Privacy Information Processing of Data from Non-Members

IG Metall processes personal data of non-members for the following purposes:

• Communication between Non-Members and Us;
• Sending of informational materials;
• Subscription to publications;
• Invitations to events;
• Participation in educational events;
• Advising works council members;
• Advising representatives of the disability representative body;
• Performing statutory duties within the framework of corporate co-determination and advising members of the supervisory board;
• Communicating with individuals whose data is published by companies or organizations (e.g., in the case of managing directors, supervisory board members, works council chairs, or other company contacts; executive board members or other organizational contacts);
• Providing information from a company’s union representatives to all employees (including non-members) regarding IG Metall’s company-specific policies and information; and
• Management of business partners and financial processing of the corresponding legal transactions.

IG Metall collects and processes personal data in accordance with the principle of data minimization (Art. 5(1)(c) of the General Data Protection Regulation 2016/679 (“GDPR”)) only to the extent necessary to fulfill the respective purposes.

• For the purposes of communication, sending informational materials, and obtaining publications, the following data is processed:
• Name;
• Address information;
• Email address;
• Phone number (solely for the purpose of contacting you); and
• Other personal data that you provide to us in the course of our communication.
• For the purpose of sending invitations to events—where applicable in individual cases—we also process job titles (e.g., managing director, works council chairperson, member of the Bundestag, official of another labor union) in addition to the data listed above.

In addition to the data mentioned above, the address information of the participants’ workplace is also processed for participants in educational events, provided that these are events for which the employer is required to reimburse costs pursuant to Section 37(6) of the Works Constitution Act (BetrVG). In this case, bank details are also processed to collect event fees via direct debit.

• For the purpose of providing advice, in addition to your name and contact information, we process the fact that you are a works council member or a member of the representative body for severely disabled employees.
• To carry out our union responsibilities in corporate co-determination in accordance with the relevant co-determination laws, we process the names and contact information of supervisory board members in companies within our organizational scope.
  We offer elected members of the supervisory board—even if they are not yet members of IG Metall—the opportunity for training and consultation.
  As part of our legal and union policy activities, we use pseudonymized data to compile internal statistics on the amount of supervisory board compensation, compensation criteria, and compliance with the quota for women.
• For the purpose of communicating with individuals whose personal data has been published by companies or organizations, job titles (e.g., managing director, works council chairperson, board member) may also be stored in addition to the data mentioned above.
• In connection with the work of union representatives, personal data that is publicly available within the company (i.e., data accessible to every employee of the company) is processed.
• In connection with the management of business partners and the processing of related transactions, the following data is processed—where applicable in individual cases—company addresses, shipping addresses, billing addresses, contact person addresses (including corresponding email addresses, phone numbers, and job titles), as well as accounts payable and accounts receivable data.

The legal bases for processing the personal data listed under Section 4 of this Privacy Notice are:

• the consent of the data subject (Art. 6(1)(a) GDPR), in cases involving the ordering of informational materials, the purchase of publications, initial contact, or invitations to events.
• the existence of a contract whose performance requires the processing of personal data, or the initiation of a contract (Article 6(1)(b) of the GDPR), insofar as this relates to the management and handling of business relationships (including consultations, audits, and training events) and the purchase of publications.
• IG Metall’s legitimate interest in processing personal data (Art. 6(1)(f) GDPR), provided that the data consists of public or company-related personal data in connection with the work of union representatives.
• If you inform us that you belong to another union and/or a political party and are in regular contact with us, Article 9(2)(d) of the GDPR applies, as the processing takes place within the scope of our legitimate activities and provided that the processing relates exclusively to you as a person who maintains regular contact with us in connection with the purpose of our activities and is carried out only internally.
• the consent of the data subject who is a member of another labor union and/or political party (Art. 6(1), subpara. 1(a) in conjunction with Art. 9(2)(a) of the GDPR), provided that the data processing is for the purposes listed in item 3 and the fact of trade union and/or political party membership is to be processed in this context and disclosed to third parties.

If you would like more information about our legitimate interests or the balancing of those interests against your own, please contact our Data Protection Officer (see above).

The provision of your personal data is not required by law or by our bylaws. You are therefore not obligated to provide us with your data. However, we cannot provide you with our services or transmit information to you as described in Section 3 if you do not provide us with your personal data.

The financial processing of legal transactions, however, requires the transmission of bank details to the relevant payment service provider. If you do not wish to have this data transmitted, please contact our Data Protection Officer so that we can discuss an alternative payment method.

Third-party companies assist us in providing our services, which requires the transfer of your personal data as part of their support activities. In addition, when organizing educational events, we may transfer your personal data to hotels or external educational providers to the extent necessary for your participation in the event. In all cases, we ensure that external service providers handle your data in compliance with the GDPR, for example by entering into data processing agreements. If you would like further information about specific recipients, please contact our Data Protection Officer.

It is not possible to list the various retention periods individually in a reasonable format here. As a general rule, your personal data is stored only for as long as necessary to achieve the purposes listed above (e.g., for the duration of the business relationship). In addition, the following criteria, among others, apply when determining the respective retention period in specific individual cases:

• To the extent that we require the personal data in connection with anticipated legal disputes, it will be stored until the final resolution of the legal dispute or until the expiration of the statute of limitations for the relevant claims (typically three years).
• To the extent that we require the data for accounting purposes, the retention period is governed by the statutory regulations for the retention of documents; the retention period is generally between six and ten years.

As a rule, we receive your personal data from you (or from a team member, such as your assistant). In isolated cases, we also obtain your contact information from public sources (e.g., the Internet).

Data subjects whose personal data is being processed are entitled to the following rights under Articles 15 through 22 of the GDPR, provided the legal requirements are met:

• Right of access, i.e., the right to receive confirmation from IG Metall as to whether personal data concerning the requesting individual is being processed and, if so, to receive information about such data and other relevant details;
• The right to have inaccurate personal data concerning you corrected;
• Right to erasure, for example, if the personal data is no longer necessary for the purposes for which it was processed;
• Right to restriction of processing;
• The right to data portability, i.e., the right to receive the personal data concerning you that you have provided to us in a specific format; and
• The right to object to data processing in certain cases for reasons arising from your particular situation, or at any time in the case of direct marketing.

Right to Withdraw Your Consent

If you have given us your consent to process your personal data, you may freely withdraw this consent at any time. However, this does not affect the lawfulness of the processing carried out on the basis of your consent prior to its withdrawal. If you withdraw your consent or effectively object to further processing based on your consent, the data will no longer be processed for these purposes.

The exercise of your rights may be limited in individual cases due to legal restrictions, particularly in cases where processing is necessary (see Art. 17(3) GDPR), where

retention obligations or if the effort involved is disproportionately high (see Section 34(1) and (4), Section 35 of the Federal Data Protection Act (BDSG)), or in the case of an overriding public interest (see Section 36 BDSG).

If you have any questions regarding your rights and/or their limitations, or if you wish to exercise your rights as a data subject, please contact our Data Protection Officer.

If you believe that the processing of your personal data is not lawful, you have the right under Article 77 of the GDPR to lodge a complaint with a competent supervisory authority, in particular in the Member State of your habitual residence, your place of work, or the place where the alleged infringement occurred. The address of the supervisory authority responsible for IG Metall is: The Hessian Data Protection Commissioner, Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Tel.: 0611 1408-0.