PINPOOLS GmbH, Karlstraße 27, 40210 Düsseldorf, Germany
The controller responsible for the processing of personal data described in this Privacy Notice is:
PINPOOLS GmbH
Karlstraße 27
40210 Düsseldorf
Germany
Commercial Register: Amtsgericht Düsseldorf, HRB 98223
Email: [email protected]
Phone: +49 211 97633827
This Privacy Notice explains how PINPOOLS GmbH (“PINPOOLS”, “we”, “us”) processes personal data in connection with our website, platform and related business activities.
PINPOOLS provides its services primarily to businesses. Accordingly, the personal data we process generally relates to representatives, employees and other users acting on behalf of companies.
Depending on the processing activity, PINPOOLS may act either as a controller or as a processor under the GDPR.
PINPOOLS acts as controller where we determine the purposes and means of processing, for example in relation to our website, user accounts, security, business communications and marketing activities.
Where a customer uses the PINPOOLS platform and determines the purposes for which personal data contained in customer data is processed, PINPOOLS generally acts as processor on behalf of that customer.
Processing carried out by PINPOOLS as processor is governed by the applicable Data Processing Agreement (“DPA”) with the customer.
Information concerning subprocessors used for such processing is made available to customers in accordance with the applicable DPA.
As a B2B platform, PINPOOLS processes a limited amount of personal data.
Depending on your interaction with us, this may include:
Our platform primarily processes business and transactional information relating to companies, products, sourcing processes, offers, specifications and transactions.
Such information is not personal data under the GDPR where it does not relate to an identified or identifiable natural person.
Customer content may nevertheless contain personal data, for example where a business email address or username is associated with an activity or transaction. Where PINPOOLS processes such information on behalf of a customer, the processing is subject to the applicable DPA.
We process personal data for the following purposes.
Providing and administering the PINPOOLS platform
We process account information to create and administer user accounts, authenticate users, provide access to the platform, manage permissions and communicate in connection with use of the service.
The provision of basic account information is necessary to create and use a user account; without it, access to the platform cannot be provided.
Where the individual is a party to a contract with PINPOOLS, the legal basis is Article 6(1)(b) GDPR.
Where users access PINPOOLS on behalf of their employer or another organisation, processing is generally based on Article 6(1)(f) GDPR. Our legitimate interest is providing our services to our business customers and enabling their authorised users to use the platform.
Operating, analysing and improving our services
We may process information generated through the use of our services to operate, secure, analyse, develop and improve our services and to generate aggregated, anonymised or statistical information.
Information that has been anonymised so that it no longer relates to an identified or identifiable natural person is not personal data under the GDPR.
Where personal data is involved, processing is based on Article 6(1)(f) GDPR where applicable. Our legitimate interests include improving the functionality, reliability, performance and commercial development of our services.
Where PINPOOLS processes personal data on behalf of a customer, such processing remains subject to the customer’s instructions and the applicable DPA.
Security and prevention of misuse
We process technical information and account activity where necessary to protect our services, users and systems, investigate security events and prevent unauthorised access, fraud or misuse.
The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is maintaining the security and integrity of our systems and services.
Business enquiries and customer communication
Where you contact PINPOOLS, request a demonstration or communicate with us in a professional capacity, we process the information necessary to respond and manage the relevant business relationship.
Depending on the circumstances, the legal basis is Article 6(1)(b) GDPR or Article 6(1)(f) GDPR.
Our legitimate interests include responding to enquiries, establishing and maintaining business relationships and providing information about our services.
Compliance with legal obligations
We process personal data where necessary to comply with applicable legal obligations.
The legal basis is Article 6(1)(c) GDPR.
Customers may provide or generate information through the PINPOOLS platform relating to sourcing activities, products, specifications, suppliers, offers, prices, quantities, transactions and other business processes.
Such information is generally business or transactional data rather than personal data.
This Privacy Notice applies only to the extent that such information constitutes personal data.
Where personal data forms part of customer-controlled platform data and PINPOOLS processes that information on behalf of a customer, the customer is generally responsible for determining the purposes and legal basis of the processing and PINPOOLS acts as processor in accordance with the applicable DPA.
The use of customer and transactional data that does not constitute personal data is governed by PINPOOLS’ contractual arrangements with its customers. Where such information constitutes personal data, it is processed in accordance with this Privacy Notice and, where applicable, the relevant DPA.
When you access our website or platform, certain technical information may be processed automatically.
This may include:
We process this information where necessary to provide our website and services and to ensure their security and technical stability.
The legal basis is Article 6(1)(f) GDPR.
PINPOOLS uses cookies and similar technologies on its website and platform.
Technologies that are strictly necessary to provide a service requested by the user may be used without consent where permitted under Section 25(2) TDDDG.
Other technologies, in particular those used for analytics or marketing where consent is required, are activated only after consent has been obtained.
The legal bases in such cases are Article 6(1)(a) GDPR and Section 25(1) TDDDG.
Detailed information about the technologies currently used, their purposes and providers is available through our consent-management tool.
You can change or withdraw your consent at any time through the consent settings. Withdrawal takes effect for the future and does not affect the lawfulness of processing carried out before withdrawal.
Where you subscribe to marketing communications or our newsletter, we process your business contact information and marketing preferences for this purpose.
Where required, processing is based on your consent pursuant to Article 6(1)(a) GDPR.
Where electronic marketing to existing business customers is permitted without separate consent under applicable law, we may process the relevant business contact information for this purpose.
You may object to direct marketing or withdraw your consent at any time, including through the unsubscribe mechanism included in marketing communications.
We use selected service providers to support the operation of our business and services.
These may include providers in the following categories:
Where a provider processes personal data on our behalf, the provider is contractually bound in accordance with applicable data-protection law, including Article 28 GDPR where applicable.
Service providers may also act as subprocessors where PINPOOLS itself processes personal data on behalf of a customer.
We may additionally disclose personal data where required by law, regulatory authorities or courts, or where necessary to establish, exercise or defend legal claims.
Some of our service providers or their group companies may process personal data outside the European Economic Area.
Where personal data is transferred to a country outside the EEA, we ensure that a transfer mechanism recognised under Chapter V GDPR is available.
This may include:
Where required, additional technical, contractual or organisational safeguards are implemented.
Further information about applicable safeguards can be requested from [email protected].
PINPOOLS retains personal data only for as long as necessary for the relevant processing purpose.
Account information is generally retained for the duration of the relevant account or customer relationship and subsequently where necessary to comply with legal obligations or protect legitimate legal interests.
Business communications, contractual and accounting records are retained for the periods required under applicable commercial and tax law.
Technical and security information is retained for as long as necessary for system operation, security, abuse prevention and investigation of incidents.
Marketing information is retained until the relevant consent is withdrawn, an objection is received or the information is otherwise no longer required.
Where PINPOOLS acts as processor, retention and deletion of customer personal data is governed by the applicable contractual arrangements and customer instructions.
Personal data may be retained for longer where required by law or where necessary for the establishment, exercise or defence of legal claims.
PINPOOLS implements appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
Our measures are reviewed and adapted based on the nature of the information processed, the risks involved and technological developments.
Where PINPOOLS acts as controller, you may have the following rights under the GDPR, subject to the applicable legal requirements:
You can exercise these rights by contacting: [email protected]
Where PINPOOLS processes personal data solely on behalf of a customer, the relevant customer is generally responsible for handling data-subject requests. PINPOOLS will assist the customer as required under applicable law and the relevant DPA.
Where we process personal data on the basis of Article 6(1)(f) GDPR, you have the right to object to such processing on grounds relating to your particular situation.
We will then cease the processing unless we can demonstrate compelling legitimate grounds for continuing it that override your interests, rights and freedoms, or where processing is necessary for the establishment, exercise or defence of legal claims.
You may object to the processing of your personal data for direct marketing purposes at any time. Following such an objection, we will no longer process your personal data for that purpose.
Objections may be sent to [email protected].
You have the right to lodge a complaint with a data-protection supervisory authority.
The supervisory authority responsible for PINPOOLS is:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
Kavalleriestraße 2–4
40213 Düsseldorf
Germany
You may also contact the supervisory authority at your habitual residence or place of work.
We may update this Privacy Notice where our services, processing activities or applicable legal requirements change.
The current version will be made available on our website together with the date of the latest revision.
Where required by law, we will provide additional notice or obtain consent before materially different processing begins.
Last updated: 25 August 2025