Privacy Policy

May 2020

Contact Information

Responsible party

GAMS Software GmbH
Augustinusstrasse 11b
50226 Frechen

For our organization we have appointed an external data privacy officer with the following contact details:
Datenschutzberater.NRW GmbH
Dennis Manz
Hansaring 78
50670 Köln
Telefon: +49 (0) 221 29 27 29 0
E-Mail: datenschutz@datenschutzberater.nrw

Which data do we collect and process?

Lawfulness of data processing

We collect and process your data to perform the contract and to provide our services, to improve and adapt our services and our website to your needs, to provide updates and upgrades, to send you notifications regarding our services, to issue invoices, and to collect our claims.

Art. 6 I lit. (a) GDPR serves as a legal basis for processing operations for which we obtain consent for a specific processing purpose. If the processing of personal data is necessary for the performance of a contract, the processing is based on Art. 6 I lit. (b) GDPR. The same applies to such processing operations which are necessary for the implementation of pre-contractual measures, for example in cases of enquiries about our products or services. If we are subject to a legal obligation which makes it necessary to process personal data, for example to fulfil tax obligations, processing is based on Art. 6 I lit. (c) GDPR.

Finally, processing operations could be based on Art. 6 I lit. (f) GDPR. Processing operations which are not covered by any of the above legal bases are based on this legal basis if the processing is necessary to safeguard our legitimate interests or those of a third party, provided that the interests, fundamental rights and freedoms of the data subject do not prevail. We are allowed to carry out such processing operations in particular because they have been specifically mentioned by the European legislation. As a rule, a legitimate interest can be assumed if the data subject is a customer of the data controller.

If the processing of personal data is based on Art. 6 I lit. (f) GDPR, our legitimate interest is the performance of our business activities and the fulfilment of legal obligations, insofar as the processing does not fall under Art. 6 I lit. (c) GDPR.

We process applicant data in accordance with Art. 88 GDPR in conjunction with § 26 BDSG (new), the relevant German federal data protection act.

Categories of Recipients

Processors

We forward various personal data to our processors as data controllers in the context of a data processing contract . We have ensured the security of your data by entering into agreements for contract data processing. Our processors can be divided into the following categories:

• Provision of services: These include newsletter dispatch, printing and dispatch of invoices, customer surveys, payment service providers

• Operation of services, maintenance and servicing of hardware and software.

We only disclose data to authorities and third parties in accordance with legal regulations or a court order. Information to authorities can be given on the basis of a legal regulation to avert danger or for criminal prosecution. Third parties will only receive information if a statutory provision provides for this.

Data Processing in third countries

Google: We use Google’s services to store and process our email correspondence. We have entered a data processing agreement with Google for this purpose. All our data is hosted in Googles European Data Center. See the current Data Processing Amendment for more details.

Amazon: Our customer database is hosted on Amazon AWS systems. We have entered a data processing agreement with AWS. See the current Data Processing Amendment for more details.

Payrexx: For processing credit card payments we use the external payment provider Payrexx AG, Burgstrasse 18, CH-3600 Thun. No credit card information is stored on GAMS systems. Payrexx will process personal data to handle payments on behalf of GAMS. Further information can be found in the Payrexx privacy policy at https://www.payrexx.com/site/assets/files/3945/privacy_policy.pdf .

Paytrace: In addition to Payrexx, we also use Paytrace for credit card payment processing (mostly for our non-European customers). No credit card information is stored on GAMS systems. Read more in the Paytrace Privacy Policy .

Mailchimp: We have entered a data processing agreement with The Rocket Science Group LLC who operate Mailchimp to handle our newsletter. See the current Data Processing Addendum for more details.

GAMS Development Corp: When you sign up for services or digital content, your data is transferred to GAMS Development Corp. in order to create quotes or for contract fulfillment on the basis of Art. 6 (1) (b) GDPR.

Duration of Data Storage

We process and store personal data only for the period of time required to achieve the purpose of storage or if required by law:

For contract data, processing is restricted after termination of the contract, after the 10 year legal retention period in accordance with § 257 HGB and § 147 AO they are deleted.

Data that you enter as a job applicant during the recruitment process will be stored for a maximum of six months.

For customer correspondence, order and payment history, the statutory retention period of 6 years applies in accordance with § 257 HGB and § 147 AO.

Your Rights

Right of information and verification: You have the right to receive free information and confirmation of the personal data stored about you and a copy of this information at any time.

Right of rectification: You have the right to demand the immediate correction of incorrect personal data concerning you. You also have the right to request the completion of incomplete personal data, including by means of a supplementary declaration, taking into account the purposes of the processing.

Right of cancellation: You have the right to obtain the immediate deletion of personal data relating to you if one of the following reasons applies and provided that the processing is not necessary:

• the personal data have been collected or otherwise processed for purposes for which they are no longer necessary
• You withdraw the consent on which the processing was based and there is no other legal basis for the processing.
• You object to the processing in accordance with Article 21(1) of the GDPR and there are no overriding legitimate reasons for processing, or you object to the processing in accordance with Article 21(2) of the GDPR.
• The personal data were processed unlawfully.
• The deletion of the personal data is necessary to comply with a legal obligation under European Union law or the law of the Member States to which we are subject.
• The personal data was collected in relation to information society services offered in accordance with Article 8 (1) of the GDPR.

Right to restrict processing: You have the right to request the restriction of the processing if one of the following conditions is met:

• You contest the accuracy of the personal data, for a period of time that allows us to verify the accuracy of the personal data.
• The processing is unlawful, you object to the deletion of the personal data and instead demand the restriction of the use of the personal data.
• We no longer need the personal data for the purposes of the processing, but you need it to assert, exercise or defend legal claims.
• You have lodged an objection to the processing in accordance with Art. 21 (1) GDPR and it is not yet clear whether our legitimate grounds outweigh yours.

Rights of objection to the processing: You have the right to object at any time to the processing of personal data concerning you that is carried out on the basis of Art. 6 I (e) or (f) GDPR. In the event of an objection, we will no longer process the personal data unless we can demonstrate compelling reasons for processing that are worthy of protection and outweigh your interests, rights and freedoms, or unless the processing serves to assert, exercise or defend legal claims. You have the right to object at any time to the processing of personal data for the purpose of direct marketing.

Right to revoke consent under data protection law: You have the right to revoke your consent to the processing of personal data at any time.

Right of appeal to a regulatory authority: You have the right to appeal at any time to a regulatory authority in the Member State in which you are resident or working or in which the alleged infringement occurred, if you consider that the processing of personal data relating to you is contrary to the EU data protection regulation

Existence of automatic decision making / profiling

We do not carry out automatic decision making or profiling.

Google Web Fonts

For uniform representation of fonts, this page uses web fonts provided by Google. When you open a page, your browser loads the required web fonts into your browser cache to display texts and fonts correctly. For this purpose your browser has to establish a direct connection to Google servers. Google thus becomes aware that our web page was accessed via your IP address. The use of web fonts constitutes a justified interest pursuant to Art. 6 (1) (f) GDPR.

If your browser does not support web fonts, a standard font is used by your computer.

Further information about handling user data, can be found at https://developers.google.com/fonts/faq and in Google’s privacy policy at https://www.google.com/policies/privacy/ .