DATA PROTECTION INFORMATION FOR CUSTOMERS, INTERESTED PARTIES, BUSINESS PARTNERS AND OTHER CONTRACTING PARTIES

Data protection information regarding our processing of (prospective) customer and data of contracting parties pursuant to Articles 13, 14 and 21 of the General Data Protection Regulation (GDPR)

MBK Fincom SA

Dear customer, dear partner,
In accordance with the requirements of Art. 13, 14 and 21 of the General Data Protection Regulation (GDPR), we hereby inform you about the processing of your personal data as well as your rights under data protection law in this respect. Which data is processed in detail and how it is used depends on the requested or agreed services. To ensure that you are fully informed about the processing of your personal data in the context of the performance of a contract or the implementation of pre-contractual measures, please take note of the following information.

1. CONTROLLER IN THE CONTEXT OF DATA PROTECTION LAW
MBK Fincom SA
Via al Molino 31
6926, Collina d’Oro
https://mbkfincom.com/
[email protected]

2. CONTACT DATA OF OUR DATA PROTECTION OFFICER
PROLIANCE GmbH / datenschutzexperte.de
Data Protection Officer
Leopoldstr. 21
80802 Munich, Germany
E-Mail: [email protected]

3. PURPOSES AND LEGAL BASIS OF PROCESSING
We process your personal data in accordance with the provisions of the European General Data Protection Regulation (GDPR), insofar as it is required for the establishment, execution and performance of a contract and for the implementation of pre-contractual measures. If the processing of personal data is necessary for the initiation or execution of a contractual relationship or in the context of the execution of pre-contractual measures, the legal basis is Art. 6 Para. 1 lit. b GDPR.
If you give us your express consent to process personal data for specific purposes (e.g. disclosure to third parties, evaluation for marketing purposes or advertising), the lawfulness of this processing is based on your consent pursuant to Art. 6 para. 1 lit. a GDPR. Given consent can be revoked at any time with effect for the future (see Section 9 of this information).
If necessary and legally permissible, we may process your data beyond the actual contractual purposes to fulfil legal obligations in accordance with Art. 6 Para. 1 lit. c GDPR. In addition, processing may be carried out based on legitimate interests of us or third parties in accordance with Art. 6 Para. 1 lit. f GDPR. If necessary, we will inform you separately, stating the legitimate interest, insofar as this is required by law.

4. CATEGORIES OF PERSONAL DATA
We only process data that is related to the initiation of a contract and its fulfilment or pre-contractual measures. This may be general data about you or employees of your company (name, address, contact data, etc.) as well as further data, if necessary, which you transmit to us in the context of the initiation and fulfilment of a contract.

5. SOURCES OF DATA
We process personal data provided by you for the purpose of establishing contact, fulfilling a contractual relationship or which you provide via our online forms.

6. RECIPIENTS OF DATA
Within our company, we only pass on your personal data to those areas and employees who require this data to fulfil contractual and legal obligations or to implement our legitimate interests.
We may transfer your personal data to affiliated companies to the extent that this is permissible within the scope of the purposes and legal bases set out in section 3 of this information.
If your personal data is processed on our behalf, this processing is performed based on data processing agreements pursuant to Art. 28 of the GDPR. In these cases, we ensure that the processing of personal data is carried out according to the provisions of the GDPR. The categories of recipients in this case are (…).
Otherwise, data is only passed on to recipients outside the company if this is permitted or required by law, if the transfer is necessary to fulfil a contract or, at your request, for the implementation of pre-contractual measures, if we have your consent or if we are authorized to provide information. Under these conditions, recipients of personal data may include, for example:
• External tax advisors
• Public bodies and institutions (e.g. public prosecutor’s office, police, supervisory authorities, tax office) where there is a legal or official obligation,

7. TRANSFER TO A THIRD COUNTRY
Personal data will only be transferred to countries outside the EEA (European Economic Area) or to an international organization if this is necessary for the performance of the contract or, at your request, for the implementation of pre-contractual measures, if the transfer is required by law or if you have given us your consent. Recipients in these cases may include local agencies etc.

8. STORAGE PERIOD
If necessary, we process and store your personal data for the duration of our business relationship or for the initiation or fulfilment of contractual purposes.
In addition, we are subject to various storage and documentation obligations arising from the Swiss Civil Code, among other regulations. The retention and documentation periods prescribed there are two to ten years.
Finally, the storage period also depends on the statutory limitation periods, which are generally three years, but in certain cases can be up to thirty years.

9. YOUR RIGHTS
Every data subject has the right of access pursuant to Art. 15 GDPR, the right to rectification pursuant to Art. 16 GDPR, the right to erasure pursuant to Art. 17 GDPR, the right to restriction of processing pursuant to Art. 18 GDPR, the right to notification pursuant to Art. 19 GDPR and the right to data portability pursuant to Art. 20 GDPR.
In addition, you have the right to lodge a complaint with a data protection supervisory authority pursuant to Art. 77 GDPR if you are of the opinion that the processing of your personal data is not lawful. The right to lodge a complaint with a supervisory authority shall be without prejudice to any other administrative or judicial remedy.
If the processing of data takes place based on your consent, you are entitled to withdraw your consent to the use of your personal data at any time in accordance with Art. 7 GDPR. Please note that the withdrawal will only take effect in the future. Processing that took place before the withdrawal is not affected by this. Please also note that we may need to retain certain data for a period of time to comply with legal requirements (see Section 8 of this Privacy Policy).

Right to object
If your personal data is processed in accordance with Art. 6 para. 1 lit. f GDPR to safeguard legitimate interests, you have the right, pursuant to Art. 21 GDPR, to object to the processing of this data at any time for reasons arising from your particular situation. We will then no longer process this personal data unless we can prove compelling reasons for the processing. These must outweigh your interests, rights and freedoms; or the processing must serve the assertion, exercise or defense of legal claims.
In individual cases we process your personal data for purposes of direct advertising. You have the right to object at any time to the processing for the purpose of such advertising. This also applies to profiling in so far as it is related to this direct marketing. If you object to the processing for the purpose of direct advertising, we will not further process your personal data for these purposes.
To exercise your rights, you can contact us using the contact details provided in section 1.

10. NECESSITY OF PROVIDING PERSONAL DATA
The provision of personal data for the purpose of deciding whether to conclude a contract, perform a contract or take pre-contractual measures is voluntary. However, we can only make a decision regarding contractual measures if you provide personal data that is required for the conclusion of a contract, the performance of a contract or pre-contractual measures.

11. AUTOMATED DECISION-MAKING
The decision about the establishment, performance or execution of the business relationship or about pre-contractual measures is not exclusively based on automated processing. Hence, no automated decision in individual cases within the meaning of Art. 22 GDPR takes place.