Last update: April 2021
Dear employees,
Dear Sirs and Madams,
With this privacy policy we would like to inform you about
- the personal data we processing in the context of photographs, audio and/or video recordings,
- what we use these data for,
- how you can object or withdraw your consent to the use of these data and
- the other rights you have as a data subject and how you can assert them.
1. Who is responsible for data processing and who can I contact?
The responsible body for data processing (data controller) in the sense given in the GDPR is:
Bionorica SE
Kerschensteinerstr. 11–15
92318 Neumarkt, Germany
Phone: +49 (0) 9181 231-90
Fax: +49 (0) 9181 231-265
E-mail: info@bionorica.de
Our company data protection officer can be reached via email at datenschutz@bionorica.de or by post at the above address (please include the line ‘ATTENTION: Data Protection Officer’).
2. Am I obligated to participate?
Of course, you are not obliged to participate in photographs, audio and/or video recordings. You have always the possibility to inform the creator of the photographs/recordings (e.g. photographers) that you do not want to be photographed/filmed/recorded.
3. Which sources and data does Bionorica SE use?
We process photographs, audio and/or video recordings that are created by us, created and transferred by commissioned third parties (e.g. photographer, agency) or transferred to us by you.
The personal data processed by us include in particular:
- photographs, audio and/or video recordings
- Name
- Department (internal)
- Address data (external)
- Date of birth
4. Processing purposes and legal basis
We process personal data in accordance with the provisions of the European General Data Protection Regulation (EU GDPR) and the German Federal Data Protection Act (BDSG) according to the following legal bases:
4.1. Based on legitimate interests (Art. 6 para. 1 cl. 1 lit. f GDPR)
In the following cases, we process personal data to protect our legitimate interests:
- As part of Bionorica events, we create photographs, audio and/or video recordings, process the photographs/recordings e.g. through post-processing (retouching, brightness, color) and save them for internal documentation purposes.
- As part of internal Bionorica events (e.g. summer party, annual celebration) we publish photos in our internal media (e.g. intranet, employee magazine).
- As part of our public relations work, we may publish large group photos, as far as those photos focus on the event itself and not on a single person or individuals.
Of course, when choosing any photos to be published, we pay particular attention to protect the legitimate interests of the data subject.
4.2. Based on your consent (Art. 6 para. 1 cl. 1 lit. a GDPR)
If you have given us your consent to the internal and/or external publication of personal data for specific purposes, the lawfulness of this processing is based on your consent.
The subject of such consent is the internal and/or external publication of the photographs/recordings without restriction of the factual, spatial or temporal area of use for all internal (e.g. intranet, employee magazine, training groups) and/or external (e.g. Bionorica Internet appearances, press releases) purposes. In this context, the photographs/recordings can be duplicated, distributed, exhibited and/or played publicly and made accessible by Bionorica SE.
We would like to draw your attention to the fact that especially in the context of the publication of photos on the Internet, for example the following risks can occur:
- the dangers of (worldwide) findability via search engines,
- the lack of possibilities for complete erasure,
- the reuse or misuse by third parties as well
- the risk of possibly inadequate legal protection if the photo is misused outside the EU.
In principle, your consent can be withdrawn with future effect. This also applies to the withdrawal of declarations of consent that were issued to us before the GDPR came into effect. Please note that the withdrawal of consent does not affect the lawfulness of the processing carried out before the withdrawal. In individual cases, despite your withdrawal, there may be a right to further processing for other legal obligations. For example if the destruction of large print products would lead to inappropriately high economic damage.
The withdrawal of consent can be sent free of charge and informally to our above-mentioned contact data (see para. 1). If you withdraw your consent by telephone, we may ask you to provide additional proof of your identity in another way.
5. Who gets my data?
Within Bionorica SE, those offices and departments are given access to your data who are responsible for creating the photographs/recordings and/or who need them for other purposes mentioned above (e.g. internal documentation purposes). Carefully selected and controlled service providers employed by us may also receive data for these purposes, if they are obliged to so-called contract data processing to meet the data protection requirements that are also applicable to us. For example, agencies.
Data will only be passed on to recipients outside of Bionorica SE with your consent or to safeguard our legitimate interests in the cases mentioned under 4.1.
6. Are data transferred to companies in third countries or to international organisations?
Data are only transferred to locations in countries outside the European Union (so-called third countries) if, in addition to the general requirements for data transfer, there is also an adequacy decision (Art. 45 GDPR) or appropriate safeguards (Art. 46 GDPR) and, if necessary, additional measures are taken or the requirements of Art. 49 are fulfilled (for example, the corresponding consent).
7. How long are my data stored?
Once the data are no longer needed for the described purposes, they are erased unless their further processing is necessary – for a limited period – for the following purposes:
- fulfilment of retention obligations according to commercial and tax law: the German Commercial Code (HGB) and the German Money Laundering Act (GwG) should be mentioned. The retention and documentation periods prescribed there can be up to ten years.
- preservation of evidence in the context of the statute of limitations. Pursuant to Sections 195ff. of the German Civil Code (BGB) these statutory limitation periods can be up to 30 years, whereby the normal limitation period is three years.
8. What rights do I have as a data subject?
As a data subject you have the right to access pursuant to Article 15 GDPR, the right to rectification pursuant to Article 16 GDPR, the right to erasure pursuant to Article 17 GDPR, the right to restriction of processing pursuant to Article 18 GDPR and the right to data portability according to Article 20 GDPR. With respect to the right to access and the right to erasure, the limitations set forth in Sections 34 and 35 BDSG apply. You also have the right to lodge a complaint with a responsible data protection supervisory authority (Article 77 GDPR in conjunction with Section 19 BDSG).
You also have the right to object under Art. 21 GDPR. You can object to the processing of personal data on the basis of Art. 6 para. 1 lit. e or f GDPR at any time without giving reasons.
Consent to the publication of photographs, audio and/or video recordings by Bionorica SE in accordance with the GDPR
Description: ______________________________________
Name, surname: ______________________________________
Department (internal): ______________________________________ OR
Street, post code, city (external): ________________________________
Date of birth: ______________________________________
Voluntary consent
I have taken note of the information on data protection.
O I agree to the internal publication. I know that I can withdraw this consent at any time with effect for the future.
O I agree to the external publication. I know that I can withdraw this consent at any time with effect for the future.
O I do not agree to the internal and external publication
I waive a model fee.
_____________________________
(Place, date)
_____________________________ _____________________________
(Name in block letters) (Signature)
In the case of minors (e.g. interns), the consent of all custodians is also required:
_____________________________ _____________________________
(Name in block letters) (Signature custodian 1)
_____________________________ _____________________________
(Name in block letters) (Signature custodian 2)