Principles of data processing at JOHS. THOMS GmbH & Co. KG
You came to this page via a link because you want to find out about our handling of (your) personal data. In order to fulfill our obligation to inform according to Art. 12 ff. of the General Data Protection Regulation (DSGVO), we are pleased to present our information on data protection below:

Who is responsible for data processing?
The responsible party in terms of data protection law is
          JOHS. THOMS GmbH & Co. KG
          Geschwister-Beschuetz-Bogen 6
          22335 Hamburg | Germany

You will find further information about our company, details of the persons authorized to represent us and also further contact options in the imprint of our website:

Which of your data do we process? And for which purposes?
If we have received data from you, we will only process them for the purposes for which we received or collected them.
Data processing for other purposes will only be considered if the legal requirements necessary in this respect pursuant to Art. 6 (4) DSGVO exist. We will of course comply with any information obligations pursuant to Art. 13 (3) DSGVO and Art. 14 (4) DSGVO in that case.

What is the legal basis?
The legal basis for the processing of personal data is basically – unless there are other specific legal provisions – Art. 6 DSGVO. In particular, the following possibilities come into consideration:
Consent (Art. 6 (1a) DSGVO)
Data processing for the fulfillment of contracts (Art. 6 (1b) DSGVO)
Data processing on the basis of a balancing of interests (Art. 6 (1f) DSGVO)
Data processing for the fulfillment of a legal obligation (Art. 6 (1c) DSGVO)
If personal data are processed on the basis of your consent, you have the right to revoke your consent to us at any time with effect for the future.
If we process data on the basis of a balance of interests, you as the person affected have the right to object to the processing of personal data, taking into account the requirements of Art. 21 DSGVO.

How long are the data stored?
We process the data as long as necessary for the respective purpose.
Insofar as statutory retention obligations exist – e.g. under commercial law or tax law – the personal data concerned will be stored for the duration of the retention obligation. After expiry of the retention obligation, it is checked whether there is a further necessity for processing. If the data are no longer required, they are deleted.
As a matter of principle, we carry out an examination of data towards the end of a calendar year with regard to the need for further processing. Due to the volume of data, this check is carried out with regard to specific types of data or purposes of processing.
Of course, you can request information about the data we have stored about you at any time (see below) and, if there is no need for further processing, you can request deletion of the data or restriction of processing.

To which recipients are data passed on?
In principle, your personal data will only be passed on to third parties if this is necessary for the performance of the contract with you, the transfer is permissible on the basis of a balancing of interests within the meaning of Art. 6 (1f) DSGVO, we are legally obliged to pass on the data or you have given your consent in this respect.

Where is the data processed?
Your personal data is processed by us exclusively in data centers located in the Federal Republic of Germany.

Your rights as the person affected
You have the right to request information about the personal data we process about you.
In the case of a request for information that is not made in writing, we ask for your understanding that we may then require evidence from you that proves that you are the person you claim to be.
Furthermore, you have a right to rectification or deletion or to restriction of processing, insofar as you are entitled to this by law.
Furthermore, you have a right to object to processing within the scope of the law. A right to data portability also exists within the framework of data protection law.
In particular, you have a right to object to the processing of your data in context with a direct marketing campaign in accordance with Article 21 (1+2) DSGVO, if this is carried out on the basis of a balancing of interests.
We do not use any processing based on automated decision-making including profiling in terms of the Art. 22 DSGVO.

Our data protection officer
We have appointed a data protection officer in our company. You can reach him under the following contact options:
Mario Barthel
– Data Protection Officer –
INNAVIS Datenschutz und Compliance GmbH & Co. KG
Gutenbergstraße 1
26632 Ihlow | Germany

Right of complaint
You have the right to complain to a data protection supervisory authority about the processing of personal data by us.


updated as of 01/2023