Privacy notice for (potential) customers, partners, and other interested parties
Last updated on 08.06.2022
Privacy notice about our processing of (potential) customer, partner and interested party data in accordance with Articles 13, 14 and 21 of the General Data Protection Regulation (GDPR) at at Rokaware SL and the Netzo family of companies ("Affiliates") ("Netzo").
Dear customer, dear interested party, dear contractual partner,
in accordance with the requirements of Art. 13, 14, and 21 of the General Data Protection Regulation (GDPR), we hereby inform you about the processing of your personal data as well as your rights under data protection law in this regard. Which data is processed in detail and how it is used depends largely on the requested or the agreed services. In order to ensure that you are fully informed about the processing of your personal data in the context of the performance of a contract or the implementation of pre-contractual measures, please take note of the following information.
1. Identity and contact of the data controller under data protection law:
Main place of business (HQ)
Paseo de la Castellana 30, Bajo Derecha
28046 Madrid, Spain
+34 910 601 536
Arturo Romero Karam (M. Sc.)
Place of jurisdiction: Madrid Local Court
NIF (Tax-ID): B09980772
Netzo family of companies ("Affiliates")
|German Office||Mexico Office|
Tal 44, 80331 Munich, Germany
+49 892 4886 6390
Arturo Romero Karam (M. Sc.)
Place of jurisdiction: Munich Local Court
Commercial register number: HRB 265887
USt-ID (Tax-ID): DE344312042
|ROKAWARE S.A.P.I. de C.V.|
66274 San Pedro Garza Garcia, Mexico
Arturo Romero Vargas (MBA)
RFC (Tax-ID): ROK220225I67
2. Contact of the data protection officer:
Contact details of the data protection officer
Support in English and German. For questions in Spanish, please write to us at: [email protected]
When contacting the data protection officer, please state the company to which your request relates. Please DO NOT provide sensitive information that could identify you, e.g. attaching copy of ID.
3. Purposes and legal basis of processing
We process your personal data in accordance with the provisions of the European General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG) insofar as this is necessary for the establishment, implementation, or performance of a contract or for the implementation of pre-contractual measures. Insofar as personal data is required for the initiation or implementation of a contractual relationship or in the context of the implementation of pre-contractual measures, the processing is lawful pursuant to Art. 6 (1)(b) GDPR.
If you give us express consent to process personal data for specific purposes (e.g., disclosure to third parties, evaluation for marketing purposes, or addressing you by email for advertising purposes), the lawfulness of this processing is based on your consent pursuant to Art. 6 (1)(a) GDPR. Consent given can be revoked at any time with effect for the future (see section 9 of this data protection information).
If necessary and legally permissible, we process your data beyond the actual contractual purposes for the fulfillment of legal obligations pursuant to Art. 6 (1)(c) GDPR. In addition, processing may be carried out to protect the legitimate interests of us or third parties and to defend and assert legal claims pursuant to Art. 6 (1)(f) GDPR. If necessary, we will inform you separately, stating the legitimate interest insofar as this is required by law.
4. Categories of personal data
We only process data that is related to the establishment of the contract or the pre-contractual measures. This can be general data about you or persons in your company (name, address, contact details, etc.) as well as, if applicable, other data that you provide to us in the context of the establishment of the contract.
5. Sources of the data
We process personal data that we receive from you in the course of contacting you or establishing a contractual relationship or in the course of pre-contractual measures or that you provide via our email, phone, web forms on our websites, as well as direct communication via social media channels and when filling out our quote form.
6. Recipients of the data
We disclose your personal data within our company exclusively to those areas and persons who need this data to fulfill contractual and legal obligations or to implement our legitimate interest.
Your personal data is processed on our behalf on the basis of order processing contracts pursuant to Art. 28 GDPR. In these cases, we ensure that the processing of personal data is carried out in accordance with the provisions of the GDPR. The categories of recipients, in this case, are internet service providers, providers of privacy and consent management software (Usercentrics), providers of customer management systems and software (Monday.com), telephone service provider (Placetel, Telnyx, 3CX), meeting scheduling software (Calendly), as well as internal collaboration tools (Google Workspace) and hosting provider for our websites and services (Cloudflare, Google Cloud), if applicable.
Otherwise, data will only be forwarded to recipients outside the company if this is permitted or required by law if the forwarding is necessary for the processing and thus the fulfillment of the contract or, at your request, for the implementation of pre-contractual measures, if we have your consent or if we are authorized to provide information. Under these conditions, recipients of personal data may be, for example:
- External tax advisor
- Public bodies and institutions (e.g. public prosecutor's office, police, supervisory authorities, tax office) if there is a legal or official obligation,
- Recipients to whom disclosure is directly necessary for the purpose of establishing or fulfilling a contract.
- Other data recipients for whom you have given us your consent to transfer data: -No other-
7. Transfer to a third country
A transfer of personal data to countries outside the EEA (European Economic Area) or to an international organization only takes place insofar as this is necessary for the processing and thus the fulfillment of the contract or, at your request, for the implementation of pre-contractual measures, the transfer is required by law or you have given us consent. Recipients in these cases and in the context of processing your request in an adequate manner are providers of customer management systems and software (Monday.com), meeting scheduling software (Calendly), as well as internal collaboration tools (Google Workspace) and hosting provider for our websites and services (Cloudflare), if applicable.
8. Duration of data storage
To the extent necessary, we process and store your personal data for the duration of our business relationship or for the fulfillment of contractual purposes. This includes, among other things, the initiation and execution of a contract.
In addition, we are subject to various storage and documentation obligations, which result, among other things, from the German Commercial Code (HGB) and the German Fiscal Code (AO). The periods prescribed there for storage or documentation are two to ten years.
Finally, the storage period also depends on the statutory limitation periods, which, for example, according to §§ 195 et seq. of the German Civil Code (BGB), are generally three years, but in certain cases can be up to thirty years.
9. Your rights
Every data subject has the right to information under Art. 15 of the GDPR, the right to rectification under Art. 16 of the GDPR, the right to erasure under Art. 17 of the GDPR, the right to restriction of processing under Art. 18 of the GDPR, the right to notification under Art. 19 of the GDPR and the right to data portability under Art. 20 of the GDPR.
In addition, you have the right to lodge a complaint with a data protection supervisory authority pursuant to Art. 77 GDPR if you believe that the processing of your personal data is not lawful. The right of appeal is without prejudice to any other administrative or judicial remedy.
If the processing of data is based on your consent, you are entitled to revoke your consent to the use of your personal data at any time in accordance with Art. 7 GDPR. Please note that the revocation is only effective for the future. Processing that took place before the revocation is not affected. Please also note that we may need to retain certain data for a certain period of time in order to comply with legal requirements (see section 8 of this data protection information).
Right of objection Insofar as the processing of your personal data is carried out for the protection of legitimate interests pursuant to Art. 6 (1)(f) GDPR, you have the right, pursuant to Art. 21 GDPR, to object to the processing of this data at any time for reasons arising from your particular situation. We will then no longer process this personal data unless we can demonstrate compelling legitimate grounds for the processing. These must override your interests, rights, and freedoms, or the processing must serve the assertion, exercise, or defense of legal claims.
10. Necessity of the provision of personal data
The provision of personal data for the decision on the conclusion of a contract, the performance of a contract, or for the implementation of pre-contractual measures is voluntary. However, we can only make a decision in the context of contractual measures if you provide such personal data that is required for the conclusion of the contract, the performance of the contract, or pre-contractual measures.
11. Automated decision
For the establishment, fulfillment, or implementation of the business relationship, as well as for pre-contractual measures, we generally do not use fully automated decision-making pursuant to Art. 22 GDPR. Should we use these procedures in individual cases, we will inform you separately about this or obtain your consent if this is required by law.
This notice on the protection of personal data is written in multiple languages. The english version shall prevail; other languages are provided in an informative character.
13. Concluding provisions
We reserve the right to adjust this privacy notice at any point in time to ensure that it is in line with the current legal requirements at all times, or in order to accommodate changes in the application process or other processes. In this case, the new privacy notice applies to any later visit of this recruitment website or any later job application.
You can always revisit the (latest) privacy notice for customers, partners and interested parties.