The following, we, Upvest GmbH, provide you with information to give you an overview of the processing of your personal data by us. We also inform you about the rights to which you are entitled under the European General Data Protection Regulation (GDPR).
- Responsible for processing your data
Upvest GmbH
Prenzlauer Allee 242-247, Haus 8
10405 Berlin
Germany
contact@upvest.co
Upvest GmbH (hereinafter "Upvest") is represented by its managing directors Tobias Auferoth and Martin Kassing.
You can reach our Data Protection Officer by email at dataprotection@upvest.co or by post at the address Schlesische Str. 33, 10997 Berlin, with the addition "Confidential - for the attention of the data protection officer"
- Sources and personal data used by Upvest
Upvest processes personal data that Upvest receives from you in the context of our business relationship. Upvest also processes personal data that Upvest obtains from freely accessible sources on a case-by-case basis.
In addition, Upvest also processes personal data, insofar as this is necessary for the business relationship, which Upvest receives from other companies in the Upvest Group within the meaning of Section 15 ff. AktG or from other third parties (e.g. from business partners or service providers, such as PR agencies, etc.) were legitimately received.
Depending on the nature of the business relationship and the services used, we process different types of personal data:
Personal data in the business context processed by Upvest may include personal contact data, such as name, business telephone or fax number, business email address, date of birth, contact language, gender, functional data, such as organisational classification in the company, power of representation; information on the preferred contact channel, advertising, sales and interaction data (e.g. on the use of the apps, websites and social media offerings provided by Upvest, as well as those collected when a contractual partner or its vicarious agents, such as employees, contact us personally by e-mail or telephone, in particular electronic copies of correspondence). We also process information that accrues when using our technical tools (e.g. IP address). In addition, we process the following data, such as the company or business address of a contractual partner, extracted from the commercial register or legitimation of a contractor.
- Purpose and legal basis for the processing of your data
In the following you will be informed about the different processing purposes and the respective legal basis on which the processing is based. Your individual personal information is not always processed for all of the stated purposes.
a. In order to fulfil contractual and pre-contractual obligations
Upvest processes personal data that is necessary for the initiation, establishment, performance or termination of the business relationship and for the settlement of contractual claims arising from contractual relationships, such as contract administration, processing and forwarding of information to courts, authorities or legal representatives for the assertion of claims.
b. As part of a balancing of interests
Upvest processes the data of contractual partners and their employees beyond the actual performance of the contract in order to safeguard the legitimate interests of Upvest or third parties if a balancing of interests shows that the interests of Upvest or the third party outweigh the interests of the natural persons concerned by the processing.
This is done for the purpose of internal administration and to facilitate smooth business processes, for example in relation to IT security, when using communication tools such as telephone, e-mail, instant messaging or video conferencing. Here, the use is logged for security reasons, as is the use of collaboration tools, such as web-based project platforms. Also to prevent cases of abuse (whistleblower system) or to ensure general security on the company premises. For security on the company premises, Upvest takes information from contractors or their employees as part of visitor management and it may happen that your image may be stored by a video surveillance system.
Other legitimate interests may include asserting legal claims and defending legal disputes; improving the quality of procedures for marketing purposes as well as for needs analysis, improving process efficiency (e.g. training our staff) or for business management and further development of services and products.
c. Based on your consent
If you have given Upvest consent to the processing of personal data for specific purposes, this processing is lawful on the basis of your consent (e.g. mailing of newsletters, advertising approach by telephone, e-mail).
A given consent can be revoked at any time. Please note that the revocation only applies to the future. Processing that took place before the revocation is not affected. This includes, for example, the publication of photos on the company website or in online media, the recording of a video conference, in the course of events.
- Recipients or categories of recipients of your data
Within Upvest, only those departments that need access to your personal data to fulfil Upvest's contractual and legal obligations will have access to them. Any vicarious agents and service providers employed by Upvest may also receive data for these purposes if they comply with Upvest's data protection provisions. With regard to the disclosure of data to recipients outside Upvest, it should be noted that Upvest is legally obliged to maintain confidentiality about all customer-related facts and evaluations. Upvest may only disclose information about the customer if this is required by law, the customer has consented and/or processors commissioned by Upvest ensure compliance with the relevant obligations under data protection law.
Such recipients may be, for example: service providers acting on behalf of Upvest, independent representatives and business partners with whom Upvest maintains regular business relationships, financial or judicial authorities, government agencies or public institutions (upon request and to the extent permitted by law), members of certain regulated professions such as lawyers, notaries or auditors as well as credit agencies.
- Transmission of your data to recipients outside the European Union and the European Economic Area
Data will only be transmitted to recipients in countries outside the European Union or the European Economic Area (so-called third countries) if this is necessary for the execution of the customer's orders or is required by law, you have given Upvest your consent or as part of order processing. When using service providers in third countries, they are contractually bound by permissible and suitable data protection instruments and by agreeing on permissible guarantees for the transmission of personal data in third countries in accordance with Article 44 et seq. GDPR to a standard comparable to the European data protection level, unless there is a valid adequacy decision by the European Commission for the recipient country concerned.
- Duration of storage of your data and criteria for determining the storage
Duration Upvest processes and stores your personal data for as long as it is necessary to fulfil contractual and legal obligations. If the processing is no longer required for the fulfilment of contractual or legal obligations, the respective data will be deleted, unless the limited further processing is necessary to fulfil commercial or tax obligations (e.g. according to the Commercial Code, the Fiscal Code) required. In these cases, the period for storage or documentation can be between two and ten years. Furthermore, storage periods can also result from the assertion of or defence against legal claims. According to §§ 195 ff. of the German Civil Code (BGB), these limitation periods can be up to 30 years, with the regular limitation period being three years.
- Your data protection rights
Every person affected by the processing of personal data has the right
- Of access,
- the right to rectification,
- the right to erasure,
- the right to restriction of processing,
- the right to object and
- the right to data portability.
The restrictions under §§ 34 and 35 BDSG apply to the right to access and the right to erasure.
In addition to the rights mentioned above, you have the right to take action against an automated individual decision-making. If a decision to enter into or perform a contract is only made in an automated process and this decision has legal effect on you or significantly affects you in a similar way, you can request Upvest to carry out another manual review after you have explained your point of view to Upvest and the manual requested verification. In the case of an automated decision in individual cases, we will also inform you about the reason, the scope and the desired effects of such data processing.
To assert the rights listed above, please contact Upvest using the contact details given in section 1 of this data protection declaration.
You also have the right to lodge a complaint with a data protection supervisory authority.
- Obligation to provide your data
As part of your business relationship with Upvest, you must provide the personal data that is required for the establishment and implementation of the business relationship and the fulfilment of the associated contractual obligations or that Upvest is legally obliged to collect. Without the provision of this data, Upvest will generally have to refuse to conclude the contract or perform the desired service, or will no longer be able to perform an existing contract and may have to terminate it.
- Right to object, Art. 21 GDPR
You have the right to object to the processing of your personal data in the public interest or on the basis of a balance of interests with reference to your particular situation. This also applies to profiling based on it. Further processing by Upvest will only take place if there is evidence of overriding interests that must be protected.
You are welcome to send your objection to Upvest using the contact details given in section 1 of this data protection notice.
The status of this data protection notice is September 2023.