a right guaranteed by the European authority issuing directives and regulations to obtain information at any time from the data controller and at no cost regarding the personal data relevant to the data subject as well as a copy of that information. Moreover, the European authority issuing directives and regulations must provide the datasubject with the following information:

• Purposes of the processing
• Categories of personal data that are being processed
• Recipients or categories of recipients to which the personal data have been divulged or are still to be divulged, especially recipientsin third countries or receiving international organizations
• Where possible, the anticipated duration for which the personal data are to be stored or, where this is not possible, the criteria for determining this duration
• The existence of a right to rectification or erasure of the data subject’s personal data or to restriction of processing by the data controller or a right to object to this processing
• The existence of a right to lodge a complaint with a supervisory authority
• If the personal data were not collected from the data subject: All available information regarding the source of the data
• The existence of automated decision making including profiling in accordance with Art. 22 Pars. 1, 4 EU GDPR and, at least in these cases, meaningful information about the logic applied as well as the implications and envisaged effects of such processing on the data subject

Moreover, the data subject is entitled to information as to whether the personal data were transferred to a third country or an international organization. To the extent that this is the case, the data subject is also entitled to receive information concerning the appropriate guarantees connected with the transfer.

c) Right to rectification

Every person subject to the processing of personal data has a right guaranteed by the European authority issuing directives and regulations to demand immediate rectification of inaccurate personal data connected to the data subject. Moreover, taking into account the purposes of the processing, the data subject has the right to demand that incomplete personal data be completed, including by means of providing a supplementary statement.

d) Right to erasure (right to be forgotten)

Every person subject to the processing of personal data has a right guaranteed by the European authority issuing directives and regulations has the right to demand that the data controller immediately erase personal data connected to the data subject to the extentthat any of the following reasons applies and provided processing is not required:

• The personal data were collected for purposes or in a manner no that are/is no longer necessary.
• The data subject revokes the consent on which processing is based in accordance with Art. 6 Par. 1 lett. a) EU GDPR or Art. 9 Par. 2 lett. a) EU GDPR, and no other legal basis for the data processing exists.
• The data subject objects to the processing in accordance with Art. 21 Par. 1 GDPR and there is no other overriding justified basis for the processing or the data subject objects to the processing in accordance with Art. 21 Par. 2 GDPR.
• The personal data were unlawfully processed.
• Erasure of the personal data is required to fulfill a legal obligation pursuant to EU Law or of the law of the member states to which the data controller is subject.
• The personal data were gathered pursuant to services offered by the information company in accordance with Art. 8 Par. 1 GDPR.

If the personal data were made public by Bavaria Yachtbau GmbH and our company is responsible as the controller in accordance with Art. 17 Par. 1 GDPR for erasing the personal data, Bavaria Yachtbau GmbH will take reasonable steps in keeping with available technology and implementation costs to notify other data controllers processing the divulged personal data that the data subject has demanded that these other controllers erase all links to these personal data or copies or replications of these personal data where processing is not required.

e) Right to restriction of processing

Every person subject to the processing of personal data has a right guaranteed by the European authority issuing directives and regulations to demand that the data controller restrict the processing of the data where any of the following prerequisites apply:

• The accuracy of the personal data is contested by the data subject, for a period sufficient for the controller to verify the accuracy of the personal data.
• The processing is unlawful, and the data subject opposes the erasure of the personal data and instead requests the restriction of the use of the personal data.
• The controller no longer requires the personal data for the purposes of the processing, but the data subject requires the data for the assertion, exercise or defense of legal claims.
• The data subject has objected to the processing in accordance with Art. 21 Par. 1 GDPR and a determination has not yet been made whether the justified interests of the data controller outweigh those of the data subject.

f) Right to data portability

Every person subject to the processing of personal data has a right guaranteed by the European authority issuing directives and regulations to receive the relevant personal data made available by the data subject to a data controller in a structured, current and machine‐readable format. The data subject is also entitled to transfer these data to another data controller without hindrance by the data controller to which the personal data were made available, to the extent that processing is based on Art. 6 Par. 1 lett. a) GDPR or Art. 9 Par. 2 lett. a) GDPR or on a contract in accordance with Art. 6 Par. 1 lett. b) GDPR and the processing takes place automatically, unless processing is required for the performance of a duty that lies in the public interest or occurs in the exercise of public authority that was delegated to the data controller.

Moreover, in the exercise of its right to data portability in accordance with Art. 20 Par. 1 GDPR, the data subject is entitled to have those data transmitted to another controller to the extent that this is technically feasible and does notadversely affect the rights and freedoms of other persons.

g) Right to object

Every person subject to the processing of personal data has a right guaranteed by the European authority issuing directives and regulations to object at any time, for reasons relating to his or her particular situation, to the processing of relevant personal data based on Art. 6 Par. 1 letts. e), f) GDPR. This also applies to profiling based on those provisions.

In the event of an objection, Bavaria Yachtbau GmbH will no longer process personal data unless we can provide compelling reasons worthy of protection for the processing which outweigh the interests, rights and freedoms of the data subject or unless the processing is in support of the assertion, exercise or defense of legal claims.

Where personal data are processed by Bavaria Yachtbau GmbH for the promotion of direct marketing, the data subject has the right to object at any time to the processing of personal data for the purpose of such marketing. This also applies to profiling to the extent that it is related to the direct marketing. Where the data subject objects to Bavaria Yachtbau GmbH’s processing of personal data for direct marketing purposes, Bavaria Yachtbau GmbH will no longer process the personal data for those purposes.

Furthermore, where personal data are processed by Bavaria Yachtbau GmbH for scientific or historical research purposes or statistical purposes pursuant to Art. 89 Par. 1 GDPR, the data subject, for reasons relating to his or her particular situation, has the right to object to processing of relevant personal data unless the processing is necessary for the performance of a duty carried out in the public interest.

h) Automated decisions in individual cases including profiling

Every person subject tothe processing of personal data has a right guaranteed by the European authority issuing directives and regulations not to be subjected to decisions supported by automatic processing, including profiling, that carry legal effect against the data subject or that has a significant adverse effect, to the extent that the decision (1) is not required for the conclusion or fulfillment of a contract between the data subject and the data controller or (2) is permitted based on the legal provisions of the EU or theMember States to which the data controller is subject and these legal provisions contain reasonable measures to safeguard the rights and freedoms as well as the legitimate interest of the data subject, or (3) takes place with the express consent of the data subject.

Where the decision (1) is required for the conclusion or fulfillment of a contract between the data subject and the data controller or (2) takes place with the express consent of the data subject, Bavaria Yachtbau GmbH will take reasonable steps to protect the rights and freedoms as well as justified interests of the data subject, minimally including the right to intervention by a person on behalf of the data controller to present its own perspective and defend the decision.

i) Right to revoke consent under data protection law

Every person subject to the processing of personal data has a right guaranteed by the European authority issuing directives and regulations to revoke consent to the processing of personal data at any time.

j) Assertion of data subject rights

To assert rights detailed under Item 11, the data subject can email Bavaria Yachtbau GmbH at datenschutz@bavariayachts.com or send correspondence by mail to Bavaria Yachtbau GmbH, Bavariastrasse 1, 97232 Giebelstadt. In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, the data subject is entitled to exercise the right to object by automated procedures that use technical specifications.

Should the data subject assert the right to revoke consent, contact can be made at any time with an employee of the data controller responsible for the processing.

14. Data protection for applications and application procedures

The data controller collects and processes the personal data of applicants for the purposes of processing the application. This processing may also be carried out electronically. This is particularly the case if an applicant sends application documents electronically to the person responsible -for example, by email to the data controller responsible for processing it. If the controller enters into an employment contract with an applicant, the transmitted data are stored for the purpose of processing the employment relationship in compliance with the statutory provisions. The legal basis for data processing is Art. 6 Par. 1 lett. b) EU GDPR. If the data controller does not conclude an employment contract with the applicant, the application documents will be automatically erasedtwo months after notification of the decision of refusal, provided that no other legitimate interests of the data controller stand in the way of the erasure. Another legitimate interest in this sense would be, for example, a burden of proof in legal proceedings under the General Equal Treatment Act (GETA).

15. Transparency and information obligations for applicants with Bavaria Yachtbau GmbH

Categories of data/data sources

We process the following personal data within the framework of applications:

Your master data (first name/surname, if applicable: name affixes)

Contact data (address, e-mail address, telephone number)

Data concerning your qualification (CV, covering letter, certificates)

If applicable, photo/work permit/residence title, date of birth

As a matter of principle, we collect your personal data directly from you as part of the application process.

(1) In certain constellations, your personal data may exceptionally also be collected from other sources such as recruitment agencies.

We also use personal data that we have legitimately obtained from publicly accessible directories, (e.g. professional networks)

(2) In some cases we work together with personnel service providers / headhunters, from whom we receive the relevant application documents as part of the recruitment process.

Purposes and lawfulness of data processing

When processing your personal data, the provisions of the GDPR, local data protection laws and all other legal provisions (labor law, equal treatment act, etc.) are always observed.

We are aware of the importance of your data. Your personal data will be used solely for the purpose of the effective and correct handling of the application process and for contacting you in the context of the application process.

In addition, we process your data if we have a legal obligation to do so, in particular from labor law. Processing of special categories of personal data within the meaning of Art. 9 (1) GDPR only takes place if it is required by law and if there is no reason to assume that your interest in excluding such processing prevails.

Your consent also constitutes an agreement for data processing. If you have given us your consent (e.g. for longer storage of the application documents in our applicant pool) we will process your data for this purpose as well. If we obtain your consent, we will naturally inform you about the specific purpose of the data processing and your right of withdrawal. Should the consent also refer to the processing of special categories of personal data acc. Article 9 EU-DS-GVO, we will explicitly inform you in advance.

Duration of data storage

As soon as your data is no longer needed for the application process, the above-mentioned purposes or upon revocation of your consent. Should we enter into an employment relationship with you, the relevant applicant data will be stored with us if they are still relevant for the employment relationship. If we unfortunately have to reject your application, we will delete your application documents at the latest 6 months.

Data recipients/categories of recipients

In our company, we make sure that only those departments and individuals receive your data that need them for application process or to fulfil legal obligations.

If the applicant data will be forwarded to other bodies (e.g. HR service providers), please complete accordingly, that required agreement of data protection has been completed.

Transmission in legal cases to certain public authorities is possible, e.g. taxation authority or law enforcement agency.

Intention to transfer data to a third country

Data transfer to third countries (outside the European Union or the European Economic Area) only takes place if you have given us your consent or if this is required by law.

We do not transmit your personal data to service providers or allied company outside the European Economic Area.

Rights of data subjects

Your rights as a data subject are set out in Articles 15–22 GDPR, and include:

The right to access (Art. 15 GDPR)

The right to erasure (Art. 17 GDPR)

The right to rectification (Art. 16 GDPR)

The right to data portability (Art. 20 GDPR)

The right to object to processing (Art. 21 GDPR)

The right to restriction of processing (Art. 18 GDPR)

To exercise these rights, please contact: datenschutz@bavariayachts.com. The same applies if you have questions about data processing in our company. You also have the right to lodge a complaint with a supervisory authority.

Obligation to provide data

It is not possible to decide on the conclusion of an employment relationship – the chances of success of an application – without the provision of certain personal information and data. e.g. your CV. Though we respect the principle of data minimization and data avoidance by providing us with only the data we need for a complete review of your application documents or when we are required by law to collect them.

Without those data, we are unfortunately not able to check your application documents. Of course, you have the opportunity to voluntarily provide further information in your application documents.

Automated individual decision-making

We do not use any automated decision-making

16. Sales: Transparency and information obligations for customers, clients, contractual partners and interested parties of Bavaria Yachtbau GmbH

Categories of data/data origins

We process the following personal data within the framework of the contractual relationship and for the initiation of a business relationship:

For business customers:

Contact data (e.g. first/surname of current and previous contact persons, if applicable, name affixes, company name and address of partner, telephone number including extensions, business e-mail address)

Occupational data (e.g. department including position)

Company information: supplier self-assessment, delivery history

Bank details

For private customers:

Master data (e.g. first/surname, if applicable name affixes and date of birth)

Contact details (e.g. private address: street, postal code, city; if applicable: mobile and landline telephone number, e-mail address, fax number)

Deviating delivery/invoice address (e.g. address, if applicable: name, telephone number and e-mail address

Purchase order history

If applicable, bank details (in the context of a SEPA direct debit mandate also first/surname of the account holder

If applicable, preferred payment system, information on credit risk assessment

Product group, area of operation

As a matter of principle, we collect your personal data directly from you within the framework of current contractual transactions and the underlying relationship or in the framework of the initiation of a business relationship. In certain constellations, your personal data may exceptionally also be collected from other sources. This includes event-related queries on relevant information from credit agencies, in particular with regard to credit risk assessments and former credit behavior (Creditreform).

Purposes and lawfulness of data processing

When processing your personal data, the provisions of the GDPR, local data protection laws and other relevant legal provisions are always observed.

Your personal data is exclusively processed for the execution of pre-contractual measures (e.g. for the preparation of offers for products or services) and/or for the fulfilment of contractual obligations (e.g. for the execution of our services or for sales/order/payment processing) (Art. 6 (1) lit. b GDPR) or if there is a legal obligation for processing (e.g. due to tax regulations) (Art. 6 (1) lit. c GDPR). Personal data was originally collected for these purposes.

Bavaria Yachtbau GmbH would like to maintain a relationship to its customers and send information and offers on products and services. We therefore use your data to email you relevant information and offers (Art. para 1 lit. f GDPR).

Your personal data will only be processed for the detection of criminal offences if the requirements of Art. 10 GDPR are met.

Duration of data storage

We will delete data as soon as your data is no longer needed for the above-mentioned purposes or in the event that you revoked your consent. Data will only be stored beyond the existence of the contractual relationship only in cases in which we are either obliged or entitled to do so. Regulations, which oblige us to keep data, can for example be found in commercial or tax laws. This may result in a storage period of up to ten years. In addition, statutory limitation periods must be observed.

Data recipients/categories of recipients

In our company, we make sure that only those departments and individuals receive your data that need them to fulfil contractual and legal obligations.

In certain cases, service providers support our specialist departments in fulfilling their tasks. In this case, the necessary data protection agreements have been concluded with all service providers. (IT, shipment, payment, credit check, data collection).

In addition, we are obliged in cases provided by law to transmit certain information to public authorities such as: tax authorities, law enforcement authorities and customs authorities.

Intention to transfer data to a third country

A transfer of data to third countries (outside the European Union or the European Economic Area) only takes place if this is necessary for the execution of the underlying relationship or required by law or if you have given us your consent.

We transfer your personal data to group companies outside the European Economic Area, namely around the world (Bavaria network / organizations).

Compliance with the data protection level is ensured by: e.g. EU standard contractual clauses/ binding corporate rules, etc.

Rights of data subjects

Your rights as a data subject are set out in Articles 15–22 GDPR, and include:

The right to access (Art. 15 GDPR)

The right to erasure (Art. 17 GDPR)

The right to rectification (Art. 16 GDPR)

The right to data portability (Art. 20 GDPR)

The right to object to processing (Art. 21 GDPR)

The right to restriction of processing (Art. 18 GDPR)

To exercise these rights, please contact: Datenschutz@bavariayachts.com. The same applies if you have questions about data processing in our company. You also have the right to lodge a complaint with a supervisory authority.

Obligation to provide data

Certain personal data needs to be provided in the framework of our contractual/business relationship as such data are necessary for the establishment, execution and termination of the contractual relationship and the fulfilment of the associated contractual and legal obligations. Without the provision of such data, an execution of the above tasks and duties is not possible.

Automated individual decision-making

We do not use any automated decision-making.

17. Purchase: Transparency and information obligations for customers, clients, contractual partners and interested parties of Bavaria Yachtbau GmbH

Categories of data/data origins

We process the following personal data within the framework of the contractual relationship and for the initiation of a business relationship:

For business customers:

Contact data (e.g. first/surname of current and previous contact persons, if applicable, name affixes, company name and address of partner, telephone number including extensions, business e-mail address)

Occupational data (e.g. department including position)

bank details (in the context of a SEPA direct debit mandate - refund processes)

company information: sales history, credit check, supplier self-assessment, delivery history

product-related data: drawings, specifications, data sheets

As a matter of principle, we collect your personal data directly from you within the framework of current contractual transactions and the underlying relationship or in the framework of the initiation of a business relationship. In certain constellations, your personal data may exceptionally also be collected from other sources. This includes event-related queries on relevant information from credit agencies, in particular with regard to credit risk assessments and former credit behavior (Creditreform).

Purposes and lawfulness of data processing

When processing your personal data, the provisions of the GDPR, local data protection laws and other relevant legal provisions are always observed.

Your personal data is exclusively processed for the execution of pre-contractual measures (e.g. for the preparation of offers for products or services) and/or for the fulfilment of contractual obligations (e.g. for the execution of our services or for sales/order/payment processing) (Art. 6 (1) lit. b GDPR) or if there is a legal obligation for processing (e.g. due to tax regulations) (Art. 6 (1) lit. c GDPR). Personal data was originally collected for these purposes.

Of course, your consent may also constitute a legal basis for the processing of your personal data (Art. 6 (1) lit. a GDPR). Before you grant such consent, we will inform you about the purpose of the data processing and about your right of revocation according to Art. 7 (3) GDPR.

Your personal data will only be processed for the detection of criminal offences if the requirements of Art. 10 GDPR are met.

Duration of data storage

We will delete data as soon as your data is no longer needed for the above-mentioned purposes or in the event that you revoked your consent. Data will only be stored beyond the existence of the contractual relationship only in cases in which we are either obliged or entitled to do so. Regulations, which oblige us to keep data, can for example be found in commercial or tax laws. This may result in a storage period of up to ten years. In addition, statutory limitation periods must be observed.

Data recipients/categories of recipients

In our company, we make sure that only those departments and individuals receive your data that need them to fulfil contractual and legal obligations.

In certain cases, service providers support our specialist departments in fulfilling their tasks. In this case, the necessary data protection agreements have been concluded with all service providers. (Procurement, IT, shipment, payment, insurance, credit check).

In addition, we are obliged in cases provided by law to transmit certain information to public authorities such as: tax authorities, law enforcement authorities and customs authorities.

Intention to transfer data to a third country

A transfer of data to third countries (outside the European Union or the European Economic Area) only takes place if this is necessary for the execution of the underlying relationship or required by law or if you have given us your consent.

We do not transfer your personal data to any service provider or to affiliates outside the European Economic Area.

Rights of data subjects

Your rights as a data subject are set out in Articles 15–22 GDPR, and include:

The right to access (Art. 15 GDPR)

The right to erasure (Art. 17 GDPR)

The right to rectification (Art. 16 GDPR)

The right to data portability (Art. 20 GDPR)

The right to object to processing (Art. 21 GDPR)

The right to restriction of processing (Art. 18 GDPR)

To exercise these rights, please contact: Datenschutz@bavariayachts.com. The same applies if you have questions about data processing in our company. You also have the right to lodge a complaint with a supervisory authority.

Obligation to provide data

Certain personal data needs to be provided in the framework of our contractual/business relationship as such data are necessary for the establishment, execution and termination of the contractual relationship and the fulfilment of the associated contractual and legal obligations. Without the provision of such data, an execution of the above tasks and duties is not possible.

Automated individual decision-making

We do not use any automated decision-making.

18. Data protection policy on the use and application of Facebook Custom Audiences („Facebook pixels“)

Facebook Inc., 1Hacker Way, Menlo Park, CA 94025, United States or, for those residing within the EU, Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

The data processing is based on your consent in accordance with Art. 6 Par. 1 lett. a) EU GDPR. You can revoke your consentHERE at any time.

Facebook Inc. may transfer any personal data to the United States. However, Facebook is certified under the Privacy Shield framework(https://www.privacyshield.gov/participant?id=a2zt0000000GnywAAC&status=Active. Under this framework, Facebook undertakes a commitment to observe EU data protection standards.

You can enable Facebook and its partners to activate ad impressions on and outside of Facebook. A cookie can be stored on your computer for this purpose. We use the Facebook pixel to display ad impressions delivered by us only to users that have also visited our Internet page or that have certain features that we transmit to Facebook. Through the use of the Facebook pixel, it is possible to designate our Internet page visitors as a target group for the display of ad impressions.

Through the use of the Facebook pixel, your behavior can be tracked across multiple sites once you have viewed or clicked on a Facebook ad impression. This behavior permits the evaluation of the effectiveness of the Facebook ad impression for statistical and market research purposes and can contribute to the optimization of future marketing efforts.

The processing of data by Facebook takes place in the context of the Facebook Data Policy: https://www.facebook.com/policy. You may obtain specific information regarding the Facebook pixel and how it works here: https://www.facebook.com/business/help/651294705016616.

19. Data protection policy on the use and application of Google Analytics (with anonymization)

At our website, we use the Google Analytics tracking tool at Google Ireland Limited. Through the use of this tool, your user interactions with our website are collected and systematically evaluated.

In this process, the following data relevant to you are stored:

The first three bytes of your IP address

Your assigned Google Analytics ID

The website being accessed

The referrer (the website you used to access our website)

Other sub-pages you accessed

Time spent at the website

Frequency of website access

Browser type

Language settings

Device and operating system

The legal basis for processing your personal data is your consent in accordance with Art. 6 Par. 1 lett. a) EU GDPR. You can revoke your consent HERE at any time.

The purpose of theprocessing of your personal data by the Google Analytics service is to analyze the interaction of our website visitors with our website. Such an evaluation of the data collected in this manner allows us to optimize our offer and increase user‐friendliness.

We erase the data collected through Google Analytics once these data are no longer required for our purposes. This will occur within no more than 26 months.

20. Data protection policy on the use and application of Google Maps

At our website, we use Google Maps (API) at Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google”). To ensure data protection, Google Maps is deactivated when you visit this website for the first time. A direct connection to the Google servers is established only when you independently activate Google Maps (consent in accordance with Art. 6 Par. 1 lett. a) EU GDPR). You can revoke your consent HERE at any time. In this way, your data are prevented from being sent when you visit the Google site for the first time. Following activation, Google Maps will store your IP address. This information is generally transmitted to a Google server in the United States and stored there.

Google is a certified participant in the EU‐United States Privacy Shield framework and has committed itself to handle all personal data received from European Union (EU) Member States in accordance with the Privacy Shield framework in compliance with the applicable principles of that framework. You can find more information on managing user databy consulting the Google privacy policy: https://www.google.de/intl/de/policies/privacy/

21. Data protection policy regarding conversion tracking and remarketing using Google Ads and Google Tag Manager

At our website, we useThe Google Ads (formerly Google AdWords) marketing service of Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, United States; „Google“). If you reside in the European Economic Area or Switzerland, Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) is the controller responsible for data collected by means of this procedure. Using the type display network, shopping and search functions active at our site, your interactions with ad impressions activated at Google are measured. In this process, whenever you click on one of our advertisements placed at Google, a cookie is deposited in your browser. This is used to track your further activity regarding the product displayed in the advertisement (conversion tracking). Using these data, we can measure the effectiveness of our promotional campaigns. The following data are collected from you: a unique ID, the number/frequency of ad impressions delivered to you, and the actions/clicks you executed.

In addition, we use the remarketing function within theGoogle Ads service. With the remarketing function, we can present users of our website with ad impressions at other websites within the Google Ad network („Google Ads“ or those on other websites) in the Google Search or on YouTube, based on their interests. To accomplish this, the users’ interaction at our website is analyzed ‐for example, the offers in which the user has expressed an interest ‐to be able to display targeted advertising on other websites even after the visit to our own website. Google does this by storing a piece of data in the browsers of users who visit certain Google services or websites in the Google display network. Through the use of this piece of data, known as a „cookie“, the visits of these users are collected. This piece of datais used as a unique identifier of a web browser on a specific terminal and not to identify a person.

The Google Tag Manager performs the administration and control of various tags. To accomplish this, it deposits a cookie in your browser. The tag manager solely administers other tags and does not itself collect any personal data.

The use of Google Tools is based on your consent in accordance with Art. 6 Par. 1 lett. a) EU GDPR. You can revoke your consentHERE at any time. The revocation is valid solely for the device and web browser on which it was deposited; please repeat the process as necessary on alldevices. If you erase the opt-out cookie, you will be asked once more to give your consent to the data transmission.

In addition, you can configure your browser accordingly to prevent third‐party advertisements. You can also permanently prevent Google tracking by using the appropriate plug‐in for current web browsers that you will need to download and install here: https://support.google.com/ads/answer/7395996

Your data will be transmitted to Google for evaluation. If you have a Google account, Google can also compile the data it receives from tracking. Transmittal to third countries occurs; to learn more, see: Transmittal to third countries / Purpose of transmittal to third countries. Based on EU GDPR, we have concluded a related agreement for order processing.

The data collected by means of this procedure will be erased once these data are no longer required for our purposes. In our case, this will occur within no more than 24 months.

You can view more detailed information on Google as well as the Google privacy policy at: www.google.com/privacy/ads/

22. Data protection policy on the use and application of Instagram

The party responsible for data processing has integrated components of the Instagram service at this Internet page. Instagram is a service that may be classified as an audiovisual platform which allows users to share photos and videos, as well as disseminate such data in other social networks.

Instagram is operated by Instagram LLC, 1 Hacker Way, Building 14 First Floor, Menlo Park, CA, USA.

Whenever a person loads an individual page on this site, which is operated by the controller and in which an Instagram component (Insta‐button) is integrated, the Internet browser on the data subject’s IT system is automatically prompted by the relevant Instagram component to download a display of the corresponding Instagram component from Instagram. During the course of this technical procedure, Instagram is made aware of which specific subpage of our website was visited by the data subject.

If the data subject is logged in at the same time on Instagram, every time the website is called up by the data subject—and for the entire duration of their stay on our Internet site ‐Instagram detects which specific subpage was visited by the data subject. This information is collected by the Instagram component and associated by Instagram with the particular Instagram account of the data subject. If the data subject clicks on one of the Instagram buttons integrated on our website, Instagram assigns the data thus transmitted and the information to the personal Instagram user account of the data subject and stores and processes the personal data.

If you are logged into Instagram when you access our website, Instagram will always be notified via the Instagram component that you have visited our website; this occurs whether or not you have clicked on anInstagram component. If the data subject does not want such a transmission of information to Instagram, then he or she may prevent this by logging off from his/her Instagram account before a call‐up to our website is made.

More information about Instagram’s current Data Protection Policy can be retrieved underhttps://help.instagram.com/155833707900388 and https://www.instagram.com/about/legal/privacy/.

23. Data protection policy on the use and application of YouTube

The party responsible for data processing has integrated components of YouTube at this Internet page. YouTube is an internet video portal that gives video publishers the opportunity to post video clips free of charge and enables other users to watch, evaluate and comment on these video clips also free of charge. YouTube permits publication of all types of videos, which is why entire films and TV shows, but also music videos, trailers or user-produced videos can be viewed via the internet portal.

YouTube is operated by YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. YouTube, LLC is a subsidiary of Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043–1351, USA.

Each time someone loads an individual page on this site which is operated by the controller and in which a YouTube component (YouTube video) is integrated, the internet browser on the data subject’s IT system is automatically prompted by the relevant YouTube component to download a display of the corresponding YouTube component from YouTube. More information about YouTube can be retrieved under https://www.youtube.com/yt/about/de/. During the course of this technical procedure, YouTube and Google are made aware of which specific subpage of our website was visited by the data subject.

If the data subject is logged into a YouTube account at the same time, YouTube will detect which specific subpage of our website the data subject is visiting when a subpage is accessed that contains a YouTube video. This information is collected by YouTube and Google and associated with the particular YouTube account of the data subject.

If the data subject is logged into YouTube when accessing our website, YouTube and Google will always be notified via the YouTube component that has been visited our website; this occurs whether or not a YouTube video has been clicked. If the data subject does notwish for such information to be transmitted to YouTube, then he or she may prevent this by logging off from his/her YouTube account before a call‐up to our website is made.

The data protection guidelines published by YouTube, which can be retrieved under https://www.google.de/intl/de/policies/privacy/, provide information concerning the collection, processing and use of personal data by YouTube and Google.

24. Legal or contractual provisions governing the provision of personal data; necessity for the conclusion of a contract; obligation on the part of the data subject to provide personal data; possible consequences of not providing the data

We will inform you if the provision of personal data is in part required by law (e. g., tax regulations) or may result from contractual provisions (e. g., information on the contractual partner). It may be necessary at times for a contract to be concluded for a data subject to provide us with personal data which must subsequently be processed by us. For example, the data subject is required to provide us with personal data when our company concludes a contract with the data subject. Failure to provide personal data would mean that the contract cannot be concluded with the data subject. The data subject must contact one of our employees before providing personal data to the company. Our employee will inform the data subject on a case‐by‐case basis as to whether provision of personal data is required by law or contract or is necessary for the conclusion of a contract, whether there is an obligation to provide personal data and what consequences the failure to provide personal data may have.

25. Existence of automated decision‐making

As a company that is conscious of its responsibility, we reject automated decision‐making and profiling.

This privacy policy was created by the privacy policy generator of Deutsche Gesellschaft für Datenschutz GmbH (DGD), which serves as an authorized external representative for data protection in Landshut in cooperation with IT/privacy law attorney Christian Solmecke.

26. Privacy policy / information data protection in the social media

Bavaria Yachtbau GmbH maintains a presence on „social media.“ Where we control the processing of your data, we ensure that applicable data protection provisions are observed. With respect to our presence, you will find the key information on privacy law below.

Nachfolgend finden Sie in Bezug auf unsere Auftritte die wichtigsten Informationen zum Datenschutzrecht.

Name and address of the individuals responsible for operation

Besides Bavaria Yachtbau GmbH, those responsible for the company’s presence in the sense of the General Data Protection Regulation (GDPR) as well as other privacy provisions include:

Facebook: (Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland)

Instagram: (Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland)

Youtube: (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland)

You use these platforms and their functions on your own responsibility, however. This specifically applies to use of interactive functions (such as commenting, sharing, assessing).

We advise you that your data can thereby be processed outside the area of the European Union. With respect to providers in the United States that hold certification under the „Privacy Shield“, we point out that these providers have pledged to uphold the data protection standards of the EU.

Purpose and legal basis

We maintain our own fan pages to communicate with visitors and inform them in this way concerning our offers.

In addition, we collect data for statistical purposes to be able to develop and optimize the contents and increase the attractiveness of our offer. The data required for us to do this (such as total page views, page activities and data provided by visitors, interactions) are processed and made available by the social networks. We have no influence on their creation or presentation.

In addition, your personal data are processed by the social media providers for the purposes of market research and promotions. Thus it is possible for a user profile to be created, for example, based on your user behavior and the interests it reveals. In this way, ad impressions and other advertising can be activated within and outside the platforms that presumably correspond to your interests. To accomplish this, cookies are generally deposited on your computer. Regardless of this, data not directly connected at your terminals can be stored in your user profiles. Cross‐device storage and analysis can result, especially but not exclusively if you are registered as a member and logged into particular platforms.

The processing of your personal data by Bavaria Yachtbau GmbH is based on our justified interests in effective information and communication in accordance with Art. 6 Par. 1 Sentence 1 lett. f) EU GDPR.

Should you be asked for your consent to data processing ‐that is, if you give your approval by confirming a button or similar (opting in) ‐the legal basis for this processing is Art. 6 Par. 1 Sentence 1lett. a) EU GDPR, Art. 7 EU GDPR.

Your rights / Option to object

If you belong to a social network and do not wish for the network to collect data about you via our presence or to link your stored membership data to the respective network, you must

log out of the respective network prior to visiting our fan page,

erase existing cookies from the device and

close your browser and reboot the computer.

Following a new login, however, you once again become identifiable to the network as a specific user.

For a detailed presentation of processing and how to opt out of it, we refer you to the following linked information:

Facebook

Privacy policy: https://www.facebook.com/about/privacy/;

Opt-Out: https://www.facebook.com/settings?tab=ads und http://www.youronlinechoices.com;

Privacy Shield: https://help.instagram.com/519522125107875;

Opt-Out: http://www.networkadvertising.org/managing/opt_out.asp und http://www.youronlinechoices.com;

Privacy Shield: https://www.privacyshield.gov/participant?id=a2zt0000000GnywAAC&status=Active.

YouTube

Privacy policy: https://policies.google.com/privacy;

Opt-Out: https://tools.google.com/dlpage/gaoptout?hl=de und http://www.youronlinechoices.com;

Privacy Shield: https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active.

Overall, you have the following rights regarding the processing of your personal data: Right to information; right to rectification; right to erasure; right to restrict processing; right to object; right to data portability; right to lodge a complaint with the responsible data protection authority regarding unlawful processing of your personal data.

Since Bavaria Yachtbau GmbH does not have full access to your personal data, however, you should address any claims directly to the social media providers, as they have access to the respective personal data of their users and can take appropriate measures and provide information.

Should you still require assistance, we will of course attempt to support you. Please contact us atdatenschutz@bavariayachts.com.

Instructions on copyrights and art copyrights

If you wish to make public any images, texts, plans, videos, music, etc. via our Internet presence, it is important for you to know that you may be assigning all rights of usage to the network and that this may result in legal consequences for you if you are not yourself the originator or the holder of the rights.

26. Data protection information for employees

Download PDF

Categories / origin of the data

We process the following personal data as part of the employment relationship:

Contact data (e.g. private address, mobile and landline number, e-mail address)

Master data (name, date of birth, gender, nationality, parental status)

Log data generated when using the IT systems

Tax identification number, pension/social security number, health insurance

bank details

Periods of incapacity for work, time recording data and holiday periods

Work permit / residence permit

Salary and social data, secondary employment

Severe disability / equalisation

Data from the BEM procedure

Photos / video recordings

Criminal record

Qualification data

Special types of personal data: Health data, religious affiliation and, if applicable, biometric data

Purpose and legal basis of data processing

When processing your personal data, the provisions of the GDPR, the BDSG and all other legal provisions (such as BetrVG, ArbZG, etc.) are always complied with. In accordance with Art. 88 para. 1 GDPR in conjunction with. § Section 26 (1) BDSG, personal data of employees may be processed for the purposes of the employment relationship if this serves the decision on the establishment of an employment relationship or, after the establishment of the employment relationship, the implementation or termination of the employment relationship. In addition, authorisation for data processing, including special categories of personal data, may result from a law or a collective agreement, a works or service agreement (collective agreement), provided that the processing is necessary for the rights and obligations of the representation of employees' interests. Art. 88 para. 1 GDPR i.V.m. § Section 26 para. 1, 4 BDSG. The processing of your data also serves to fulfil our legal obligations as an employer under labour law, social security law and social protection law, Art. 88 para. 1 GDPR in conjunction with § Section 26 para. 3 BDSG. Your consent to data processing can of course also constitute a data protection authorisation provision. Here we will inform you about the purpose of the data processing and about your right of revocation in accordance with Art. 7 para. 3 of the GDPR, Art. 88 para. 1 GDPR i.V.m. § 26 para. 2 BDSG. If the consent also relates to the processing of special categories of personal data, we will expressly point this out to you in the consent, Art. 88 para. 1 GDPR in conjunction with Section 26 para. 3 BDSG. § 26 para. 3 BDSG. Processing of special categories of personal data within the meaning of Art. 9 para. 1 GDPR only takes place if this is required by law and there is no reason to assume that your legitimate interest in the exclusion of processing prevails, Art. 88 para. 1 GDPR i.V.m. § Section 26 para. 3 BDSG. We also process personal data to protect our legitimate interests in accordance with Art. 6 para. 1 lit. f GDPR.

In particular, to protect our company and to ensure proper and functional operation - of course, we always take your interests and rights into account in the process. Examples of such processing operations are IT security systems such as firewalls, etc. To detect criminal offences, your personal data will only be processed if there are factual indications that give rise to the suspicion that a criminal offence has been committed in the employment relationship and the processing does not conflict with any overriding interest on your part that is worthy of protection, Art. 88 para. 1 GDPR in conjunction with § Section 26 para. 1 BDSG.

Recipients of the data / transfer of data to third parties

Within BAVARIA Yachtbau GmbH, it is ensured that the data is only forwarded to those bodies that require it to fulfil contractual and legal obligations. Otherwise, data will only be passed on to third parties to the extent that BAVARIA Yachtbau GmbH is legally obliged to do so, e.g. tax authorities, health insurance companies, law enforcement authorities and customs authorities. Personal data will not be transferred to countries outside the EU/EEA.

Retention period

The transmitted data will be stored for as long as is necessary to fulfil the purpose. As soon as the data is no longer required or consent is withdrawn, it will be deleted unless BAVARIA Yachtbau GmbH has a longer-term obligation to retain this data (e.g. under commercial or tax law).

Rights of data subjects

Data subjects are entitled to the data subject rights set out in Art. 12 to Art. 23 GDPR, including the right to information (Art. 15 GDPR), to rectification (Art. 16 GDPR), to restriction of processing (Art. 18 GDPR), to erasure (Art. 17 GDPR), to data portability (Art. 20 GDPR) and to object (Art. 21 GDPR). To assert these rights, data subjects should contact datenschutz@bavariayachts.com. The same applies if you have any questions about data processing in our company or wish to withdraw your consent. Data subjects also have the right to lodge a complaint with a data protection supervisory authority.

Obligation to provide the data

If it concerns your employment with Bavaria Yachtbau GmbH, you are obliged to provide certain personal data. This is necessary for the establishment, implementation and termination of the employment relationship and the fulfilment of the associated contractual and legal obligations. It is not possible to fulfil the employment contract without providing this data.

If we process your data to protect legitimate interests, you can object to this processing at any time for reasons arising from your particular situation; this also applies to profiling based on these provisions. We will then no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or the processing serves the establishment, exercise or defence of legal claims.