Business partners, prospective customers and other external contacts | Version: 20 October 2026

1. Scope and Controller

This general privacy information explains, pursuant to Articles 13 and 14 of the GDPR, how personal data is processed in connection with business contacts and business email communication with Messer SE & Co. KGaA. It is provided in particular via a link in our employees’ email signatures and is intended to inform external contacts about the essential processing activities from the first business email contact. It applies in particular to contact persons at customers, suppliers and other business partners, prospective customers, employees of external companies, consultants, service providers and other external contacts. Additional or separate privacy information may apply to specific processing situations and to processing carried out by other Messer companies.
Controller: Messer SE & Co. KGaA, Messer-Platz 1, 65812 Bad Soden am Taunus, Germany; email: info@messergroup.com.
Data Protection Officer: email: datenschutz.mg@messergroup.com.

2. Data We Process

Depending on the business contact, we process in particular names, companies, functions, business contact details, the content of communications and collaboration, appointment and meeting data, and information relating to enquiries, quotations, contracts and business processes. This may also include technically necessary usage and connection data. We use Microsoft 365, among other services, for communication and collaboration.

3. Purposes and Legal Bases

We process personal data to initiate, conduct and maintain business relationships, handle enquiries, communicate and collaborate, and administer and perform contracts. The legal basis is generally our legitimate interest in efficient business organisation and communication (Article 6(1)(f) GDPR). Where contracts are concluded with natural persons, processing may be necessary for the performance of a contract or to take steps prior to entering into a contract (Article 6(1)(b) GDPR).
Where legal obligations apply, such as commercial or tax-law retention requirements, processing is based on Article 6(1)(c) GDPR. Where we obtain consent, particularly for certain advertising activities, Article 6(1)(a) GDPR applies. Advertising is carried out only in accordance with the applicable legal requirements; you may object to direct marketing at any time.

4. Sources of the Data

We receive data from you directly or, where necessary for the business relationship, from your company, other participating business partners, companies of the Messer Group or publicly accessible business sources, such as company websites. Such data generally consists of business contact and role information.

5. Recipients and International Transfers

Within our company, only the responsible departments and personnel have access to your data. Where necessary, data may be disclosed to companies of the Messer Group, participating business partners and service providers. These include in particular Kyndryl in the area of IT infrastructure and Microsoft in connection with Microsoft 365.
Due to our international business activities and the IT services we use, personal data may also be processed outside the EU or the EEA. Intra-group data transfers are governed organisationally by the Group Data Sharing Agreement (GDSA). Where required, transfers to third countries are based on an adequacy decision or appropriate safeguards, in particular the EU Standard Contractual Clauses. You may request information about the applicable safeguards through the data protection contact.

6. Retention Period

We retain data only for as long as necessary for the stated purposes. In doing so, we take into account the duration of the business relationship, the continuing need for business communication, statutory retention periods and, where applicable, the establishment, exercise or defence of legal claims. The data is subsequently deleted or anonymised.

7. Provision of Data

Providing business contact details is generally voluntary. Without the necessary information, we may be unable to process enquiries or business relationships. Certain information may be required for entering into a contract or due to legal obligations.

8. Your Rights

Subject to the applicable legal requirements, you have the right of access, rectification, erasure, restriction of processing and data portability (Articles 15 to 18 and 20 GDPR). You may withdraw consent at any time with effect for the future. Where processing is based on legitimate interests, you may object on grounds relating to your particular situation (Article 21(1) GDPR). You may object to processing for direct marketing purposes at any time without stating reasons (Article 21(2) GDPR).
To exercise your rights, please contact datenschutz.mg@messergroup.com. You also have the right to lodge a complaint with a data protection supervisory authority (Article 77 GDPR).

9. Further Information

In the context of the ordinary business contacts described here, we do not make decisions based solely on automated processing that produce legal effects or similarly significantly affect you within the meaning of Article 22 GDPR. Where necessary, we provide additional privacy information for specific processing situations, such as video surveillance, events or online services.