We hereby inform you about the processing of your personal data by us and the rights and entitlements to which you are entitled under the GDPR. The specific data processed and the manner in which it is used depend primarily on the legal relationship we have with you at any given time.
We process your personal data exclusively in accordance with the statutory provisions. This includes the following categories of personal data: Master data (e.g. surname, first name, address, role), contact details (e.g. telephone number, email address), contractual data (e.g. customer number), billing data, as well as similar data and the content data generated in the course of our communication with you.
1. Data controller and data protection officer
The data controller responsible for the processing of your personal data is Rexim Lebensmittelproduktion KG, Wittenberger Weg 9, 24941 Flensburg. You can contact our Data Protection Officer as follows: compolicy GmbH, Schwedenkai 1, 24103 Kiel, Tel.: 0431-9089480, Email: info(at)compolicy.de.
2. For what purposes and on what legal basis do we process data?
2.1 Data processing for the purpose of entering into and fulfilling a contract (Art. 6(1)(b) GDPR)
We process data only to the extent necessary for the initiation, performance and fulfilment of the contractual relationship or any other legal relationship underlying the data processing. Without processing this data, we cannot provide our services.
2.2 Data processing based on your consent (Article 6(1)(a) of the GDPR)
Where we have obtained your consent to the processing of personal data for specific purposes, the processing is lawful on this basis. Consent that has been given may be withdrawn at any time with effect for the future. This also applies to the withdrawal of declarations of consent that you gave us prior to the GDPR coming into force on 25 May 2018. The withdrawal of consent takes effect from the timeof withdrawal and does not affect the lawfulness of the processing of data carried out prior to the withdrawal.
2.3 Data processing based on legitimate interests (Article 6(1), first sentence et seq. of the GDPR)
We also process your data in a lawful manner to pursue our legitimate interests.
This includes the use of your personal data to
carry out advertising, provided you have not objected to the use of your data;
carry out measures to improve and develop services and/or products, so that we can offer you a personalised approach with bespoke offers and products;
carry out market and opinion research, or have such research carried out by market and opinion research organisations. This enables us to gain an overview of the transparency and quality of our products, services and communications, and to tailor and design these in the best interests of our customers;
to consult with and exchange data with credit reference agencies (e.g. Schufa, Creditreform) to assess creditworthiness and the risk of payment default, in particular where the conditions set out in Section 31 of the Federal Data Protection Act (BDSG) are met;
to assert legal claims and to defend ourselves against third-party claims in the event of legal disputes;
to use your data in anonymised form for analytical purposes;
to ensure IT security and the ongoing operation of IT systems;
where necessary, to implement measures relating to building and facility security (e.g. access controls).
Should we wish to process your personal data for a purpose not previously mentioned, we will inform you of this in advance in accordance with the statutory provisions.
2.4 Data processing based on legal requirements (Article 6(1)(c) of the GDPR)
Our company is subject to various legal obligations (e.g. tax laws, the German Commercial Code) which require the processing of your data. These processing purposes include, in particular, measures to fulfil tax-related audit and reporting obligations, as well as to assess and manage risks relevant to the company.
3. Transfer of data to third countries and international organisations
Within our company, only those departments that require your data to fulfil the purposes mentioned above (see above) are granted access to it. This also applies to third parties commissioned by us. Processors engaged by us in accordance with Article 28 of the GDPR may also receive data for the purposes described in this privacy notice. These are primarily companies operating in the fields of IT services, logistics, printing services, telecommunications, debt collection, advisory and consultancy services, and, where applicable, sales and marketing. We will only transfer personal data to third parties if this is necessary for the aforementioned purposes or if you have given your prior consent.
Your data may, in some cases, also be processed outside the European Union (EU) or the European Economic Area (EEA) in the course of providing IT services. This will only take place where an adequate level of protection is guaranteed for the processing in question. The adequate level of protection is determined in each individual case by:
an adequacy decision by the European Commission pursuant to Article 45 of the GDPR;
binding internal data protection rules pursuant to Article 47 in conjunction with Article 46(2)(b) of the GDPR;
standard data protection clauses pursuant to Article 46(2)(c) and (d) of the GDPR;
approved codes of conduct pursuant to Article 46(2)(e) in conjunction with Article 40 of the GDPR;
approved certification mechanisms pursuant to Article 46(2)(f) in conjunction with Article 42 of the GDPR;
contractual clauses authorised by the data protection supervisory authority in accordance with Article 46(3)(a) of the GDPR;
an exception for a specific case pursuant to Article 49(1) of the GDPR;
an exception for an individual case pursuant to Article 49(1), second subparagraph, of the GDPR.
There are no plans to transfer data to international organisations.
4. Retention period for personal data
We store your personal data for the purposes set out above. Your data will be processed from the time of collection, insofar as you or a third party provide it to us. We will erase your personal data once the legal relationship with you on which the data processing is based has ended, all mutual claims, if any, have been settled, and there are no other statutory retention obligations or legal grounds justifying the storage of such data. These include, amongst other things, retention obligations under the German Commercial Code (HGB) and the German Fiscal Code (AO). This means that we will delete your personal data at the latest upon expiry of the statutory retention obligations, which is usually 10 years after the end of the contract. Insofar as there are no other legal grounds for retention, the data will be deleted as soon as the purpose of processing ceases to apply. Finally, the retention period is also determined by the relevant statutory limitation periods in each individual case, as assessed as part of our balancing of interests; these may, for example, under Sections 195 et seq. of the German Civil Code (BGB), which are generally three years but may, in certain cases, extend up to 30 years.
5. Your rights
If you have any questions or complaints regarding data protection, please feel free to contact us (Rexim Lebensmittel- produktion KG, Wittenberger Weg 9, 24941 Flensburg, contact: info(at)rexim-lebensmittel.de).
You have the right to access your data under Article 15 of the GDPR, the right to rectification under Article 16 of the GDPR, the right to erasure under Article 17 of the GDPR, the right to restriction of processing under Article 18 of the GDPR, and the right to data portability under Article 20 of the GDPR. The restrictions set out in Sections 34 and 35 of the German Federal Data Protection Act (BDSG) apply to the exercise of the right to access and the right to erasure. Furthermore, you have the right to lodge a complaint with a data protection supervisory authority (Article 77 of the GDPR in conjunction with Section 19 of the BDSG).
5.1 Right to object on a case-by-case basis
Where we process your data to safeguard our legitimate interests (see 2.3 above), you have the right to object to such processing at any time on grounds relating to your particular situation. This also includes the right to object to processing for marketing purposes. If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims.
5.2 Right to object to marketing
Insofar as we also process your personal data for the purpose of direct marketing, you have the right to object to this at any time. If you object to processing for marketing purposes, we will no longer process your personal data for these purposes.
5.3 Right to withdraw consent
Consent that has been given may be withdrawn at any time with effect for the future (see 2.2 above). Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of that consent prior to its withdrawal.
The objection or withdrawal may be made in any form, e.g. by post or by email.
6. Automated decision-making
No automated decision-making pursuant to Article 22 of the GDPR, including profiling, takes place for the purpose of establishing and conducting our business relationship.
7. Source of data
We process personal data that we receive from our customers in the course of our business relationship.
8. Changes
We will inform you of any changes to our privacy policy.
Last updated: June 2026