Data Privacy Information for Business & Cooperation Partners

Who is this information for?

This notice applies to suppliers, service providers and cooperation partners of ALPLA who are in contact with us or engaged in business relations.

Why are you seeing this page?

We explain how and why we process your personal data, what rights you have under the GDPR, and who to contact if you have questions or concerns.

As a cooperation partner, you typically want to know:

• what personal data we process and for which purposes
• whether data is shared within the ALPLA Group or with third parties
• how long your data is stored
• what rights you have and how to exercise them

You’ll find details on all of these points below.

The controller is the ALPLA company with which you initiate or maintain a business relationship. In some cases, joint responsibility within the ALPLA Group may apply (Article 26 GDPR). A list of controllers and contact options is available via the ALPLA website. Details of the appointed Data Protection Officer can be found at the end of this page.

We process personal data only where necessary to establish, manage, and maintain business relationships and cooperation.
Typical purposes include:

• preparing and executing contracts
• managing suppliers and cooperation partners
• communication and collaboration
• accounting, invoicing and financial controls
• compliance, internal audits and IT security
• project management and documentation

The legal basis depends on the context and includes:

• contract performance (Art. 6(1)(b) GDPR)
• legitimate interests (Art. 6(1)(f) GDPR)
• consent, where explicitly given (Art. 6(1)(a) GDPR)
• legal obligations (Art. 6(1)(c) GDPR)

To manage cooperation with you or your company, we may process personal data such as:

• contact details
• contractual and transactional information
• communication records
• supplier or partner master data

Providing this data is necessary to conclude or perform a contract. Without it, a business relationship may not be possible.

When holding online meetings, training sessions or conferences, we may process:

• your name and contact details (for invitations)
• content you share during meetings (e.g. chat messages, files)
• technical metadata necessary to run the meeting

Online meetings are used:

• to perform or prepare contracts
• to maintain business relationships
• based on consent, where recordings are made

If a meeting is recorded, you will be informed transparently in advance and asked for your consent.

In certain contractual situations, a credit or identity check may be performed to assess creditworthiness or prevent misuse of data.

For this purpose, limited personal data may be shared with credit reference agencies. You may contact such agencies directly to access or review your data.

In some cases, we process personal data only with your explicit consent, for example:

• when you subscribe to a newsletter
• when you agree to receive event information

You may withdraw your consent at any time. Withdrawal does not affect processing carried out before consent was revoked.

Your data may be processed where required to comply with legal obligations, such as:

• commercial and tax law
• financial or regulatory requirements

In these cases, processing is limited to what the law requires.

We store personal data only for as long as necessary for the relevant purpose or as required by law.
Data is deleted once:

• the purpose no longer applies, and
• no legal obligation requires further storage

We process:

• data you provide directly, and
• data provided by your company or obtained from publicly accessible sources

Within ALPLA

Access is limited to employees who need the data to fulfil business purposes, such as:

• supplier management
• accounting and controlling
• purchasing and compliance

External recipients

Where necessary, data may be shared with:

• other ALPLA companies (internal administration)
• external service providers (processors)
• public authorities (where legally required)
• credit reference agencies (in specific cases)

All recipients are bound by applicable data protection obligations.

If personal data is transferred outside the EU/EEA, ALPLA ensures an adequate level of protection, for example by using EU standard contractual clauses, unless an adequacy decision applies.

Under the GDPR, you have the right to:

• access your personal data
• have inaccurate data corrected
• request deletion or restriction of processing (in specific cases)
• receive your data in a structured format
• object to processing based on legitimate interests

Usually no.

You only need to contact us if you want to:

• exercise your data protection rights
• withdraw consent
• object to processing
• lodge a complaint

If you believe your data is processed unlawfully, you have the right to lodge a complaint with the competent data protection supervisory authority in your country of residence or work.

Details of the Data Protection Officer for ALPLA entities, including contact information, are provided below.