Privacy policy

Information on data protection

Data protection information for customers and business partners, their authorised representatives and agents, as well as other persons associated with our customers or business partners and interested parties.

This information is intended to inform you about how we process your personal data and your rights under data protection regulations. The following explanations provide details on which data is processed and how it is used.

As changes in legislation or changes to our internal company processes may require this privacy policy to be amended, we ask you to review this privacy policy regularly. The privacy policy can be accessed, saved and printed at any time at Privacy Policy.

1. Who is responsible for data processing and who can I contact?

The responsible body is:

Medical Strategy GmbH
Bahnhofstraße 7
82166 Gräfelfing
Tel.: +49 (0)89-27 27 24-16
Fax: +49 (0)89-27 27 24-24
Email: office@medicalstrategy.de
Website: www.medicalstrategy.de

External data protection officer:

Mr. Karsten Kinast, LL.M., attorney at law
KINAST Rechtsanwaltsgesellschaft mbH
Nordstraße 17a, 50733 Cologne
Tel.: + 49 221 222183-0
Email: apo-dsb@kinast.eu
Website: www.kinast.eu

2. What sources and personal data do we use?

We process personal data that we receive from our customers and business partners, their authorised representatives, agents and other persons associated with the customer or business partner, as well as from interested parties, within the scope of our business relationship or in the course of establishing business relations. In addition, we process personal data that we obtain from publicly accessible sources (e.g. commercial and association registers, press, Internet) in a permissible manner or that is transmitted to us by other third parties in a legitimate manner, insofar as this is necessary for the provision of our services.

Relevant personal data includes personal details (name, address and other contact details, department, position, date and place of birth and nationality), identification data (e.g. ID card details) and authentication data (e.g. signature sample).

Every time you visit our website, our system automatically collects data and information from the computer system of the requesting computer. The following data is collected:

• IP address of the requesting computer,
• date and time of access,
• name and URL of the file accessed,
• website from which access is made (referrer URL),
• browser used and, if applicable, the operating system of your computer and the name of your access provider.

3. Why do we process your data (processing purpose) and on what legal basis?

We process personal data in accordance with the provisions of the European General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG).

a. To fulfil contractual obligations (Art. 6 para. 1 b GDPR)

The processing of personal data (Art. 4 No. 2 GDPR) is carried out for the purpose of providing our services as a securities institution or for the implementation of pre-contractual measures.

b. Within the scope of balancing interests (Art. 6 para. 1 f GDPR)

Where necessary, we process your data to protect our legitimate interests or those of third parties. Examples:

• for the purpose of direct marketing
• provision of the website and creation of log files
• statistical analysis of user behaviour for optimisation and marketing purposes

c. Based on your consent (Art. 6 para. 1 a GDPR)

If you have given us your consent to process personal data for specific purposes (e.g. advertising by email or telephone), the lawfulness of this processing is based on your consent. Consent that has been given can be revoked at any time without giving reasons. This also applies to the revocation of declarations of consent that were given to us before the GDPR came into force, i.e. before 25 May 2018. Please note that the revocation only takes effect for the future. Processing that took place before the revocation is not affected.

d. Based on legal requirements (Art. 6 para. 1 c GDPR)

As a financial services institution, we are also subject to various legal obligations, i.e. legal requirements (e.g. Money Laundering Act, Capital Investment Act, tax laws) and regulatory requirements (e.g. the Federal Financial Supervisory Authority). The purposes of processing include identity verification and fraud and money laundering prevention.

4. Who receives my data?

Within Medical Strategy GmbH, those departments that need your data to fulfil our contractual and legal obligations will have access to it. Processors employed by us (Article 28 GDPR) may also receive data for these purposes. These are companies in the categories of IT services, logistics, printing services, telecommunications, debt collection, consulting and sales and marketing.

We may only disclose information about you to recipients outside Medical Strategy GmbH who are not service providers or vicarious agents if this is required by law or if you have given your consent. Under these conditions, recipients of personal data may include, for example:

• Public authorities and institutions (e.g. Federal Financial Supervisory Authority, tax authorities, law enforcement authorities) if there is a legal or official obligation to do so.
• Credit institutions, financial services institutions and investment companies or comparable institutions to which we transfer personal data in order to conduct our business relationship with you.

Other data recipients may be those entities to whom you have given your consent for data transfer.

5. How long will my data be stored?

As soon as data is no longer required to display the website, it will be deleted. The collection of data for the provision of the website and the storage of data in log files is essential for the operation of the website. Consequently, there is no possibility for the user to object. Further storage may take place in individual cases if this is required by law.

Where necessary, we process and store your personal data for the duration of our business relationship, which also includes, for example, the initiation and execution of a contract. It should be noted that our business relationship is a continuing obligation that is intended to last for years.

In addition, we are subject to various storage and documentation obligations, which arise, among other things, from the German Commercial Code (HGB), the German Fiscal Code (AO), the Securities Trading Act (WpIG), the Money Laundering Act (GwG) and the Securities Trading Act (WpHG). The retention and documentation periods specified therein range from two to ten years. Finally, the storage period is also determined by the statutory limitation periods, which, for example, according to Sections 195 et seq. of the German Civil Code (BGB), are generally three years, but in certain cases can be up to thirty years.

6. Is data transferred to a third country or to an international organisation?

Data is transferred to entities in countries outside the European Union and outside the European Economic Area (so-called third countries) if

• it is necessary for the execution of transactions,
• it is required by law (e.g. tax reporting obligations),
• you have given us your consent, or
• within the scope of order processing.

If service providers in third countries are used, they are obliged to comply with the EU standard contractual clauses in addition to written instructions in order to maintain the level of data protection in Europe.

7. What data protection rights do I have?

Every data subject has the right to information under Article 15 GDPR, the right to rectification under Article 16 GDPR, the right to erasure under Article 17 GDPR, the right to restriction of processing under Article 18 GDPR, the right to data portability under Article 20 GDPR and the right to object under Article 21 GDPR. The restrictions under Sections 34 and 35 of the German Federal Data Protection Act (BDSG) apply to the right to information and the right to erasure. In addition, you have the right to lodge a complaint with a data protection supervisory authority (Article 77 GDPR in conjunction with Section 19 BDSG).

8. Am I obliged to provide data?

Within the scope of our business relationship with our customers and business partners, they must provide us with the personal data that is necessary for the establishment, implementation and termination of a business relationship or that we are legally obliged to collect.

In particular, we are obliged under money laundering regulations to identify you before establishing a business relationship, for example by means of your identity card, and to collect your name, place of birth, date of birth, nationality and residential address. In order for us to comply with this legal obligation, you must provide us with the necessary information and documents in accordance with the Money Laundering Act and notify us immediately of any changes that occur during the course of the business relationship. If you do not provide us with the necessary information and documents, we will not be able to establish or continue the business relationship you have requested.

9. To what extent is there automated decision-making?

We do not use fully automated decision-making in accordance with Article 22 of the GDPR.

10. To what extent is my data used for ‘profiling’?

We do not create personal user profiles.

11. Use of cookies

We use cookies on our website. These are small files that your browser automatically creates and stores on your device (laptop, tablet, smartphone, etc.) when you visit our website. Cookies do not cause any damage to your device and do not contain viruses, Trojans or other malware.

Information is stored in the cookie that is related to the specific device used. However, this does not mean that we are immediately aware of your identity.

The use of cookies serves to make our website more user-friendly for you. We use so-called session cookies to recognise that you have already visited individual pages of our website. These are automatically deleted after you leave our website.

In addition, we also use temporary cookies to optimise user-friendliness, which are stored on your device for a specific period of time. If you visit our site again to use our services, the system will automatically recognise that you have already been there and what entries and settings you have made so that you do not have to enter them again.

On the other hand, we use cookies to statistically analyse the use of our website and to evaluate it for the purpose of optimising our offer for you. These cookies enable us to automatically recognise that you have already visited our site when you return. These cookies are automatically deleted after a defined period of time.

The data processed by cookies is necessary for the purposes mentioned above to protect our legitimate interests and those of third parties in accordance with Art. 6 para. 1 sentence 1 lit. f GDPR.

Most browsers automatically accept cookies. However, you can configure your browser so that no cookies are stored on your computer or so that a message always appears before new cookies are created. However, completely deactivating cookies may mean that you cannot use all the functions of our website.