Information on data processing - Self-assessment application

In accordance with Article 13 of the General Data Protection Regulation (GDPR), we would like to inform you below which personal data we process on this website, for what purposes and on what legal basis we do so.

1. Responsible for data protection

The CBR Fashion Group company to which your application is addressed:

• Street One GmbH, Imkerstraße 4, 30916 Isernhagen, Germany
• Street One Studio GmbH, Imkerstraße 4, 30916 Isernhagen, Germany
• Street One Men GmbH, Imkerstraße 4, 30916 Isernhagen, Germany
• Cecil GmbH, Sattlerstraße 10, 30916 Isernhagen, Germany

is responsible for the data collection and processing described below.

2. Scope of data processing

2.1 Data processing during visits to the website

2.1.1 Device and access data

The following technical data is collected by the web server when you visit the Self-Assessment-Application: The IP address of the device from which the website is being accessed, the user-agent of the browser used to access the website, the URL of the website accessed, the HTTP status code returned in response to the request. the size of the response returned by the server to the client. the referrer of the web page from which the current web page was accessed, the timestamp at which the request was processed. the time taken to process the request.

The processing is carried out in the legitimate interest of providing the content of the website and ensuring a device- and browser-optimized display. The legal basis for the processing is therefore Art. 6 (1) lit. f) GDPR.

2.1.2 Cookies

We use cookies, small text files that your browser stores on your computer or smartphone and that can be read. We only use cookies that are strictly necessary for the website to function. The duration of the cookies is limited to the respective session, i.e.they are deleted as soon as you close your browser. The legal basis for the processing is therefore Art. 6 (1) lit. f) GDPR.

We use the following cookies when the page is accessed:

2.2 Data processing for inquiries

As part of the application process, we require you to provide the information marked as mandatory fields on our application form. This includes in particular contact details of responsible (contact) persons (e.g. names, positions, email addresses, phone numbers) as well as company-related information.

The legal basis for processing this data is Article 6 (1)lit. b) GDPR, as the data is necessary for the decision on whether to enter into an agency-/ supplier relationship.

In addition, you may decide for yourself whether to provide us with further information that is marked as non-mandatory on the self-assessment-application. The provision of this data is voluntary and is not mandatory for the application. If you voluntarily provide us with personal data, we will process this data on the basis of your consent, which may be withdrawn at any time, in accordance with Article 6(1) lit. (a) GDPR. You may withdraw your consent at any time with future effect. To do so, please contact info@cbr.de.

If an agreement is concluded following the application process, we will store the data from your application for the purposes of supplier management, compliance monitoring, risk assessment, audit coordination, and related operational processes. The legal basis for this processing is Article 6 (1) lit.b) GDPR. If your application is unsuccessful, we storage of the data based on Article 6 (1) lit.f) GDPR (our legitimate interest to document the assessment and decision for further inquiries).

3. Transfer of personal data

We transfer your data to third parties who support us in the operation of the website and the associated processes. The transfer takes place exclusively within the framework of strictly instruction-bound order processing in accordance with Art. 28 GDPR.

We use the Microsoft Azure Cloud from the service provider Microsoft Ireland Operations Limited (One Microsoft Place, South County Business Park Leopardstown, Dublin 18, D18 P521, Ireland) to host our website. Data processing takes place exclusively within the EEA.

In addition, personal data (in particular contact details such as names, positions, email addresses, and phone numbers) may be shared with selected external partners where necessary for compliance and supplier management processes.

This includes in particular:

• Elevate Hong Kong Holdings Limited, 16/F Cambridge House, 979 King's Road, Quarry Bay, Hong Kong SAR, China, for the purpose of initiating and managing audits, as well as corrective action plan (CAP) management and follow-up activities
• Swin Technologies AB (TrustTrace-TT), Torsgatan 30, 11321 Stockholm, SwedenTrusTrace (TT), for the purpose of inviting relevant contact persons to the platform and enabling participation in traceability processes

4. Your rights as a user

When processing your personal data, the GDPR grants you the following rights as a data subject

Right of access (Art. 15 GDPR):

You have the right to request confirmation as to whether personal data concerning you is being processed; if this is the case, you have a right of access to this personal data and to the information listed in detail in Art. 15 GDPR.

Right to rectification and erasure (Art. 16 and 17 GDPR):

You have the right to obtain without undue delay the rectification of inaccurate personal data concerning you and, where applicable, the completion of incomplete personal data. You also have the right to demand that personal data concerning you be deleted immediately if one of the reasons listed in Art. 17 GDPR applies, e.g. if the data is no longer required for the purposes pursued.

Right to restriction of processing (Art. 18 GDPR):

You have the right to request the restriction of processing if one of the conditions listed in Art. 18 GDPR applies, e.g. if you have objected to processing, for the duration of any review.

Right to data portability (Art. 20 GDPR):

In certain cases, which are listed in detail in Art. 20 GDPR, you have the right to receive the personal data concerning you in a structured, commonly used and machine-readable format or to request the transmission of this data to a third party.

Right to object (Art. 21 GDPR):

If data is collected on the basis of Art. 6 para. 1 lit. f (data processing to safeguard legitimate interests), you have the right to object to the processing at any time for reasons arising from your particular situation. We will then no longer process the personal data unless there are demonstrably compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or the processing serves the establishment, exercise or defense of legal claims.

Right to lodge a complaint with a supervisory authority:

In accordance with Art. 77 GDPR, you have the right to lodge a complaint with a supervisory authority if you believe that the processing of data concerning you infringes data protection regulations. The right to lodge a complaint can be asserted in particular with a supervisory authority in the Member State of your habitual residence, place of work or place of the alleged infringement.

5. Contact details of the company data protection officer

Our external data protection officer can be reached as follows: datenschutz nord GmbH, Sechlingspforte 2, 22087 Hamburg, Germany, e-mail: office@datenschutz-nord.de.