Data Privacy Statement

This privacy statement provides an overview of how the Arvato Systems Group (hereinafter referred to as Arvato Systems) processes your personal data as you use business applications for which your company has subscribed ("Arvato Systems Services" e.g. mobile apps).

Your company is considered to be the data controller in accordance with the EU General Data Protection Regulation, and the processing of your data by Arvato Systems as a processor is carried out according to the direct or indirect instructions of your company. It would be best if you asked your company any questions about how data about you is used within the Arvato Systems Services.

In general, personal data in Arvato Systems Services includes the following categories of data:

• Contact data, e.g., name or e-mail address
• Organizational information, such as employee identification, cost center, etc.
• Mobile phone data, e.g., information about the mobile device
• Data on use and transactions triggered by the use of the business application

Which categories of your data are recorded or derived in the Arvato Systems Services depends in part on which Arvato Systems Services your Company has acquired usage rights for and how these are configured for your company.

You provide personal data directly when you enter it in Arvato Systems Services. In some cases, another user, such as an administrator, may provide personal information on the instruction or with the permission of your company.

Arvato Systems Services may also obtain personal data from other sources, such as your company's back-office systems. In addition, Arvato Systems Services may establish connections to external partners. Through each of these connected services, personal data about you may be transferred to Arvato Systems Services. In principle, these connections are controlled by your company.

When you use Arvato Systems Services, certain information about your use and activities in the Arvato Systems Services, such as your IP address, device, or browser information, is automatically collected to facilitate technical support. 

Arvato Systems will use personal data within the Arvato Systems Services only on the instructions of your company for the following purposes:

• Provide, operate, host, maintain, connect, and optimize Arvato Systems Services and enable you to use and connect to Arvato Systems Services.
• Processing and completion of transactions in Arvato Systems Services
• Providing customer service and support
• Ensure that unauthorized persons do not gain access to Arvato Systems Services

Arvato Systems does not pursue any business purposes of its own with the processing of your data and only acts on behalf of your company.

Personal data about you in the Arvato Systems Services is available to your company and those other users, persons or third parties to whom your Company chooses to provide access. Your company may instruct Arvato Systems to make information, including personal data, available to third parties through Arvato Systems APIs. In accordance with our agreement for Arvato Systems Services, Arvato Systems is also entitled to share personal data with contractors in order to provide Arvato Systems Services.

Insofar as contractors and/or third parties outside the EU or EEA process your data for the purposes described herein, this may result in your data being transferred to a country where no data protection level appropriate to the EU or EEA can be guaranteed. However, such a level of data protection can be ensured with a suitable guarantee. When selecting contractors, Arvato Systems takes the steps agreed with your company to contractually secure an equivalent level of data protection.

The data processed by Arvato Systems will be deleted on the instructions of your company. If the data are not deleted because they are required for other and legally permissible purposes, their processing will be restricted on the instructions of your company, i.e. the data will be blocked and not processed for other purposes.

Arvato Systems complies with the applicable data protection laws in the European Economic Area. These contain, as far as they apply to you, the following rights: 

• If the processing of personal data is based on your consent, you have the right to revoke your consent at any time for future processing.
• You have the right to request access to your personal data that is currently stored, as well as to request rectification or erasure.
• You have the right to object to the processing of your personal data under certain circumstances.
• You have the right to contact a data protection authority and file a complaint.

If you have any questions about these rights or would like to exercise any of them, please contact your company.

We do not use any fully automated decision-making processes for any of the purposes described herein. No profiling takes place.

In the course of further development of Arvato Systems services, changes to this privacy policy may become necessary. We, therefore, recommend that you read this privacy policy again from time to time.