Data Privacy Information for Customers, Suppliers, Business Partners and Prospective Business Contacts

1. Information about the Controller

The controller within the meaning of the GDPR responsible for processing your data is:

If you have any questions about the processing of your data or wish to exercise your rights as a data subject, please contact us using the contact details provided above.

You may also contact our Data Protection Officer directly. You can reach the Data Protection Officer by email at dsb@plicatec.com or using the following contact details:

2. Information on Data Processing

2.1. General Contact and Contact for Marketing Purposes

As a rule, we contact you by email or telephone if you have provided us with your master and contact data for this purpose, for example at a trade fair, via the contact form on our website or via our social media presence. Further information on data processing in connection with the use of our social media presence can be found at https://www.plicatec.com/en/data-privacy-social-media/. Further information on data processing in connection with the use of the contact form can be found in our website Privacy Policy (available at https://www.plicatec.com/en/privacy-policy/).

When you contact us, we collect and store the master and contact data you provide to us (e.g. name, email address, telephone number, company, position, etc.) as well as the respective communication content. If you have provided us with your contact details in connection with an order, we may send you our regular postal newsletter containing marketing information based on your previous orders.

Where necessary to deal with your request, or where you have expressly consented to this in advance, we may also forward the data you have provided to the relevant sales partners and/or relevant affiliated companies for further processing of your request. The respective sales partner or affiliated company may then contact you by email or telephone.

We transfer the data you provide to our Customer Relationship Management system (hereinafter referred to as the “CRM system”). There, your data is managed, maintained and processed for lead and contractual partner management as well as for the initiation and performance of contractual relationships. Your master, contact and contract data, together with data that may have been collected through other channels, such as our social media channels or at trade fairs, may be combined in one profile.

Your data is collected, stored and used only for the specific purposes of customer acquisition, responding to your enquiry and, where applicable, initiating or performing a contractual relationship with you. Data processing is based on Article 6(1)(b) GDPR where it relates to the performance of or steps prior to entering into a contract with you, or on Article 6(1)(f) GDPR for the purposes of our legitimate interests in properly responding to your enquiry, expanding our customer base and promoting sales. Where you have voluntarily consented in advance to the processing of your data, Article 6(1)(a) GDPR is the applicable legal basis.

2.2. Research and Direct Approach of Prospective Business Customers on Behalf of Clients

As part of our business activities, we support our clients in acquiring new business customers and initiating business relationships. For this purpose, we research and identify prospective business customers and their contact persons and, where appropriate, contact them. Such contact is made on behalf of our clients for the purposes of new customer acquisition and sales promotion.

We may obtain the master and contact data required for this purpose from our clients or cooperation partners as well as from publicly available sources, such as company websites, business directories or professional online networks such as LinkedIn. We also process data provided to us directly by the data subjects, for example in the course of previous contact.

As part of these activities, we collect and store in particular master and contact data (e.g. name, email address, telephone number, company, position, etc.) as well as other professional information, such as details about the employer, professional position or publicly available professional profiles. Where contact is made, we also process the respective communication content as well as, where applicable, call notes and information about the contact history.

We transfer the data collected to our CRM system. There, your data is managed, maintained and processed for lead and contact management and for the preparation, performance and documentation of our sales activities. Your master and contact data as well as, where applicable, further professional information and data from previous contacts may be combined in one profile. Where this is necessary for the performance of our contractual services for our clients and an appropriate legal basis exists, we provide our clients with the contact details and information relevant to them for the further initiation of business relationships.

Your data is collected, stored and used only for the specific purposes of identifying and qualifying prospective business customers, making telephone contact and initiating business relationships on behalf of our clients. Data processing is based on Article 6(1)(f) GDPR for the purposes of our legitimate interests in conducting our business activities and fulfilling our contractual obligations towards our clients. In particular, we take into account that the processing is generally limited to professional data and that contact is made in a business context. Telephone contact for marketing purposes takes place only where the applicable legal requirements are met.

2.3. Contract Processing, Customer Advice and Support

If you send us a purchase or cooperation enquiry via the contact form, by email or by telephone (see Section 2.1), we may prepare an appropriate quotation on the basis of your enquiry and the information provided and send you the quotation documents by email. We record the data relating to your enquiry and the respective quotation in our CRM system.

Where necessary, your data may be transferred to shipping or freight service providers and, where applicable, to the competent customs authorities as part of contract processing. Outgoing invoices and incoming payments are documented under the respective profile in our CRM system. Where applicable, your data may also be checked against the relevant sanctions lists.

Within existing contractual relationships, we process your data in connection with the handling and administration of enquiries and complaints. As a rule, we process your master, contact and contract data as well as other information that you have provided to us in connection with your respective matter.

Your data is collected, stored and used only for the specific purposes of performing the contractual relationship with you, properly processing incoming orders and complying with legal obligations. Data processing is based on Article 6(1)(b) GDPR where it relates to the performance of or steps prior to entering into a contractual relationship with you, or on Article 6(1)(c) GDPR where processing is necessary to comply with legal obligations, for example under commercial or tax law. Furthermore, data processing is based on Article 6(1)(f) GDPR for the purposes of our legitimate interests in properly processing incoming orders and establishing, exercising or defending legal claims.

2.4. Data Processing in Connection with Video Conferences

We use Microsoft Teams to conduct video conferences, webinars and other online meetings. Microsoft Teams is a service provided by Microsoft Ireland Operations Ltd., 1 Microsoft Place, Leopardstown South County Business Park, Dublin, Ireland (hereinafter “Microsoft Ireland”). Various categories of personal data are processed when Microsoft Teams is used. The scope of the data processed also depends on the information you provide before or while participating in an online meeting.

The following categories of personal data may be processed:

• User information: display name, email address, profile picture (optional), preferred language
• Meeting metadata: e.g. date, start and end time, meeting ID, telephone number, location
• Text, audio and video data: Audio and video data are processed during the online meeting. You may also optionally use the chat function during an online meeting. In this case, the text entries you make are processed in order to display them in the online meeting.

In certain situations, plicatec may record online meetings, for example to enable participants who were unable to attend to view the online meeting afterwards. Only certain persons at plicatec are authorised to record online meetings.

If we record online meetings, you will be informed before the recording begins or notified within the online meeting and, where required, asked for your consent. Consent may, for example, be given by an affirmative message in the chat and is always voluntary. If you do not wish to be recorded, you may leave the online meeting. You may also deactivate your video or refrain from using the chat tool.

If an online meeting is recorded, files containing video, audio and presentation content are created. Where necessary to document the specific results of an online meeting, a text file containing the online meeting chat may also be stored.

Data processing is carried out on the basis of the following legal provisions:

• Where data processing is necessary to initiate or perform contractual relationships with our business partners, the legal basis for the processing is Article 6(1)(b) GDPR.
• Where data processing is not necessary for the performance of a contract with business partners or for the performance of an employment relationship, the processing is carried out for the purposes of our legitimate interests on the basis of Article 6(1)(f) GDPR. In these cases, our legitimate interests consist in the use of modern means of communication and the optimisation of our business processes.
• Where data processing is based on your consent, in particular in connection with the recording of online meetings described above, Article 6(1)(a) GDPR is the applicable legal basis.

When Microsoft Teams is accessed and used, information may be stored on your terminal device and/or information already stored on your terminal device may be accessed, in particular server log data. Such storage or access is based on Section 25(2) No. 2 TDDDG, as this information is strictly necessary to provide the service requested.

We store your data for as long as necessary for the purposes described above. Longer retention, in particular for the establishment, exercise or defence of legal claims, remains reserved.

3. Recipients of Personal Data

Your personal data is transferred to external recipients only to the extent necessary to achieve the purposes described above, where we have your consent to do so or where another legal basis permits such transfer. Where applicable, your data may be transferred to external service providers that we use to achieve the purposes described above and with whom we have concluded data processing agreements in accordance with Article 28(3) GDPR.

External recipients of your personal data may include, in particular:

• affiliated companies with which we may exchange personal data where this is necessary for internal administrative, marketing or customer support purposes;
• clients and contracting parties to whom, as part of our business activities, we transfer personal data relating to prospective business contacts for the purpose of initiating business relationships;
• service providers acting on our instructions whom we use to achieve the purposes described above;
• business partners, e.g. freelance staff;
• tax authorities;
• tax advisers and auditors; and
• courts, arbitration tribunals, authorities or legal advisers where this is necessary to comply with applicable law or to establish, exercise or defend legal claims.

4. Data Processing in Third Countries

Where, in accordance with the explanations above, we transfer your data to third countries outside the European Union (EU) or the European Economic Area (EEA), we ensure before any transfer that, except in cases permitted by law, either an adequate level of data protection exists at the recipient or you consent to the transfer. An adequate level of data protection may, for example, be ensured by an adequacy decision of the European Commission, by concluding EU Standard Contractual Clauses (SCCs) or by the existence of Binding Corporate Rules (BCRs). Please contact us using the contact details provided above if you would like information about the specific safeguards used for the transfer of your data to third countries.

5. Storage Period and Deletion

We store your personal data only for as long as necessary to fulfil the purposes described above or, where processing is based on consent, until you withdraw your consent. If you object to the processing, we will no longer process your personal data unless further processing is permitted or required under the applicable legal provisions, for example under commercial or tax law retention obligations. We also delete your personal data where we are legally required to do so.

If no contract is concluded with you, we store your data in accordance with the statutory retention and limitation periods, generally three years. If a contract is concluded with you, we store your data for the duration of the respective business relationship or contractual relationship plus any applicable retention and limitation periods.

6. Your Rights

As a data subject, you have the following rights in accordance with the GDPR:

Right of Access (Article 15 GDPR)

You have the right to obtain information about the personal data concerning you that we process, provided the statutory requirements are met.

Right to Rectification (Article 16 GDPR)

You have the right to request the immediate correction of inaccurate data and the completion of incomplete data, provided the statutory requirements are met.

Right to Erasure (Article 17 GDPR)

You have the right to request the erasure of your personal data, provided the statutory requirements are met and, in particular, where (1) your data is no longer necessary for the purposes specified in this data privacy information, (2) you have withdrawn your consent and there is no other legal basis for further retention or storage, (3) your data has been processed unlawfully, or (4) you have objected to the processing and there are no overriding legitimate grounds for the processing.

Right to Restriction of Processing (Article 18 GDPR)

You have the right to request that we restrict the processing of personal data concerning you, provided the statutory requirements are met. This applies in particular where you contest the accuracy of the data or where the processing of your data is unlawful and you request restriction instead of erasure.

Right to Data Portability (Article 20 GDPR)

Where your data is processed on the basis of a contract or your consent, you have the right to receive your data in a structured, commonly used and machine-readable format or to have your data transmitted to another controller, provided the statutory requirements are met.

Right to Lodge a Complaint with a Supervisory Authority (Article 77 GDPR)

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority if you believe that the processing of personal data concerning you infringes the GDPR (Article 77 GDPR). You may exercise this right in particular before a supervisory authority in the Member State of your habitual residence, your place of work or the place of the alleged infringement, or before the supervisory authority responsible for us. The supervisory authority responsible for us is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg), Lautenschlagerstraße 20, 70173 Stuttgart, Germany.

If you have any questions concerning the processing of your data or wish to exercise your rights as a data subject, please contact us using the contact details provided above.

7. Version

This data privacy information may be amended from time to time. The current version of this data privacy information shall apply.

Version: October 2025