Data protection for commercial providers
Entrepreneurs processing personal data relating to interested parties, customers, employees or other people must comply with the General Data Protection Regulation (GDPR) and, where applicable, other data protection rules.
This also applies to personal data a commercial provider receives in connection with an advertisement or contact made through Suchen.Expert.
Suchen.Expert is used to publish advertisements, facilitate contact and enable communication between users. Using the platform does not entitle a commercial provider to use personal data received without limitation or for any other purpose they choose.
1. What is personal data?
Personal data is information relating to an identified or identifiable natural person.
This may include, for example:
name and address,
telephone number and email address,
messages and communication content,
delivery and invoice details,
payment information,
user identifiers,
photographs or other information through which a person can be identified.
The GDPR generally protects data relating to natural persons. Information about a legal person as such does not automatically fall within its scope. However, data relating to individual contacts at a business, such as an employee's name, business email address or telephone number, may constitute personal data.
2. Personal data requires a legal basis
Personal data must not be processed simply because it is technically available.
Under Article 6 GDPR, processing is lawful only where a legal basis exists. Possible bases include in particular:
the data subject's consent,
processing for the performance of a contract or pre-contractual measures,
compliance with a legal obligation, or
pursuit of legitimate interests, provided these are not overridden by the data subject's interests or rights.
Where an interested party makes an enquiry, processing the data necessary to respond and, where applicable, for a subsequent contract may be based in particular on Article 6(1)(b) GDPR, provided the statutory conditions are met.
3. Data obtained from contact through Suchen.Expert
If a user contacts a commercial provider through Suchen.Expert, the data received may in particular be processed to handle that enquiry and, insofar as necessary, to initiate and carry out the transaction concerned.
Example:
An interested party asks a commercial provider about an offered product through Suchen.Expert. The provider may use the contact details necessary to answer the enquiry and potentially perform a contract.
However, making contact does not automatically mean that the interested party has consented to further use of their data.
In particular, contact details must not be reused for other purposes, passed on or added to marketing mailing lists without a separate legal basis.
The GDPR requires, among other things, purpose limitation and data minimisation: data may be processed for specified and legitimate purposes and must remain limited to what is necessary for those purposes.
4. No automatic consent to advertising
In particular, an enquiry through Suchen.Expert does not constitute general consent to advertising.
For example, someone who receives an email address to answer a specific enquiry or perform a contract may not subsequently use that address freely for newsletters or other advertising messages solely for that reason.
§ 7 UWG generally requires prior express consent for advertising by electronic mail. A limited exception exists under the conditions of § 7(3) UWG for advertising to existing customers for the business's own similar goods or services. All conditions specified there must be met.
The lawfulness of processing under data protection law must also be considered separately.
5. Collect only necessary data
Entrepreneurs should request only personal data they actually need for the relevant purpose.
For example, copies of identity documents, bank documents or other particularly extensive personal information are generally unnecessary for a simple enquiry.
The principle of data minimisation under Article 5 GDPR requires personal data to be adequate, relevant and limited to what is necessary for the purpose.
Particular care is needed with sensitive information. In particular, data should not be published publicly in an advertisement or business profile where there is no need and no sufficient legal basis.
6. The entrepreneur's privacy information
Entrepreneurs collecting and processing personal data themselves must check which information obligations they must fulfil towards data subjects.
Where personal data is collected directly from the data subject, Article 13 GDPR sets out corresponding information obligations. These include in particular information about the controller, the purposes and legal bases of processing, and other legally required details.
Where personal data is not collected directly from the data subject, Article 14 GDPR may apply.
Commercial providers should therefore check whether they need their own privacy policy or privacy information for their own data processing.
Suchen.Expert's privacy policy does not automatically replace the entrepreneur's privacy information for their own processing of personal data.
7. Responsibility of Suchen.Expert and the entrepreneur
Suchen.Expert processes personal data in connection with operating the platform in accordance with the data protection provisions applicable to Suchen.Expert.
This must be distinguished from a commercial provider's own processing of personal data.
If the entrepreneur independently decides for which purposes of their own and in what manner to process customer data received, they may themselves be the controller for that processing within the meaning of the GDPR. Under Article 4(7) GDPR, the controller is generally the entity that, alone or jointly with others, determines the purposes and means of processing.
Merely using Suchen.Expert therefore does not automatically mean that Suchen.Expert is the commercial user's processor or that the commercial user is Suchen.Expert's processor.
The role under data protection law depends on the specific processing and the actual tasks of those involved.
8. Sharing customer data
Personal data may be shared only where a sufficient legal basis exists.
When performing a contract, for example, transmitting certain necessary data to a shipping service provider may be required so that the ordered goods can be delivered.
Sharing data with tax advisers, payment service providers or other service providers may also be lawful depending on the purpose and legal arrangement.
However, the recipient's role under data protection law must be checked.
If an external service provider processes personal data solely on behalf of the entrepreneur, a processor relationship under Article 28 GDPR may exist. In that case, a corresponding contract or other legal instrument meeting the requirements of Article 28 GDPR is generally necessary.
However, not every external service provider is automatically a processor.
9. Storage and erasure
Personal data generally must not be stored indefinitely.
Article 5 GDPR requires storage to be limited to the period necessary for the relevant processing purposes.
However, this does not mean that all customer data must be deleted immediately after a transaction is completed.
Statutory retention obligations, for example for invoices, accounting vouchers or business records, may require certain data to be retained longer.
Entrepreneurs should therefore distinguish between:
data still needed to fulfil statutory retention obligations, and
data for which no purpose or legal basis for further storage remains.
Personal data that is no longer needed should be deleted or, where appropriate, its processing restricted in accordance with statutory requirements.
10. Secure processing
Entrepreneurs must adequately protect personal data against loss, unauthorised use and unauthorised access.
Article 32 GDPR requires appropriate technical and organisational measures, taking particular account of the risk, the state of the art and the nature of the processing. Depending on the specific risk, these may include encryption, access restrictions, backups and procedures for regularly reviewing security measures.
For the use of Suchen.Expert, this means in particular that commercial users should protect their login details and allow only authorised people to access their business account.
If personal information from Suchen.Expert is exported or transferred to the entrepreneur's own systems, an appropriate level of protection must also be ensured there.
11. Access rights within the business
Not every employee in a business should automatically have access to all customer data.
Access should be based on the data a person needs for their particular task.
If an employee leaves or no longer needs access, their permissions should be reviewed immediately and revoked where necessary.
Passwords or personal user access should not be shared among multiple people without control.
12. Rights of data subjects
People whose data is processed have various rights under the GDPR.
Subject to the respective statutory conditions, these include in particular rights of access, rectification, erasure, restriction of processing and data portability, and a right to object to certain processing.
A commercial provider must handle requests from data subjects in accordance with statutory requirements insofar as they are responsible for the processing concerned.
It must first be established whether the request relates to processing by the entrepreneur or by Suchen.Expert itself.
13. Personal data breaches
If personal data is lost, accidentally sent to the wrong recipient or accessed by unauthorised persons, a personal data breach may have occurred.
If a risk to the rights and freedoms of natural persons is likely, the controller must generally notify the competent supervisory authority of the breach without undue delay and, where feasible, within 72 hours of becoming aware of it. Article 33 GDPR contains the statutory requirements in this respect.
If a high risk to the rights and freedoms of affected individuals is likely, prompt notification of those individuals may also be required.
Personal data breaches must also be documented in accordance with Article 33(5) GDPR.
14. Your own service providers and software
Entrepreneurs who additionally use their own
cloud services, CRM systems, newsletter services, accounting software, analytics programs, communication services or other external systems
for customer data must independently assess that processing under data protection law.
The following may be relevant in particular:
the legal basis, processing on behalf of a controller, technical and organisational measures, retention periods and, where applicable, transfers outside the European Economic Area.
The fact that data was originally obtained through Suchen.Expert does not release the entrepreneur from these obligations.
15. No publication of customer data
Personal data relating to interested parties or customers generally must not be published publicly in advertisements, reviews, business profiles or other publicly accessible areas without a sufficient legal basis.
This concerns in particular:
names, private addresses, telephone numbers, email addresses, photographs, message histories and payment or contract information.
Screenshots of communications may also contain personal data.
For example, anyone wishing to publish a positive customer message as a reference or testimonial must first check whether a sufficient legal basis exists.
Data protection on Suchen.Expert
Suchen.Expert provides the technical platform for advertisements, contact facilitation and communication.
Suchen.Expert's privacy information applies to processing that Suchen.Expert itself carries out in connection with operating the platform.
By contrast, if a commercial user processes personal data for their own business purposes, they are responsible for complying with the applicable data protection requirements insofar as they are the controller of that processing.
In particular, contact details obtained through Suchen.Expert must not be used for advertising, external mailing lists, publication or other new purposes solely because the user concerned previously made contact through the platform.
This guidance provides general orientation and does not replace a data protection assessment of a business's specific processing activities.
