Privacy Policy

Section 2

Which data are processed and what are the origins of these data?

We process the data, which we receive in the context of the initial business contact and business relationship with you. In addition, we process, as permissible, data, which we have received from credit agencies, creditor protection associations, from publicly accessible sources (e.g. Companies Register, Register of Associations, Land Register, the media) and other companies, with whom we entertain permanent business relations.

Personal data include your master and contact data, such as:

• as a private customer: forename and surname, address, contact data (e-mail address, telephone number, fax), date of birth, data from identity documents submitted (copy of identity card), bank details
• as a corporate customer or supplier: name of your legal representative, company name, Company Register number, VAT number, company number, address contact details for contact person (e-mail address, telephone number, fax), bank details

Furthermore, we also process the following other personal data:

• information on the type and content of our business relationship, such as contract data, order data, sales figures and voucher data, customer and supplier history, consultancy documents, vehicle data
• information on your financial status (e.g. credit rating data)
• advertising and sales data
• documentation, (e.g. consultation minutes), image data
• information from your electronic communication with BayWa (e.g. IP address, log-in data)
• other data, which we have received in the context of our business relations (e.g. in discussions with the customer)
• data, which we ourselves generate, such as by means of customer need and customer potential analyses
• documentation of your declaration of consent for the receipt of e.g. newsletters
• photos, taken at public events

Section 3

For what purposes and on which legal base are the data processed?

We process your data in accordance with the provisions of the General Data Protection Regulation (GDPR) and the Federal German Data Protection Act (FGDPA) 2018, as amended:

For the performance of a contract or in order to take steps prior to entering into a contract (Article 6 (1) (b) GDPR)

Your data are processed for the distribution and sale of our goods and services, for procurement and logistics purposes and for customer and supplier administration and analysis. The data are processed in particular in the case of initial business contacts and for the performance of contracts with you, for example, in the following cases:

• setting up and administering a customer or supplier account
• delivery of orders
• participation in competitions
• despatch of information, e.g. catalogue requests

For compliance with a legal obligation (Article 6 (1) (c) GDPR)

It is necessary to process your data for the purpose of complying with a variety of legal obligations, e.g. arising from the German Commercial Code or Tax Code, money-laundering provisions, product-specific regulations such as, for example the Ordinance on Hazardous Substances.

For the protection of legitimate interests (Article 6 (1) (f) GDPR)

By virtue of a balancing of interests data may be processed for purposes exceeding those of actual compliance with the contract to protect our legitimate interests or those of third parties. For example, data is processed to protect legitimate interests in the following cases:

• consultation and data exchange with credit agencies and creditor protection societies for the investigation of credit rating data and the management of a group-wide credit rating database for the identification of financial credit risks in the case of joint customers
• advertising or marketing
• business management measures and further development of services and products
• administering a customer database to improve customer services
• measures to protect the BayWa AG / AGRAVIS Technik Center GmbH sites from conduct contrary to a contract or the law, e.g. access controls, video surveillance
• in the case of legal proceedings or prosecution

In the context of your consent (Article 6 (1) (a) GDPR)

If you have granted us your consent to the processing of your data, we process your data only in accordance with the purposes specified in the declaration of consent and to the extent agreed therein. You may withdraw the consent you have granted us at any time with effect for the future, e.g. for the despatch of the newsletter. Please contact us at the addresses given in Paragraph 1.

Section 4

Information on joint control pursuant to Article 26(2)(2) of the General Data Protection Regulation (GDPR)

What is the reason for joint control?

Agravis and BayWa are collaborating within the framework of the online auction platform "ab-auction". This also applies to the processing of your personal data. The parties have jointly determined the order in which this data is processed in the individual process stages. They therefore are joint controllers of your personal data within the process stages described below (Article 26 GDPR).

For which processing operations and purposes is there joint control?

• Operation/provision of the website ab-auction: Both companies work together to ensure the functionality and security of the auction platform.
• Registration/login/user administration: The collection and management of user data is a joint responsibility in order to provide users with access to the platform.
• Analytics and tracking (Google Analytics, social media, YouTube, cookie consent): Joint analysis of user behaviour to optimise the offering and marketing strategies.
• Payment method: Processing payments by integrating payment service providers to ensure a smooth payment process.
• Shipping/dispatch: At the buyer's request, we provide support in collaborating with logistics service providers.
• Customer communication during and after an auction: Answering customer enquiries and providing information on auctions and products.
• Marketing measures: Realisation of joint advertising campaigns to promote the platform and its offers.
• Identity and credit check: Checking the identity and creditworthiness of users to prevent fraud.
• Misuse prevention & fraud monitoring: Use of automated systems to detect fake accounts and suspicious behaviour.
• Data transfer to authorities: Provision of personal data on a legal basis.
• Archiving and backup procedure: Storage and backup of user data in backup systems.

What have the parties agreed?

As part of their joint control under data protection law, Agravis and BayWa have agreed which of them fulfils which obligations under the GDPR. This applies in particular to the exercise of the rights of data subjects and the fulfilment of information obligations in accordance with Articles 13 and 14 GDPR and the deletion of personal data.

This agreement is necessary because the online platform ab-auction processes personal data, which is operated by either Agravis or BayWa and used by both partners.

What does this mean for data subjects?

Even if there is joint control, the parties fulfil the data protection obligations in accordance with their respective responsibilities for the individual process stages as follows:

• Within the framework of joint control, Agravis and BayWa are responsible for the processing of personal data within the framework of the online platform (provision of the website and online account).
• Agravis and BayWa are each responsible for the deletion or implementation of statutory retention periods in their respective process stages.
• Agravis and BayWa make the information required under Article 13 and 14 GDPR available to the data subjects free of charge by means of this joint data protection information in a precise, transparent, comprehensible and easily accessible form in clear and simple language. Each party shall provide the other party with all necessary information from its field of activity.
• Data protection rights can be asserted both at BayWa (betroffenenrechte@baywa.de) and at Agravis (datenschutz@agravis.de). Data subjects generally receive the information from the party to which rights have been asserted.
• The parties shall inform each other immediately of any legal claims asserted by data subjects. They shall provide each other with all information necessary to respond to requests for information.

Section 5

Processing of personal data for promotional purposes

We also use your data to communicate to you details of your orders, certain products or marketing campaigns and to recommend to you products or services, which might be of interest to you.

You may at any time object to the use in full of your personal data or to their use for individual measures, without incurring transmission costs other than at the basic rates. For this purpose please contact us at the addresses given in Paragraph 1.

Product recommendations by e-mail

Under the legal provisions in § 7 (3) Unfair Competition Act BayWa AG / AGRAVIS Technik Center GmbH is entitled to use the e-mail address, which you have provided in the course of ordering a product or a service, for direct advertising of their own similar goods or services. You receive these product recommendations from us irrespective of whether you have subscribed to a newsletter.

If you do not wish to receive further product recommendations from us by e-mail, you may object to the use of your address for this purpose at any time, without incurring transmission costs other than at the basic rates. For this purpose please contact us at the addresses given in Paragraph 1. Of course, there is always a de-registration link included in each e-mail.

Newsletter

To despatch the newsletter we use what is known as the double opt-in procedure, i.e. we shall not send you the newsletter until you have previously and expressly confirmed that we should activate the newsletter service. We will then send you a notification e-mail and request you to confirm that you wish to receive our newsletter by clicking on a link contained in this e-mail.

If you should subsequently no longer wish to receive a newsletter from us, you may at any time object, without incurring transmission costs other than at the basic rates. A notification in textual form to the BayWa AG / AGRAVIS Technik Center GmbH contact address referred to in Paragraph 1 is sufficient for this purpose. Of course, there is also a de-registration link in every e-mail.

Section 6

Processing for credit rating information

Data transfer to SCHUFA

In the context of this contractual relationship BayWa AG / AGRAVIS Technik Center GmbH transfers personal data on the application, performance and termination of this business relationship, as well as data on conduct contrary to the contract or on fraudulent behaviour to SCHUFA Holding AG, Kormoranweg 5, 65201 Wiesbaden. The legal bases for these transfers are Article 6 (1) (b) and Article 6 (1) (f) General Data Protection Regulation (GDPR).

Data may be transferred on the basis of Article 6 (1) (f) GDPR only if this is necessary to safeguard the legitimate interests of BayWa AG and/or Agravis Technik Center GmbH or third parties and this does not override the interests or basic rights and freedoms of the data subject, who requires his or her personal data to be protected. The exchange of data with SCHUFA also serves to comply with legal duties to implement credit-worthiness checks on customers (§§ 505 (a) and 506 German Civil Code).

SCHUFA processes the data received and uses it for the purpose of creating a profile (scoring), in order to provide to its contractual partners in the European Economic Area and in Switzerland and in other third countries (insofar as an adequacy decision from the European Commission exists on this country) information inter alia for the assessment of the credit-worthiness of natural persons. Further details on SCHUFA's activity are available from the SCHUFA information sheet in accordance with Article 14 GDPR or can be inspected online on www.schufa.de/datenschutz.

Data transfer to other credit agencies

Furthermore, BayWa AG / AGRAVIS Technik Center GmbH also uses the following credit agencies, in order to obtain credit rating information where there exists a legitimate interest: Bisnode Deutschland GmbH, Robert-Bosch-Straße 11, 64293 Darmstadt, Coface Central Europe Holding AG, Stubenring 24, A-1010 Vienna, CRIF Bürgel GmbH, Radlkoferstraße 2, 81373 Munich, CRIF GmbH, Diefenbachgasse 35, AT-1150 Vienna, Creditreform, Machtlfinger Straße 13, 81302 Munich, EOS Deutschland GmbH, Gottlieb-Daimler-Ring 7-9, 74906 Bad Rappenau.

Administration of a group-wide credit rating database

If, as permitted by law, we have collected credit rating data on you from a credit agency, we store these data in a system, to which both BayWa AG / AGRAVIS Technik Center GmbH and member companies of the BayWa-/Agravis-Kreditmanagement Group have access. The purpose of this is to facilitate work flow management and to identify financial credit risks. The data in the credit rating database are accessed only insofar as there exists a legitimate interest for the respective group member company.

Section 7

Who receives my data?

If we use a service provider within the meaning of commissioned data processing, we nonetheless remain responsible for the protection of your data. All our processors are bound by contract to treat your data in confidence and to process them only in the context of the service to be provided. The processors commissioned by us receive your data, if the latter need the data to perform their respective service. These processors are, for example, IT service providers, whom we need for the operation and security of our IT system, as well as advertising and directory publishers for our own advertising campaigns.

Your data are processed in a customer database, to which both BayWa AG / AGRAVIS Technik Center GmbH and the affiliated companies in the BayWa-/ Agravis Group have access. This customer database improves the data quality of existing customer data (cleaning-up of doublets, identification of customers who have moved or are deceased, corrections of address) and enables us to enrich the data from public sources. The data are made available to the group member companies of both companies, which participate in the customer database (participating companies) and may be used for personalised direct marketing campaigns (e.g. newsletters), for targeted online marketing and personalised online shop design.

These customer databases are intended to provide participating companies, which serve the same customers, with information on these customers extending over the entire organisation. The object of this procedure is always to provide the customer with the most up-to-date and relevant information. This processing of customer interests represents profiling within the meaning of Article 4 GDPR; we do not practise automated individual decision-making. Customer data are stored separately and in relation to each company.

A summary of the BayWa AG Group member companies is available on the following link: https://www.baywa.com/konzern/im_profil/konzerngesellschaften/.

If a bid is submitted or a sale processed through manufacturer portals, data provided by you are processed directly in the manufacturer's portal.

Where a legal obligation exists and in the event of prosecution, government agencies and the Courts, as well as external auditors may be the recipients of your data.

Moreover, your data may also be transferred to insurance companies, banks, credit agencies and service providers for the purpose of negotiating and performing a contract.

Section 8

For how long are my data stored?

We process your data until the termination of the business relationship or until the expiry of the applicable guarantee, warranty, statute of limitations or legal retention periods (for example as provided in the German Commercial Code or Tax Code); moreover, we retain data until the termination of any legal disputes, in which the data are needed as evidence.

Section 9

Communication by e-mail

Please note that the despatch of unencrypted e-mails is regarded as insecure, since unauthorised parties may gain knowledge of the content of the e-mail and where applicable manipulate that content. Therefore, we advise you not to send any sensitive data by e-mail in any communication with us. If you are applying for a job with us, please use our job applications portal, since your application documents are transferred there by secured means. If it should become necessary to send us sensitive data by e-mail, please use the contents encryption facility. Instructions for this are available here.

Section 10

Which data are collected when I visit your website?

Use of cookies

Our website uses what are known as cookies. These are small text files, which are deposited by your browser on your terminal. They do not harm your computer. We use cookies to make our site more user-friendly. Other cookies remain stored on your device until you erase them. These cookies allow us to recognise your browser the next time you visit us. If you do not want this, you can adjust your browser settings, so that you are notified whenever cookies are deposited and can allow this only in individual cases. We would advise you that deactivating cookies may restrict the functionality of this website.

Web analysis

This website uses analysis tools to collect general information on the user behaviour of visitors. This information includes, for example, the sites accessed, the length of time spent on the site, the pages referred to and general information on your computer system, such as the operating system, screen resolution, browser used, etc. All the data collected is stored in an anonymised form and does not allow any identification of your person. If you not agree with this anonymised collection of your user behaviour, you may prevent this by deactivating cookies in your browser.

Operation of Google components

This Internet site also uses Google Analytics, an Internet analysis service from Google. Google Analytics uses text files, known as cookies, which are stored on your computer and allow the use of the website to be analysed.

The information on your use of this home page (including your IP address) is transferred to a Google server in the USA and stored there. Google shall use this information in order to evaluate your use of the website, to compile reports on website activities for the website operator and to perform other services connected with the use of the website and the use of the Internet. In addition, Google shall forward this information to third parties, insofar as this is required by law or insofar as third parties process these data on behalf of Google. Google informs us that on no account will it link your IP address with any other data from Google. You may prevent cookies from being saved by using the appropriate settings in your browser software; nevertheless, we would like to make you aware of the fact that, in this case, you will not be able to use all of the website's functions to their full extent. By using this website you are giving your consent to the processing of your data, collected by Google in the manner described above and for the purpose specified above.

We advise you that this website uses Google Analytics in application of a deactivation add-on, _anonymizeIp(). Your complete IP address is not stored. The visitor to the website cannot be identified.

You can object to the use of Google Analytics by installing the browser add-on for deactivation of Google Analytics (http://tools.google.com/dlpage/gaoptout?hl=de). In this way you notify Google Analytics that no information on your visit to our website should be transferred to Google Analytics. Unless we have your express agreement, we shall not use tracking tools in order surreptitiously

• to collect personal data on you
• to transfer such data to third party suppliers and marketing platforms
• to link the data with your personal data (name, address, etc.)

Application of the Google re-marketing function

On this website we use the re-marketing function from Google. This technology allows the Google Partner network sites to approach users, who have visited our Internet site, with targeted advertising. For this purpose Google stores small text files (cookies) on your computer, which analyse your visit to the website and subsequently may be used to display targeted product recommendations and interest-based advertising. You have the option to deactivate the application of cookies. To do this, access Google's Ads Preferences Manager, or alternatively, you can prevent the use of cookies by third party providers by visiting the deactivation site of the network promotional campaign.

Use of social plug-ins

We have linked social plug-ins into our site; however, on grounds of data protection these are deactivated. Therefore, when you access our site as matter of principle no data are transferred to social media services, such as Facebook, Twitter or Google + and thus any creation of profiles by third parties is excluded.

Deactivated social plug-ins can be identified by their grey background.

However, you have the option to activate the social plug-ins by clicking on them and thus granting your consent to communication with the respective social network. If you activate the social plug-in, certain data are transferred to the respective social network, such as your IP address, information on the browser used and the operating system, the website accessed and the data and time. In the course of this communication data are also downloaded from a server to the social media access provider to our website. Through these data the respective social plug-in access provider collects information as to which specific websites you visit, and this is irrespective of whether or not you are actually logged on to the social media plug-in access provider (e.g. Facebook) or whether you have or have not clicked on the plug-in. The access provider may process these data outside the European Union and is able to generate individualised usage profiles. We have no influence on the nature, scope or purpose of the data processing implemented by the social media service access provider.

An activated social plug-in is displayed in colour and from this moment data are transferred, as described, to the social media service. To use the social plug-in, click on it again.

Further information from Facebook on plug-ins and the respective social media service is available on http://developers.facebook.com/plugins. Facebook's data application guidelines are available on: http://www.facebook.com/about/privacy.

Further information from Twitter on plug-ins and the respective social media service is available on https://twitter.com/logo. Twitter's data application guidelines are available on: https://twitter.com/privacy.

Profiling when you visit this website

On our website we operate a profiling system based on your click behaviour. This profiling serves to improve your customer experience when you visit our website. If, for example, you are interested in the main in products and contents with relation to agriculture, the next time you visit the website, you are forwarded directly to the "Agriculture" target group home page.

In addition, individual specialist articles or offers are proposed to you in relation to your surfing behaviour on our website.

To do this, we use cookies. If you do not want this, you can adjust your browser settings, so that you are notified of the deposit of cookies and can allow this only in individual cases. We would advise you that deactivating cookies may restrict the functionality of this website.

We also conduct profiling as part of our customer relations management based on your purchasing behaviour in our affiliated companies.

In none of these cases do we use automated individual decision-making within the meaning of the GDPR.

Section 11

Are personal data transferred to a third country?

As a matter of principle we do not transfer data to any third country. In individual cases data are transferred only on the basis of an adequacy decision of the European Commission, standard contractual clauses, suitable guarantees or your express agreement.

Section 12

What are my rights under data protection law?

You have at any time a right to access, correction, erasure or restriction of processing of your stored data, a right to object against the processing and a right to data portability and to lodge a complaint pursuant to the provisions of data protection law.

Right of access

You may request us for information on whether and to what extent we process your data.

Right to correction

If we process data from you, which are incomplete or incorrect, you may at any time request from us their correction or completion.

Right to erasure

You may request us to erase your data, provided that we are processing these unlawfully or the processing interferes disproportionately with your legitimate interests in being protected. Please note that there may be grounds, which conflict with immediate erasure, e.g. in the case of duties of retention regulated by statute.

Irrespective of the safeguarding of your right to erasure, we erase your data promptly and completely, provided that in this regard there exists no conflicting legal or statutory period of retention.

Right to restriction of processing

You may request us to restrict the processing of your data, if

• you dispute the accuracy of the data and allow us a period to enable us to check the accuracy of the data
• the processing of the data is unlawful, but you refuse to have the data erased and instead request that the use of the data be restricted
• we no longer require the data for the intended purpose, but you continue to need these data to establish or defend legal claims
• you have lodged a complaint against the processing of the data

Right to data portability

You may request us to receive your data, which you have provided to us, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from us, provided that

• we process these data based on your consent granted to us and which you are entitled to withdraw or for the performance of a contract between us
• the data is processed by automated means

Where it is technically feasible, you may request us to transmit your data directly to another controller.

Right to object

If we process your data on grounds of legitimate interests, you may at any time object to this data processing on grounds relating to your personal situation; this also applies to profiling based on those provisions. If you object, we shall no longer process your personal data, unless we can prove compelling legitimate grounds for the processing, which override your interests, rights and freedoms or the processing serves the purpose of the establishment, exercise or defence of legal claims. You may object to the processing of your data for the purpose of direct advertising at any time without giving reasons.

Right to lodge a complaint

If you think that in processing your data we are in breach of German or European data protection law, we would request you to contact us, in order to clarify the issues. Of course, you also have the right to contact the supervisory authority competent for BayWa AG, the Data Protection Authority of Bavaria for the Private Sector.

If you wish to establish one of the rights referred to, please contact us at the addresses given in Paragraph 1. In case of doubt we may require additional information in order to confirm your identity.

Section 13

Am I obliged to provide data?

The processing of your data is necessary for the conclusion and/or performance of any contract, into which you have entered with us. If you do not provide us with these data, we shall, as rule, be obliged to refuse to conclude the contract or to perform the order or shall be unable to continue to implement an existing contract and consequently shall have to terminate it. However, you are not obliged to grant your consent to the processing of data, which is not relevant and/or legally necessary for the fulfilment of the contract.