RoPA – Records of Processing Activities in the Mercedes-Benz Group

DATA PROTECTION INFORMATION

The protection of your personal data is a high priority for us. The following data protection information provides you with a detailed overview of the processing of your personal data. Personal data means any information relating to an identified or identifiable natural person. With this data protection information, we inform you about the nature, scope and purpose of the collection of personal data and how we handle this data. In addition, we would like to inform you about your rights regarding the processing of your personal data.

This Privacy Statement applies to all users of RoPA, the Records of Processing Activities pursuant to Art. 30 GDPR in the Mercedes-Benz Group.

Controller for the processing of personal data is:

Mercedes-Benz Group AG
Mercedesstr. 120
70372 Stuttgart
Germany
data.protection@mercedes-benz.com

The contact details of the Chief Officer Corporate Data Protection are as follows:

Mercedes-Benz Group AG
Chief Officer Corporate Data Protection
HPC E600
70546 Stuttgart
Germany
E-Mail: data.protection@mercedes-benz.com 

We process the following personal data that we have received from you:
First name, last name, Business E-Mail address, Department/organisation, Authentication data, User-ID, Company ID.

We process your personal data for the performance of the employment contract (Art. 6 para. 1 lit. b GDPR).

We process your personal data based on our legitimate interest or the legitimate interest of a third party unless your own legitimate interests outweigh (Art. 6 para. 1 lit. f GDPR).
This includes the following processing purposes:

• Fulfilment of the documentation obligations according to Art. 30 GDPR
• Ensuring IT security and IT operations
• Business management and risk assessment in the Mercedes-Benz Group AG

We delete deactivated procedures, and thus your data linked to the procedure, at the end of the calendar year following deactivation.

We will also delete inactive Group companies, and thus data on company officials, at the end of the calendar year following the inactivation.

When a procedure is updated and this results in a change in personal data (e.g., regarding contact persons), the old status is deleted immediately.

If you hand over your responsibility/role in relation to a procedure, e.g., by changing department or company, your data will be deleted at the end of the calendar month following the change.

We use processors to provide our services. For the purpose of providing and running the application, we transfer your data to our processor 2B Advice GmbH, Bonn, Germany. The transfer of your data to them takes place under strict compliance with the requirements of the GDPR. Processors are only allowed to process the data for our purposes but not for their own and are obliged to comply with the standards of the Mercedes-Benz Group.

The authorized users of RoPA in other Group companies of the Mercedes-Benz Group will be able to view your personal data associated with a procedure. This transmission shall only take place if there is a legal basis for this and this is necessary for one of the above purposes. If a competent data protection supervisory authority requests information about a procedure of the Mercedes-Benz Group, data on contact persons for this procedure and on company officials is transmitted to the supervisory authority.

Your data may be transferred to group companies of Mercedes-Benz Group located outside the EU/EEA. The transfer may only take place if the third country offers an adequate level of data protection according to the EU Commission or in case other appropriate safeguards are in place.

As a data subject you have the following rights:

Art. 15 GDPR: Right of access.
Art. 16 GDPR: Right to rectification.
Art. 17 GDPR: Right to have your data deleted, unless there are legal reasons for further storage.
Art. 18 GDPR: Right to restriction of processing of your personal data. This means that your data will still be stored but may only be processed under limited conditions (e.g., with your consent or to assert legal claims).
Art. 20 GDPR: Right of data portability. You have the right to receive your personal data, which you have provided to the controller, in a structured, commonly used, and machine-readable format.
Art. 21 GDPR: RIGHT TO OBJECT: In case we process your data based on legitimate interests (Art. 6 para. 1 lit. f) GDPR) or to perform a public task (Art. 6 para. 1 lit. e) GDPR) and in case there are reasons on grounds of your specific situation against processing, you have the right to object to this processing.

You can address your rights to the following contact details: Mercedes-Benz Group AG, Mercedesstr. 120, 70372 Stuttgart, Germany, data.protection@mercedes-benz.com.

For the establishment, fulfilment, or execution of the business relationship as well as for pre-contractual measures, there are no fully automated individual decision-making according to Art. 22 GDPR.

You have the right to lodge a complaint with the data protection officer or a data protection supervisory authority if you believe that the processing of personal data concerning you violates the GDPR or other laws (Art. 77 GDPR).