Privacy Notice for Customers, Business Partners, and Prospective Clients

Who is responsible for processing your personal data?

The data controller is

Rössle & Wanner GmbH
Ulrichstraße 102
72116 Mössingen

Telefon: +49 (0) 7473 70 12 0

Telefax: +49 (0) 7473 70 12 78

E-Mail: info@roewa.com

The Röwa Group, which includes not only Rössle & Wanner GmbH but also Selecta Matratzen GmbH, Ulrichstraße 102, 72116 Mössingen, and Rössle & Wanner Schweiz AG, Seetalstrasse 5, CH-5630 Muri—uses a unified system for customer management. The companies of the Röwa Group are therefore jointly responsible with respect to this customer management system and the associated processing of personal data within the meaning of Article 26 of the GDPR. A key provision of the relevant agreement is the regulation of data subjects’ rights. According to this, Rössle & Wanner GmbH is responsible for fulfilling the data subjects’ rights under Articles 15 through 22 of the GDPR. However, the assignment of responsibility does not affect the fact that data subjects may exercise the rights granted to them under Articles 15 through 22 of the GDPR against any of the parties.

How can you contact our Data Protection Officer?

The company’s Data Protection Officer can be reached by email at: dsb@roewa.com.

What are the purpose and legal basis for processing your personal data?

1. Processing of personal data within the scope of the business relationship We process personal data of customers, business partners, and prospective customers, as well as their employees, in accordance with Article 6(1)(b) of the GDPR, to the extent necessary to fulfill obligations arising from contractual relationships with our customers and business partners or to carry out pre-contractual measures with prospective customers, in particular for advising on or supplying our products and for invoicing. This includes, in particular, title, first name, last name, address, telephone number (landline and/or cell phone), fax number, email address, website, commercial register number, VAT number, membership number, industry, collection selection, purchase history, job title, and bank account information. To the extent that we do not receive personal data directly from data subjects (e.g., for correspondence with contacts at customers and business partners), the data comes from our customers or business partners.
2. . Processing of Data for Advertising Purposes, Specifically Email Newsletters We may process personal data for advertising purposes (e.g., email newsletters containing event invitations, product information, and promotional offers) related to our own services. We have a legitimate interest in processing your data for direct marketing purposes within the meaning of the applicable legal basis under Article 6(1)(f) of the GDPR. You may unsubscribe from an email newsletter at any time with future effect by using the link provided for this purpose in each email newsletter or by sending a message to the contact information provided above. The lawfulness of data processing operations that have already taken place remains unaffected by this. The newsletters are sent by a service provider bound by our instructions, who is obligated to comply with data protection regulations and is not permitted to use the data for any other purpose. If you exercise your right to object, we will store the specified address data in a “block list” to implement your objection. This serves both your interests and our legitimate interest, as defined in Article 6(1)(f) of the GDPR, in complying with legal requirements when sending newsletters. There is no time limit on storage in the block list. You may object to this storage if your interests outweigh our legitimate interest. However, please note that, due to the complete deletion of your data, processing for advertising purposes may resume if your data is collected again.

Who has access to your personal data?

Your personal data will only be disclosed to third parties to the extent necessary for the purpose of contract fulfillment (e.g., for the delivery of products as part of contract fulfillment, or the sending of product information), if you have expressly consented to such disclosure (Article 6(1), sentence 1, letter a of the GDPR), or if data protection law permits such disclosure. Categories of recipients of personal data include, in particular, package and shipping service providers. Furthermore, we engage legal advisors, management consultants, auditors, and similar professionals who may have access to personal data to the extent necessary for the provision of their services. We also rely on the services of external service providers for certain technical and organizational processes; these providers are granted access to personal data in order to perform these services. These are service providers bound by our instructions, who are subject to data protection requirements and are not permitted to use the data for any other purpose. Specifically, these service providers are as follows:

• We use Microsoft’s services for virtual meetings, communication, and surveys. Microsoft Corporation, USA, is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR).
• To send our email newsletters, we use Rapidmail, a service provided by Positive Group Deutschland GmbH, Ingeborg-Krummer-Schroth-Straße 18a, 79106 Freiburg im Breisgau.
• In some cases, we also commission advertising agencies to create and send promotional materials or to organize events.
• For the administration, upkeep, and maintenance of our information technology systems, we occasionally utilize the services of software and IT companies.
• We use the services of waste disposal companies for the disposal and destruction of confidential documents.

How long do we store your personal data?

We store personal data for as long as necessary for the respective purpose of processing, in compliance with statutory retention periods (e.g., ten years for tax-related documents and six years for other business correspondence, as stipulated by the German Commercial Code and the German Fiscal Code) (Art. 6(1), sentence 1, lit. c GDPR). Storage beyond the statutory retention periods is possible if you have consented to this pursuant to Article 6(1), sentence 1, letter a of the GDPR, or if the purpose of the data processing has not yet ceased to apply.

What are your rights?

Subject to the conditions set forth in Articles 15 through 20 of the GDPR, you have the right to obtain, free of charge, information about the personal data we have stored about you; to have incorrect data corrected or incomplete data completed; and to request the erasure or restriction of processing, as well as the portability of your personal data.

You may object at any time, with future effect, to the use of your data for direct marketing purposes; you may also object at any time, with future effect, to the use of your data based on Article 6(1)(f) of the GDPR for reasons arising from your particular situation. The only costs incurred for such an objection are the transmission costs according to the standard rates.

To the extent that we process data based on your consent, you may revoke your consent at any time with future effect.

We would also like to inform you of your right to file a complaint with a competent data protection supervisory authority. The supervisory authority responsible for us is the State Commissioner for Data Protection and Freedom of Information in Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart.