GFT Group Privacy Statement - SynerTrade Accelerate

The following document sets out the rules under which GFT Group (henceforth as: GFT) operates and processes your personal data as a GFT business partner for invoice and payment handling purposes within GFT. Your personal data is processed based on GFT legitimate interest to which you can object at any time.

Your personal data controllers through joint-controlment

GFT Technologies SE
Schelmenwasenstr. 34
70567 Stuttgart, Germany

 

 

T: +49 711 62042-0
F: +49 711 62042-101
Email: info@gft.com
Internet: www.gft.com

Managing Directors

Marco Santos (CEO),

Dr. Jochen Ruetz (CFO & deputy CEO)

Chairman of the Administrative Board

Ulrich Dietz

Data Protection Officer

Ernst O. Wilhelm

And the GFT Company with which you are contracted with. You can find the list of GFT Companies with their contact details HERE. If you are interested in exercising your privacy rights for your personal data gathered for invoice and payment handling purposes, please contact us through purchase@gft.com.

You can contact us for the submission of complaints regarding our privacy practices through dataprotection@gft.com.

Purpose of data processing and scope of data

Purpose

GFT Company with which you are contracted with will process your personal data with the purpose of internal invoice and payment handling processes managed by GFT. All GFT business partners who issue an invoice for GFT will have a dedicated profile inside of the cloud-based solution - SynerTrade Accelerate. Profile can be created either directly by the GFT business partner (you) using the online registration process or indirectly by GFT representative contracting you and who will create a profile for you based on the data you would share with us. Even though the main type of data being processed is the data of legal entities with whom GFT cooperates, and which does not constitute personal data, personal data might be a part of required dataset to enable cooperation with GFT (e.g. contact details of the GFT business partner representative) or part of the business partner structure itself (e.g. company name/self-employment). 

Following data will be processed:

data which needs (according to applicable, local legal framework) to be present on the invoicing documents; invoice history; contact details of the company and their representatives.

Data for creating a business profile

To create a business partner profile, at minimum, the following data needs to be provided: 

  • Company name
  • Address
  • City
  • Postal code
  • Country
  • Language
  • Phone
  • Email address
  • Currency
  • Regional Tax Code (If applies)

 

As a technical administrator of the GFT SynerTrade Accelerate platform, the join-controller of your data will be GFT Technologies SE (Stuttgart, Germany).

International data transfers and data sharing

Visibility

In general, your company profile is only visible to the Company with which you are contracted with. For troubleshooting and technical support purposes, it may become available to GFT Technologies SE representatives and/or solution provider. 

Hosting of your Data

Your data will be hosted on external cloud platform of the SynerTrade Accelerate provider: 

 

Synertrade Germany
Bunzlauer Str. 7
80992 München, Germany

 

Data hosting is done inside European Economic Area. 

Adequate level of protection for personal data

This notice and our practices are designed to ensure an adequate level of protection for personal data in every country where we operate. This means that even in countries whose laws would provide for less protection for your information, GFT will still handle your information in the manner described here. There are a variety of tools that GFT use and procedures that GFT follows to keep your data safe and secure, for instance:

  • the country in which your data is being processed may be approved by the European Commission or a relevant data protection authority;
  • the recipient might have signed up to a contract based on “model contractual clauses” approved by the European Commission, obliging them to protect your personal data.

 

Regardless of the above, GFT implemented technical and organizational measures (e.g.: need-based rights of access, data anonymization) to secure confidentiality, integrity and availability of your data.

 

GFT does not use your personal data for profiling or automated decision-making processes.

Data retention and deletion

GFT keeps your personal data for no longer than reasonably necessary and we retain your data for purposes described in this document, as well as to comply with applicable laws in jurisdictions in which GFT operates. 

With that in mind, in general your invoice data will be deleted within 10 years counting from the beginning of the year after the year in which you provided the data to us. For Poland after 6 years (with the exemption of some assets purchases which may require up to 20 years retention period). All data will be reviewed on annual basis and deleted if the purpose of the processing was achieved, and no other legal grounds remains for further processing. 

You can request deletion of your profile inside SynerTrade Accelerate by contacting us through provided in this document contact methods. But please be aware, that deletion of your profile does not equal deletion of all of your data which may have to be retained by GFT for legal compliance purposes. 

Data Subject rights

Please remember that as a data subject, you are eligible to exercise the following rights by self-service on your SynerTrade Accelerate platform profile or by sending us a corresponding request to purchase@gft.com:

   
The right of access The right to request a copy of your personal data which GFT holds.
The right to be informed You have the right to be provided with clear, transparent and easily understandable information about how we use your information and also about your rights.
The right to erasure This is also known as ‘the right to be forgotten’.  The right to request your personal data to be erased where it is no longer necessary for GFT to retain such data
The right to data portability You have the right to obtain and reuse your personal data for your own purposes across different services.
The right to restrict processing You have the right to suppress further processing of your information. When processing is restricted, we can still store your information, but may not use it further.
The right to object to processing You have the right to object to certain types of processing 
The right to lodge a complaint You have the right to submit a complaint about the way we process your personal data with your national data protection regulator.
The right to withdraw consent If you have given your consent to anything we do with your personal data, you have the right to withdraw your consent at any time (although if you do so, it does not mean that anything we have done with your personal data with your consent up to that point is unlawful). 
The right to rectification You have the right to have your information corrected if it is inaccurate or incomplete.