According to article 13 of the GDPR & article 50 of the EU-AI Act
General
Below please find information on the processing of your personal data and the data protection rights and privileges to which you are entitled. The collection, processing and use of personal data is always carried out in compliance with the applicable data protection regulations
Data Controller
Company name: Cargo-Partner Holdings GmbH
Address: Airportstraße 9, 2401 Fischamend, Austria
Telephone: +43 5 9888-0
Fax: +43 5 9888-11378
E-Mail-Address: atfis@cargo-partner.com
Website https://www.cargo-partner.com/de/
Processing purpose legal basis and data retention period
In the following, we would like to inform you about the processing purposes related to your personal data and our data collection and their corresponding legal basis and data retention.
| Purpose | Legal basis | Data retention |
|---|---|---|
| Presales contact and providing of information and offerings (quote) | Processing is necessary in order to take steps at the request of the data subject prior to entering into a contract based on GDPR art 6(1)(b) | 3 years In case of a following business relationship: until end of the business relationship + 3 years |
| Customer Relationship Management | Processing is necessary for the performance of a contract or the legitimate interest of our company based on GDPR art 6(1)(b)(f) | Until end of the business relationship + 3 years |
| In case of becoming a customer: Fulfilment of the underlying contract | Contract fulfilment based on GDPR art 6(1)(b) | Until the end of the business relationship + 7 years |
| Storage due to tax and business law retention obligations | Fulfilment of legal obligations based on GDPR art 6(1)(c) in conjunction with national tax and business laws | In Austria, according to section 132 BAO (7 years) |
| Contacting for sales and marketing purposes | Consent by you as the data subject based on GDPR art 6(1)(a) or legitimate interest of our company based on GDPR art 6(1)(f) – both combined with local telecommunication and privacy rules related to electronic communication and sales purposes | Until withdrawal of consent if based on GDPR art 6(1)(a) + 1 month handling time However, depending on the purpose of use, Nippon Express Group may delete your personal data much earlier. |
| Use of AI-Systems for supporting business purposes | We use AI-supported systems to assist certain business processes based based on GDPR art 6(1)(f) and in accordance with the European AI-Act | 3 years In case of a following business relationship: until end of the business relationship + 3 years |
Data Subject Rights & Right of Complaint
If the relevant legal requirements are fulfilled, you have the following rights under article 15 to 22 of the GDPR: the right to information, rectification, erasure, restriction of processing and data portability. In addition, you have the right to object to processing based on article 6(1)(f) GDPR (legitimate interest) in accordance with article 21 of the GDPR.
If the processing is based on Article 6(1)(a) GDPR you have the right to withdraw your consent at any time without affecting the lawfulness of the processing carried out based on the consent until the withdrawal.
In accordance with article 77 of the GDPR, you have the right to complain to the supervisory authority if you believe that the processing of your personal data is unlawful. The address of the responsible supervisory authority for Cargo-Partner is the Austrian Data Protection Authority located in 1030 Vienna, Barichgasse 40-42.
Your rights in connection with AI-supported processing: You have the right to obtain information about the processing of your personal data, including processing supported by AI systems, in accordance with GDPR. Where applicable, you may also object to certain processing activities or request human review, in accordance with applicable data protection laws.
Recipients or categories of recipients
Within our company, those departments and employees will receive your data that are required to fulfill the intended purpose. In addition, data processors contracted by us (e.g., IT service provider) or independently data controllers receive your personal data if this is necessary for the same purpose.
All data processors are contractually obliged to treat your personal data in accordance with the provisions of data protection laws and to process it exclusively in the context of the provision of services.
A list of all group companies you can find here: Link
Automated decision making, Profiling & AI
We use artificial intelligence (AI)-supported systems in certain processes to support our business operations, for example to assist with information provision, internal analyses, content generation, or process optimisation. In some areas, we use AI-based systems to support decision-making processes, for example by providing recommendations, prioritisations, or analytical insights. Where these systems are used, they are applied in a supportive manner and do not produce decisions with legal or similarly significant effects on individuals. Final decisions are subject to meaningful human review and oversight.
You will be informed where required if you are interacting with an AI system or if content has been generated or supported by AI. The processing of personal data in connection with AI systems is carried out in accordance with applicable data protection laws, in particular the GDPR, and is limited to the defined purposes.
In certain cases, content such as texts, responses or analyses may be generated or supported using AI-based tools. Such content is reviewed before use where appropriate. Where legally required, AI-generated content will be clearly identified as such.
International data transfer
We transfer your data to countries within the NIPPON EXPRESS and CARGO-PARTNER group. These also include countries with a currently not adequate level of data protection from international Privacy Law perspective.
Therefore, we use an Intra Company Agreement within our group which also uses Standard Data Protection Clauses in accordance with Article 46 GDPR which secures an adequate level of data protection adopted by the Commission of the European Union and signed it between all our group companies.