Information for customers of the Article 13 GDPR


The following information is intended to give you an overview of the processing of your personal data by the Rhenus Group and the rights to which you are entitled under data protection law. In order to fulfil our duty to provide information in accordance with Article 13 GDPR, we would be pleased to provide you with our data protection information below:

The identity and the contact details of the controller:

Rhenus SE &Co. KG
Rhenus-Platz 1
59439 Holzwickede
Phone: +49 (0) 2301 29-0
E-Mail: [email protected] 

The contact details of the data protection officer:

- data protection officer -
Rhenus-Platz 1
59439 Holzwickede
E-Mail: [email protected]

Purpose of processing and legal basis

We process your personal data in accordance with the provisions of the General Data Protection Regulation (GDPR):

a.) Based on your consent (Article 6 Para. 1 a) of the GDPR)
If you have given us your consent to process personal data for certain purposes (e.g. passing on data within the group), the lawfulness of this processing is given on the basis of your consent. Your consent can be revoked at any time. This also applies to the revocation of declarations of consent given to us prior to the application of the General Data Protection Regulation, before 25 May 2018. Please note that the revocation will only take effect in the future. Processing that took place before the revocation is not affected by this.

b.) For the fulfilment of contractual obligations (Article 6 Para. 1 b) of the GDPR)
The processing of personal data is carried out to provide disposal and cleaning services within the framework of the execution of our contracts with our customers or to carry out pre-contractual measures, which are carried out at your request. The purposes of data processing are primarily based on the requirements of the service and may include, but are not limited to, needs assessments and advice. Further details on the purpose of data processing can be found in the respective contract documents and terms and conditions.

c.) As part of the balancing of interests (Article 6 Para. 1 f) of the GDPR)  
If necessary, we process your data beyond the actual fulfilment of the contract to protect the legitimate interests of us or third parties. Examples:

  • Review and optimization of procedures for needs analysis and direct customer contact
  • Advertising or market and opinion research, insofar as you have not objected to the use of your data
  • Assertion of legal claims and defence in legal disputes
  • Prevention of criminal offences
  • Measures for business management and further development of services and products

d.) Due to legal requirements (Article 6 Para. 1 c) of the GDPR) or in the public interest (Article 6 Para. 1 e) of the GDPR)
As a company, we are also subject to various legal obligations, i.e. legal requirements (e.g. tax law, waste law). The purposes of the processing include, among other things, the fulfilment of control and reporting obligations under tax law as well as the fulfilment of the waste documentation system under waste law, the guarantee of IT security and IT operation, measures for building and plant security (e.g. access controls).

Categories of personal data

We process personal data which we receive from our customers within the scope of our business relationship. If you are our customer as a natural person, this refers to your personal data. If you have been named to us by our customer as a contact person within the framework of the business relationship, we process the personal data that our customer or you have provided to us personally for this purpose (usually name, address and other contact data such as e-mail address, telephone number and function). In addition, we process - to the extent necessary for the provision of our services - personal data which we have received from other companies of the Rhenus Group or from other third parties (e.g. for the execution of orders, for the fulfilment of contracts or on the basis of your consent).

On the other hand, we process personal data that we have obtained and are permitted to process from publicly accessible sources (e.g. land registers, commercial and association registers, press, media, Internet). Relevant personal data in the interested party process when opening master data are name, address/other contact data (telephone, e-mail address), bank details and function.

Recipients of the personal data

The service providers and vicarious agents employed by us may have access to your data, which they need to fulfil our contractual and legal obligations. These are the companies from the categories listed below:

  • Public bodies and institutions (e.g. regional council as waste authority) in the event of a legal or official obligation.
  • Subcontractors for disposal and cleaning services.

Under these conditions, recipients of personal data may be: Processors to whom we transfer personal data in order to carry out the business relationship with you. In detail: Processing of subcontractor services, support/maintenance of EDP/IT applications, archiving, document processing, call centre services, compliance services, controlling, data destruction, purchasing/procurement, customer administration, letter shops, marketing, media technology, reporting, spear accounting, telephony, video identification, website management, auditing services, payment transactions.

Other data recipients may be those for whom you have given your consent for data transfer.

Transfer of data to third countries and to an international organisation

Data will only be transferred to third countries (countries outside the European Economic Area - EEA) if this is necessary to carry out the internal business process, is required by law or if you have given us your consent.

Duration of storage

We process and store your personal data as long as it is necessary for the fulfilment of our contractual and legal obligations. If the data are no longer required for the fulfilment of contractual or legal obligations, they are regularly deleted, unless their - temporary - further processing is necessary for the following purposes:

  • Compliance with commercial and tax retention periods: The German Commercial Code (Handelsgesetzbuch) and the German Fiscal Code (Abgabenverordnung) must be mentioned. The periods specified there for storage or documentation amount to up to ten years.
  • Preservation of evidence within the framework of the statute of limitations. According to Article 195 ff. of the German Civil Code (BGB), these limitation periods can be up to 30 years, whereby the regular limitation period is three years.


Your rights as a data subject


Right of access
On request, we will inform you in writing or electronically whether and which personal data we have stored about you (Article 15 GDPR).

Right to rectification
You have the right to rectify (Article 16 GDPR) and/or complete the data vis-à-vis the data controller if the personal data processed concerning you are inaccurate or incomplete.

Right to erasure
You may request the person responsible to delete the personal data concerning you immediately (Article 17 GDPR).

Right to restriction of processing
You have the right to demand the restriction of the processing (Article 18 GDPR).

Right to data portability
You have the right to data portability (Article 20 GDPR). In other words, you have the right to receive your personal data in a machine-readable format.

Right of appeal to the supervisory authority
There is a right of appeal to a data protection supervisory authority. A list of the Germany supervisory authorities and their contact details can be found in the following link:

Revocation of consent
If you have given your consent to the collection or use of personal data and wish to revoke it, you can revoke it at any time with effect for the future by e-mail or letter.

Provision of personal data
As part of our business relationship, you must provide the personal information necessary to establish and conduct a business relationship and to fulfil the contractual obligations associated therewith, or which we are required by law to collect. Without this data we will normally have to refuse the conclusion of the contract or the execution of the order or will no longer be able to execute an existing contract and may have to terminate it.

Automated individual decision-making/profiling
An automated decision making (including profiling) does not take place with your data.

Information about your right of objection

1. Right of objection in individual cases
You have the right, for reasons arising from your particular situation, to object at any time to the processing of personal data concerning you on the basis of Article 6 para. 1 e) GDPR (data processing in the public interest) and Article 6 para. 1 f) GDPR (data processing on the basis of a weighing of interests); this also applies to profiling based on this provision within the meaning of Article 4 para. 4 GDPR.

If you file an objection, we will no longer process your personal data unless we can prove compelling reasons for the processing worthy of protection which outweigh your interests, rights and freedoms, or the processing serves the assertion, exercise or defence of legal claims.

2. Right to object to the processing of data for advertising purposes
In individual cases we process your personal data in order to operate direct advertising. You have the right at any time to object to the processing of your personal data for the purpose of such advertising; this also applies to profiling in so far as it is connected with such direct advertising.