PART A

 I.         Name and Address of the Controller

The website is operated by DIHK and DIHK DEinternational GmbH, both located at Breite Straße 29, 10178 Berlin, as joint controllers for specific topics together with

Southern African-German Chamber of Commerce and Industry (hereinafter referred to as "AHK Southern Africa")
Oxford Road, Forest Town, 2193
Johannesburg, South Africa
Tel.: +27 (0)11 486 2775
gfrayne@germanchamber.co.za

We will be happy to provide you with excerpts from the joint controller agreement. Please contact ahk@ahk.de.

Processing operations for which the AHK Southern Africa is solely responsible are described below in Part B. 

   II.         EU Representative

As AHK Southern Africa is not based in the EU, it has appointed DIHK, Breite Straße 29, 10178 Berlin, as its EU representative in accordance with Art. 27 of the General Data Protection Regulation ("GDPR").

 III.         Name and Address of the Data Protection Officer

The data protection officer of the controller is:

Gavin Frayne
gfrayne@germanchamber.co.za

 IV.         Provision of the Website and Creation of Server Log Files

1.     Data Categories and Description of Data Processing

The following data is processed each time our website is accessed:

• IP address;
• Date and time of access;
• Time zone difference to Greenwich Mean Time (GMT);
• Specific website accessed;
• Access status/HTTP status code;
• Amount of data transferred in each case;
• Website from which you came;
• Browser;
• Operating system and its interface;
• Language and version of the browser software;
• Internet service provider (collectively referred to as "server log files").

2.     Legal Basis and Purpose of Data Processing

The legal basis for the processing of your personal data when you use our website are the public tasks assigned to us is, Art. 6 (1) (e), (3) GDPR in conjunction with Section 10a IHKG, in particular the representation of the overall interests of associated businesses in the Federal Republic of Germany at national, European, and international level, the promotion of the economy, and the coordination and promotion of the AHK network, including delegate offices as well as representative offices, and the promotion of foreign trade of the Federal Republic of Germany. To promote this purpose, a functional website is provided, and the associated processing of personal data takes place.

3.     Data Retention

Server log files are deleted after seven days at the latest.

In the event of an error, logs are also generated, which are then stored for a period of 30 days for error analysis as well as problem tracking and are then deleted.

4.     Data Recipients

The server log files are accessible to those employees of the controller who are responsible for maintaining the website. In this context, employees of DIHK DEinternational GmbH may receive access to your personal data. For this reason,  AHK Southern Africa, DIHK, and DIHK DEinternational GmbH have concluded a data protection group agreement that regulates the processing and transfer of personal data within the AHK network.

We also use third-party services on our website. For more information about these services and the associated data processing, please visit [ Part B] and the cookie settings.

   V.         Website Analysis with PIWIK Pro Analytics Suite

1.     Data Categories and Description of Data Processing

We use Piwik PRO Analytics Suite as our website analysis software. We collect data about website visitors in the form of server log files and cookies. For an overview of the cookies placed in this context, please refer to the following link: https://help.piwik.pro/support/privacy/cookies-created-for-piwik-pro-users/. For a description of the server log files, please refer to Section IV.1 

2.     Legal Basis and Purpose of Data Processing

The purpose of using PIWIK PRO Analytics Suite is to track certain usage patterns, such as bounce rate, page views, and session duration, to understand how our website is used. We may also create visitor profiles based on browsing history to analyze visitor behavior, display personalized content, and conduct online campaigns. The legal basis for analytics and conversion tracking is your consent pursuant to Art. 6 (1) (a) GDPR.

3.     Data Retention

If you have provided us with your consent for analytics and conversion tracking, we will retain your personal data for a period of 25 months and then delete it thereafter, unless you withdraw your consent; in this case, we will no longer retain any personal data once we have received your withdrawal. Your withdrawal only takes effect for the future and has no effect on the previous processing of your data up to the time of your withdrawal.

4.     Recipients

The recipients of your personal data are employees of DIHK DEinternational GmbH and the AHK Southern Africa who are responsible for maintaining the website. In addition, it may happen (e.g., in troubleshooting cases) that employees of PIWIK PRO Analytics Suite, AHK Southern Africa, and DIHK DEInternational GmbH receive access to your personal data. PIWIK PRO Analytics Suite uses third-party providers, some of which are based in the USA, to provide its services, so it is possible that your personal data may be transferred to these third-party providers. For more information, please refer to the PIWIK PRO privacy policy.

 VI.         Use of Cookies

1.     Data Categories and Description of Data Processing

We use Piwik PRO to manage consent and collect personal data via cookies for this purpose. We also use cookies to make our website more user-friendly. Cookies are small text files that are placed on your computer. For an overview of the cookies placed in this context, please refer to the following link: https://help.piwik.pro/support/privacy/cookies-created-for-visitors-by-piwik-pro/. Some of the cookies we place are deleted from your device at the end of your browser session ("session cookies"). In addition, we also set permanent cookies that remain on your device to recognize you, for example, when you visit our website again.

If cookies are set, they process certain user information to an individual extent, as described in the link.

You can control the use of cookies at any time through your browser settings, which provide you the option of deleting or blocking cookies. However, this may result in the functionality of our website being restricted. We also use social media buttons on our website; for more information, please refer to Section VIII.

2.     Legal Basis and Purpose of Data Processing

The legal basis for the management of consent by PIWIK PRO is our legitimate interest of a legally compliant and usage-specific consent management pursuant to Art. 6 (1) (f) GDPR.

If personal data is processed through individual cookies placed by us, the processing is carried out on the following legal bases:

• Necessary cookies: The processing of personal data through necessary cookies is based on our legitimate interests pursuant to Art. 6 (1) (f) GDPR, as these cookies are necessary for the proper functioning of the website. The placing of cookies is also based on Section 25 (2) No. 2 TDDDG, according to which the storage of information on your device or access to information already stored on your device is absolutely necessary for us to provide a digital service that you have expressly requested – our website. 
• All other cookies: The placing of these cookies in accordance with Section 25 (1) TDDDG and the processing of personal data is based on your consent in accordance with Art. 6 (1) (a) GDPR. These cookies collect information about your use of our website, which we use to improve its functionality and your user experience.

3.     Data Retention

Data for consent management is stored for a period of 25 months.

You can find an overview of the cookies we place and their storage time at the following link: https://help.piwik.pro/support/privacy/cookies-created-for-visitors-by-piwik-pro/.

4.     Recipients

Your personal data will be accessed by those employees of the controller who are responsible for maintaining the website. In addition, it may happen (e.g., in troubleshooting cases) that employees of PIWIK PRO receive access to your personal data. Insofar as PIWIK PRO employees receive access to personal data, we implemented necessary arrangements to protect your personal data, in particular by concluding data processing agreements in accordance with Art. 28 GDPR, pursuant to which PIWIK PRO is obligated to maintain confidentiality.

VII.         Map Service

1.     Data Categories and Description of Data Processing

We have integrated the map service "OpenStreetMap" ("OSM") into our website. This is a service provided by the OpenStreetMap Foundation, based at St John's Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom, which is the controller for OSM pursuant to Art. 4 No. 7 GDPR.

The map is displayed only after you have provided your consent. 

To display OSM, server log files are transmitted to the OpenStreetMap Foundation. For information on how your personal data is processed by the OpenStreetMap Foundation, please refer to the OpenStreetMap Foundation's privacy policy at https://osmfoundation.org/wiki/Privacy_Policy.

2.     Legal Basis and Purpose of Data Processing

The legal basis for the processing of your personal data is your consent in accordance with Art. 6 (1) (a) GDPR. The processing of your personal data serves to display a map for the purpose of location display and route planning.

3.     Data Retention

For information on processing and storage periods, please refer to: https://osmfoundation.org/wiki/Privacy_Policy

4.     Recipient

The OpenStreetMap Foundation is the recipient of your personal data.

VIII.         Automated Decision-Making and Profiling

Except for the processing described in section V, your personal data will not be processed by us for automated decision-making and/or profiling.

 IX.         Obligation to Provide Personal Data

You may choose not to provide us with your personal data or provide us with incomplete data. In such cases, for example, if you prevent the placing of cookies, this may mean that you are unable to use all the features of our website. If you wish to become a member and do not provide us with your personal data, we may not be able to process your membership application.

   X.         Data Subject Rights

You can contact AHK Southern Africa directly either in writing or by email gfrayne@germanchamber.co.za  to exercise the following rights:

• Information about your data to check and verify it
• Receive a copy of your personal data
• Correction, deletion, or restriction of processing; this also includes the right to complete incomplete or incorrect data by providing additional information,
• Right to object to the processing; please note that Art. 21 GDPR provides you the right to object to the processing of personal data we process on the basis of legitimate interests in accordance with Art. 6 (1) (f) GDPR. You have the right to object to the processing of your personal data for reasons arising from your particular situation; if the objection is directed against the processing of personal data for direct marketing purposes, you have a general right to object without the need to specify a particular situation.
• You can receive your provided personal data in a structured, commonly used, and machine-readable format and transmit this data to another controller, provided that the processing is based on your consent or on a contract.

If you have provided us with your consent to process your personal data, you can withdraw this consent at any time with effect for the future.

You also have the right to lodge a complaint with a supervisory authority in connection with the processing of your personal data. To exercise this right, you can contact the authority competent for your place of residence or the authority competent for AHK Southern Africa:

The supervisory authority competent for our EU representative is the Federal Commissioner for Data Protection and Freedom of Information, Graurheindorfer Str. 153, 53117 Bonn.

Part B

Local Data Protection Requirements and Special Forms of Processing:

I. Special Processing Forms:

1.  Newsletter

           i.         Data Categories and Description of Data Processing

On our website, you can subscribe to our free newsletter. We use this to keep you informed about our products and services, upcoming events, and current economic topics. If you sign up, we will process the following personal data:  

• Title,
• First name,
• Last name,
• Company Name
• Job Title
• Email address along with the date and time of registration

We use a double opt-in procedure for newsletter registrations. After you have registered, we will send a confirmation email to the address you provided, asking you to confirm your subscription to the newsletter. This procedure is designed to verify your registration and prevent the misuse of your personal data.

If you sign up for our newsletter [and provided us with your consent], we will evaluate your user behavior, particularly how our newsletters are opened and used. Specifically, we track:

• Whether and when you opened our newsletter,
• Which links are clicked,
• We analyze how you interact with the content of our newsletters (collectively referred to as 'newsletter tracking').

This is achieved with the help of a small, invisible image file or code embedded in our website or email. When you visit our website or open the newsletter, the file is downloaded from the server and your interaction with the newsletter is recorded. To evaluate this, we link server log files with the web beacon and your email address as well as add an individual ID.

 ii.         Legal Basis and Purpose of Data Processing

The legal basis for subscribing to and receiving our newsletter is your consent, in accordance with Art. 6(1)(a) of the GDPR. You can withdraw your consent to receive the newsletter at any time. To do so, click on the link at the end of the newsletter or send an email to [marketing@germanchamber.co.za]. Your email address is collected to inform you about AHK Southern Africa news as requested.

 iii.         Data Retention

We will process your personal data until you withdraw your consent. As part of our regular reviews (approximately every two years), we will periodically ask you whether you are still interested in receiving our newsletter. If you do not confirm your interest, we will stop sending you the newsletter. You can always subscribe to our newsletter again. 

 iv.         Recipients

In order to send you our newsletter, we use the services of external providers, some of whom are based outside the EU. In such cases, we enter into data processing agreements incorporating EU standard contractual clauses unless an adequacy decision exists. You can view the EU standard contractual clauses at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de.

We use personalized newsletter tracking to optimize our newsletter offering. In addition to the email address, we also record activities related to newsletter dispatch (e.g. click behavior).

v.         Right to Object and Right to Erasure

Users can unsubscribe from the newsletter at any time. There is a corresponding link for this purpose in every newsletter. Alternatively, you can send us an email marketing@germanchamber.co.za

2. Membership Registration

 i.         Data Categories and Description of Data Processing

We offer you the opportunity to apply for a membership on our website. To do so, we need to process the following information:

• Amount of the membership fee, which is based on the size of the company;
• Information about the company, such as company name, street, house number and postcode, city, email address, number of employees,
• Information about the applicant and the CEO/Managing Director/Owner, i.e. first name, last name, telephone number and email address.

The above data are mandatory fields in the form embedded into our website.

Server log files are also processed at the time of application.

ii.         Legal Basis and Purpose of Data Processing

The legal basis for processing data marked as mandatory fields is Article 6(1)(b) GDPR, i.e. processing is necessary for the implementation of pre-contractual measures, particularly the review of your membership application, which is carried out at your request. The legal basis for processing data that is not marked as mandatory and which you provide voluntarily is your consent in accordance with Art. 6(1)(a) GDPR. This information helps us to gain a more complete picture of your membership.

iii.         Data Retention

We retain the data marked as mandatory fields for as long as you maintain your membership application. You will receive a separate data protection information for members.

You can withdraw your consent at any time regarding the data you voluntarily provide to us. You can declare your withdrawal by email to members@germanchamber.co.za . We will retain your data until we receive a corresponding withdrawal.

iv.         Recipients

Your personal data will be accessed by those AHK Southern Africa employees who are responsible for processing membership applications. In addition, employees of other German Chambers of Commerce Abroad, employees of the DIHK as well as DIHK DEInternational GmbH (collectively referred to as the "AHK network") may also receive access to your personal data, as the AHK Southern Africa receives support from DIHK DEinternational GmbH and DIHK for central services such as controlling, accounting, office, process and quality management, as well as IT services. We have concluded an internal group data transfer and processing agreement with the AHK network for this purpose.

In this context, we may also use external service providers, some of whom are based outside the EU. In such cases, we enter into data processing agreements incorporating EU standard contractual clauses unless an adequacy decision exists. You can view the EU standard contractual clauses at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de.

3. Contact Form and Email Contact

 i.         Data Categories and Description of Data Processing

If you contact us via the contact form on our website, we will process the following information:

• Your full name;
• Your company name;
• Your email address; and
• A message. This data is marked as a mandatory field.

You can also provide the following information voluntarily:

• Your telephone number.

In addition to your personal data described here, we also process server log files (see IV.1) when you access our contact form.

As an alternative to using the contact form, you can contact us via the email address provided.

In this case, the personal data transmitted with the email will be processed.

ii.         Legal Basis and Purpose of Data Processing

The legal basis for the processing of your data marked as mandatory fields is your request to us in accordance with Art. 6 (1) (b) GDPR. The same applies to any contact you make with us by email.

The legal basis for data that is not marked as a mandatory field and that you provide to us voluntarily is your consent in accordance with Art. 6 (1) (a) GDPR. You can withdraw your consent at any time regarding the data you provide to us voluntarily. You can declare your withdrawal by email to members@germanchamber.co.za We will store your data until we receive a corresponding withdrawal.

We process your personal data to process and respond to your request.

iii.         Data Retention

Your personal data will be deleted as soon as your request has been answered conclusively. If you have given us your consent, we will process your data until you withdraw your consent, or your request has been answered conclusively.

iv.         Recipients

Your personal data will be accessed by those employees of the AHK Southern Africa and DIHK DEinternational GmbH who are responsible for responding to inquiries. In addition, employees of DIHK DEinternational GmbH and/or other AHKs may also receive access to your personal data. For this purpose, we have concluded an internal data transfer and processing agreement with the AHK network, which incorporates EU standard contractual clauses. You can view the EU standard contractual clauses at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de.

4.     Cookies

In addition to the Piwik cookies described in Part A, the following cookies are also placed by this local website:

Outlook: If you use features on our website that are provided by Microsoft Outlook or Microsoft 365, such as calendar bookings or embedded forms, this service is provided by Microsoft, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland and is embedded in our website. Microsoft sets the following cookies on your device:

The overview indicates that some cookies are deleted from your device at the end of your browser session. Furthermore, certain cookies are classified as "necessary cookies". These cookies are essential for the proper functioning and display of our website.

The legal basis for setting these cookies is your consent, as outlined in Art. 6 (1) (a) GDPR, except for necessary cookies, which may be set pursuant to Art. 6 (1) (f) GDPR based on our legitimate interest, as the functionality of the website is dependent on these cookies. The legal basis for the setting of the cookie is also outlined in Section 25 (2) No. 2 TDDDG, which stipulates that the storage of information on your device or access to information already stored on your device is essential for us to provide a digital service that you have explicitly requested – namely, our website. For more information on data processing by Microsoft, please refer to the Microsoft Privacy Statement: https://www.microsoft.com/en-gb/privacy/privacystatement

YouTube: Our website utilizes "YouTube" videos. This service is provided by Google Ireland Limited, with its registered office at Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter referred to as "YouTube"). When you visit our website, which contains an embedded YouTube video, YouTube will place cookies and similar technologies on your device to collect information about website visitors:

The overview indicates that some cookies are deleted from your device at the end of your browser session; these cookies are known as "session cookies." 

The legal basis for setting these cookies is your consent in accordance with Art. 6 (1) (a) GDPR. For more information on YouTube's data processing, please refer to Google's privacy policy: How Google uses cookies – Privacy Policy & Terms of Service – Google

5.     Social media buttons:

Our website contains social media buttons for the following social networks: 

 i.         LinkedIn

The social media button is operated by LinkedIn Ireland Unlimited Company (hereinafter referred to as "LinkedIn"), located at Wilton Place, Dublin 2, Ireland. When you click on the social media button, your browser connects to LinkedIn's servers. This process involved the transfer of your personal data to LinkedIn. If you are logged into your LinkedIn account while visiting our website, LinkedIn may assign this information to your personal LinkedIn account.  Information on the processing of your personal data by LinkedIn can be found in LinkedIn's privacy policy at www.linkedin.com/legal/privacy-policy . The legal basis for your use of the social media button is your consent in accordance with Art. 6 (1) (a) GDPR.

ii.         YouTube Videos

If we embed YouTube videos on our website, these videos are hosted on servers belonging to Google Ireland Limited, Gordon House, Barrow Street Dublin 4, Ireland. We have embedded the videos using the so-called "advanced privacy settings." This means that your personal data is not transferred directly to YouTube when you visit our website. Only when the video is actively clicked to play will personal data be transferred to YouTube in the form of server log files and cookie IDs. At this point, cookies will also be set by YouTube.  

This data is transferred regardless of whether you have a Google user account that you are logged into or not. If you are logged into a Google account while visiting our website, this data will be assigned to your account by Google. To ensure that this data is not assigned to your Google account, it is necessary to log out of your Google account before activating the video. For information on the processing of your personal data by YouTube, please refer to YouTube's privacy policy, which you can access here: Privacy Policy – Privacy Policy & Terms of Service – Google

6.     Support for Expansion Abroad – Appointment Booking Option at a local AHK Southern Africa

 i.         Data Categories and Description of Data Processing

If you have taken advantage of the "Support for Expansion Abroad" offer on the AHK.de website, entered your personal data there, and have now been redirected to our website via the appointment link, we will now process your personal data in order to offer you an appointment with a suitable contact person. For this reason, we process the following data categories

• Your first and last name,
• Your business email address,
• General background information you provided, such as region, industry, and desired service, and
• Date and time of your chosen appointment.

Should you have also entered the following voluntary personal data on the AHK.de website, such as

• Your business phone number,
• Company name, 
• Company size, in particular number of employees, and
• Questions as well as comments that you can enter in a free text field,

we will also process this data.

ii.         Legal Basis and Purpose of Data Processing

The legal basis for the processing of the data originally marked as mandatory fields, along with the date and time of your desired appointment, is your request to us in accordance with Art. 6 (1) (b) GDPR.

The legal basis for the data that is not marked as a mandatory field and that you provide to us voluntarily is your consent in accordance with Art. 6 (1) (a) GDPR. The information you provide voluntarily helps us to obtain a more complete picture of your membership.

iii.         Data Retention

Your personal data will be processed for the duration of the expansion support.

iv.         Recipients

Your personal data will be accessed by those AHK Southern Africa employees who are responsible for responding to your inquiry. In addition, employees of DIHK DEinternational GmbH and/or other AHKs may also receive access to your personal data. For this purpose, we have concluded an internal group data transfer and processing agreement with the AHK network, which includes the EU standard contractual clauses. You can view the EU standard contractual clauses at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de.

   II.         Local Data Protection Requirements:

DIHK specified as controller and Ms. Ting-Winarto as DPO. 

For AHK Southern Africa, local data protection law applies in the form of the Protection of Personal Information Act, 2013 (POPIA).

Where applicable, DIHK remains the controller as defined in Part A. The appointed Group Data Protection Officer also applies to AHK Southern Africa.

In addition to EU supervisory authorities referenced in Part A, the Information Regulator of South Africa is the competent authority for matters relating to POPIA.