PRIVACY NOTICE – REPRESENTATIVE FUNCTION

Regingada UG (haftungsbeschränkt) · Information under Art. 13 and 14 GDPR for persons who contact Regingada as the representative of a company established outside the EU
Version: 22 October 2026 · Published at www.regingada.com/privacy-representative.html

1 Controller

Regingada UG (haftungsbeschränkt), Troppauplatz 1d, 96052 Bamberg, Germany, represented by its managing director Theo Funk, e-mail office@regingada.com, telephone +49 951 16090321. The e-mail address for communications to Regingada as the representative of a particular company is stated in that company's privacy notice and legal notice; Regingada can also be reached at office@regingada.com. No data protection officer has been designated; there is no obligation to designate one.

2 What this is about

Regingada has been designated by companies established outside the European Union as their representative in the Union under Art. 27 GDPR and as their legal representative under Art. 13 of Regulation (EU) 2022/2065 (Digital Services Act). When you contact Regingada as a data subject or as an authority, Regingada receives your communication, acknowledges receipt, records the matter and, where the conditions for doing so are met, forwards the communication to the represented company. Regingada does not decide on your request itself; the decision is taken by the represented company. Which companies Regingada represents is stated in their privacy notices and legal notices; Regingada names the represented company in its acknowledgement of receipt. Every communication is handled by a person at Regingada; no step takes place without human approval.

3 Data processed by Regingada

Regingada processes the data you provide in your communication, in particular your name, your contact details, the content of your communication including any attachments, and procedural data such as the date of receipt, reference numbers and deadlines. Where an authority contacts Regingada, Regingada processes the data of the officials acting and the content of the communication. Where a communication contains data of other persons, Regingada also processes those data to the extent they are contained in the communication (Art. 14 GDPR); the source is then the sender.

4 Purposes and legal bases

Regingada processes your data in order to perform its tasks as representative: receipt and acknowledgement, logging, obtaining your decision on forwarding, forwarding to the represented company, transmitting its response to you and monitoring deadlines. The legal bases are Art. 6(1)(c) GDPR in conjunction with Art. 27(4) GDPR and Art. 13(2) DSA, to the extent Regingada performs statutory duties as representative, and otherwise Art. 6(1)(f) GDPR; the legitimate interest lies in the proper and verifiable performance of the representative mandate. Special categories of personal data, such as health information, are processed by Regingada only where you provide them yourself, on the basis of Art. 9(2)(a) GDPR or, for communications from authorities, Art. 9(2)(f) GDPR.

5 Forwarding to the represented company in a third country

The represented company is established in a country outside the Union for which the European Commission has adopted no adequacy decision and for which Regingada cannot provide appropriate safeguards within the meaning of Art. 46 GDPR. Regingada therefore forwards the content of your communication only where one of the following conditions is met: you have, after being informed of the risks, explicitly consented to the forwarding (Art. 49(1)(a) GDPR); the forwarding is necessary for a contract between you and the company (Art. 49(1)(b) GDPR); or the communication comes from an authority and its forwarding is necessary for the company's legal position in the procedure concerned (Art. 49(1)(e) GDPR). The risks consist in particular in the possibility that public authorities of the third country may access data without the authorisation, oversight, notification and judicial-remedy guarantees that apply in the Union, that the company may be prevented from notifying such access, and that enforcing your rights there may be more difficult. The represented company has undertaken towards Regingada, also for your benefit, to comply with data protection obligations modelled on the European Commission's standard contractual clauses, including the obligation to challenge unlawful access requests. Before any forwarding, the company receives only an alert without personal data: sender category, type of communication, date of receipt, deadline, Regingada's reference number and a generic description of the subject matter in Regingada's own words; neither your name nor your contact details, the subject line, extracts or attachments. Data of other persons contained in your communication are forwarded only where one of the conditions above is met for those persons, and are otherwise redacted or paraphrased. Health-related information and other special categories of personal data are forwarded only where your explicit consent expressly covers them or, for communications from authorities, where strictly necessary, and then only as a password-protected attachment to the company's primary address, with the password sent separately. Where the forwarding rests on a contract between you and the company (Art. 49(1)(b) GDPR), Regingada does not ask for your consent but informs you of the forwarding and its risks in the acknowledgement of receipt. If you refuse or withdraw your consent, your communication is not forwarded in identifiable form. Your request is nevertheless answered within the statutory time limit: the company responds through Regingada, and where your request cannot be fulfilled without forwarding, it explains the reasons, how you can pursue your request, and your right to lodge a complaint with a supervisory authority and to seek a judicial remedy (Art. 12(4) GDPR).

6 Recipients and processors

Recipients of your data are the represented company under the conditions in section 5 and, where a procedure so requires, the competent supervisory authorities and courts. Regingada uses processors under Art. 28 GDPR for its systems: Hetzner Online GmbH, Gunzenhausen, for hosting in Falkenstein, Germany; Zoho Corporation for the e-mail mailbox, hosted in the European Union; Amazon Web Services EMEA SARL for AI-assisted tools through the Amazon Bedrock service: Claude language models (currently Claude Opus 4.8), called from the AWS Frankfurt region through the EU inference profile, which processes requests exclusively in AWS regions located in the European Union (Frankfurt, Stockholm, Milan, Spain, Ireland, Paris), with the setting that no inputs or outputs are retained; the data are not used to train models and are not shared with the model provider. The AI-assisted tools are currently not activated. If activated, Regingada uses them only at the request of the person handling the matter, to support classification, summarising, translation and drafting; every decision and every dispatch is made by a person. Health-related information, other special categories of personal data, material marked confidential by an authority and attachments are not supplied to the AI-assisted tools. No automated decision within the meaning of Art. 22 GDPR takes place; the represented company decides on your request.

7 Retention

Regingada keeps a mandate file for each representative mandate: the log of every communication, the acknowledgement of receipt, your decision on forwarding, the forwarding itself, the represented company's responses and the transfer records. Regingada retains the mandate file for the duration of the representative mandate and for three years from the end of the calendar year in which the mandate ends; longer only where statutory retention periods (in particular sections 257 of the German Commercial Code and 147 of the German Fiscal Code) require this for individual records. The data are then deleted. Any consent you give and its withdrawal are documented for that period.

8 Your rights

You have the right to obtain from Regingada access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20), and the right to object, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR (Art. 21). You may withdraw a consent to forwarding at any time with effect for the future by e-mail to the address stated in the acknowledgement of receipt or to office@regingada.com; the lawfulness of forwarding carried out before the withdrawal is unaffected. You have the right to lodge a complaint with a supervisory authority, in particular the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de. Rights against the represented company as controller may be exercised through Regingada or directly against the company.

9 No obligation to provide data

You are not obliged to provide data to Regingada. Without your contact details, however, Regingada cannot respond to you, and without your consent your communication is not forwarded to the represented company in identifiable form.