Skip to content
vitagroup HIP
ContactBook a consultation

Data processing notes

With the following information, we would like to provide you with an overview of how we process your personal data and your rights in this regard. This information applies to all companies within the vitagroup group of companies with which you may come into contact:

  • vitagroup AG
  • vitasystems GmbH
  • vitagroup health intelligence GmbH
  • vitagroup corporate service GmbH

These notices apply to the personal data of individuals with whom we enter into contractual or business relationships, as well as to the personal data of officers, managing directors, key account managers or other employees of our contractual or business partners, which we process in the context of existing or prospective contractual and business relationships. This includes, among others, existing or potential suppliers, service providers, customers or consultants, as well as existing or potential cooperation partners or other partner companies.

Name and contact details of the controller. The controller responsible for data processing is the respective company within the vitagroup group of companies with which you come into contact and to which you provide your personal data:

vitagroup AG

Gottlieb-Daimler-Straße 8
68165 Mannheim
Phone: +49 (0) 621 121 849-0
Email: info@vitagroup.ag
Executive Board: Kamilo Kolarz

vitasystems GmbH

Gottlieb-Daimler-Straße 8
68165 Mannheim
Phone: +49 (0) 621 121 849-0
Email: info.vitasystems@vitagroup.ag
Managing Directors: Kamilo Kolarz, Dr. Nils Hellrung

vitagroup health intelligence GmbH (formerly symeda GmbH)

Hamburger Str. 273b
38114 Braunschweig
Phone: +49 531 70220160
E-Mail: info.vhi@vitagroup.ag
Managing Director: Dr. Nils Hellrung

vitagroup corporate service GmbH

Gottlieb-Daimler-Straße 8
68165 Mannheim
Phone: +49 (0) 621 121 849-0
E-Mail: info@vitagroup.ag
Managing Directors: Kamilo Kolarz, Dr. Nils Hellrung

Contact details of the company data protection officer

The data protection officer of the respective controller can be contacted at the addresses given above, for the attention of the Data Protection Officer, or via the following e-mail addresses:

vitagroup AG
datenschutz@vitagroup.ag

vitasystems GmbH
datenschutz@vitasystems.de

vitagroup health intelligence GmbH (formerly symeda GmbH)
datenschutz.vhi@vitagroup.ag

vitagroup corporate service GmbH
datenschutz.vcs@vitagroup.ag

Sources and categories of personal data

We primarily process personal data that the data subjects concerned provide to us themselves in the context of contractual and business relationships, or that we receive from the respective contractual and business partners (e.g. from your colleagues, with whom we are already in contact), for instance when processing an enquiry or an order. We also process personal data that we collect from publicly accessible sources (such as the commercial register, the press, the internet) or receive from third parties (e.g. credit agencies, business partners). We will provide separate notice of any collection of personal data from third-party sources.

Relevant personal data includes, in particular, your personal details and other contact information, such as:

  • Salutation
  • Title
  • First name
  • Last name
  • Company name
  • Department
  • Position
  • Supervisor
  • Address
  • EMail address
  • Phone number
  • Cell phone

This may also include contract or order data, data arising from the fulfilment of our contractual obligations, data relating to you personally (e.g. business interests, occupation, industry, tasks and authorities), as well as other data comparable to the categories mentioned.

The scope of the data processed about a person varies depending on the capacity in which that person interacts with us, such as their position at the respective business partner.

Processing purposes and legal bases

We process personal data for the following purposes on the basis of the following legal bases:

  • Data processing takes place to perform contracts concluded with you or your employer, or to carry out pre-contractual measures (Art. 6(1)(1)(b) GDPR); this includes in particular: purchase and delivery contracts (e.g. processing enquiries, authenticating contractual partners, preparing and signing contract documents, carrying out purchases and sales, invoicing and processing purchase price payments); service and work contracts as well as other engagement relationships (e.g. processing and reviewing relevant offers and enquiries; authenticating contractual partners, preparing and signing contract documents, processing payments; sending information letters);
  •  Further data processing takes place on the basis of legal requirements (Art. 6(1)(1)(c) GDPR), for example to fulfil tax-related and other statutory control and reporting obligations, as well as audits by tax or other authorities and to comply with statutory retention periods;
  • In individual cases, we process data because you have given your explicit consent to do so (Art. 6(1)(1)(a) GDPR), for example to receive advertising by email and/or telephone;
  • We also process your data to safeguard our legitimate interests (Art. 6(1)(1)(f) GDPR), specifically for the following purposes:
    optimal contact management/relationships, including with employees of our business partners; optimising our business processes, e.g. by maintaining a customer, supplier or prospect database, including as part of "customer relationship management"; centralising or outsourcing company functions; reducing default risks in our business processes by consulting credit agencies (such as Creditreform, Bürgel); asserting and defending legal claims; market research purposes.

Recipients of personal data

Under certain circumstances (beyond the cases already mentioned above), your personal data may be disclosed for the purposes stated above; specifically:

  • If necessary to investigate or prosecute unlawful or abusive incidents, personal data will be forwarded to our legal advisers, law enforcement authorities and, where applicable, to injured third parties. However, this will only take place where there are concrete indications of unlawful or abusive conduct. Disclosure may also take place where it serves to enforce contractual provisions between us and our contractual and business partners.
  • We are also legally obliged to provide information to certain public authorities upon request. These are primarily law enforcement authorities, authorities responsible for prosecuting regulatory offences subject to fines, and tax authorities.
  • Where this is necessary for processing your enquiry or for the conclusion or performance of a contractual or business relationship with you, as well as in the case of centralised or outsourced company functions, your data may be disclosed to affiliated companies for the purposes stated above, in particular to the aforementioned companies of the vitagroup group. Detailed information on the joint processing of customer data within the vitagroup group can be found below.
  • Occasionally, in order to fulfil the purposes described in this data processing notice or to provide our services, we rely on contractually affiliated third-party companies or other cooperation partners as well as external service providers, which may be based outside the EU or EEA, for example logistics companies, IT service providers, business consultants and financial institutions. In such cases, information is disclosed to these companies or individuals to enable them to carry out further processing. Where these are bodies outside the EU or EEA, we ensure an adequate level of data protection, for example by entering into appropriate contracts with the data recipient.
  • As part of the further development of our business activities, the structure of our company may change, for example through a change in legal form, or through the establishment, purchase or sale of subsidiaries, company divisions or parts thereof. In such transactions, customer information is transferred together with the part of the company being transferred. Whenever personal data is disclosed to third parties within the scope described above, we ensure that this is done in accordance with this data processing notice and applicable data protection laws.

Joint processing of customer data within the vitagroup group

The company within the vitagroup group responsible for processing your personal data (see above) processes your customer data in a shared customer database. The data stored and processed in the database generally includes first and last name, salutation, title, address, telephone number, fax number, email address, professional position or function, as well as any other data required for the performance of the contract or voluntarily provided by you.

The legal basis for this joint data processing is our legitimate interest in transmitting and processing personal customer data within the group of companies for internal administrative purposes (cf. Art. 6(1) sentence 1 lit. f) GDPR in conjunction with Recital 48 GDPR). There are no conflicting interests on your part as a customer or as an employee of a customer; rather, the interests of the group described above, in particular ensuring consistent data protection standards, are likely to be in your interest as well.

The data protection responsibilities and areas of accountability are governed by an agreement between the companies of the vitagroup group in accordance with Art. 26 GDPR.

If, as a customer or as an employee of a customer, you wish to exercise your data subject rights, you may contact any company within the vitagroup group of companies (see above).

Data retention period and deletion

Personal data collected by us in connection with an enquiry or contractual relationship is generally stored until the enquiry or contractual relationship has been fully completed, and is deleted thereafter, unless we

  • are obliged to retain it for a longer period pursuant to Art. 6 (1) sentence 1 (c) GDPR due to retention and documentation obligations under tax and commercial law (arising from the German Commercial Code (HGB), Criminal Code (StGB) or Fiscal Code (AO) – retention periods generally range from 2 to 10 years), or
  • are entitled to retain it for a longer period pursuant to Art. 6 (1) sentence 1 (f) GDPR in order to preserve evidence within the framework of statutory limitation periods (limitation periods may extend to a maximum of 30 years, with the standard limitation period being 3 years), or
  • you have consented to storage beyond this period pursuant to Art. 6 (1) sentence 1 (a) GDPR.
  • In the cases described above, where we are obliged or entitled to retain data for a longer period, the data concerned is blocked from further processing.

Data subject rights

You have the right: to access information pursuant to Art. 15 GDPR; to rectification pursuant to Art. 16 GDPR or to erasure pursuant to Art. 17 GDPR; to restriction of processing pursuant to Art. 18 GDPR; to object to processing pursuant to Art. 21 GDPR; to data portability pursuant to Art. 20 GDPR; and to lodge a complaint with a competent supervisory authority pursuant to Art. 77 GDPR.

Obligation to provide data

Within the scope of our pre-contractual or contractual business relationship, you are required to provide the personal data necessary for the establishment, performance and termination of a business relationship and for fulfilling the associated contractual obligations. Without this data, we will generally be unable to process your enquiry or to conclude, perform and terminate a contract with you.

No automated decision-making

In establishing and performing the business relationship, we generally do not use fully automated decision-making pursuant to Article 22 GDPR.

Right to object pursuant to Art. 21 GDPR

Where your personal data is processed on the basis of legitimate interests pursuant to Art. 6 (1) sentence 1 (f) GDPR, you have the right, pursuant to Art. 21 GDPR, to object to the processing of your personal data on grounds relating to your particular situation. If you wish to exercise your right to object, it is sufficient to send an email to the email address of the responsible company stated at the beginning of these data processing notices.

Version and amendment of these data processing notices

These data processing notices are dated 23.06.2022. Further developments in data protection or within our company may also affect the handling of personal data. We therefore reserve the right to amend these data processing notices in the future within the scope of applicable data protection laws and, where necessary, to adapt them to changing data processing practices. We will notify you of any material changes in content.