UTA-an edenred company Logo

Information on data protection in accordance with the Art. 13 General Data Protection Regulation (GDPR) in the EU

Secure handling of personal data is very important for the UNION TANK Eckstein GmbH & Co KG. Therefore, we and our data protection officer ensure compliance with data protection regulations, in particular the applicable General Data Protection Regulation (GDPR) in the EU and the German Federal Data Protection Act (BDSG-neu). The objective of this Statement on the Protection of Personal Data is to inform you of the purposes for which your personal data will be acquired and how it will be used, and your rights in relation to the data we keep and how to enforce it. You can cancel your subscription at any time by clicking on the unsubscribe "Data protection" link in the newsletter.Personal data within the meaning of the Basic Data Protection Ordinance (Art. 4 No. 1 DSGVO) are all data that are personally identifiable to you, e.g. name, address, e-mail addresses, user behavior.

Our EDP systems are protected by technical and organizational measures against access, modification or distribution of your data by unauthorized persons, as well as against loss and destruction.

I. Name and contact details of the data protection officer

II. Contact data of the data protection officer

III. General information on data processing

IV. Processing of personal data via our websites

V. UTA Station Finder Mobile App

VI. UTA SmartCockpit® App

VII. Processing of personal data for the fulfillment of the contract in the customer relationship

VIII. Processing of personal data for the fulfillment of the contract in the supplier relationship

IX. Processing of personal data in the context of application procedures

X. Privacy policy for the "Passion for customers" programme

XI. Rights of the data subjects

I. Name and contact details of the data protection officer

Responsible party in accordance with Article 4 Paragraph 7 of the General Data Protection Regulation GDPR

UNION TANK Eckstein GmbH & Co. KG
Heinrich-Eckstein-Straße 1
63801 Kleinostheim
Germany
Tel: +49 6027 – 509-0
E-Mail: info@uta.com
Website: www.uta.com

II. Contact data of the data protection officer

If you have any questions about the legal data protection handling of your personal data, please contact our data protection officer:

UNION TANK Eckstein GmbH & Co. KG
Datenschutzbeauftragter
Heinrich-Eckstein-Straße 1
63801 Kleinostheim
Germany

or

by e-mail under datenschutz@uta.com bzw. dataprivacy@uta.com

Note:

When you contact us by e-mail or via a contact form, the data you provide (your e-mail address, and if applicable your name and your telephone number) will be stored by us in order to answer your questions. We will delete the data collected in this context after the storage is no longer required by law or otherwise limit its further processing if we are required by law to continue archiving it.

III. General information on data processing

1. Scope of the personal data processing

SYou can be sure: We store your data at UNION TANK Eckstein GmbH & Co KG only for the fulfilment of your inquiries, fulfilment and processing of the contracts concluded with us (including payment processing and, if applicable, credit assessment) and for our own advertising purposes. Processing is carried out on the basis of the EU General Data Protection Regulation GDPR and the Federal Data Protection Act.

If you make an inquiry, request an offer from us or enter into a contractual relationship with us, we process your personal data.

2. Legal basis for the processing of personal data

Insofar as we process your personal data on the basis of consent, Art. 6 Para. 1 (a) EU General Data Protection Regulation (GDPR) serves as legal basis.

When processing personal data to fulfil a contractual relationship with you, we process your personal data on the basis of Art. 6 Para. 1 lit. b EU General Data Protection Regulation GDPR. This also applies to processing operations that are necessary for carrying out pre-contractual measures.

Insofar as the processing of your personal data is necessary to fulfil a legal obligation to which our company is subject, Art. 6 Para. 1 (c) EU General Data Protection Regulation (GDPR) serves as legal basis.

If processing is necessary to safeguard a legitimate interest of our company or a third party and if the interests, fundamental rights and freedoms of the data subject do not outweigh the first-mentioned interest, Art. 6 Para. 1 lit. f EU General Data Protection Regulation (GDPR) serves as legal basis for processing.

3. Data deletion and storage duration

UNION TANK Eckstein GmbH & Co KG blocks or deletes your personal data as soon as the purpose of processing ceases to apply. Furthermore, data may be stored if this is provided for by European or national legislators in EU regulations, laws or other regulations to which we are subject as the person responsible. Blocking or erasure of data will be carried out even if a storage deadline prescribed by the above-mentioned standards expires, unless data storage is a necessity for concluding or performing a contract.

IV. Processing of personal data via our websites

1. Visit the website

You can use our online presences without disclosing your personal data. When you access our website, data is stored for security purposes, such as the name of your Internet service provider, the website from which you visit us, the websites you visit on our site and your IP address. This data would possibly allow identification, however, no personal utilization takes place in this respect. They can be evaluated for statistical purposes, but the individual user remains anonymous. Insofar as the transfer of data to external service providers is concerned, we have ensured through technical and organisational measures that all data protection provisions are adhered to.

The processing of the data and temporary storage is necessary to enable the website to be delivered to your computer. For this purpose, the data remains stored for the duration of the session.

The purpose of the processing is based on a legitimate interest in accordance with the legal basis Art. 6 para. 1 lit. 1 (f) GDPR.

2. Use of cookies

3. Newsletter

We will only send newsletters, e-mails and other electronic notifications containing advertising information (hereinafter "newsletters") with the consent of the recipients (double opt-in procedure) or a legal permission.
The newsletters are sent via "Inxmail", a newsletter dispatch platform of Inxmail GmbH, Wentzingerstr. 17, D-79106 Freiburg
In the context of the newsletter a so-called newsletter tracking (also called web beacons or tracking pixels) is used. The pixel-sized file is retrieved from the Inxmail server when the newsletter is opened and, in addition to certain technical data of the recipient (e.g. information on the browser, e-mail client and system), also records the IP address and the time of retrieval. Statistical data collection also includes an analysis of when the newsletters are opened and which links are clicked upon. This information is collected anonymously; click behaviour is not assigned to a specific newsletter recipient. Data analysis is used to recognize patterns in the reading behavior of users and adapt contents accordingly or send different content according to the interests of our users.
The recipient has the right and the possibility to unsubscribe from the newsletter distribution list at any time. You can unsubscribe from the newsletter by clicking on the unsubscribe link.

4. online form for e.g. contact, offer preparation, callback request to UTA

By providing your personal data in online forms on websites of UNION TANK Eckstein GmbH & Co KG (UTA), you agree that UTA and MercedesService Card GmbH & Co KG, Kleinostheim, will also provide your company via e-mail and fax with information on the subject of mobile care and inform about interesting products and services of UTA and MercedesService Card. You agree that UTA may use the data provided for this purpose and exchange it with MercedesService Card. If your company should not be informed about the contact person in this form or not through all media, the corresponding contact data fields can of course also be released. This consent can also be revoked later at any time without incurring costs for the transmission of the revocation that go beyond the basic tariffs. The use of the data for the aforementioned purposes can be revoked at any time.
With your consent, you confirm that the contact person named is responsible for the information and questions of the UTA and MercedesService Card and is informed about the communication of contact data and the above consent.
There is no obligation to provide all data. However, UTA and MercedesService Card can only send the information in the way requested by your company if you provide us with the corresponding contact details.

The legal basis for the processing of data on the basis of consent is Art. 6 Para. 1 lit. a EU General Data Protection Regulation (GDPR).

5. Web analysis

We use various tools on our website to analyse surfing behaviour on our websites. 

Use of Google Analytics

Our web pages use Google Analytics, a web analytics service provided by Google, Inc. ("Google"). Google Analytics uses so-called 'cookies', text files stored on your computer which enable your website use to be analysed. The information generated by the cookie regarding your use

  • Browser type/version,
  • used Operating system
  • Referrer URL (the previously visited website),
  • Host name of the accessing computer (IP address),
  • Time of the server request

This information is generally transmitted to a Google server in the USA and stored there. The IP address transmitted by your browser as part of Google Analytics is not bought together with other Google data. We have also expanded Google Analytics with the code "anonymizeIP" on this website. That guarantees your IP address is masked, so all data are collected anonymously. In exceptional cases only, the complete IP address may be transmitted to a Google server in the USA and abbreviated there.

Google adopts EU-US Privacy Shield framework. Https://www.privacyshield.gov/EU-US-Framework.

On behalf of the website operator, Google will use this information to evaluate your use of the website, compile reports on website activity and to provide the website operator with services related to website usage and internet use. 

The legal basis for data processing is your consent, which you have provided in the cookie banner in accordance with Art. 6 para. 1 lit a) GDPR. You can of course revoke your consent at any time with effect for the future. Feel free to send us an email: datenschutz@uta.com.

In order to better integrate Google Analytics into our website and manage it, we use the Google TAG Manager. According to Google, no cookies are used for this purpose and no personal data is collected.

We still use Google Analytics to evaluate data from double-click cookies and AdWords for statistical purposes. If you do not want this to be carried out, you can disable the function via the Ads Preferences Manager (https://www.google.com/settings/ads/onweb/?hl=en).

Further information on data protection in connection with Google Analytics can be found in the Google Analytics Help (https://support.google.com/analytics/answer/6004245?hl=en).
The data is kept for statistical purposes for 26 months.

Use of Google Maps

We use the offer of Google Maps on this website. This allows us to display interactive maps on the website, and it gives you convenient use of the map feature.

When you visit the website, Google receives notification that you have called up the relevant subpage of our website. Further data are also transmitted to Google, such as your IP address, date and time of the request, the website from which the request originates, browser, as well as the operating system and its interface. This happens regardless of whether Google makes a user account available through which you are logged in or whether no such account exists. If you are logged into Google, your information is directly associated with your account. If you do not wish your profile to be associated with Google, you must log out before activating the button. Google stores your data as user profiles and uses them for the purposes of advertising, market research and/or the demand-oriented design of its website. Such an analysis is carried out in particular (even for users who are not logged in) to provide advertising tailored to you and to inform other users of the social network about your activities on our website. You have the right to object to the creation of such user profiles; you must contact Google to exercise this right.

For further information on the purpose and scope of data collection and processing by the plug-in provider, see the provider's data protection declaration. There, you will also find additional information about your rights in this regard as well as on settings that protect your privacy: https://policies.google.com/privacy?hl=en-GB. Google may process your personal data in the USA and it has adopted the EU-US Privacy Shield framework, https://www.privacyshield.gov/EU-US-Framework.

The legal basis for transmission is your consent in accordance with Art. 6 para. 1 lit. a GDPR.

You can revoke your consent at any time. To do this, please send an email to datenschutz@uta.com.

Google AdWords

Our website uses Google Conversion Tracking. If you have reached our website via an ad placed by Google, Google Adwords sets a cookie on your computer. The cookie for conversion tracking is set when a user clicks on an ad placed by Google. These cookies expire after 30 days and are not used for personal identification. If the user visits certain pages of our website when the cookie has not yet expired, we and Google can detect that the user clicked on the ad and proceeded to this website. Each Google AdWords advertiser has a different cookie. Thus, cookies cannot be tracked using the website of an Adwords advertiser. The information obtained using the conversion cookie is used to create conversion statistics for Adwords customers who have opted into conversion tracking. Customers are told the total number of users who clicked on their ad and were redirected to a conversion tracking tag page. However, advertisers do not obtain any information that can be used to personally identify users.

If you do not wish to participate in tracking, you can refuse to allow the required cookie to be set - for example using browser settings that deactivate all automatic cookie setting, or by setting your browser to block cookies from the "googleleadservices.com" domain.

Please note that if you do not wish measurement data to be recorded, you must not delete opt-out cookies. If you have deleted all cookies in your browser, you must reset the respective opt-out cookie.

Hotjar

On our website we use Hotjar. Hotjar is a service that analyses the behaviour and feedback of users on websites using a combination of analysis and feedback tools. Hotjar gives providers of Hotjar-based websites an "overall picture" of how to improve the end user experience and performance of the Hotjar-based website.

For more information about Hotjar, see 'About Hotjar'. Hotjar helps us to provide you with a better user experience and service, helps us diagnose technical problems and analyses user trends. Above all, the functionality of the Hotjar-based website can be improved through the services of Hotjar by making them more user-friendly, more valuable and easier to use.

When visiting a Hotjar-based website, you can prevent Hotjar from collecting your data at any time by going to our opt-out page and clicking'Disable Hotjar' or activating'Do Not Track (DNT)' in your browser.

6. use of social media plug-ins

In our blog "Stories from the Tanke" we use the visitor action pixel of Facebook for statistical purposes. A cookie can help us understand how our marketing activities on Facebook can be taken up and improved.

With your consent, which you have given as follows

"I agree to the use of the visitor action pixel of Facebook"

within our Internet presence we set the "visitor action pixel"  of

Facebook Inc.
1601 S. California Ave,
Palo Alto, CA 94304, USA
"("Facebook").

These allow the behavior of site visitors to be tracked after they click on a Facebook ad to reach the provider's website. This process is designed to evaluate the effectiveness of Facebook ads for statistical and market research purposes and may help to optimize future advertising efforts.

The data collected on you remains anonymous to us, so it does not provide us with any information about the identity of the user. However, the data are stored and processed by Facebook, which may make a connection to your Facebook profile and which may use the data for its own advertising purposes, as stipulated in the Facebook privacy policy (https://www.facebook.com/about/privacy/). You can enable Facebook as well as its partners to switch advertising ads to and from Facebook. You can also store a cookie on your computer for these purposes.

Consent to the use of the visitor action pixel may only be given by users who are older than 13 years of age. If you are younger, we request that you ask your guardians for advice.

You can withdraw your consent informally at any time.

7. use of our blog offer (Stories from the Tanke)

You can make public comments on our blog, where we publish various articles on topics related to petrol stations. Your comment will be published with your username. We recommend that you use a pseudonym instead of your clear name. User name and e-mail address are required, further information is voluntary. When you make a comment, we continue to store your IP address. The storage is necessary for us to be able to defend ourselves against liability claims in cases of possible publication of illegal content. We need your e-mail address in order to contact you if a third party should object to your comment as unlawful. This address will not be published.

The legal basis is Art. 6 para. 1 lit. 1 (f) GDPR. Comments will not be reviewed before publication. We reserve the right to delete comments if they are objected to as unlawful by third parties.

The comments are stored on the basis of your consent per Art. 6 (1)(a) GDPR You may revoke your consent at any time with future effect. An informal email making this request is sufficient. The data processed before we receive your request may still be legally processed.

Comments and associated data (e.g. IP address) are stored and remain on our website until the content commented upon has been completely deleted or the comments are required to be removed for legal reasons (libel, etc.).

8. UTA Exclusive Areas

Within the scope of our exclusive areas, we make services and/or services available to you via our website which require registration and the creation of a personal user account. When registering and setting up a user account, we collect the following data:

  • User name 
  • Password
  • Business e-mail address of the user 
  • Company, address, country
  • Telephone and fax numbers (optional)

The user is registered for the purposes of access restriction, access control and clear identification. It is also used to provide customer-specific content and information. 

If you use our portal, we store your required data until you finally delete your access. You can manage and change all information in the protected customer area. We process the data on the basis of Art. 6 para. 1 lit. 1 (f) GDPR.

As a user you have the option of cancelling the registration at any time.

V. UTA Station Finder Mobile App

1. iOS

You have decided to use the fuel station finder App. In connection with the use of this application (app), you have read the privacy policy of Apple Inc. (https://www.apple.com/legal/privacy/en-ww/) is accepted. In addition, we inform you about access rights for certain services of the app that are active on your mobile device.

Geoposition

Your geoposition is determined using the search function within the app in order to be able to show you the UTA stations. This only happens if the app is active in the foreground. As soon as the app is not used, i.e. in the background, we do not determine a geoposition. If you have activated the "Report automatically" function, the iOS will continue to determine the geoposition.

routing

This function transmits information via the Apple API. The start and destination of the route are processed. Using the route determined, the app finds possible filling stations (or POIs) along the route.

push service

If you have activated the push function, current information is made available within the "News" section by means of a so-called "push token".

Equipment Identity

This feature checks the exact device you are using to display content to your phone correctly. No IMEI or UDID number is requested.

Statistical evaluations

Statistical data (e.g. frequency of use, download figures, number of new users) are transferred to the "Flurry" service. The privacy policy for this service can be found here: developer.yahoo.com/flurry/legal-privacy/tos.html

2. Android

You have decided to use the fuel station finder App. In connection with the use of this application (app), you have read the privacy policy of Google Inc. (https://policies.google.com/privacy?hl=en ) accepted. In addition, we inform you about access rights for certain services of the app that are active on your mobile device.

When using the app you have the choice between the online or offline version. When using the offline variant, no usage data is transferred.

In order for the online version to be technically implemented, we list the various access authorizations in connection with your mobile device below.

android.permission.INTERNET
In connection with the access authorization, the following queries are made when the data is retrieved by a backend ("eJump"):

System language: Language of the user (required so that texts of the "News" section and "Service numbers" can be displayed under "More".)

Device ID: This makes it possible to deliver device-specific content. No IMEI or UDID number is requested.

routing

This service transmits data via the Google API. Data about the start and destination is processed. As a result, routes can be calculated.

android.permission.WRITE_EXTERNAL_STORAGE
This access authorization temporarily stores data and images on the device, such as "Favorites", image elements such as icons or images under "News".

android.permission.ACCESS_FINE_LOCATION
android.permission.ACCESS_COARSE_LOCATION
The search for the stations in the vicinity is performed locally on the device. Geo coordinates are not transmitted.

Statistical evaluations

Statistical data (e.g. frequency of use, download figures, number of new users) are transferred to the "Flurry" service. The privacy policy for this service can be found here: developer.yahoo.com/flurry/legal-privacy/tos.html

VI. UTA SmartCockpit® App

In principle, it is also possible to use the app without providing personal data. If you want to use special functions of the app, the processing of personal data may be necessary.

1. Scope of the personal data processing
UTA collects and processes your data exclusively for specific purposes. These may also arise from technical necessities, contractual requirements or explicit user requests. For technical reasons, certain data must be collected and stored when using the App (e.g. push token, device platform and App version).
Within the scope of the App provided by UTA, UTA processes the personal data described below:

  • Geolocation data (location data of the device which we have linked to a vehicle according to your specifications). During the initiation of the app, you as the user decide whether to activate the functionality for processing geolocation data. This is deactivated by default.
    The data flow into the UTA SmartCockpit® Web Application is dependent on
    - Activation of the function (geolocation) in the mobile device,
    - Activation of data transfer from the mobile device to the UTA SmartCockpit® Web Application,
    - Assignment of the mobile device to the vehicle in the UTA SmartCockpit® App.
    In case of an inquiry, we collect your current location via GPS in order to provide you with quick information about your immediate surroundings (proximity search) and to offer you the possibility to plan routes from your current position. Data on your location will be used to process your request and will be transmitted to the UTA SmartCockpit® Web Application. The transmission of your location data takes place via an encrypted connection using HTTPS. Your location data is used in the UTA SmartCockpit® Web Application to enable the user of the UTA SmartCockpit® Web Application to plan a route from the current position of a vehicle, as well as for subsequent analysis.
    Based on the geolocation data, UTA shall under no circumstances carry out profiling according to Art. 22 DSGVO or measures to monitor the performance and behaviour of individual SmartCockpit® App users. If the GPS reception is disturbed, the positioning is automatically carried out via WLAN or radio masts. In this case, the geolocation may be less accurate. If the GPS function is deactivated, the last known position of the mobile device is displayed.
  • Activating the App
    Within the scope of activating the UTA SmartCockpit® App, it is necessary that the customer number and the telephone number of the App user are processed in the App in order to create a permanent connection between the UTA SmartCockpit® Web Application and the associated App. This is necessary in order to be able to select vehicles, plan routes and receive planned routes from the UTA SmartCockpit® Web Application when using the App. In addition, the so-called Driver ID is processed.
  • Using the push function towards the App
    When using the push function from the UTA SmartCockpit® Web Application towards the App, it is also necessary to process Vehicle ID and Push Token. Note: The Push Token is an App-specific token that is automatically generated by Goolge Firebase.
  • Using the map functionality
    There is a difference between iOS and Android for the use of the map functionality. Android uses Google Maps, while iOS uses Apple Maps.
    Due to a used functionality (Layer) there is no transmission of geolocation data to Google, respectively iOS. UTA has the geolocation data processed within the scope of a regulated order processing.
    UTA has the geolocation data processed by Qivalon for display on the map within the scope of a regulated order processing.
    Prerequisite for the use of this function is an existing Internet connection via WLAN or mobile data. This may result in additional costs which are beyond the control of UTA.
  • Analysis data 
    In order to continuously improve your user experience, we collect statistics on the use of the App. For this purpose we use the analysis tool Google Analytics Firebase. This enables us to ensure that our app is designed to meet your needs and is continuously optimized. On the other hand, we use the tracking measures to record the use of our app statistically and evaluate it for the purpose of optimizing our offer for you. All data is processed anonymously. 
    In standard tracking the following data is analysed: Number of active users, number of application crashes, user interaction, information about the target group and app usage. In addition, an event-based tracking is carried out in which the number of app activations, registered vehicles, planned routes, started routes and accepted missions are stored and evaluated. In addition, the number of app starts, the status of the app (opened in the background or foreground) and the number of app deletions are recorded and evaluated in this event-based tracking. Furthermore, the tracking of changes in settings regarding the radius, price projection, ignoring of motorway filling stations and the display of traffic information including the respective set parameters are also included.  Within the app, you as a user can make settings accordingly. These can be found in Route Planning or under the menu item Settings.
  • Technical access authorisation to your Device
    For technical reasons access to the Internet is necessary. Access to the location of the device is also necessary for planning routes or radius searches from the current position of the vehicle. This is also one of the prerequisites for using the geolocation function, if desired and activated.
  • Cookies
    We do not use any cookies within the app.

2. Legal basis for the processing of personal data
Within the framework of the UTA SmartCockpit® App, UTA processes personal data purely for a specific purpose and based on a legal basis. 

Location data shall be processed on the basis of the consent granted in the App in accordance with Art. 6 para. 1 lit. a DSGVO. The functionality can be switched off at any time with future effect by the App user under 'Settings'. The functionality is then terminated and no more location data is collected or transmitted to the UTA SmartCockpit® Web Application. For the transmission of location data to the UTA SmartCockpit® Web Application it is essential that the mobile device accesses the Internet. 

The processing of personal data within the scope of the use of the card functionality and technically required access authorisations is based on Art. 6 para. 1 lit. b DSGVO and is exclusively for the purpose of providing contractually agreed services. The possibility of accessing the Internet is dependent on the provision of services. The availability of access to the Internet is beyond the control of UTA. Accordingly, UTA shall not assume any responsibility for the UTA SmartCockpit® App not functioning as agreed due to the lack of availability of or access to the Internet.
If UTA is subject to a legal obligation, which makes the processing of personal data necessary, the processing shall be based on Art. 6 para. 1 lit. c DSGVO.

3. Recipients of the personal data: 
In the context of the operation of the UTA SmartCockpit® App, contractually commissioned processors commissioned by UTA come into contact with personal data provided by you. In detail, these are the following service providers:

Company subcontractorService
Qivalon GmbHProvision of the “Tankplaner” web service for integration into the UTA SmartCockpit® application
o-soft Klaus Stumpf GmbHTechnical development of the UTA SmartCockpit® web application and mobile app
Google Analytics FirebaseTracking of user statistics in the UTA SmartCockpit® Mobile App

UTA will under no circumstances sell your data to third parties

4. Transfer to a third country or to an international organisation:
For the provision of services outside the EU/EEA area, the special requirements of Art. 44 et seq. DSGVO are fulfilled and the Commission has issued an appropriateness decision pursuant to Art. 45 para. 1 DSGVO.
See below: https://datenschutz.hessen.de/datenschutz/internationales/angemessenheitsbeschl%C3%BCsse

5. Data deletion and storage duration
The customer number, the driver's telephone number and the driver ID are permanently stored in the app in order to guarantee the continuous connection of the app with the UTA SmartCockpit® web application. In addition, the respective connected vehicle ID is temporarily stored for the duration of the connection of the vehicle with the App and the push token for a maximum of 6 months.
The data will be automatically deleted when the App is uninstalled.
Depending on the contract term of the UTA SmartCockpit® Web Application, UTA may store data collected via your mobile device for fulfilment of the contract.
In case of an objection to data processing, UTA shall treat the data in accordance with Art. 17 DSGVO.

6. Rights as a data subject
You have the following rights in connection with the processing of your personal data:

  • In accordance with Art. 15 EU-DSGVO, you have the right to request information about the data stored by us.
  • Under Art. 16 EU-DSGVO, you have the right to have incorrect data corrected.
  • Under Art. 17 EU-DSGVO, you have the right to have your data deleted, provided there is no legal reason for further storage.
  • Under Art. 18 EU DSGVO, you have the right to request that the processing of your data be restricted. This means that your data may still be stored, but may only be processed under limited conditions (e.g. with your consent or to assert legal claims).
  • In accordance with Art. 20 EU-DSGVO, you have the right to data transferability with regard to all data which you have made available to us. This means that we provide you with this data in a structured, common and machine-readable format.

You may exercise your rights with regard to the above-mentioned processing activities vis-à-vis UTA at any time by using the above-mentioned contact details.
Furthermore, you have the right to object to UTA's processing of your data within the scope of continuous technical improvement processes. In order to exercise your right of objection, you can contact UTA at the above-mentioned.

VII. Processing of personal data for the fulfillment of the contract in the customer relationship

1. purposes and legal bases of the processing

a. For the fulfilment of contractual obligations (Art. 6 para. (1) lit b GDPR).

Upon application for a customer relationship with UNION TANK Eckstein GmbH & Co KG, we process information provided by you for the conclusion of the contract and to assess the economic risk to be assumed by us.

Data processing within the scope of a business relationship

If a contract is concluded, we process your data to carry out the contractual relationship. The personal data processed here includes master data (e.g. company name, company name, address), data of a central contact person, as well as all data that we require from you for billing purposes (e.g. VAT ID, bank data) within the scope of the contractual relationship. This also includes processing processes that take place in connection with the sending of acceptance media.

The conclusion or execution of the contractual relationship is not possible without the processing of your personal data.

Use of data in case of late payment

In the event of default in payment, we may assign claims to third parties. All necessary data is transferred to the respective third party (e.g. collection company) to the required extent for the purpose of handling the collection procedure.

b. Ordering of products and services (Art. 6 para. (1) lit b GDPR).

When ordering and using products/services in the categories listed below, there may be a need to process further personal data in addition to the aforementioned data. These primarily include:

Acceptance media (service cards, toll boxes)

Vehicle-related data (e.g. vehicle owner or lessor, vehicle registration number), driver data (different shipping address or name when the service card is stamped).

Digital services (UTA exclusive customer area, e-invoicing, electronic data output)

Electronic contact data (e-mail address) for information about a new billing document or for the transmission of billing details or in the context of creating new users of the UTA customer exclusive area or in the case of using the feedback function within the UTA Stationsfinder APP. Within the app, we will also process your location data to show you the nearest acceptance point. 

(Toll) Registration procedure

Customer master data for validation purposes (e.g. company master data), processing of all data requested by the acceptance system operator (vary per acceptance system).

Within the scope of registration procedures for the use of selected toll acceptance systems or when UNION TANK Eckstein GmbH & Co KG issues service cards of third parties, we process without exception the personal data that is required by the acceptance partner / system operator. In order to legitimise the information you provide to us during the registration process, it may be necessary to provide us with the relevant documents (e.g. vehicle registration document). Acceptance partners/system operators must be proven.

In order to be able to fully support you in the context of possible queries or in enforcement cases by the toll acceptance system operator or by national enforcement bodies, we also store all data submitted by you as part of the registration procedure internally.

credit management

When a credit note is issued (e.g. to a Mercedes ServiceCard), we share all relevant information about the consumption of this credit note with the company granting the credit note (e.g. Daimler AG). This is to inform you about offers within the validity period of the credit memo.

All processing of your personal data in the above-mentioned processing procedures for pre-contractual or contractual purposes is based on Art. 6 Para. 1 b of the GDPR.

c. Due to a justified interest of UNION TANK Eckstein GmbH & Co KG (Art.6 Para. 1 lit. f, GDPR).

We also process your data beyond the actual fulfilment of the contract in order to protect the legitimate interests of us and third parties. These processing operations are carried out on the basis of Art. 6 para. 1 lit. f GDPR. These finishes are:

Assessment of the economic risk to be assumed (determination of creditworthiness)

To conclude a business initiation and to monitor an existing customer relationship - especially in the case of late payment - we make use of the support of credit agencies. They assess the risk of non-payment on the basis of available information, including your personal data. The result will be reviewed personally and evaluated by an employee of UNION TANK Eckstein GmbH & Co KG with regard to possible consequences for the business relationship.

A fully automated rating does not take place.

Advertising for own products and services

In the event that we have not been given a specific contact person for advertising purposes, we will use the data provided by the central contact person and inform you about products and services of UNION TANK Eckstein GmbH & Co KG and our affiliated companies within the framework of the contractual relationship.

You can revoke the transfer with effect for the future at any time.

Further processing of your data to protect our legitimate interest may be:

Measures for business management and further development of own products and services

Internal monitoring to control the existing business relationship.

Prevention
 
To prevent criminal offences, we monitor the usage behaviour and the use of your acceptance media.

Review and optimization of procedures for needs analysis and direct customer approach; incl. internal customer segmentation

d. On the basis of consents (Art. 6 para. 1 lit. a of the GDPR)

If you have given us your consent to process personal data for specific purposes, this processing is legal on the basis of your consent. A given consent can be revoked at any time. This also applies to the revocation of consents that may have been given to us prior to the validity of the GDPR, i.e. before 25 May 2018. Please note that the revocation is only effective for the future. Processing that took place before the revocation is not affected by this.

Newsletter registration for advertising purposes

Newsletters will only be sent to you on the basis of a separate consent.

(Personal) guarantees

In the case of personal guarantees by third parties (third-party guarantors), UNION TANK Eckstein GmbH & Co KG processes all necessary personal data together with information about the economic and financial circumstances of this third party.

e. For the fulfilment of legal obligations in connection with Art. 6 para. 1 lit. c of the GDPR

Within the framework of financial processes and to meet legal archiving requirements.

2. recipients or categories of recipients of the data;

Within the company, all departments that need access to your data in order to fulfil our contractual and legal obligations are granted access to it.

Contractual service providers and vicarious agents may also come into contact with your data. These partners are contractually bound to our compliance with data protection instructions within the scope of order processing and support UNION TANK Eckstein GmbH & Co KG in the implementation of the business relationship with you.

Among other things, we use contract processors for the services: Support/maintenance/development of EDP/IT applications, call centre services, data destruction and disposal, sending advertising material, website hosting, website design, letter shop, building security, address data validation, driving licence controls, process support (24/7), online authorisations, breakdown services.

In special constellations we process your personal data together with cooperation partners. Each party processes your data exclusively for a specific purpose and within the framework of shared responsibility. This contract construct is available in the context of:

  • distribution partnerships / Models of cooperation:
    In models in which the cooperation partners involved are in an independent contractual relationship with you, we may exchange data within the cooperation. The respective processing of your data including the further processing of previously exchanged data by each cooperation partner is based on the direct contractual relationship with you. There is no further obligation to inform about the data processing by the cooperation partner at this point, since we can assume that you have been comprehensively informed about the processing of your data by the cooperation partner in the context of the separate contractual relationship with the cooperation partner. There is no authority to issue instructions to the respective cooperation partner.
  • Activities with internal group companies or affiliated companies
  • billing services

Third party service providers

Within the scope of fulfilling contractual obligations, we make use of external service providers in some cases. We use these for the services: Credit information, toll registration, logistics services, reimbursement services, collection procedures, billing of service payments in the expense reimbursement procedure

In all the cases mentioned above, we ensure that third parties only have access to the personal data necessary for the performance of individual tasks.

More recipients

In addition, we may transfer your data to other recipients, such as public authorities for the fulfilment of legal notification obligations such as social insurance carriers, tax authorities or law enforcement authorities.

Very important: Under no circumstances does UNION TANK Eckstein GmbH & Co KG sell your data to third parties.

Transmission of data to a third country

If we have your data processed by a service provider outside the EU/EEA area, it will only be processed if the third country has been confirmed an appropriate level of data protection by the EU Commission or if there are other appropriate data protection guarantees.

3. Duration of storage

Your data will be deleted as soon as they are no longer required for processing the above-mentioned purposes. Among other things, your data may be stored for the period during which claims can be asserted against our company (statutory limitation period - 3 years). In addition, we store your data if we are legally obliged to do so. These obligations are derived, among other things, from the HGB and the AO.

VIII. Processing of personal data for the fulfillment of the contract in the supplier relationship

1. purposes and legal bases of the processing

a. For the fulfilment of contractual obligations (Art. 6 para. (1) lit b GDPR).

Data processing within the scope of a business relationship

In the context of the conclusion of a supplier contract or during pre-contractual negotiations with UNION TANK Eckstein GmbH & Co KG, we process your data to establish and implement the business relationship. The personal data processed here includes master data (e.g. company name incl. company name, address, data on geolocalisation), contact person data (e-mail address, telephone/mobile phone number), as well as all data that we require from you for billing purposes (e.g. VAT ID, bank data) within the scope of the contractual relationship.

The conclusion or execution of the contractual relationship is not possible without the processing of your personal data.

To ensure data quality 

Use of the e-mail address of contact persons provided by you to ensure an appropriate data quality.

All processing of your personal data in the above-mentioned processing procedures for pre-contractual or contractual purposes is based on Art. 6 Para. 1 b of the GDPR.

b. Due to a justified interest of UNION TANK Eckstein GmbH & Co KG (Art.6 Para. 1 lit. f, GDPR).

We also process your data beyond the actual fulfilment of the contract in order to protect the legitimate interests of us and third parties. These processing operations are carried out on the basis of Art. 6 para. 1 lit. f GDPR. These finishes are:

The transparent presentation of benefit payments and places of purchase compared to the Customers of UNION TANK Eckstein GmbH & Co. KG
Customer settlement documents (line item verification) or digital data output 

The publication of data in electronic and analogue acceptance point overviews
Station Finder, UTA App, Petrol Station Directory.

For information of customers, business partners, service providers of UNION TANK Eckstein GmbH & Co. KG.
Overview of acceptance partners/locations or UTA acceptances.

Measures for business management and further development of the business relationship
Monitoring and controlling the acceptance partner relationship

c. For the fulfilment of legal obligations in connection with Art. 6 para. 1 lit. c of the GDPR

In addition, we may transfer your data to other recipients, such as public authorities for the fulfilment of legal notification obligations such as social insurance carriers, tax authorities or law enforcement authorities.

2. recipients or categories of recipients of the data;

Within the company, all departments that need access to your data in order to fulfil our contractual and legal obligations are granted access to it.

Contractual service providers and vicarious agents may also come into contact with your data. These partners are contractually bound to our compliance with data protection instructions within the scope of order processing and support UNION TANK Eckstein GmbH & Co KG in the implementation of the business relationship with you.

Among other things, we use contract processors for the services: Support/maintenance/development of IT applications, data destruction and disposal, website hosting, website design, building security, sign suppliers.

In special constellations we process your personal data together with cooperation partners. Each party processes your data exclusively for a specific purpose and within the framework of shared responsibility. This contract construct is available in the context of:

  • distribution partnerships 
  • Activities with internal group companies or affiliated companies
  • billing services

Third party service providers

Within the scope of fulfilling contractual obligations, we make use of external service providers in some cases.

In all the cases mentioned above, we ensure that third parties only have access to the personal data necessary for the performance of individual tasks.

More recipients

Customers receive your location data as information regarding the possible use of acceptance media.

Very important: Under no circumstances does UNION TANK Eckstein GmbH & Co KG sell your data to third parties.

Transmission of data to a third country

If we have your data processed by a service provider outside the EU/EEA area, it will only be processed if the third country has been confirmed an appropriate level of data protection by the EU Commission or if there are other appropriate data protection guarantees.

3. Duration of data retention

Your data will be deleted as soon as they are no longer required for processing the above-mentioned purposes. Among other things, your data may be stored for the period during which claims can be asserted against our company (statutory limitation period - 3 years). In addition, we store your data if we are legally obliged to do so. These obligations are derived, among other things, from the HGB and the AO.

IX. Processing of personal data in the context of application procedures

1. Purpose of processing

In the context of application and decision-making processes for the conclusion of an employment contract, we process your personal data for the relevant purpose.

Automated decision making does not take place.

2. LEGAL BASIS OF THE PROCESSING

This processing takes place on the basis of Art. 6 para. 1 lit. b of the GDPR.

3. the recipients or categories of recipients of the data;

Your personal data will be processed exclusively by internal departments (personnel, superior of the position, management). A transmission to third parties does not take place, with the exception of our service providers in the context of order processing.
There is no intention to transfer the personal data to a third country or an international organisation.

4. Duration of storage

The data will be deleted 6 months after completion of the application process. If an employment contract is concluded or if there is an interest in extending the deadline, we will inform you separately about the use of the data in the employment relationship or obtain your consent to the extension of the deadline.

X. Privacy policy for the “Passion for customers” programme

Together with our parent company Edenred S.A., UNION TANK Eckstein GmbH & Co. KG is running a programme that aims to identify customer satisfaction levels for UTA products and services and necessary improvements. For this purpose, UTA is using a solution which makes it possible to manage surveys, analyse survey results and classify customer feedback (Medallia programme).

With this privacy policy, UNION TANK Eckstein GmbH & Co. KG (UTA, we) is informing you as the controller within the meaning of Art. 13 no. 7 GDPR about the processing of your personal data and your rights in relation to this.

UTA processes personal data in accordance with the EU General Data Protection Regulation (GDPR), the German Data Protection Act (Bundesdatenschutzgesetz, BDSG) and industry-specific regulations relating to data protection (special laws).

1. Purposes and legal basis of the processing

UTA processes in the Medallia programme, in addition to company data, the data of a named contact person. All of this data is based on information that you have disclosed to us in the new customer process. The following data is processed:
•    the data of contact persons (first name and surname, gender, personal company e-mail address if applicable)
•    company data (company name, registered office (town, country), central communication data (e-mail address, telephone number)), language
•    the data of digital visitors (IP address, device information, browser information, etc.)

UTA also sometimes processes in connection with your feedback personal data in order to identify specific customer needs and satisfaction levels as well as trends and potential improvements for the products and services offered. 
UTA also gathers information in the Medallia programme on potential problems (technical, operational) in the use of UTA products and services.

For internal purposes, UTA processes customer feedback in order to: 
•    define standard customer profiles, 
•    identify trends through segmenting, filtering and profile comparisons,
•    personalise customer interaction,
•    support and identify potential areas for business expansion.

All of the processing activities described above are based on a legitimate interest of UTA and take place in accordance with Art. 6 (1) letter f GDPR. 

2. Categories of recipients of personal data

Access to your personal data is given to all persons in the company who need this access in order to perform their duties.

Contracted service providers and vicarious agents also come into contact with your data. These partners are placed under contractual obligation by us to comply with data protection requirements and support UTA in the performance of this duty.

In the Medallia programme support is provided by:

  • Medallia, a SaaS solution provider that provides, in addition to the technical platform, maintenance and technical support.
  • Edenred S.A. to ensure the smooth operation of the Medallia programme. Edenred S.A. is given general access as the parent company to all personal data that is processed in the Medallia programme. Your personal data will not be processed by Edenred for purposes other than those stated above.

3. External service providers and other recipients

Third parties do not have any access to your personal data in the Medallia programme.

Very important: UTA will not sell your personal data to third parties under any circumstances.

4. Transmission of data to a third country

It is assured that your personal data in the Medallia programme will be processed exclusively on servers in the EU/EEA (Frankfurt am Main, Germany or Amsterdam, Netherlands). 

Personal data that is collected will only be processed outside of the European Union if an adequacy decision has been adopted by the European Commission or if appropriate and adequate security measures have been taken which ensure the security and privacy of your personal data.

5. Length of time your data will be stored

Your personal data will be processed and stored for a period of 3 years. After this period the personal data will be erased by an automatic routine.

XI. Rights of the data subjects
In the event that we process personal data from you, you are affected within the meaning of the GDPR and you have the following rights vis-à-vis us, the person responsible within the meaning of the GDPR:

1. The right to information

You can request that the responsible party confirm whether we will process personal data that concerns you.

If such processing is taking place, you can request to be informed by the data controller regarding the following information:

  • the purposes for processing the personal data;
  • the categories of personal data being processed;
  • the recipients or categories of recipients to whom your personal data has been or will be disclosed;
  • the planned storage duration of your personal data or, if specific information in that regard is not possible, criteria for determining the storage period;
  • the existence of a right of rectification or deletion of your personal data or of a restriction on processing by the data controller or of a right to oppose such processing;
  • the existence of a right of appeal to the competent supervisory authority;
  • any available information about the origin of the data if the personal data was not collected directly from you;

You have the right to request information regarding whether your personal information will be transmitted to a third-party country or an international organisation. In this respect, you can request the appropriate guarantees in accordance with Art. 46 GDPR in connection with the transmission.

2. The right of rectification

You have a right of rectification and/or completion with respect to the responsible party if the personal data processed concerning you is incorrect or incomplete.

3. The right to restriction of processing

Under the following conditions, you may request that the processing of personal data concerning you be restricted if:

  • you contest the accuracy of your personal data for a period that enables the controller to verify the accuracy of the personal data;
  • the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;
  • the controller no longer needs the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defence of legal claims or
  • you have objected to processing pursuant to Art. 21 Para. 1 GDPR pending the verification whether the legitimate grounds of the controller override your reasons.

Where processing of the personal data that concerns you has been restricted, such data – apart from being stored – may be processed only with your consent or for the purpose of asserting, exercising or defending rights or protecting the rights of another natural or legal person or on the grounds of an important public interest of the Union or of a Member State.

If the restriction of processing has been restricted in accordance with the above conditions, you will be informed by us before the restriction has been lifted.

4. The right to deletion (right to be forgotten)

a) Obligation to erase

You have the right to obtain from the controller the erasure of personal data concerning you without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:

  • the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed.
  • you withdraw your consent on which the processing is based according to Art. 6 Para. 1 lit. a or Art. 9 Para. 2 (a) GDPR , and where there is no other legal reason for the processing. 
  • You object pursuant to Art. 21 Para. 1, GDPR, and there are no overriding legitimate grounds for processing, or you submit an objection according to Art. 21 Para. 2 GDPR to the processing; 
  • The personal data have been unlawfully processed. 
  • The personal data must be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject. 
  • The personal data concerning you has been collected in relation to services offered by information society services according to Art. 8 Para. 1, GDPR.

b. Transfer of personal data to third parties

In the event that we have made the personal data concerning you public and we are obliged to disclose it in accordance with Art. 17 Para. 1 GDPR, we will take appropriate measures, including technical measures, taking into account the available technology and the implementation costs, to inform data processors who process the personal data that you as the data subject have requested the deletion of all links to this personal data or of copies or replications of this personal data.

c. Exceptions to deletion

The right to deletion does not exist insofar as the processing is necessary

to exercise the right of freedom of expression and information;
for the performance of a legal obligation required for processing under the law of the Union or of the Member States to which the person responsible is subject or for the performance of a task in the public interest or in the exercise of official authority conferred to the person responsible;
for reasons of public interest in the field of public health in accordance with Art. 9 Para. 2 lit. h and i, as well as Art. 9 Para. 3, GDPR;
for archiving purposes in the interest of public, scientific or historical research purposes or for statistical purposes in accordance with Art. 89 Para. 1 GDPR, to the extent that the law referred to in (a) is likely to render impossible or seriously prejudicial the attainment of the objectives of such processing; or
to assert, exercise or defend legal claims.

5. Right to information

If you have exercised your right to have the responsible party correct, delete or limit the processing, this party is obliged to inform all recipients to whom the personal data that concerns you has been disclosed of this correction or deletion of the data or restriction on processing, unless this proves impossible or involves a disproportionate effort.

It is your right to be informed regarding such recipients.

6. The right of data portability

You have the right to obtain your personal data, which you have provided to the controller, in a structured, commonly used and machine-readable format. Furthermore, you have the right to transmit this data to another person responsible without any hindrance by us, provided that

the processing is based on consent pursuant to Art. 6 Para. 1 lit. a, GDPR or Art. 9 Para. 2 lit. a GDPR or on a contract pursuant to Art. 6 Para. 1 (b) GDPR and
the processing is carried out using automated methods.
In exercising this right, you also have the right to request that the personal data concerning you be transferred directly by us to another person responsible, insofar as this is technically feasible. The freedoms and rights of other persons must not be affected by this.

The right to data portability shall not apply to the processing of personal data necessary for the performance of a task in the public interest or in the exercise of official authority conferred on the responsible party.

7. The right of objection

You have the right, for reasons arising from your specific situation, to object to the processing of personal data concerning you at any time, which is carried out in accordance with Art. 6 Para. 1 lit. e or f  GDPR, including profiling based on those provisions;

The responsible party will no longer process the personal data that concerns you, unless the party can prove compelling legitimate reasons for the processing, which outweigh your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

If the personal data that concerns you is being processed for direct marketing purposes, you have the right to object at any time to the processing of the personal data that concerns you for the purpose of such marketing; this also applies to profiling, insofar as it is associated with such direct marketing.

If you object to processing that is for direct marketing purposes, the personal data that concerns you will no longer be processed for these purposes.

You have the option of exercising your right of objection in connection with the use of Information Society services by means of automated procedures using technical specifications, notwithstanding Directive 2002/58/EC.

8. The right to revoke the data protection declaration of consent

You have the right at any time to revoke your data protection declaration of consent. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its revocation.

9. Automated decision in individual cases, including profiling

You have the right not to be subject to a decision based exclusively on automated processing - including profiling - that has legal effect against you or significantly impairs you in a similar manner. This shall not apply if the decision:

is necessary for entering into, or performance of, a contract between the you and a data controller;
is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests; or
is based on your explicit consent.
However, these decisions may not be based on special categories of personal data pursuant to Art. 9, Para. 1 GDPR, unless Art. 9 Para. 2 (a) or g and appropriate measures have been taken to protect your rights and freedom as well as your legitimate interests.

In the above cases, we will take reasonable measures to protect your rights and freedoms and your legitimate interests, including at least the right to obtain the intervention of a person by the person responsible, to state his or her own position and to challenge the decision.

10. The right of appeal to a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right of appeal to a supervisory authority, in particular in the Member State where you reside, work or where the infringement is suspected, if you believe that the processing of personal data that concerns you is in contravention of GDPR.

The supervisory authority with which the appeal has been lodged shall inform the appellant of the status and results of the appeal, including the possibility of a judicial remedy under Art. 78 GDPR.

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Bavarian State Office for Data Protection
Promenade 27
D-91522 Ansbach
Telefon: +49 (0) 981 53 1300
mailto: poststelle@lda.bayern.de

Last updated: May, 2018