Information on Data Protection in Business Transactions

  1. Home
  2. |
  3. Contact
  4. |
  5. Information on Data Protection in Business Transactions

Information on Data Protection in Business Transactions (Art. 13 f. GDPR), Status September 2022

(1) In the following we provide information on the processing of personal data in business trans-actions. Personal data are all data that can be related to you personally, e.g. name, address, e-mail address, payment data, ordered goods.

(2) The person responsible in accordance with Art. 4 No. 7 GDPR is your respective contractual partner in our group of companies: Sturm Holding GmbH (parent company) and Sturm Maschinen- & Anlagenbau GmbH (subsidiary) can be reached at, Industriestraße 10, 94330 Salching.

(3) We process personal data that we receive within the scope of the contractual relationship or the initiation of such an offer (offer phase) or obtained by your contacting us from the business partners themselves, our sales representatives, headhunters, temporary employment agencies or similar or from publicly accessible sources (e.g. your website).

(4) The data is processed by us
a) insofar as it is necessary to fulfil pre-contractual and contractual obligations. The processing is therefore carried out for the purpose of fulfilling the contract and on the basis of Art. 6 para. 1 S. 1 lit. b GDPR.
b) to safeguard legitimate interests of us or third parties, e.g. video surveillance to collect evidence in the event of criminal offences for the protection of customers and employees, measures for building and plant security (access controls), measures to secure the right to the premises, direct advertising to existing customers for customer care purposes.
The legal basis for this is Art. 6 para. 1 lit. f GDPR.
When ordering on account (customers) or granting a down payment (suppliers), we can carry out an assessment of the credit risk on the basis of mathematical-statistical procedures with a credit agency (scoring). For this purpose, the personal data (name, address) required for credit assessment are transferred to the credit agency. In addition, we can also check the creditworthiness of suppliers during/before the initial inquiry or before the suppliers are created in the ERP system. The collection, storage and forwarding is therefore carried out for the purpose of credit assessment to avoid default of payment and on the basis of Art. 6 para. 1 S. 1 lit. b GDPR and Art. 6 para. 1 S. 1 lit. f GDPR. para. 1 S. 1 lit. b GDPR and Art. 6 para. 1 S. 1 lit. f GDPR. On the basis of this information, a statistical probability of a credit default and thus of your inability to pay is calculated, which may affect the agreement of the contractual conditions.

(5) Data is only passed on
a) within the company to those bodies that need them to fulfil our pre-contractual and contractual and legal obligations.
Processors commissioned by us (Art. 28 GDPR) may also receive data for these purposes. These are companies in the categories of IT services, telecommunications, consulting, marketing, ad-dress research and data destruction, but also the parent company Sturm Holding GmbH, which assumes central tasks for its subsidiaries, especially in the commercial sector (personnel, finance, controlling, law) or in the area of project management and analysis.
To protect your data, data protection agreements have been made with these bodies in accordance with the legal requirements.
b) to third parties, if legal provisions permit or require this, if you have given your consent or if we are authorised to provide information. This includes public authorities and institutions such as police/prosecutor’s office, supervisory authorities, auditors as well as other companies such as credit institutions and payment service providers, collection and shipping companies.
Any further processing will only be carried out if you have given your consent or a legal authorisation has been obtained.

(6) We maintain up-to-date technical measures to ensure the protection of personal data. These are adapted to the current state of the art in each case.

(7) You have the right to request information from us at any time about the personal data stored by us about you (Art. 15 GDPR). This also applies to the recipients or categories of recipients to whom this data is passed on and the purpose of the storage. In addition, you have the right to demand correction under the conditions of Art. 16 GDPR and/or deletion under the conditions of Art. 17 GDPR and/or restriction of processing under the conditions of Art. 18 GDPR. Furthermore, you may at any time request data transmission under the conditions of Art. 20 GDPR.
In the case of processing of personal data for the protection of legitimate interests (Art. 6 para. 1 S. 1 lit. f GDPR), you may object to the processing of personal data concerning you at any time with effect for the future (Art. 21 GDPR). This applies in particular to the use of your data for the purpose of direct advertising. In the event of an objection, we must refrain from any further processing of your data for the aforementioned purposes, unless
– there are compelling legitimate reasons for processing that outweigh your interests, rights and freedoms, or
– the processing is necessary for the assertion, exercise or defence of legal claims.

(8) Personal data will only be stored for as long as necessary to achieve the respective purpose, taking into account the statutory storage obligations.

(9) All information requests, requests for information, revocations or objections to data processing should be sent by e-mail to our data protection officer at For further information, please refer to the full text of the GDPR, which is available on the Internet at, and to our data protection declaration, which can be viewed on the Internet at You also have the opportunity to complain to the responsible supervisory authority about data protection issues.

Download area