A disclosure of your personal data occurs in the following cases:
• Personal data will be disclosed to criminal prosecution authorities as well as, if necessary, harmed third parties if necessary to investigate illegal or abusive use of our services. However, this only occurs if there are specific indications of illegal use or misuse. A disclosure can also take place if this serves to enforce the terms and conditions for the use of our services or other agreements or, if necessary, to assert, exercise or defend legal claims. Our legitimate interest for the processing is safeguarding the proper functioning of our website and to assert, exercise or defend legal claims, as the case may be. We are also required by law to provide information to certain governmental agencies. These are the criminal prosecution authorities, public authorities that prosecute administrative misdemeanors sanctioned with fines, and the tax authorities. Our legitimate interest for the processing is to prevent misuse, prosecute criminal offenses and to assert, exercise or defend legal claims, as the case may be (e.g. Art. 6 para. 1 f) GDPR).
• For the fulfilment of our services we must rely on third party companies and external service providers under contractual relationships (“processor”). Categories of such processors can be agencies, fulfilment-service provides, IT-Service providers, etc.
In such situations, information will be disclosed to these companies or individuals in order to enable further processing. We carefully select these external service providers and regularly examine them in order to make sure that your privacy is safeguarded. Processors are only allowed to use the data for the purposes determined by us. They are also obligated under contracts with us to treat your data exclusively in accordance with this data protection statement as well as the European and United Kingdom laws on data protection.
Within the framework of potential transfers described above, it might occur that the third party bound by instructions might process the data in states outside the EU (“third countries”).
• Every disclosure of data to a party outside the EU is carried out in compliance with applicable data protection laws. To the extent the EU-Commission has not declared that a third country provides an adequate level of data protection, we will provide sufficient guarantees to establish an adequate protection of your data. For this purpose a contract with the processor might be concluded that incorporates the EU Standard Contract Clauses (http://ec.europa.eu/justice/data-protection/international-transfers/transfer/index_en.htm).
• During the course of the further development of our business, it is possible that the structure of Henkel Limited will change by changing the legal form, establishing, purchasing or selling subsidiaries, company divisions or parts of the company. In case of such transactions, the customer information is passed on together with the part of the business which is transferred. To this extent, we make sure that each disclosure of personal data to third parties is carried out in accordance with this data protection statement and applicable data protection laws. Such a transfer of personal data can be justified by a legitimate interest in adapting the structure of our company to economic and legal circumstances if required (Art. 6 para. 1 f) GDPR).
