Information Pursuant to the EU General Data Protection Regulation (EU GDPR)

1. Name and contact information of the controller and the company’s data protection officer

The controller within the meaning of Article 4(7) of the EU GDPR is

Creditreform Luxembourg SA
50, rue Gabriel Lippmann
L-6947 Niederanven
Tel. +352 26 34 60
Fax: +352 26 34 60 – 50
info@luxembourg.creditreform.lu 

Data Protection Officer

You can contact our Data Protection Officer at

Creditreform Compliance Services GmbH
Data Protection Officer
Hammfelddamm 13
41460 Neuss
dataprotection@luxembourg.creditreform.lu 

2. Categories of Personal Data Processed

The Creditreform credit information database stores information regarding the name, business name, address, occupation, financial circumstances, any liabilities, details regarding payment history, or negative entries such as insolvency information and listings in debtor registers.

3. Purposes of Data Processing

Creditreform processes the data for various purposes:
Creditreform processes data to provide credit reports on the creditworthiness of the individuals or companies in question. Within the framework of legal provisions, a portion of the data contained in the business database is also used to supply other company databases (e.g., firmeneintrag.creditreform.de), including for the purposes of dialogue marketing and for updating, validating, and enriching address databases, as well as for the production of corresponding data carriers.
If Creditreform, as a debt collection agency, is processing a claim against you as a debtor, the data required for this purpose is also processed within Creditreform’s debt collection division.

4. Legal Bases for Data Processing

The legal basis for data processing for credit reporting purposes and for direct marketing and marketing purposes is Article 6(1)(f) of the EU GDPR. Information may only be disclosed if a customer has credibly demonstrated a legitimate interest in obtaining the information. Legitimate interests in the aforementioned sense may include: credit decisions, business development, ownership interests, claims, credit checks, insurance contracts, past-due claims, and enforcement information.
The legal basis for debt management is Article 6(1)(b) and (f) of the EU GDPR.

5. Source of the Data

The information and address marketing data are derived in part from publicly accessible sources such as public registers, the Internet, the press, and other media. In some cases, the data are collected directly from the data subjects. Data may also be obtained from the debt collection management process.

6. Categories of Recipients of Personal Data

Creditreform’s customers include credit institutions, leasing companies, insurance companies, telecommunications companies, debt collection agencies, mail-order, wholesale, and retail companies, as well as other businesses that supply goods or provide services on an invoice basis, both domestically and internationally.
If data is transferred to countries outside the EU, this is done on the basis of the so-called Standard Contractual Clauses, which you can view at the following link https://eur-lex.europa.eu/legal-content/DE/TXT/HTML/?uri=CELEX:32021D0914&from=DE or request to have sent to you.

7. Duration of Data Storage

In the Creditreform credit information database as well as in the areas of direct marketing and marketing, personal data is stored in accordance with Article 5(1)(e) of the GDPR only for as long as it is necessary for the respective processing purposes.

Appropriate retention and review periods are established for the individual data categories. To the extent that a regular retention period of initially three years is provided for certain creditworthiness-related data, a review is conducted upon its expiration to determine whether further storage is still necessary for the respective purpose. If this is not the case, the data is deleted. The necessity of retention is assessed in particular based on the nature of the information, its timeliness and significance, as well as its continuing relevance for creditworthiness and risk assessment.

Information regarding insolvency proceedings may originate, in particular, from the Luxembourg Trade and Companies Register (RCS) or the REGINSOL insolvency register. REGINSOL is maintained in accordance with Art. 23-1 of the amended Law of December 19, 2002, concerning the Trade and Companies Register as well as corporate accounting and annual financial statements. Creditreform Luxembourg’s storage of such information is subject to the principles of necessity and storage limitation pursuant to Article 5(1)(e) of the GDPR.

In the debt collection sector, personal data is processed for as long as necessary to carry out the debt collection mandate. Upon completion of the mandate, only those data will continue to be stored whose retention is necessary to comply with statutory retention obligations or to assert, exercise, or defend legal claims. The data will then be deleted.

8. Data Subject Rights

 Every data subject has the right to access information from Creditreform under Article 15 of the GDPR, the right to rectification under Article 16 of the GDPR, the right to erasure under Article 17 of the GDPR, and the right to restriction of processing under Article 18 of the GDPR. If you have given your consent to the processing of the data we have stored, you have the right to withdraw this consent at any time. Withdrawal of consent does not affect the lawfulness of the processing of your data that took place on the basis of your consent up until the time of withdrawal.
You may file a complaint regarding our processing of your data with the state data protection commissioner responsible for your federal state.
The provision of your data to us is neither required by law nor by contract, nor is it necessary for the conclusion of a contract. You are not obligated to provide us with the requested data. If you do not provide us with your data, this may make it difficult or impossible for your lender or supplier to assess your creditworthiness, which in turn may result in you being denied a loan or advance payment from the supplier.

Right to Object

The processing of the data stored by us is carried out for compelling legitimate reasons related to creditor and credit protection, which generally outweigh your interests, rights, and freedoms, or serves to assert, exercise, or defend legal claims. You may object to the processing of your data only if there are reasons arising from your specific situation that must be substantiated. If such specific reasons are demonstrably present, the data will no longer be processed. If your data is processed for advertising and marketing purposes, you have the right to object to this at any time. In that case, your data will no longer be processed for this purpose.

Information Pursuant to the EU General Data Protection Regulation (Information for Job Applicants Regarding Data Processing)

As part of the application process, it is essential for us to store and process your personal data. We hereby wish to inform you about the purpose and nature of this processing. With this information notice, we fulfill, among other things, the disclosure obligations imposed on us by data protection law, in particular pursuant to Article 13 of the GDPR

1. Name and contact information of the controller and the company’s data protection officer

The controller within the meaning of Article 4(7) of the EU GDPR is

Creditreform Luxembourg SA
50, rue Gabriel Lippmann
L-6947 Niederanven
Tel. +352 26 34 60
Fax: +352 26 34 60 – 50
info@luxembourg.creditreform.lu 

Data Protection Officer

You can contact our Data Protection Officer at

Creditreform Compliance Services GmbH
Data Protection Officer
Hammfelddamm 13
41460 Neuss
dataprotection@luxembourg.creditreform.lu 

2. Categories of Personal Data Processed

For the purpose of processing applicant data, we process the following data about you: title (if applicable), last name, first name, date of birth, email address, phone number, mailing address, bank account information (if applicable), identification documents, certificates, and certificate details.

3. Purposes of Data Processing

We process your personal data in our application system exclusively for the purposes necessary to ensure the effective and proper conduct of the application process. This also includes data that is added during the course of the application process, such as data resulting from follow-up inquiries or documents submitted at a later date. In addition, we process your personal data for evidentiary purposes and in anticipation of any potential legal disputes.

4. Legal Bases for Data Processing

Any processing of personal data requires a legal basis. Processing is carried out on the basis of consent (Art. 6(1)(a) of the GDPR) as well as on the basis of Art. 6(1)(f) of the GDPR, to the extent that processing is necessary to safeguard the legitimate interests of the controller or a third party and does not override the interests or fundamental rights and freedoms of the data subject that require the protection of personal data. To conduct the application process and to decide on the establishment of an employment relationship, processing is also carried out on the basis of Article 6(1)(b) of the GDPR.

5. Categories of Recipients of Personal Data

No Disclosure of Data

Applications are reviewed only for positions at Creditreform Luxembourg. For open positions outside of Creditreform Luxembourg but within the Creditreform Group, you are asked to apply directly to the respective company. Data will be disclosed to other companies within the Creditreform Group only with your express consent.

Your personal data will not be disclosed to external third parties without your consent. To evaluate your application materials, they will be forwarded to the relevant contacts in the respective department for which the application is intended.

6. Data Retention Period / Data Deletion

Data will be stored for as long as necessary to complete the application process. Once the data is no longer needed, it will be deleted. For record-keeping purposes and in anticipation of any potential legal disputes, data regarding rejected applicants will be deleted no later than six months after the end of the application process. Longer retention of your data is only possible with your express consent.

7. Data Subject Rights

Every data subject has the right to access information from Creditreform pursuant to Article 15 of the GDPR, the right to rectification pursuant to Article 16 of the GDPR, the right to erasure pursuant to Article 17 of the GDPR, and the right to restriction of processing pursuant to Article 18 of the GDPR.

If you have given your consent to the processing of the data we have stored, you have the right to withdraw this consent at any time. Withdrawal does not affect the lawfulness of the processing of your data that took place on the basis of your consent up until the time of withdrawal.

You may file a complaint regarding our processing of your data with the State Data Protection Commissioner responsible for your federal state.

If the processing is based on an overriding legitimate interest, you may object to the processing of your data for the purpose of applicant data management at any time. The data will then no longer be processed for this purpose. In addition, you have the right to object to the processing of your data for direct marketing purposes. This also applies to profiling, insofar as it is related to direct marketing.

8. Changes to the Privacy Policy

We reserve the right to amend this Privacy Policy. We therefore recommend that you review our Privacy Policy regularly.

Additional General Information About Visiting Our Website

General Information

The operators of this website take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with applicable data protection laws and this Privacy Policy.

As a general rule, you can use our website without providing any personal data. To the extent that personal data (such as your name, address, or email address) is collected on our website, this is always done on a voluntary basis whenever possible.

Please note that data transmission over the Internet (e.g., when communicating via email) may involve security vulnerabilities. It is not possible to completely protect data from access by third parties.

Plugins from the social networks Facebook, Google, Twitter, Xing, and LinkedIn are integrated into our website. Please review the following sections regarding these plugins, which apply if you have activated the plugin at the bottom of the webpage.

Server Log Files

When you access our website, general information is automatically collected via a cookie. This information (server log files) includes, for example, the type of web browser, the operating system used, the domain name of your Internet service provider, and similar details. This information does not allow any conclusions to be drawn about your identity.

This information is technically necessary to correctly deliver the web content you have requested and is inevitably generated when using the Internet. It is processed in particular for the following purposes:

•    To ensure a smooth connection to the website
•    To ensure the smooth operation of our website
•    To evaluate system security and stability
•    For other administrative purposes.

The processing of your personal data is based on our legitimate interest in the aforementioned purposes for data collection. We do not use your data to draw conclusions about your identity. The recipients of the data are only the controller and, if applicable, processors.

We may analyze anonymous information of this kind statistically to optimize our website based on the underlying technology.

Cookies

Some parts of this website use so-called cookies. Cookies do not harm your computer and do not contain viruses. Cookies help make our website at more user-friendly, effective, and secure. Cookies are small text files that are stored on your computer and saved by your browser.

Most of the cookies we use are so-called “session cookies.” They are automatically deleted at the end of your visit. Other cookies remain stored on your device until you delete them. These cookies enable us to recognize your browser the next time you visit.

You can configure your browser to notify you when cookies are set and to allow cookies only on a case-by-case basis, to block cookies in specific cases or generally, and to enable the automatic deletion of cookies when you close your browser. Disabling cookies may limit the functionality of this website.

Registration/Creating an Account

When you register to use our personalized services, we collect certain personal data, such as your name, address, and contact and communication information, including your phone number and email address. Once you are registered with us, you can access content and services that we offer exclusively to registered users. Registered users also have the option to change or delete the data provided during registration at any time, if necessary. Of course, we will also provide you with information at any time regarding the personal data we have stored about you. We will gladly correct or delete this data at your request, provided that no legal retention obligations prevent us from doing so. To contact us in this regard, please use the contact information provided at the end of this Privacy Policy.

By registering, you consent to the processing of your basic data for the specified purpose and also to our use of your contact information for our own promotional purposes—for example, to offer you other Creditreform services. You may revoke your consent at any time. If you do so, your registration data will be deleted.

Newsletter Data

If you would like to subscribe to the newsletter offered on the website, we require your email address as well as information that allows us to verify that you are the owner of the provided email address and that you consent to receiving the newsletter. No additional data is collected by . We use this data exclusively for sending the requested information.

You may revoke your consent to the storage of your data and email address, as well as their use for sending the newsletter, at any time—for example, via the “unsubscribe” link in the newsletter.

Contact Form and Email Contact

Our website features a contact form that can be used to contact us electronically. If you use this option, the data entered in the form will be transmitted to us and stored.

Alternatively, you can contact us via the email address provided. In this case, the user’s personal data transmitted with the email will be stored.

In this context, the data may be disclosed to third parties under certain circumstances. Processing is based on your consent in accordance with Article 6(1)(a) of the GDPR. To the extent that information is stored on or read from your device, Article 4(3)(e) of the Amended Law of May 30, 2005, on the Protection of Privacy in the Electronic Communications Sector also applies, where applicable. You may revoke your consent at any time with future effect via the cookie settings. If you do so, your contact information will be deleted.

Encryption

Creditreform employs technical and organizational security measures to protect the data we manage against accidental or intentional manipulation, loss, or destruction, as well as against access by unauthorized persons. All personal data you entrust to us when visiting our website is transmitted to Creditreform in encrypted form. To this end, we use the recognized secure SSL protocol with encryption of up to 256 bits. Most browsers indicate whether the security protocol is supported by displaying a message or a lock icon in the status bar.

Certificate with Extended Validation

Creditreform also uses an Extended Validation certificate in some instances to underscore the trustworthiness of this web application. Strict criteria are applied when issuing Extended Validation certificates, and a thorough review of the applicant is conducted. You can recognize the Extended Validation certificate by the additional field in the browser’s address bar, which is partially colored green.

Use of Google reCAPTCHA

We use “Google reCAPTCHA” (hereinafter “reCAPTCHA”) on our websites. The provider is Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”).

reCAPTCHA is designed to verify whether data entry on our websites (e.g., in a contact form) is performed by a human or by an automated program. To do this, reCAPTCHA analyzes the website visitor’s behavior based on various characteristics. This analysis begins automatically as soon as the website visitor enters the website. For the analysis, reCAPTCHA evaluates various pieces of information (e.g., IP address, the length of time the website visitor spends on the website, or mouse movements made by the user). The data collected during the analysis is forwarded to Google.

The reCAPTCHA analyses run entirely in the background. Website visitors are not notified that an analysis is taking place.

Data processing is based on Article 6(1)(f) of the GDPR. The website operator has a legitimate interest in protecting its web offerings from abusive automated scanning and spam.

For more information about Google reCAPTCHA and Google’s Privacy Policy, please visit the following links: https://www.google.com/intl/de/policies/privacy/ and https://www.google.com/recaptcha/intro/android.html.

Use of Usercentrics

Usercentrics is a consent management tool that we use to obtain your consent to the use of cookies and to document your decision. For this purpose, we transmit data regarding your log file, the browser you are using, and your cookie settings (yes or no, timestamp, and scope of data) to Usercentrics.

Social Media Presences

Based on our legitimate interests pursuant to Article 6(1)(f) of the GDPR, we maintain online presences on social networks and platforms to communicate with customers, prospective customers, and users active there and to inform them about our services. When you access the respective networks and platforms, the terms of service and data processing policies of their respective operators apply.

Unless otherwise specified in our Privacy Policy, we process users’ data when they communicate with us on social networks and platforms—for example, by posting on our social media profiles or sending us messages

Note on the Use of a Security Solution Against Cyberattacks

To protect our IT systems and web services from unauthorized access, attacks, and technical malfunctions, we employ technical and organizational security measures as well as external security service providers. In doing so, system-related data such as IP addresses, timestamps, and connection data may be processed. This processing is based on our legitimate interest in IT and network security pursuant to Article 6(1)(f) of the GDPR.

Notice Regarding Data Transfer to the U.S. or Third Countries

When using Google tools, we transfer your truncated IP address to the U.S. This data transfer is based on the EU Standard Contractual Clauses provided by Google.
Furthermore, we cannot rule out the possibility that other service providers (e.g., Webtrekk/Mapp, Google services) may, under certain circumstances, transfer data to countries outside the EU. Due to the laws of non-EU countries (e.g., under the so-called Cloud Act in the U.S.), even if these agreements and regulations are in place, there is still a possibility that government agencies, in particular, may access your personal data without us or you being able to prevent, stop, or control this. For these reasons, your consent—for example, to the use of cookies by the services mentioned above—also covers the purpose of data transfers to countries outside the EU.