Information on data processing in accordance with Article 13 of the EU General Data Protection Regulation (GDPR) (‘data protection information’)
GIZ takes the protection of personal data very seriously. This document provides information about how your personal data is processed in GIZ’s contract award procedures and in contracts with GIZ.
- Contact details of the data controller
The data controller for processing purposes is the Deutsche Gesellschaft für Internationale Zusammenarbeit (GIZ) GmbH.
Address: Friedrich-Ebert-Allee 32 + 36, 53113 Bonn, Germany Dag-Hammarskjöld-Weg 1 – 5, 65760 Eschborn, Germany Contact: email to info@giz.de
Processor: cosinex GmbH, Gesundheitscampus-Süd 31, 44801 Bochum, Germany
The processor handles the technical operation (provision of technical infrastructure and software) of the web-based e-procurement solution (known as the GIZ eProcurement Tender Platform) which enables award procedures to be processed electronically and in compliance with legislation. End-to-end, legally compliant support for GIZ’s process for requesting and obtaining tenders (the procurement process) is also provided by the standardised award management system, which is based on the processor’s standard award management software (a stand-alone solution with a software as a service (SaaS) contract) and which the processor runs on its servers.
- Collecting your data
We process your personal data as follows:
• Contact data of tenderers (e.g. name, position in company, telephone number, address and email address); • Contact data of tenderers’ employees or experts for assignment (e.g. name, position in company, telephone number, address and email address); • Data for assessing the qualifications of tenderers’ employees or experts for assignment (e.g. CVs, proof of qualifications, personal references, professional references); • Data that we obtain by permissible means from publicly accessible sources (e.g. trade registers, Central Trade and Industry Register in Germany (Gewerbezentralregister)), to the extent that these are necessary for decision-making in the context of the award procedures; • User data (e.g. IP address, registration numbers); • In the event of negotiations, the data required for an online meeting (e.g. IP address); • In the event of the award of a contract, the data required to conclude the contract (e.g. signatures, electronic signatures); • In the event of the award of a contract, the data required for contract processing and billing (e.g. invoice data, bank details, VAT ID number).
Date: 07/2024 Prepared by: E200 Page 1
- Purpose of data processing and its legal basis
Purposes for the performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR) We process personal data for the following purposes:
• Concluding and implementing the contract; • Contract billing.
This processing of your personal data is required for the performance of a contract or for carrying out pre-contractual measures.
Purposes for compliance with legal obligations (Article 6(1)(c) GDPR) and for performing tasks that are in the public interest (Article 6(1)(e) GDPR) We process personal data for the following purposes:
• Preparing and implementing the award procedure (GIZ is subject to European and German procurement law. This particularly includes the German Act against Restraints on Competition (GWB), the German Ordinance on the Award of Public Contracts (VgV) and the Rules of Procedure for the Award of Public Supply and Service Contracts below the EU Thresholds (UVgO)); • Obtaining information from registers and agencies (Central Trade and Industry Register (Gewerbezentralregister) and Competition Register (Wettbewerbsregister) in Germany, credit reference agencies).
This processing of your personal data is required in order to comply with a legal obligation to which our company is subject. Both GIZ and its processors are subject to statutory requirements that entitle or oblige them to share your data. Furthermore, processing is necessary to enable GIZ to perform tasks carried out in the public interest.
- Disclosure to third parties
The data are only disclosed to third parties if GIZ is legally obliged or entitled to do so or if you have given your consent to the transfer.
Your personal data are disclosed to the following third parties, among others:
• In Europe-wide award procedures, in accordance with Section 134 (1) GWB, the tenderers whose tenders will not be accepted are informed before the contract is awarded of the name of the company whose tender is to be accepted. In addition, the tenderers whose tenders are not accepted are informed on request of the characteristics and advantages of the successful tender in accordance with Section 62 (2) VgV. • In German award procedures, the tenderers whose tenders are not accepted are informed on request of the name of the successful tenderer and the characteristics and advantages of the successful tender in accordance with Section 46 UVgO. • When awarding public contracts with a contract amount that exceeds EUR 30,000 (excluding VAT), the public contracting authority must obtain an extract from the Central Trade and Industry Register in Germany (Gewerbezentralregister), (in future: Competition Register in Germany (Wettbewerbsregister)) for the tenderer who is to be awarded the contract.
Date: 07/2024 Prepared by: E200 Page 2
• For contracts that exceed EUR 30,000 (excluding VAT), in accordance with Section 19(4) of the German Act Regulating a General Minimum Wage (MiLoG), Section 21(4) of the German Act on Mandatory Working Conditions for Workers Posted Across Borders and for Workers Regularly Employed in Germany (AEntG) and Section 21(1) of the German Act to Combat Undeclared Work and Unlawful Employment (SchwarzArbG), an extract for the tenderer who is to be awarded the contract must be obtained from the Central Trade and Industry Register in Germany (Gewerbezentralregister) before the contract is awarded, pursuant to Section 150a of the German Trade, Commerce and Industry Regulation Act (GewO). Your personal data are forwarded to the respective responsible body (the German Federal Office of Justice (BfJ)) to this end. • In the case of restricted tenders without a competitive tender and negotiated awards without a competitive tender with a contract amount that exceeds EUR 25,000 (excluding VAT), information is published for a period of three months on every contract awarded on www.giz.de, www.ausschreibungen.giz.de and ted.europa.eu in accordance with Section 30 UVgO. This information includes at a minimum the name of the entity awarded the contract. • To credit reference agencies in order to obtain creditworthiness reports. • To external legal, technical and organisational advisors to support the preparation and implementation of the award procedure (including assessment of the tender and in connection with any review procedures). • For carrying out review procedures (Federal Contract Awards Chamber at the German Federal Cartel Office). • To legal counsel and courts for processing legal disputes.
- Transfer of data to a third country
No data are transmitted to third countries.
- Retention and erasure of your data
Your data will be retained no longer than is required to • fulfil the purpose for which they were collected; • fulfil another purpose that is compatible with the purpose for which the data were initially collected, as set out in Article 6(4) GDPR in conjunction with Section 23 of the German Federal Data Protection Act (BDSG); or • comply with statutory retention periods.
Requests to participate, tenders (including annexes) and the documentation of the contract award procedure must be retained until the end of the term of the contract or framework agreement, but in all cases for at least three years from the date of award (Section 8(4) VgV, Section 6(2) UVgO).
- Technical and organisational measures to protect your data
GIZ uses appropriate technical and organisational measures to protect data against unintended or deliberate falsification, destruction, loss or access by unauthorised persons. These measures are updated based on technical developments and adapted continuously in line with the given risks.
Date: 07/2024 Prepared by: E200 Page 3
- Your rights
In accordance with GDPR, you have the right to
• access the data we have stored about you (Article 15 GDPR); • obtain rectification of the data we have stored about you (Article 16 GDPR); • obtain erasure of the data we have stored about you (Article 17 GDPR); • obtain restriction of processing of the data we have stored about you (Article 18 GDPR); • object to the storage of your data if they are processed on the basis of Article 6(1) sentence 1(f) and (e) GDPR (Article 21 GDPR); • receive data concerning you in a commonly used and machine-readable format from the controller such that they can be potentially transmitted to another controller (right to data portability, Article 20 GDPR); • withdraw your consent to the extent that the data have been processed on the basis of consent (point (a) of Article 6(1) GDPR). The lawfulness of the processing on the basis of the consent given remains unaffected until receipt of the withdrawal.
In accordance with Article 15 GDPR, you can also contact GIZ’s Data Protection Officer at datenschutzbeauftragte@giz.de.
You also have the right in accordance with Article 77 GDPR to lodge a complaint with the competent data protection supervisory authority. The competent authority for GIZ is the Federal Commissioner for Data Protection and Freedom of Information (BfDI).
Date: 07/2024 Prepared by: E200 Page 4