How we handle your data and your rights – 
information pursuant to Articles 13, 14, and 21 of the EU General Data Protection Regulation (GDPR)

The following information is intended to provide you with an overview of how we process your personal data and your rights in this regard. Which specific data is processed and how it is used depends largely on the services requested or agreed upon. 

INFORMATION ABOUT THE RESPONSIBLE PARTY

The responsible party within the meaning of data protection laws, in particular the EU General Data Protection Regulation (GDPR), is: 

Müller-BBM AG
Helmut-A.-Müller-Strasse 1 - 5, 82152 Planegg/Munich, Germany
Tel. +49 89 2620228-00 | Email: info(at)mbbm-ag.com 

You can contact our data protection officer at:

Data Protection Officer of Müller-BBM AG
c/o activeMind AG Management- und Technologieberatung
Potsdamer Str. 3, 80802 Munich, Germany
Tel. +49 89 919294-900 | Email: datenschutz(at)mbbm-ag.com

Joint responsibility is governed by an agreement between the companies. activeMind AG Management- und Technologieberatung is the appointed representative for data protection at Müller-BBM AG. The companies access the same personal data as necessary within the scope of implementing the GDPR. Both companies are independently responsible for the lawful processing of personal data and for ensuring the rights of data subjects, including the provision of mandatory information.

WE PROCESS YOUR DATA FOR THE FOLLOWING PURPOSES AND ON THE FOLLOWING LEGAL BASES.

We process personal data in accordance with the provisions of the GDPR and the Federal Data Protection Act (BDSG):

Within the scope of the balancing of interests (Art. 6 para. 1 lit. f GDPR)

Where necessary, we process your data beyond the actual fulfillment of the contract to protect our legitimate interests or those of third parties. Examples of such cases are:

• If you contact us by email, contact form, or telephone, the data you enter will be stored for the purpose of individual communication with you, maintaining customer relations, and inviting you to company events.
• Assertion of legal claims and defense in legal disputes
• Storage of additional contact persons for communication.

To fulfill contractual obligations (Art. 6 para. 1 lit. b GDPR)

Data is processed for the purpose of performing our service and/or work contract with you. This also includes sending the newsletter by email, provided that this is an agreed, contractual service.

Due to legal requirements (Art. 6 para. 1 lit. c GDPR)

We are subject to various legal obligations that entail data processing. These include, for example, tax laws, statutory accounting, the fulfillment of requests and requirements from supervisory or law enforcement authorities, and the fulfillment of tax control and reporting obligations. In addition, the disclosure of personal data may be necessary in the context of official/judicial measures for the purposes of evidence gathering, criminal prosecution, or the enforcement of civil law claims.

In doing so, we process personal data that we receive in the course of our business relationship with you or with the companies of Müller-BBM AG, including:

• Title and name
• Telephone numbers
• Email addresses
• Position
• Company
• Addresses

WHO RECEIVES YOUR DATA?

Within our company

Within our company, your data will be received by employees who are responsible for contacting you and for the respective contractual cooperation (including the fulfillment of pre-contractual measures), as well as employees who are responsible for organizing events.

Within the scope of data processing

Your data may be passed on to service providers who act as processors on our behalf. All service providers are contractually bound and, in particular, obliged to treat your data confidentially.

Other third parties

Data will only be passed on to recipients outside our company in compliance with the applicable data protection regulations. Recipients of personal data may include, for example:

• The individual companies of the Müller-BBM AG and the Müller-BBM Group
• Public authorities and institutions (e.g., tax authorities) in the event of a legal or official obligation
• Credit and financial services institutions (payment processing)

• Tax advisors, auditors, and payroll tax/tax auditors (statutory audit mandate).

   

IS DATA TRANSFERRED TO A THIRD COUNTRY OR TO AN INTERNATIONAL ORGANIZATION?

Your data will only be processed within the European Union and countries within the European Economic Area (EEA).

HOW LONG WILL MY DATA BE STORED?

We process and store your personal data for as long as this is necessary to fulfill our contractual and legal obligations. If the data is no longer required for the fulfillment of contractual or legal obligations, it will be deleted regularly. Exceptions apply

• if statutory retention obligations must be fulfilled, e.g. the German Commercial Code (HGB) and the German Fiscal Code (AO). The retention and documentation periods specified there are generally six to ten years;
• to preserve evidence within the scope of the statutory limitation provisions. According to Sections 195 et seq. of the German Civil Code (BGB), these limitation periods can be up to 30 years, with the regular limitation period being 3 years.

If data processing is carried out in the legitimate interest of us or a third party, the personal data will be deleted as soon as this interest no longer exists. The exceptions mentioned above apply here.

WHAT DATA PROTECTION RIGHTS DO YOU HAVE?

Every data subject has the right to information under Art. 15 GDPR, the right to rectification under Art. 16 GDPR, the right to erasure under Art. 17 GDPR, the right to restriction of processing under Art. 18 GDPR, the right to object under Art. 21 GDPR, and the right to data portability under Art. 20 GDPR. The restrictions under Sections 34 and 35 BDSG apply to the right to information and the right to erasure.

In addition, you have the right to lodge a complaint with a competent data protection supervisory authority (Art. 77 GDPR). The supervisory authority responsible for us is:

Bayerisches Landesamt für Datenschutzaufsicht
Promenade 27, 91522 Ansbach, Germany
Tel. +49 981 180093-0 | Fax +49 981 180093-800
poststelle(at)lda.bayern.de | https://www.lda.bayern.de/ 

IS THERE AN OBLIGATION TO PROVIDE DATA?

Within the scope of the contractual relationship, you must provide us with the personal data that is necessary for the establishment, execution, and termination of the contractual relationship and for the fulfillment of the associated contractual obligations, or that we are legally obliged to collect. Without this data, we will generally not be able to conclude or execute the contract with you.

INFORMATION ABOUT YOUR RIGHT TO OBJECT UNDER ARTICLE 21 OF THE GENERAL DATA PROTECTION REGULATION (GDPR)

Right to object on individual grounds

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Article 6(1)(f) GDPR (data processing based on a balancing of interests); this also applies to profiling based on this provision within the meaning of Article 4(4) GDPR. If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing serves to assert, exercise, or defend legal claims.

Recipients of an objection

The objection can be made informally with the subject line “Objection” and stating your name, address, or other identifying features to:

Data Protection Officer of Müller-BBM AG
c/o activeMind AG Management- und Technologieberatung
Potsdamer Str. 3, 80802 Munich, Germany
Tel. +49 89 919294-900 | Email: datenschutz(at)mbbm-ag.com

We reserve the right to amend this privacy policy to ensure that it always complies with current legal requirements or to implement changes to our services.

As of: 05.2025