Transparency and trustworthy handling of your personal data is an important basis for good cooperation. We therefore inform you about how we process your data in accordance with the statutory data protection regulations,
- if your employer is our contractual partner or is in the process of initiating business with us, or
- if you yourself as a natural person are our contractual partner or are in the process of initiating business with us, e. g. as a sole trader.
1. Controller and Data Protection Officer
The responsible party is your contractual partner or the contractual partner of your employer. In the latter case, you can also obtain information about the contact details of the person responsible at RWE from them.
You can reach our Data Protection Officer at
RWE Generation Holding B.V.
Data Protection
Amerweg 1
4931 NC Geertruidenberg
E-mail: dpo-BeNeLux@rwe.com
2. Data protection information for business partners and external employees
2.1 Which of your personal data do we process?
Various types of data are processed as part of the initiation of a business relationship, the conclusion and performance of a contract or other agreement with our business partner for whom you may be working. The following categories of personal data may be subject to processing (depending in part on whether you yourself are a contractual partner or an external employee):
Name, contact details, address data, details of profession, contract data, communication data, vehicle license plate number, image and video data, physical access and exit data.
2.2 What are the sources of the data?
We process personal data that we have received from you or your employer as part of the business relationship or its initiation. We may also receive your data from other Group companies or third parties, in particular from other business partners.
2.3 For what purposes do we process your data and on what legal basis?
a. Data processing for the performance of the contract
The data processing essentially serves to carry out pre-contractual measures or to conclude and fulfil a contract between us and the contractual partner for whom you may be working.
The legal basis in these cases is Art. 6 para. 1 lit. b) EU General Data Protection Regulation ("GDPR").
b. Data processing for the fulfilment of legal obligations
We also process your data to fulfil legal obligations insofar as this is necessary (e.g. instructions in accordance with the Occupational Health and Safety Act, sanctions list check in accordance with the Foreign Trade and Payments Act, reliability check in accordance with the Atomic Energy Act).
The legal basis in these cases is Art. 6 para. 1 lit. c) GDPR in conjunction with the respective statutory provision.
c. Data processing to protect the legitimate interests of the controller
In certain cases, we process your personal data to protect legitimate interests, unless your interests and rights in the processing of the data take precedence:
- Investigation and enforcement of claims or defense against claims in connection with the contract,
- in the context of access control – including billing-related reasons in the execution of the contract - to safeguard domiciliary rights and building security,
- Preventing fraud or criminal offences and protecting our IT systems, assets and workplaces, monitoring insolvency proceedings,
- Credit reports on contractual partners,
- Evaluation of the service provided by the contractor for possible re-commissioning,
- Implementation of compliance measures.
The legal basis in these cases is Art. 6 para. 1 lit. f) GDPR.
d. Consent to data processing
If you give us your consent to process personal data for specific purposes (e.g. disclosure to third parties, evaluation for marketing purposes or advertising by e-mail, in particular sending information in the form of analyses, current topics of the energy market, etc. or sending invitations to trade fairs and customer events), the lawfulness of this processing is based on your consent in accordance with Art. 6 para. 1 lit. a) GDPR or Art. 6 para. 1 lit. f) GDPR for direct advertising. Any consent given can be withdrawn at any time with effect for the future (see section 3 of this data protection information).
2.4 Who will receive your data?
In certain cases, the data may be transferred within the Group to other RWE Group companies because these companies perform certain tasks within the Group for all or some other RWE companies. Under certain circumstances, the data may also be transferred to carefully selected, commissioned external service providers and only to those divisions and persons who need this data to carry out or fulfil the above-mentioned purposes. If your personal data is processed on our behalf, this is done on the basis of order processing agreements in accordance with Art. 28 GDPR. In this way, we ensure that the legal provisions of the GDPR are complied with. Otherwise, data will only be transferred to recipients outside the company if this is permitted or required by law, if the transfer is necessary for processing and thus for the fulfilment of the contract or, at your request, for the implementation of pre-contractual measures, if we have your consent or if we are authorised to provide information. Under these conditions, recipients of personal data may be, for example
- External tax consultant/auditor
- Public bodies and institutions (e.g. public prosecutor's office, police, supervisory authorities, tax office) if there is a legal or official obligation,
- Recipients to whom the disclosure is directly necessary for the establishment or fulfilment of the contract, such as external accounting, IT or other external service providers.
2.5 Is your data transferred to countries outside the European Union and the European Economic Area (so-called "third countries")?
Individual services and performances are carried out by carefully selected and commissioned service providers based outside the European Union and the European Economic Area (so-called "third country"), e.g. IT service providers. If these service providers need to access personal data in the course of providing the service, this third country transfer is always carried out in accordance with Chapter V of the GDPR. In the absence of an adequacy decision by the European Commission pursuant to Art. 45 GDPR, we provide appropriate safeguards to ensure an adequate level of data protection. As a standard procedure, we conclude contracts with data recipients that contain standard data protection clauses, also known as "standard contractual clauses". You have the option of requesting further information and receiving copies of corresponding sample agreements at any time. You can contact us using the contact details given in section 1.
2.6 How long will your data be stored?
The data is generally deleted as soon as it is no longer required to fulfil the purpose for which it was collected. Statutory retention obligations or legitimate interests (e.g. assertion, exercise or defense of legal claims) are taken into account in the context of erasure.
