Privacy policy
Quick navigation
The protection of your privacy is very important to us. Below, we provide you with information about the handling of your personal data. This privacy policy applies to every TNP Global Trade website in which the footer refers to this privacy policy.
TNP Global Trade GmbH operates the website and its trade hub at www.tnp.ai. You can visit our website without providing any personal data. However, certain services listed below require the processing of personal data, such as the name, address, or telephone number of a natural person. In this case, the processing is carried out on a statutory basis or with the consent of the data subject. The processing of personal data is carried out in accordance with the General Data Protection Regulation (GDPR) and the other data protection regulations applicable to TNP Global Trade.
With our privacy policy, we would like to inform you about the type, extent and purpose of the personal data processed by us.
I. Definitions
Our privacy policy is based on the General Data Protection Regulation (EU GDPR). For reasons of comprehensibility, we would like to explain the terms used here and there.
Personal data
Personal data is any information relating to an identified or identifiable natural person (hereinafter referred to as the ‘data subject’); an identifiable natural person is one who can be identified directly or indirectly, in particular by assignment to an identifier such as a name, an identification number, location data, an online identifier or one or more special characteristics that express the physical, physiological, genetic, psychological, economic, cultural or social identity of that natural person.
Data subject
The data subject is any identified or identifiable person whose personal data is processed by the data controller.
Processing
Processing means any operation or series of operations carried out with or without the aid of automated procedures in relation to personal data, such as the collection, recording, organisation, sorting, storage, adaptation or alteration, reading, retrieval, use, disclosure by transmission, dissemination or any other form of provision, reconciliation or linking, restriction, erasure or destruction.
Data controller
The data controller shall be the natural or legal person, public authority, agency or other body which alone or jointly with others decides on the purposes and means of processing personal data; where the purposes and means of such processing are specified by Union law or the law of the Member States, the data controller or certain criteria for his/her appointment may prescribed in accordance with Union law or the law of the Member States.
Profiling
Profiling is any form of automated processing of personal data consisting in the use of such personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects relating to the payment behavior, economic situation, personal preferences, interests, behaviour, whereabouts or relocation of that natural person.
Restriction of processing
Restriction of processing is the marking of stored personal data with the aim of restricting its future processing.
Third party
A third party is a natural or legal person, public authority, agency or other body other than the data subject, the data controller, the data processor and the persons authorised to process the personal data under the direct responsibility of the data controller or the data processor.
Processor
The order processor is a natural or legal person, public authority, agency or other body that processes personal data on behalf of the data controller.
Consent
Consent is any freely given, specific, informed and unambiguous declaration of intent made by the data subject, in the form of a declaration or other clear affirmative act, through which the data subject indicates that he/she agrees to the processing of his/her personal data.
Recipient
A recipient is a natural or legal person, public authority, agency or other body to which personal data is disclosed, irrespective of whether it is a third party or not. However, authorities which receive personal data under Union law or the law of the Member States of the European Union within the context of a specific investigation mandate shall not be regarded as recipients. The processing of this data by the said authorities shall be carried out in accordance with the applicable data protection regulations and in accordance with the purposes of the processing.
Group of undertakings
A group of undertakings means a controlling undertaking and its controlled undertakings.
II. Name and contact
For the processing of the personal data that we collect via the website and our products, the responsible party is:
TNP Global Trade GmbH
Carsten-Rehder-Str. 50
22767 Hamburg
Web: www.tnp.ai
Email: contact_us@tnp.ai
You can always contact us by email or by post for all matters relating to data protection.
III. Data processing in general
1. Scope of processing of personal data
In principle, personal data is only collected and used if this is necessary to provide a functioning website as well as for our content and services. As a rule, the collection and use of personal data takes place only after you have granted your consent, or if it was not possible to obtain consent in advance for actual reasons, but the processing of the data is permitted by legal regulations.
2. Legal basis for the processing of personal data
The processing of personal data takes place on various legal bases:
- Article 6 (1) lit. a EU GDPR: The consent of the data subject has been obtained for the processing of personal data.
- Article 6 (1) lit. b EU GDPR: The processing of personal data is necessary for the performance of a contract to which the data subject is a party. This includes processing operations that are necessary to carry out pre-contractual measures.
- Article 6 (1) lit. c EU GDPR: The processing of personal data is necessary to fulfil a legal obligation to which the data controller is subject.
- Article 6 (1) lit. d EU GDPR: Vital interests of the data subject or another natural person require the processing of personal data.
- Article 6 (1) lit. f EU GDPR: Processing is necessary to safeguard a legitimate interest of the data controller or a third party and the interests, fundamental rights and freedoms of the data subject do not outweigh the aforementioned interest.
3. Data deletion and duration of storage
The personal data of the person concerned will be deleted or blocked as soon as the purpose of storage ceases to apply. In addition, data may be stored if this has been provided for by the European or national legislator in EU regulations, laws or other provisions to which the data controller is subject. The data will also be blocked or deleted if a storage period prescribed by the above standards expires, unless there is a need for further storage of the data for the conclusion or fulfilment of a contract.
IV. Scope, purpose, legal basis and duration of the processing of personal data
1. Data processing when visiting our website
When you access our website and call up a file or subpage stored on the website, some general data and information will be logged. The following data is logged: (1) Path of the requested resource, (2) date and time of access, (3) amount of data transferred, (4) notification of successful access, (5) web browser used, (6) requested domain, (7) the website from which our website is accessed (Referrer URL), (8) time of the server request, (9) operating system used, (10) screen resolution, (11) plugins used, (12) IP address of the accessing computer, and (13) other similar data and information to fend off a threat in the event of an attack on our IT systems.
This data is stored separately from the personal data provided in addition to the IP address. There is no inference to the person concerned. The data is required to (1, 2, 5, 6, 7, 9, 12) correctly display and transmit the contents of our website, (1, 3, 4, 5, 6, 9, 10, 11) improve the contents and the advertising for our website, (1, 2, 3, 4, 6, 7, 8, 12, 13) ensure the permanent functionality of our IT systems and the technology of our website and to detect and fend off cyber-attacks, as well as (1, 2, 4, 5, 6, 7, 9, 12, 13) to provide law enforcement authorities with the information necessary for criminal prosecution in the event of a cyber-attack. This anonymously collected data and information is thus statistically and internally evaluated in order to optimise data protection and data security at TNP Global Trade. The legal basis for data processing is Article 6 (1) lit. f EU GDPR.
The data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected. If the data was collected for the provision of the website, it is no longer required at the end of the respective session and will be deleted. For data stored in log files, this applies after seven days at the latest, although further storage remains possible if the IP addresses are deleted or altered so that it is no longer possible to assign the data to a user.
2. Data collection in the context of the use of the services offered
Visitors to our website have the opportunity to use the services we offer. What personal data is transmitted to us is determined by the input mask provided for the use of the respective service and the data fields to be filled in.
The legal basis for data processing is Article 6 (1) lit. b EU GDPR.
Registration takes place so that we can offer services to the data subject, which by nature can only be offered to registered participants. The purpose of the registration and the personal data collected is to fulfil the contract with the data subject regarding the use of the respective service or to carry out pre-contractual measures which are carried out at the request of the data subject. It is used in particular for:
- registration as a participant on the TNP hub
- the conclusion of trade receivable purchase contracts and the performance of assignments/transactions between the participants on the TNB hub
- the delivery of transaction-related notifications. In addition to notifications to the participants of the TNB hub, this also includes the sending of payment reminders to a debtor and informing a debtor about a sale of receivables in the event of a disclosed assignment,
- the provision of our agreed services, including the possible presentation of personal data in connection with sales offers and
- the billing of our services.
When signing up for or using the services we offer, the following other personal data is also stored:
- IP address of the person concerned
- date and time of registration
- date and time of the last login
- number of failed logins.
The legal basis for the storage of other personal data is Article 6 (1) lit. c and f EU GDPR.
The other personal data stored during registration are required
- to ensure the operation of the TNB hub, in particular, to determine any technical problems and to make adjustments or improvements.
- to ensure that we comply with legal provisions, including, in particular, the necessary measures in connection with the prevention of fraud and money laundering, as well as the prevention of violations of embargo regulations.
V. Rights of the data subject
1. Right of expression, Article 15 EU GDPR
The data subject has a right to request confirmation from the controller as to whether personal data concerning them is being processed.
2. Right to information, Article 15 EU GDPR
The data subject shall have a right with respect to the controller to obtain free information on the personal data relating to their stored data and a copy of such information. This right to information includes the following information:
- the purposes of the processing
- the categories of personal data to be processed
- the recipients or categories of recipients to whom the personal data has been or is still being disclosed, in particular recipients in third countries or international organisations
- if possible, the planned duration for which the personal data will be stored or, if this is not possible, the criteria for determining this duration
- the existence of a right of rectification or deletion of personal data concerning them or of a restriction on processing by the controller or of a right of opposition to such processing
- the existence of a right of appeal to a supervisory authority
- if the personal data is not collected from the data subject, all available information on the origin of the data
- the existence of automated decision-making including profiling in accordance with Article 22(1) and (4) EU GDPR and, at least in these cases, meaningful information on the logic involved and the scope and intended impact of such processing on the data subject
- In addition, the data subject has a right to information as to whether personal data has been transferred to a third country or to an international organisation. If this is the case, the data subject also has the right to obtain information on the appropriate guarantees under Article 46 EU GDPR in connection with the transmission.
3. Right to rectification, Article 16 EU GDPR
The data subject shall have the right to request that controller rectifies any inaccurate personal data concerning them without delay. Taking into account the purposes of the processing, the data subject has the right to request the completion of incomplete personal data, including by means of a supplementary declaration.
4. Right to erasure (‘right to be forgotten’), Article 17 EU GDPR
The data subject has the right to require the data controller to delete personal data concerning them without delay and the data controller shall be required to delete personal data without delay if one of the following reasons applies:
- the personal data is no longer necessary for the purposes for which it was collected or otherwise processed
- the data subject withdraws his/her consent on which the processing was based under Article 6 (1)(a) EU GDPR or Article 9 (2)(a) EU GDPR and there is no other legal basis for processing
- the data subject objects to processing under Article 21(1) of the EU GDPR and there are no overriding legitimate interests for processing or the data subject objects to processing under Article 21(2) of the EU GDPR
- the personal data has been processed unlawfully
- the deletion of personal data is necessary to fulfil a legal obligation under Union law or the law of the Member States to which the data controller is subject
- the personal data was collected in relation to information company services offered in accordance with Article 8 (1) EU GDPR.
The right to deletion does not exist insofar as the processing is necessary
- to exercise rights of freedom of expression and information;
- for the performance of a legal obligation required for processing under the law of the Union or of the Member States to which the controller is subject or for the performance of a task in the public interest or in the exercise of official authority conferred on the data controller;
- on grounds of public interest in the field of public health in accordance with Article 9 (2) lit. h and i and Article 9 (3) EU GDPR;
- for archiving purposes, scientific or historical research purposes in the public interest or for statistical purposes in accordance with Article 89 (1) GDPR, to the extent that the right referred to in (a) is likely to render the attainment of the objectives of such processing impossible or seriously impaired, or
- to assert, exercise or defend legal claims.
If, as data controller, we have made the personal data public and are required to delete it in accordance with Article 17 (1) EU GDPR, we shall take appropriate measures, including technical measures, taking into account the available technology and the implementation costs, to inform other responsible parties who process the personal data that a data subject has requested that they delete all links to this personal data or copies or replications of this personal data, insofar as processing is not necessary.
5. Right to restriction of processing, Article 18 EU GDPR
The data subject has the right to require the data controller to restrict processing if one of the following conditions is met:
- the accuracy of the personal data is disputed by the data subject for a period which enables the data controller to verify the accuracy of the personal data
- the processing is unlawful and the data subject refuses to delete the personal data and instead requests a restriction on the use of the personal data
- the data controller no longer needs the personal data for the purposes of processing, but the data subject needs it for the purpose of asserting, exercising or defending legal claims, or
- the data subject has lodged an objection to the processing under Article 21 (1) EU GDPR until it has been established whether the legitimate interests of the data subject outweigh those of the data subject
If the processing of personal data concerning you has been restricted, such data may only be processed – apart from being stored – with your consent or for the purpose of asserting, exercising or defending rights or protecting the rights of another natural person or legal entity or on grounds of an important public interest of the Union or a Member State.
If the processing restriction has been restricted in accordance with the above conditions, you will be informed before the restriction is lifted.
6. Right to notification, Article 19 EU GDPR
When exercising the right to rectify, cancel or limit the processing, the data subject has the right to be informed of the recipients to whom the rectification, cancellation or limitation of the processing has been communicated.
7. Right to data portability, Article 20 EU GDPR
The data subject has the right to receive the personal data concerning him/her which he/she has provided to a data controller in a structured, current and machine-readable format. The data subject also has the right to transmit such data to another data controller without obstruction by the data controller to whom the personal data has been provided, provided that
- processing is based on consent under Article 6 (1) lit. a EU GDPR or Article 9 (2) lit. a EU GDPR or on a contract under Article 6 (1) letter b EU GDPR and
- processing is carried out using automated methods.
In addition, in exercising his/her right to data transferability, the data subject has the right to have the personal data transferred directly from one data controller to another data controller, provided that this is technically feasible and does not affect the rights and freedoms of other persons.
The right of data transferability shall not apply where processing is necessary for the performance of a task in the public interest or in the exercise of official authority conferred on the data controller.
8. Right of objection, Article 21 EU GDPR
The data subject has the right to object at any time to the processing of personal data concerning him/her on the basis of Article 6 (1) lit. e or f EU GDPR for reasons arising from his particular situation. This also applies to profiling based on these provisions.
In the event of an objection, we will no longer process the personal data unless we can prove compelling reasons for the processing which are worthy of protection and which outweigh the interests, rights and freedoms of the data subject, or the processing serves to assert, exercise or defend legal claims.
Where personal data are processed for direct marketing purposes, the data subject has the right to object at any time to the processing of personal data concerning him/her for the purpose of such advertising. This also applies to profiling insofar as it is connected with such direct advertising. If the data subject objects to our processing for direct marketing purposes, we will no longer process the personal data for these purposes.
In addition, the data subject has the right to object to the processing of personal data concerning him/her for scientific or historical research purposes or for statistical purposes in accordance with Article 89 (1) EU GDPR for reasons arising from his/her particular situation, unless the processing is necessary for the performance of a task in the public interest.
The data subject may also, notwithstanding Directive 2002/58/EC, exercise his/her right of opposition in relation to the use of services of the information company by means of automated procedures in which technical specifications are applied.
9. Automated decisions in individual cases including profiling, Article 22 EU GDPR
The data subject has the right not to be subjected to a decision based exclusively on automated processing, including profiling, which has legal effect against him/her or significantly impairs him/her in a similar manner. This does not apply if the decision is necessary for the conclusion or performance of a contract between the data subject and the data controller, or is admissible in accordance with the law of the Union or of the Member States to which the data controller is subject and that law contains appropriate measures to safeguard the rights, freedoms and legitimate interests of the data subject; or with the express consent of the data subject.
These decisions may not be based on special categories of personal data under Article 9 (1) EU GDPR, unless Article 9 (2) lit. a or g applies and appropriate measures have been taken to protect the rights and freedoms and the legitimate interests of the data subject.
Where a decision is necessary for the conclusion or performance of a contract between the data subject and the data controller or is taken with the express consent of the data subject, we shall take appropriate measures to safeguard the rights, freedoms and legitimate interests of the data subject, including at least the right to bring about the intervention of a person on the part of the data controller, to state his own position and to challenge the decision.
10. Right to revoke consent granted under data protection law, Article 7 EU GDPR
The data subject has the right to revoke his/her consent to the processing of personal data at any time. The revocation shall not affect the legality of the processing carried out on the basis of the consent before the revocation.
11. Right to lodge a complaint with a supervisory authority, Article 77 EU GDPR
Without prejudice to any other administrative or judicial remedy, the data subject shall have the right of appeal to a supervisory authority, in particular in the Member State where he/she resides or works or where he/she allegedly carried out the infringement, if the data subject considers that the processing of personal data concerning him/her is contrary to EU GDPR or national data protection laws. The supervisory authority with which the appeal has been lodged will inform the appellant of the status and results of the appeal, including the possibility of a judicial remedy in accordance with Article 78 EU GDPR.
VI. Use of cookies
Please refer to our Cookie Policy page.
VII. Contact form, email contact and document dispatch
On our website there is a contact form which can be used for to contact us electronically. The data entered into the input mask during use will be transmitted to us. This data is:
- name
- phone number
- company name
- message
The contact will be recorded. Both the time of sending as well as the IP address will be stored.
Logging is technically necessary to deliver your message and is also required for security reasons.
For the processing of the data entered in the input mask, the sender’s consent is obtained during the sending process and reference is made to this privacy policy. The legal basis for data processing is Article 6 (1) lit. a and Article 7 EU GDPR. Article 6 (1) lit. f EU GDPR applies to the logged data.
It is also possible to contact us via the email addresses published on the website. The data transmitted by the sender with the email is stored. The legal basis for data processing is Article 6 (1) lit. f EU GDPR and, if the enquiry relates to the conclusion of a contract, Article 6 (1) lit. b EU GDPR.
The personal data will be used solely for the processing of the contact or for the document dispatch. If contact is made by email, the necessary legitimate interest in data processing also lies in the processing of the contact. The personal data processed within the context of logging serves to prevent misuse of the contact form and to safeguard the security of our IT systems. This is the necessary legitimate interest of data processing. Personal data will not be disclosed to third parties unless required by law or for the purpose of prosecution.
Personal data will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected. In the case of personal information submitted to us for a conversation, this is the case when the conversation is over, i.e. when the matter underlying the request have been finally clarified. The additionally logged personal data will be deleted after a period of seven days.
The user of the contact form can revoke his/her consent to the processing of personal data at any time. If you contact us by email, you can object to the storage of your personal data at any time. A conversation can then no longer be continued. Revocation and objections are to be sent by email to contact_us@tnp.ai. All personal data of the data subject stored during the establishment of contact will then be deleted.
VIII.Demo calls
Our website gives companies the opportunity to sign up for an online demonstration of the TNP hub. In the course of a demo call, interested parties are introduced to the functionalities of the hub live by a member of our staff. Sign up for the demo requires a name, email, phone, and a company name. The legal basis for the processing of personal data is Article 6 (1) lit. b EU-GDPR. The personal data will be used solely for the coordination and execution of the demo call. To demo calls are held via Microsoft Teams. To participate, the specified email address must be transferred to Microsoft. The web conference data is routed through Microsoft servers. These can also be outside the EU. In all these cases, we ensure that processing in third countries is at a level of protection comparable to the European standard. Please refer to the Microsoft Teams Privacy Policy.
Personal data will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected, i. E. if the facts underlying the sign up for the webinar are finally clarified.
IX. Job applications and related procedures
Interested parties can apply for jobs with us via the email addresses published on the websites. The data transmitted by the sender with the email is stored. The legal basis for data processing is Article 6 (1) lit. f EU GDPR and, if the contact inquiry relates to the conclusion of a contract, Article 6 (1) lit. b EU GDPR. The personal data of applicants will be processed exclusively for the purpose of the application procedure. The necessary legitimate interest in data processing lies in the processing of the application and the contacting of interested applicants. If an employment contract is concluded, the data transmitted by the applicant will be stored in accordance with the law for the purpose of processing the employment relationship. If an employment contract is not concluded, the application documents will be deleted no later than six months after the rejection decision has been announced to the applicant, provided that there are no other legitimate interests, such as in particular evidence obligations within the context of proceedings under the General Equal Treatment Act (AGG).
The applicant can object to the storage of personal data at any time. The processing of the application and the conversation with the applicant can then no longer be continued. The objection must be sent by email to contact_us@tnp.ai. All personal data of the person concerned stored in the application will then be deleted.
X. Google Analytics
On the basis of our legitimate interests (i.e. interest in the analysis, optimization and economic operation of our online offer within the meaning of Art. 6 para. 1 lit. f. DSGVO) we use Google Analytics, a web analysis service of Google LLC (“Google”). Google uses cookies. The information generated by the cookie about the use of the website by the user is usually transferred to a Google server in the USA and stored there.
Google is certified under the PrivacyShieldAgreement and thus offers a guarantee to comply with the European data protection law. More about this here.
Google will use this information on our behalf to evaluate the use of our website by users, to compile reports on the activities within this website and to provide us with further services associated with the use of this website and the internet. In doing so, pseudonymous user profiles of the users can be created from the processed data.
We only use Google Analytics with activated IP anonymization. This means that the IP address of the user is shortened by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transferred to a Google server in the USA and shortened there.
The IP address transmitted by the user’s browser is not merged with other Google data. Users can prevent the storage of cookies by adjusting their browser software accordingly; users can also prevent the collection of data generated by the cookie and relating to their use of the online offer to Google and the processing of this data by Google by downloading and installing the browser plugin available under the following link: Download from Google.
Further information on the use of data by Google, setting and objection options, can be found in Google’s Google’s privacy policy and in the settings for the display of advertising by Google.
The personal data of users will be deleted or anonymised after 14 months.
XI. Youtube
Our website displays videos hosted by Youtube, which is operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). You can find Google’s privacy policy at https://policies.google.com/privacy .
When you watch the Youtube-hosted video on TNP.ai, we receive anonymous and aggregated information from Google about your interactions with our content provided on YouTube and the use of our YouTube channel. Based on the recorded views, information collected by YouTube Analytics allows us to evaluate the audience and popularity of our YouTube videos and our YouTube channel. YouTube Analytics also allows us to evaluate our audiences (e.g., by demographic and geographic factors) and the effectiveness of our YouTube activities. The processing that takes place in this respect is based on our legitimate interests in optimising our YouTube activities, Art 6 (1)(f) GDPR. Learn more about how YouTube protects your data and find YouTube’s terms of service here.