Privacy Policy

The processing of personal data takes place on various legal bases:

When you access our website and call up a file or subpage stored on the website, some general data and information will be logged. The following data is logged: (1) Path of the requested resource, (2) date and time of access, (3) amount of data transferred, (4) notification of successful access, (5) web browser used, (6) requested domain, (7) the website from which our website is accessed (Referrer URL), (8) time of the server request, (9) operating system used, (10) screen resolution, (11) plugins used, (12) IP address of the accessing computer, and (13) other similar data and information to fend off a threat in the event of an attack on our IT systems.

This data is stored separately from the personal data provided in addition to the IP address. There is no inference to the person concerned. The data is required to (1, 2, 5, 6, 7, 9, 12) correctly display and transmit the contents of our website, (1, 3, 4, 5, 6, 9, 10, 11) improve the contents and the advertising for our website, (1, 2, 3, 4, 6, 7, 8, 12, 13) ensure the permanent functionality of our IT systems and the technology of our website and to detect and fend off cyber-attacks, as well as (1, 2, 4, 5, 6, 7, 9, 12, 13) to provide law enforcement authorities with the information necessary for criminal prosecution in the event of a cyber-attack. This anonymously collected data and information is thus statistically and internally evaluated in order to optimise data protection and data security at Walbing. The legal basis for data processing is Article 6 (1) lit. f EU GDPR.

The data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected. If the data was collected for the provision of the website, it is no longer required at the end of the respective session and will be deleted. For data stored in log files, this applies after seven days at the latest, although further storage remains possible if the IP addresses are deleted or altered so that it is no longer possible to assign the data to a user.

Visitors to our website have the opportunity to use the services we offer. What personal data is transmitted to us is determined by the input mask provided for the use of the respective service and the data fields to be filled in.

The legal basis for data processing is Article 6 (1) lit. b EU GDPR.

The legal basis for the storage of other personal data is Article 6 (1) lit. c and f EU GDPR.

Special information for the placement of offers for sale that contain personal data

In order to make an offer to sell a trade receivable, it is necessary to provide various details, which may also contain or constitute personal data. This can include the debtor’s contact email address or telephone number if these can be assigned to a specific natural person, or the identity of the debtor if the debtor is a natural person (for example the foreign equivalent to a registered businessman, if he is admitted as a debtor) or if it is a partnership whose partners are personally liable for the claims against the company (e.g. the foreign equivalent to a partnership, general partnership, partnership under civil law or limited partnership with at least one natural person as general partner if these foreign equivalents are admitted as debtors on Walbing). We use this personal data to the extent necessary for the purposes listed above. This data is transmitted to the buyer of a trade receivable and, if necessary, also to the banks involved. In addition, some of this data may also become visible to other registered participants in connection with the presentation of a sales offer on our auction platform; the data visible to other participants includes: the name, registered office and industrial sector of the debtor. Under our platform conditions, the seller of a receivable is required to transmit to us only such personal data of a debtor for which corresponding consent of the data subjects is present or for which no consent is required which enables us to use the data as described above.

Special Information for the payment behaviour history

Prior to the approval trade receivables uploaded by sellers will be analysed by Walbing by means of a payment history based on the data provided by the seller and if applicable by the debtor and the account data that can be viewed by Walbing. The seller is given opportunity to provide data about a specific debtor when uploading the first trade receivable against this debtor. Insofar as personal data of the Seller is concerned, the Seller consents to the collection, storage, processing and publication of the aggregated data in the context of the payment history. From the first upload Walbing monitors the fulfilment of each uploaded trade receivable of this debtor by accessing the accounts and ads the collected data to the payment history mentioned above.

Personal data will only be passed on if this is necessary to achieve the above purposes or based on legal or official orders. This includes in particular the transfer of personal data (email address/contact data) of the seller of a trade receivable to the buyer and vice versa, the transfer of personal data to the banks involved in order to be able to carry out the instructions of the banks owed by us for the transfer of incoming payments or our fees, as well as the transfer of data of the buyer to the debtor in the case of a disclosed assignment. In addition, personal data is reconciled using databases such as Worldcheck to minimize the risk of fraud and money laundering.

The Walbing Marketplace GmbH is subject to a group of undertakings with the Walbing Technologies GmbH in accordance to Article 4 No 19 EU GDPR and together they are joint controllers (Article 26 EU GDPR). The legal basis for the joint processing and transmission of personal data between the companies lies, unless a different determination is made in individual cases, in the legitimate interests of the companies under Article 6 (1) clause 1 lit. f in conjunction with Recital 48 EU GDPR, to transmit personal data within a group of undertakings for internal administrative purposes, including the processing of personal data of customers and employees. For further information regarding the joint controllership please refer to the contract about joint data controllership.

The personal data will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected. The personal data processed for the performance of a contract or pre-contractual measures will be deleted if it is no longer required for the performance of the contract. A necessity of data processing can also arise after conclusion of the contract if personal data of the contractual partner must be stored due to contractual or legal obligations.

The data subject has a right to request confirmation from the controller as to whether personal data concerning him or her is being processed.

The data subject shall have the right to request that controller rectifies any inaccurate personal data concerning him/her without delay. Taking into account the purposes of the processing, the data subject has the right to request the completion of incomplete personal data, including by means of a supplementary declaration.

If, as data controller, we have made the personal data public and are required to delete it in accordance with Article 17 (1) EU GDPR, we shall take appropriate measures, including technical measures, taking into account the available technology and the implementation costs, to inform other responsible parties who process the personal data that a data subject has requested that they delete all links to this personal data or copies or replications of this personal data, insofar as processing is not necessary. We will take the necessary steps.

If the processing of personal data concerning you has been restricted, such data may only be processed – apart from being stored – with your consent or for the purpose of asserting, exercising or defending rights or protecting the rights of another natural person or legal entity or on grounds of an important public interest of the Union or a Member State.

If the processing restriction has been restricted in accordance with the above conditions, you will be informed before the restriction is lifted.

When exercising the right to rectify, cancel or limit the processing, the data subject has the right to be informed of the recipients to whom the rectification, cancellation or limitation of the processing has been communicated.

In addition, in exercising his/her right to data transferability, the data subject has the right to have the personal data transferred directly from one data controller to another data controller, provided that this is technically feasible and does not affect the rights and freedoms of other persons.

The right of data transferability shall not apply where processing is necessary for the performance of a task in the public interest or in the exercise of official authority conferred on the data controller.

The data subject has the right to object at any time to the processing of personal data concerning him/her on the basis of Article 6 (1) lit. e or f EU GDPR for reasons arising from his particular situation. This also applies to profiling based on these provisions.

In the event of an objection, we will no longer process the personal data unless we can prove compelling reasons for the processing which are worthy of protection and which outweigh the interests, rights and freedoms of the data subject, or the processing serves to assert, exercise or defend legal claims.

Where personal data are processed for direct marketing purposes, the data subject has the right to object at any time to the processing of personal data concerning him/her for the purpose of such advertising. This also applies to profiling insofar as it is connected with such direct advertising. If the data subject objects to our processing for direct marketing purposes, we will no longer process the personal data for these purposes.

In addition, the data subject has the right to object to the processing of personal data concerning him/her for scientific or historical research purposes or for statistical purposes in accordance with Article 89 (1) EU GDPR for reasons arising from his/her particular situation, unless the processing is necessary for the performance of a task in the public interest.

The data subject may also, notwithstanding Directive 2002/58/EC, exercise his/her right of opposition in relation to the use of services of the information company by means of automated procedures in which technical specifications are applied.

The data subject has the right not to be subjected to a decision based exclusively on automated processing, including profiling, which has legal effect against him/her or significantly impairs him/her in a similar manner. This does not apply if the decision is necessary for the conclusion or performance of a contract between the data subject and the data controller, or is admissible in accordance with the law of the Union or of the Member States to which the data controller is subject and that law contains appropriate measures to safeguard the rights, freedoms and legitimate interests of the data subject; or with the express consent of the data subject.

These decisions may not be based on special categories of personal data under Article 9 (1) EU GDPR, unless Article 9 (2) lit. a or g applies and appropriate measures have been taken to protect the rights and freedoms and the legitimate interests of the data subject.

Where a decision is necessary for the conclusion or performance of a contract between the data subject and the data controller or is taken with the express consent of the data subject, we shall take appropriate measures to safeguard the rights, freedoms and legitimate interests of the data subject, including at least the right to bring about the intervention of a person on the part of the data controller, to state his own position and to challenge the decision.

The data subject has the right to revoke his/her consent to the processing of personal data at any time. The revocation shall not affect the legality of the processing carried out on the basis of the consent before the revocation.

Without prejudice to any other administrative or judicial remedy, the data subject shall have the right of appeal to a supervisory authority, in particular in the Member State where he/she resides or works or where he/she allegedly carried out the infringement, if the data subject considers that the processing of personal data concerning him/her is contrary to EU GDPR or national data protection laws. The supervisory authority with which the appeal has been lodged will inform the appellant of the status and results of the appeal, including the possibility of a judicial remedy in accordance with Article 78 EU GDPR.

Logging is technically necessary to deliver your message and is also required for security reasons.

For the processing of the data entered in the input mask, the sender’s consent is obtained during the sending process and reference is made to the privacy policy. The legal basis for data processing is Article 6 (1) lit. a and Article 7 EU GDPR. Article 6 (1) lit. f EU GDPR applies to the logged data.

It is also possible to contact us via the email addresses published on the website. The data transmitted by the sender with the email is stored. The legal basis for data processing is Article 6 (1) lit. f EU GDPR and, if the enquiry relates to the conclusion of a contract, Article 6 (1) lit. b EU GDPR.

Interested parties and customers we send the documents offered on the website by post on request. We collect, store and process name and address as well as e-mail address. We need the e-mail address to check if there is a contradiction in advertising. The legal basis for data processing is Art. 6 (1) lit. a, 7 EU GDPR and, if the request relates to the conclusion of a contract, Art. 6 (1) lit. b EU-GDPR.

The personal data will be used solely for the processing of the contact or for the document dispatch. If contact is made by email, the necessary legitimate interest in data processing also lies in the processing of the contact. The personal data processed within the context of logging serves to prevent misuse of the contact form and to safeguard the security of our IT systems. This is the necessary legitimate interest of data processing. Personal data will not be disclosed to third parties unless required by law or for the purpose of prosecution.

Personal data will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected. In the case of personal information submitted to us for a conversation, this is the case when the conversation is over, i.e. when the matter underlying the request have been finally clarified. The additionally logged personal data will be deleted after a period of seven days.

The user of the contact form can revoke his/her consent to the processing of personal data at any time. If you contact us by email, you can object to the storage of your personal data at any time. A conversation can then no longer be continued. Revocation and objections are to be sent by email to privacy@Walbing.com.All personal data of the data subject stored during the establishment of contact will then be deleted.