Purchasing and invoice processing

Zittau/Görlitz University of Applied Sciences
Theodor-Körner-Allee 16
02763 Zittau

Please direct any inquiries regarding data processing todatenschutz(at)hszg.de
. Your inquiry will be forwarded to the appropriate department and processed promptly.

The data protection officer can be contacted at

DID Dresdner Institut für Datenschutz
Hospitalstraße 4
01097 Dresden

Web.: www.dids.de
Phone: +49 (0)351 / 655 772 - 0
E-mail: dsb(at)hszg.de

The HSZG processes personal tender, order and invoice data for the purposes of tender evaluation, preparation of decisions under public procurement law, triggering of orders and for checking and settlement of invoices.

Personal data is processed on the basis of Art. 6 para. 1 lit. b, e GDPR
in conjunction with § 3 SächsDSDG, § 6 para. 3 VOL/A, § 3 SächsVergabeG and §§ 33, 34, 48 VgV .

HSZG processes the following personal data for the purposes of this processing activity:

• First name, last name
• Address and contact information
• Offer details
• Contract data
• Invoice data
• Handwritten signature
• Bank account information
• Email details for email invoice receipt
• Information about subcontractors
• Commercial Register Extract
• Business registration
• Data from self-declarations verifying the eligibility of applicants and bidders, e.g.:
  • Company revenue for the last three completed fiscal years
  • References regarding the achievement of comparable services
  • Average annual number of employees in the completed fiscal years, broken down by occupational group
  • Number of employees required to perform the achievements covered by the contract, broken down by occupational group
  • Competent Chamber of Crafts, including registration number and date of registration

Data collection from third parties, pursuant to Art. 4(10) of the GDPR:

• Prequalification agencies (publicly accessible or, in some cases, for details regarding the bidder)
• Federal Office of Justice (Central Trade Register)

The personal data is regularly processed by employees of HSZG for the purposes of this data processing. The data is disclosed to the main cash office in Saxony.

The HSZG does not transfer personal data to a third country or an international organization.

The retention period for personal data is generally 10 years. In individual cases, however, it can be up to 30 years.

As a person affected by the processing of your personal data, you have the following rights if the legal requirements are met.

• You have the right to information about the processing of your personal data(Art. 15 GDPR).
• You have the right to rectification of inaccurate personal data concerning you (Art.16 GDPR)
• You have the right to erasure of your personal data (Art.17 GDPR).
• You have the right to request the restriction of the processing of your personal data (Art.18 GDPR)
• You have the right to data portability of your personal data (Art.20 GDPR)
• You have the right to object to the processing of your personal data at any time (Art.21 GDPR)
• You have the right to withdraw your consent to data processing at any time. The lawfulness of the data processing carried out on the basis of your consent until revocation remains unaffected(Art. 13 para. 2 lit. c GDPR).
• You have the right to lodge a complaint with the Saxon data protection officer
  (Art. 77 GDPR).

The provision of personal data is required under Article 13(2)(e) of the GDPR for the implementation of precontractual measures and the fulfillment of resulting contractual obligations. If you do not provide the personal data related to quotes, orders, and invoices, we will be unable to consider your request in the procurement process, process orders for goods or services, or process payments for invoices.

This processing activity does not involve automated decision-making or profiling in accordance with
Art. 22 GDPR.