The following is an overview of how we process your personal data and of your rights under data protection law.
(hereinafter referred to as the "Companies") are responsible for processing your personal data in accordance with data protection laws.
This information applies to your personal data as processed by the Companies within the scope of your participation in investment opportunities.
Personal data means information relating to an identified or identifiable natural person (hereinafter referred to as the "data subject"). This data protection information applies to you as a natural person if you yourself as an investor or interested party are in contact with the Companies or if you are involved as owner/shareholder, representative, employee or other contact person on behalf of investors.
If applicable, please also take into account the additional information regarding data protection. As a user of the companies' websites, please take into account the website-specific data protection statements which you can access here.
Personal data are processed by the Companies in compliance with the applicable data protection laws, in particular with the requirements of the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (Bundesdatenschutzgesetz or BDSG). Data processing is carried out for specifically defined purposes and in a lawful manner (i.e. with a legal basis). Data will only be processed for purposes other than those for which the Companies originally collected it if this is compatible with the original purposes in accordance with legal requirements, taking into account the collection context, type of data and consequences of further processing. Within the scope of their statutory duty, the Companies will inform you as appropriate about processing your data for any other purposes.
You provide personal data to the Companies for the purpose of participating in investment opportunities. In addition, if necessary, the Companies process personal data which they legitimately obtain from publicly accessible sources (e.g. land registers, trade and association registers, press, internet, etc.) or which are transmitted to them by other Doric Group companies, their business partners or other third parties.
The Companies can legitimately process the following personal data for the purposes stated below:
a) To fulfil contractual obligations (Art. 6 para. 1 lit. b) GDPR): In particular, personal data will be processed to establish and manage your participation, including any pre-contractual and post-contractual measures. This includes the use of personal data for (tax) identification, correspondence and payment purposes;
b) To fulfil a legal obligation (Art. 6 para. 1 lit. c) GDPR): The Companies must process your personal data in order to fulfil legal obligations imposed on it. These include, for example, regulatory or official requirements to which the Companies are subject (e.g. in accordance with the Anti-Money Laundering Act) as well as general obligations under commercial, trade or tax law (e.g. compliance with retention periods);
c) On the basis of consent given (Art. 6 para. 1 lit. a) GDPR): Furthermore, the Companies will process your personal data if you have consented to this for specific purposes (e.g. for marketing purposes). You may revoke your consent in whole or in part at any time;
d) To protect legitimate interests (Art. 6 para. 1 lit. f) GDPR): The Companies also process your data to protect the legitimate interests of the Companies or third parties. This includes in particular:
- Contact and correspondence (aside from for contractual purposes)
- the assertion of legal claims and defence in legal disputes
- the prevention and investigation of criminal offences
- for marketing purposes/direct marketing
- implementing measures for business management and further development of services and products
- ensuring IT security and operations
- consulting credit agencies to determine creditworthiness and default risks.
Transmission of personal data
In order to fulfil the aforementioned purposes and within the framework of the existing legal basis, the Companies may pass on your personal data to service providers and vicarious agents employed by the Companies. In some cases, the service providers used by the Companies receive your personal data as contract processors and are then strictly bound by the Companies' instructions when handling your personal data.
Recipients of your personal data can be:
- payment service providers and banks for the processing of payments;
- credit agencies and service providers for ascertaining creditworthiness and the like;
- logistics service providers in order to be able to send you documents, etc.;
- media companies (advertising agencies, printers, copy shops, etc.) to support the implementation of marketing activities;
- IT service providers for the administration and maintenance of our IT systems;
- collection agencies and legal advisors who assert claims;
- public authorities and institutions within the framework of our legal obligations.
Data will be transmitted to authorities in countries outside the EU or the EEA (so-called third countries) only if this is necessary to establish or administer your investment or is required by law, if you have given your consent to the Companies or in the context of the data processing of your order. Both Doric Group companies and external service providers in a third country can carry out such data processing. Compliance with European data protection norms is ensured by the Companies through contracts containing clauses prescribed by the EU Commission or, alternatively, through comparable suitable guarantees within the meaning of Art. 46 GDPR.
Duration of data storage
The Companies process and store your personal data if necessary for the fulfilment of contractual and legal obligations or based on justified interests. This may include the initiation (pre-contractual legal relationship) and the settlement of contractual relationships. Accordingly, your personal data will be deleted after the end of your participation unless further storage is required by law. If you have given your consent, your personal data will be processed for the respective purposes until you revoke your consent.
In addition, the Companies may store your personal data until the statute of limitations for any legal claims arising from the relationship with you has passed in order to be able to use your data for verification purposes if necessary. As a rule, the limitation period is three years.
When the statute of limitations comes into effect, the Companies delete your personal data unless there is an additional legal obligation to store data, for example from the German Commercial Code, the Tax Code or the Anti-Money Laundering Act. These retention obligations can last up to ten years.
Your rights
Every data subject has the right of access under Article 15 GDPR the right to rectification under Article 16 GDPR the right to erasure (right to be forgotten) under Article 17 GDPR the right to restriction of processing under Article 18 GDPR the right to object under Article 21 GDPR and the right to data portability under Article 20 GDPR. The restrictions according to §§ 34 and 35 of the Federal Data Protection Act (BDSG) apply to the right to information and the right to erasure.
Note on your right to object pursuant to Art. 21 para. 1, para. 2 GDPR
Based on Art. 6 para. 1 lit. f) GDPR (data processing on the basis of legitimate interests) you have the right to object at any time to the processing of your data if there are reasons arising from your particular situation.
If you file an objection, the Companies will no longer process your personal data unless compelling legitimate grounds for processing your data can be proven which outweigh your interests, rights and freedoms, or if the processing serves to assert, exercise or defend legal claims (reconsideration).
Insofar as the Companies process your personal data in order to carry out direct marketing on the basis of Art. 6 para. 1 lit. f) GDPR, you have the right to object at any time to the processing of your personal data for marketing purposes. The Companies will comply with your objection without further consideration. In this case, the Companies will no longer process your data for direct marketing purposes.
You may revoke your consent to the processing of personal data at any time. A revocation can also apply to declarations of consent issued to the Companies prior to the validity of the GDPR, i.e. before 25 May 2018. Please note that the revocation can only have a future effect. Processing that took place before the revocation is not affected by this.
To exercise your rights, please contact the pertinent company:
Doric Investment GmbH
Berliner Strasse 114 - 116
63065 Offenbach, Germany
Tel.: +49 69 247559 310
Fax: +49 69 247559 311
kvg@doric.com
Doric GmbH
Berliner Strasse 114 - 116
63065 Offenbach, Germany
Tel.: +49 69 247559 100
Fax: +49 69 247559 990
info@doric.com
If you have any data protection questions or concerns, the data protection officer listed above is available to assist you.
In addition, you have a right to lodge a complaint with a supervisory authority (Article 77 GDPR). The supervisory authority responsible for the Companies is:
Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
(the Hessian Commissioner for Data Protection and Freedom of Information)
Gustav-Stresemann-Ring 1
65189 Wiesbaden
Tel.: +49 611 1408-0
Fax: +49 611 1408-611
poststelle@datenschutz.hessen.de
Scope of your obligations to provide data
In principle, you are not obliged to provide the Companies with your personal data. However, establishing and administering investments is only possible if the necessary personal data is provided. Without this data, the Companies will generally not be able to manage your investments for you. Personal data which are not absolutely necessary for processing purposes will be marked by the companies as voluntary.
Automated decision-making/profiling
The Companies do not use purely automated decision-making procedures (including profiling).
