In § 4 g, the German Data Protection Act (GDPA) requires that the data protection official furnish the following statements, making them publicly available, in compliance with § 4 e.

1. Name or title of the responsible agency
   Burnus GmbH
2. Managing Director
   RA Eike Ebert
3. Address of the responsible agency
   Burnus GmbH
   Rösslerstrasse 94
   D-64293 Darmstadt
4. Purposes of collecting, processing, or using data.
   The main fields of activity of the Burnus GmbH comprise the manufacture and sale of substances used for washing and cleaning, body care products and products for bulk consumers, along with the manufacture and installation of technical facilities appertaining to these. Any collection, processing and employment of data serves the performance of the activities mentioned above.
5. Description of the groups of individuals concerned and their respective data or data categories:
   Within the framework of the purposes outlined in point 4, the data being collected, processed and used concern the following groups of individuals:
   • customer data (esp. address data, contract data, payment data),
   • employee data (esp. personal data, settlement data),
   • supplier data (esp. address data, contract data),
   • interested party data (esp. address data, product interests),
6. Recipients or categories of recipients to whom the data may be transferred:
   • public bodies that receive data in compliance with legal directives (such as social insurance bodies),
   • internal bodies involved in the implementation and completion of the respective business process (such as personnel management, sales, accounting, marketing, IT/ORG),
   • external agents according to § 11 BDSGa,
   • other external bodies such as partners involved in performing commissions given by customers.
7. Standard periods for data deletion:
   The legislation sets out various storage requirements and periods. Following the expiration of these periods, the respective data are deleted, in so far as they are no longer required. All data exempted from this are deleted as soon as the purposes stated in section 5 above no longer apply.
8. Planned data transfer to third states
   To perform the fields of activity stated in section 4 above, data are also transferred to third states in an export context.
9. General description facilitating a preliminary assessment of whether the measures complying with § 9 to guarantee processing security are adequate:
   The Burnus GmbH applies technical and organisational security measures to protect the data in its possession from accidental or intentional manipulation, loss, destruction and unauthorized access. Our security measures are continually being improved in line with technological developments.
   This specifically means that we save data-protection relevant data on secured systems in Germany. They can only be accessed by a limited number of authorised individuals who are involved with the technical and editorial servicing of these systems.

Burnus GmbH
Eike Ebert