Privacy policy

This is a translation. The German version of this privacy policy is the binding one.

I Definitions

“Personal data” means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

“Processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

“Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;

“Recipient” means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing;

II General information

1. Controller

be next GmbH, Kirchheimer Str. 27, 70619 Stuttgart, Germany
Phone: +49 711 219 596 022
Contact: contact form

2. Data protection officer

OBSECOM GmbH, Königstr. 40, 70173 Stuttgart, Germany
Phone: +49 711 4605025-40
Fax: +49 711 4605025-49
E-mail: be-next@obsecom.eu
Website: https://www.obsecom.eu

3. Information on processing operations

We state the legal basis of each processing operation. If we intend to transfer data to third countries outside the European Union (EU) or the European Economic Area (EEA), we say so as well.

4. Your rights

As a data subject, you have the following rights:

• under GDPR Art. 15, you may request information about your personal data processed by us; in particular about the purposes of processing, the categories of personal data, the recipients or categories of recipients to whom your data have been or will be disclosed, the planned storage period or the criteria for determining it, the source of your data if they were not collected from you, the existence of automated decision-making including profiling and, where applicable, meaningful information about its logic, scope and effects, the existence of a right to rectification or erasure, the right to restriction of processing or to object to it, the existence of a right to lodge a complaint with a supervisory authority; and whether personal data have been transferred to a third country or an international organisation and, if so, about the appropriate safeguards for the transfer;
• under GDPR Art. 16, you may request the rectification without delay of inaccurate personal data stored by us, or their completion;
• under GDPR Art. 17, you may request the erasure of your personal data stored by us, unless the processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise or defence of legal claims;
• under GDPR Art. 18, you may request the restriction of processing of your personal data if you contest their accuracy, if the processing is unlawful but you oppose erasure, if we no longer need the data but you need them for the establishment, exercise or defence of legal claims, or if you have objected to processing under GDPR Art. 21 and it has not yet been established whether our legitimate grounds override yours;
• under GDPR Art. 20, you may request to receive the personal data you have provided to us in a structured, commonly used and machine-readable format, or to have them transmitted to another controller;
• under GDPR Art. 21, you may object to the processing of your personal data on grounds relating to your particular situation, or where the objection concerns direct marketing, if the processing is based on legitimate interests under GDPR Art. 6(1)(f);
• under GDPR Art. 7(3), you may withdraw your consent at any time. As a result, we may no longer continue the processing based on this consent in the future;
• under GDPR Art. 77, you may lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement.

If you wish to exercise these rights, you can contact us at any time using the contact details above.

5. Erasure and restriction of personal data

Unless otherwise stated in this privacy policy for an individual case, personal data are erased once they are no longer necessary for the purposes for which they were collected or otherwise processed and no statutory retention obligations apply. We erase the personal data we process on request under the conditions of GDPR Art. 17. Personal data that are required for other, legally permitted purposes are not erased. This applies, for example, to personal data required to pursue claims we may have or to defend claims against us, or that we must retain for commercial or tax law reasons. Documents under section 257(1) nos. 2 and 3 of the German Commercial Code (HGB) and section 147(1) nos. 2, 3 and 5 of the German Fiscal Code (AO) are kept for 6 years, documents under section 257(1) nos. 1 and 4 HGB and section 147(1) nos. 1, 4 and 4a AO for 10 years.

The processing of these data is restricted under GDPR Art. 18, and the data are not processed for other purposes.

6. Cookies and browser storage

This website sets no cookies. It embeds no content from other providers; fonts, images and scripts are loaded only from our own server.

If you use the switch for the light or dark display, your choice is kept in your browser's local storage so that the website appears the same way on your next visit. This setting is not sent to us. You can delete it at any time in your browser settings.

III Individual processing operations

1. Hosting

When you visit our website or its individual pages, the browser on your device automatically sends information to the server of our website. The following information is stored in log files:

• IP address of the requesting computer,
• date and time of access,
• name and URL of the file retrieved,
• website from which the access is made (referrer URL),
• browser used and, where applicable, the operating system of your computer,
• status codes and amount of data transferred,
• type of device used,
• name of your access provider.

These data are processed for the following purposes:

• providing the website including all functions and content,
• ensuring a smooth connection to the website,
• ensuring convenient use of our website,
• ensuring system security and stability,
• optimising the website,
• where applicable, passing them on to authorities if there has been an unlawful intrusion into or attack on our systems,
• defending or pursuing claims,
• other administrative purposes.

These data are anonymised and deleted after two years, unless they are still required for other purposes (for example, defending or asserting claims).

The legal basis for the processing is GDPR Art. 6(1)(f). Our legitimate interest follows from the purposes of collection described above.

To provide our website, we use the services of hosting companies, such as web servers, storage space, database services, security services and maintenance services. In doing so, we or our service providers on our behalf process personal data of the users of our website on the basis of our legitimate interest in providing this website efficiently and securely under GDPR Art. 6(1)(f).

2. No web analysis

On nocip.com we use no tools for web analysis, audience measurement or advertising.

3. NOCIP audit procedure

If you apply for the NOCIP label for a product, we process the contact details of the contact persons you name (name, role, e-mail address, phone number) as well as the self-assessment, the evidence and the results of the audit, in order to carry out the audit, send you the audit report and administer the label (for example renewal, change notifications, spot checks). The legal basis is GDPR Art. 6(1)(b); where we process data of contact persons acting for a company, GDPR Art. 6(1)(f), based on our legitimate interest in carrying out the audit procedure.

We keep the documents, captures and results of an audit for three years after the audit has been completed and do not pass them on to third parties. We need no personal data from your products for the audit; we work with our own test data containing invented details.

4. Register

In the public register on nocip.com we publish, for every label issued, the company, the product, the tier, the index and the validity. We do not publish names of individuals there.

IV Communication

1. Contacting us

When you contact us, we need your request and your contact details (for example e-mail address, address, phone or fax number) so that we can review your request and contact you. You may also provide your address and other details voluntarily. If you do not provide these details, we cannot handle your request.

The processing for the purpose of contacting us and answering your request is based on the consent you have given voluntarily under GDPR Art. 6(1)(a). Without this consent we cannot get in touch with you. All personal data collected in connection with your contact are deleted once your request has been dealt with, unless storage is necessary for other reasons (e.g. a subsequent audit procedure).

2. E-mail information for label holders

If you hold a NOCIP label, we inform you by e-mail about the label, in particular about the end of its validity, renewal and new versions of the criteria catalogue. The legal basis is GDPR Art. 6(1)(b).

Last updated: 29 October 2026