98x
001467
2021-02-25

Legal Basis of Processing

Art. 6(1)(a) of the GDPR serves as the legal basis for processing operations for which our company obtains consent for a specific processing purpose. If the processing of personal data is necessary for the performance of a contract to which the data subject is a contracting party, as is the case, for example, with processing operations that are necessary for the delivery of goods or the provision of other services, Art. 6(1)(b) of the GDPR applies. The same applies to such processing operations that are necessary to take steps prior to entering into a contract; for example, in cases of inquiries about our products or services. If our company is subject to a legal obligation which requires the processing of personal data, such as for the fulfillment of tax obligations, the processing is based on Art. 6(1)(c) of the GDPR.

In rare cases, it may be necessary to process personal data in order to protect the vital interests of the data subject or another natural person. This would be the case, for example, if a visitor to our company were injured and their name, age, health insurance data, or other vital information had to be passed on to a doctor, hospital, or other third party. In such as case, the processing would be based on Art. 6(1)(d) of the GDPR. Ultimately, processing operations could be based on Art. 6(1)(f) of the GDPR. Processing operations that are not covered by any of the aforementioned legal bases are based on this legal basis, if the processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject that require the protection of personal data. Such processing operations are particularly permissible, because they have been specifically mentioned by the European legislator. In this respect, it considers that a legitimate interest could be assumed if the data subject is a client of the controller (Recital 47, Sentence 2 of the GDPR).