Privacy
Privacy Notice for Business Contacts
Last updated: 9 September 2026
This is a translation for convenience. In case of any discrepancy, the German version at /de/legal/datenschutz-geschaeftskontakte prevails.
1. Who we are
ASD Pharma- und Kosmetikgroßhandel GmbH
Ludmillastraße 15, 94315 Straubing, Germany
Phone +49 30 8268081 · info@asdpharma.de
Managing Director: Stephan Dräxlmaier
Local court of Straubing, HRB 13598 · VAT ID DE369210556
For data protection questions and to exercise your rights: datenschutz@asdpharma.de
2. What this is about
We maintain a database of our business contacts. It records which companies we are in business contact with or would like to be, who our contact persons there are, and which documents and messages belong to that exchange. We process your data solely in your professional capacity, not as a private individual.
3. What data we process
- About your company: name and legal name, address, country, website, VAT identification number, register details, business area, brands and product groups, our internal notes on the course of business.
- About you: first and last name, position in the company, business email address, business phone and mobile number, business messenger contact where applicable, your professional LinkedIn profile, language of correspondence, preferred means of contact.
- About our exchange: date and type of contact, subject and content of business messages, notes of conversations, documents exchanged such as enquiries, price lists, offers, orders, contracts, invoices and logistics papers, including the information they contain.
We do not process special categories of personal data within the meaning of Article 9 GDPR here — such as health data or information on political, religious or trade union beliefs.
4. Where the data comes from
We obtain the data
- from you directly, for example from your email, your business card, a conversation at a trade fair or a form,
- from your company's website,
- from your professional LinkedIn profile,
- from public industry, trade fair and company directories,
- from public registers, such as the commercial register,
- from business correspondence in which you are named as a contact person,
- occasionally from a referral by a mutual business partner.
Where we have not obtained your data from you directly, we hereby inform you in accordance with Article 14 GDPR. As a rule this concerns publicly available professional contact details.
5. Why we process the data and on what legal basis
| Purpose | Legal basis |
|---|---|
| Building and maintaining our business contacts, initiating and handling business relationships in purchasing, sales and business development | Article 6(1)(f) GDPR — legitimate interest in maintaining and initiating business relationships |
| Performance of a contract where you are a party to it yourself, for example as a sole trader | Article 6(1)(b) GDPR |
| Communication and contract handling with contact persons of a company that is or is to become a party to a contract | Article 6(1)(f) GDPR |
| Proper retention of commercial and business letters and accounting records | Article 6(1)(c) GDPR in conjunction with § 257 HGB and § 147 AO |
| Promotional contact by email | only where the requirements of § 7 UWG are met; otherwise only with your consent under Article 6(1)(a) GDPR |
| Security and traceability of operations, backup and restore | Article 6(1)(f) GDPR |
Our legitimate interest lies in keeping business contacts in a traceable way, finding contact persons again, and assigning documents to the correct matter. We have weighed this interest against your interests, taking into account that the data are professional contact details, that you must expect to be approached in your professional role, and that we do not create profiles and do not take automated decisions. We will provide you with this assessment on request.
6. Who receives the data
We do not pass your data on to third parties for their own purposes. The following service providers work for us and on our instructions in accordance with Article 28 GDPR:
- Supabase — operation of the database, file storage and authentication.
- Vercel Inc. — operation of the application.
The database, file storage and the application are operated for ASD in Frankfurt am Main. In the course of support, security operations and the use of sub-processors, personal data may also be processed outside the European Economic Area. For this purpose, Supabase and Vercel provide in particular for the European Commission's standard contractual clauses in their data processing agreements. We will provide further information on the sub-processors used and on the safeguards in place on request.
Beyond this, we disclose data where we are legally obliged to do so, for example to tax authorities.
7. How long we store the data
- Ongoing business relationship: for its duration.
- Business contacts without an active business relationship: we review the data regularly and delete contacts with whom there has been no contact for two years, and companies with no contact for three years.
- Statutory retention under § 257 HGB and § 147 AO, counted from the end of the respective calendar year: commercial and business letters as a rule six years, accounting vouchers as a rule eight years, and certain books, records and financial statements ten years. Longer retention remains possible where documents are required for tax or legal proceedings that have not yet been concluded.
- After an objection: we delete your data without delay. We retain only the minimum needed to avoid recording you again and to evidence the objection.
8. Your rights
You have the right of access (Article 15), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18) and data portability (Article 20, where applicable).
Right to object (Article 21 GDPR): you have the right to object at any time, on grounds relating to your particular situation, to processing of your data based on Article 6(1)(f) GDPR. Where we process your data for direct marketing, you may object at any time and without giving reasons; we will then no longer process your data for that purpose.
Where you have given consent, you may withdraw it at any time with effect for the future.
A message to datenschutz@asdpharma.de is sufficient.
You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, PO Box 1349, 91504 Ansbach, poststelle@lda.bayern.de.
9. No automated decision-making
We do not take decisions based solely on automated processing within the meaning of Article 22 GDPR, and we do not create profiles.
10. Is providing the data required?
You are not obliged to provide us with data. Without business contact details, however, we cannot approach you or exchange offers.