Privacy Policy

Table of contents

1. Name and address of the controller and the data protection officer

a) The controller

The controller within the meaning of the General Data Protection Regulation and other national data protection laws of the Member States of the European Union as well as other data protection regulations is:

SPRINTIS Schenk GmbH & Co. KG
Ludwig-Weis-Straße 11
97082 Würzburg
Tel.: +49 (0) 931 40 41 6-288
Email: [email protected]
Website: www.sprintis.com

b) The data protection officer

You can contact the data protection officer of the controller as follows: SiDIT GmbH, Langgasse 20, 97261 Güntersleben, [email protected]

2. Definitions

We have designed our privacy policy in accordance with the principles of clarity and transparency. However, if there are any uncertainties regarding the use of various terms, the corresponding definitions can be found here.

3. Legal basis for data processing

a) Processing of personal data in accordance with the GDPR

We only process your personal data, such as your surname and first name, your email address and IP address, etc., if there is a legal basis for doing so. In accordance with the General Data Protection Regulation, the following provisions in particular apply here:

• Art. 6 (1) (a) GDPR: The data subject has given consent to the processing of their personal data for one or more specific purposes.
• Art. 6 (1) (b) GDPR: Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
• Art. 6 (1) (c) GDPR: Processing is necessary for compliance with a legal obligation to which the controller is subject.
• Art. 6 (1) (d) GDPR: Processing is necessary to protect the vital interests of the data subject or of another natural person.
• Art. 6 (1) (e) GDPR: Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
• Art. 6 (1) (f) GDPR: Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child

However, we will always point out the legal basis for the processing of your personal data at the relevant points in this privacy policy.

b) Consent of the legal guardian pursuant to Art. 8(1) sentence 2 alternative 2 GDPR

A legal guardian must consent to all data processing within the scope of this website for which the consent of a minor under the age of 16 is required. Information on the individual data processing operations, their purposes and the categories of data concerned for which the consent of the data subject is required can be found in the privacy policy. You can revoke your consent at any time by sending a written declaration of revocation to the contact details of the controller. Processing remains lawful until revocation.

c) Processing of information in accordance with Section 25(1) TTDSG

We also process information in accordance with Section 25 (1) TTDSG by storing information on your terminal equipment or accessing information that is already stored on your terminal equipment. This may be personal information or non-personal data, e.g. cookies, browser fingerprints, advertising IDs, MAC addresses and IMEI numbers. An end device is any device connected directly or indirectly to the interface of a public telecommunications network for the purpose of sending, processing or receiving messages, Section 2 (2) No. 6 TTDSG.

We generally process this information on the basis of your consent, Section 25(1) TTDSG.

If an exception under Section 25(2)(1) and (2) TTDSG applies, we do not require your consent. Such an exception applies if we access or store the information exclusively for the purpose of transmitting a message via a public telecommunications network or if this is absolutely necessary in order for us to provide a telemedia service that you have expressly requested. You can revoke your consent at any time.

We hereby inform you that revoking your consent does not affect the lawfulness of the processing carried out on the basis of your consent until revocation.

4. Disclosure of personal data

The disclosure of personal data also constitutes processing within the meaning of section 3 above. However, we would like to take this opportunity to inform you separately about the issue of disclosure to third parties. The protection of your personal data is very important to us. For this reason, we are particularly careful when it comes to disclosing your data to third parties.

Data is therefore only passed on to third parties if there is a legal basis for processing. For example, we pass on personal data to persons or companies who work for us as processors in accordance with Art. 28 GDPR. A processor is anyone who processes personal data on our behalf – i.e. in particular in a relationship of instruction and control with us.

In accordance with the provisions of the GDPR, we conclude a contract with each of our processors to oblige them to comply with data protection regulations and thus guarantee comprehensive protection for your data.

5. Storage period and deletion

We will delete your personal data if it is no longer necessary for the purposes for which it was collected or otherwise processed, and if the processing is not necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise or defence of legal claims.

6. SSL or TLS encryption

This website uses SSL or TLS encryption for security reasons and to protect the transmission of confidential content, such as enquiries that you send to us as the website operator. You can recognise an encrypted connection by the fact that the address line of the browser changes from "http://" to "https://" and by the lock symbol in your browser line.

If SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

7. Cookies

We use cookies on our website. Cookies are small data packets that your browser automatically creates and that are stored on your device when you visit our website. These cookies are used to store information relating to the device used. When using cookies, a distinction is made between technically necessary cookies and "additional" cookies. Technically necessary cookies are those that are absolutely necessary to provide an information society service that you have expressly requested.

a) Technically necessary cookies

In order to make the use of our website more pleasant for you, we use technically necessary cookies. These can be so-called session cookies (e.g. language and font selection, shopping basket, etc.), consent cookies, cookies to ensure server stability and security, or similar. The legal basis for the cookies is Art. 6 (1) (f) GDPR, our legitimate interest in the error-free operation of the website and our interest in providing you with optimised services.

b) Other cookies

Other cookies include cookies for statistical, analysis, marketing and retargeting purposes. We use these cookies on the basis of your consent in accordance with Art. 6 (1) (a) GDPR. You can revoke your consent to the use of cookies at any time. We would like to inform you that revoking your consent does not affect the lawfulness of the processing carried out on the basis of your consent until revocation. To do this, you can either edit your cookie settings on our website, deactivate the use of cookies in your browser settings (although this may also restrict the functionality of the online offer) or set an opt-out for the relevant service in individual cases.

We will inform you of the legal basis on which this data is processed for the respective services within the privacy policy.

Cookie settings

8. Cookie banner

To obtain consent for the cookies we use, we use the cookie banner developed by SPRINTIS Schenk GmbH & Co. KG. This banner itself sets a so-called consent cookie to query and process the respective consent status. This consent cookie is technically necessary and is therefore used on the basis of our legitimate interest pursuant to Art. 6 (1) (f) GDPR, § 25 (1) TTDSG.

Information about our cookies: https://www.sprintis.com/?cmpscreencookie

9. Collection and storage of personal data and the nature and purpose of its use

a) External hosting

Our website is hosted by Profihost GmbH, Expo Plaza 1, 30539 Hanover, Germany. For this reason, all personal data collected on our website is stored on our host's servers, unless an external third-party service is integrated. This may include your IP address, email address, communication data or similar. You can find out exactly what personal data this is below in the individual functions and services we describe. If we use an external third-party service, this will be made clear in the description of the respective service or tool.

The host only processes your data on our instructions and to the extent necessary to provide the services on the website. The host does not process the data for its own purposes. We have concluded a contract with the host for order processing.

Further information on data protection can be found at:
https://www.profihost.com/datenschutz/

b) Shop system

We use the shop system from OXID ESALES AG, Bertoldstraße 48, 79098 Freiburg, Germany, to offer our goods. The data you provide will therefore also be processed by our shop provider as part of the operation of the shop system. In addition, the shop system may set further cookies. For this reason, we have concluded a contract for order data processing/standard contractual clauses with them.

Further information on data protection can be found at:
https://www.oxid-esales.com/en/privacy/

c) When visiting the website

When you visit our website, the browser used on your device automatically sends information to our website's server. This information is temporarily stored in a so-called log file. The following information is collected without your intervention and stored until it is automatically deleted:

• IP address of the requesting computer
• Date and time of access
• Name and URL of the file accessed
• Website from which access is made (referrer URL)
• Browser used and, if applicable, the operating system of your computer and the name of your access provider

We process the aforementioned data for the following purposes:

• Ensuring smooth connection to the website
• Evaluating system security and stability
• Analysing errors

Data that allows conclusions to be drawn about your person, such as your IP address, will be deleted after 7 days at the latest. If we store the data beyond this period, it will be pseudonymised so that it can no longer be traced back to you.

The legal basis for data processing is Art. 6 (1) (f) GDPR. Our legitimate interest follows from the purposes listed above for data collection. Under no circumstances do we use the collected data for the purpose of drawing conclusions about your person.

d) CloudFlare

On our website, we use a so-called Content Delivery Network ("CDN") and the web firewall to defend against DDoS attacks from the technology service provider Cloudflare Inc., 101 Townsend St. San Francisco, CA 94107, USA ("Cloudflare").

Cloudflare may process IP addresses, information regarding the routing of data traffic, system configuration and other information about traffic destined for or originating from websites.

For the CDN, the transfer of information between the browser and our server is technically routed via the Cloudflare network so that we can optimise the loading speeds of our website. The web firewall is designed to prevent fraudulent transactions, unauthorised access to services and other illegal activities.

Processing is carried out in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in the secure and efficient provision and improvement of the stability and functionality of our website.

We have concluded the standard contractual clauses (Data Processing Addendum) with Cloudflare.

Further information can be found in Cloudflare's privacy policy at:
https://www.cloudflare.com/privacypolicy/

e) Contractual relationship

(1) Conclusion of contract

Within the framework of establishing the contractual relationship, only the personal data that is absolutely necessary for the execution of the contract will be processed in accordance with Art. 6 para. 1 sentence 1 lit. b GDPR. If you provide additional voluntary information, this will only be processed on the basis of your consent in accordance with Art. 6 (1) (a) GDPR. We use this voluntary information to offer a customer-friendly service and to continuously improve it.

(2) Customer account

You have the option of creating a customer account with us. In addition to your personal data for contract processing, your other voluntary information and your past purchases from us will also be stored and processed. You can access this information at any time to get an overview of your purchases from us. This data is used to enable you to easily log in with your login details for your next purchase. It is also intended to help you manage your purchasing activities at . The legal basis for this is your consent in accordance with Art. 6 (1) (a) GDPR.

You can change or delete your data in your customer account at any time and also delete the account entirely. If you make use of this function, your customer account and all the data it contains will be deleted immediately.

(3) Transfer of data for shipping

We pass on the data necessary for shipping our goods (first name and surname, address, email address, telephone number if required for shipping goods) to the relevant shipping service provider for notification/coordination of the delivery of the goods and for delivery of the goods. The legal basis for the transfer is Art. 6 (1) (b) GDPR. In this context, we pass on your data to one of the following shipping service providers. You will then receive further information on the processing of your data from them:

DHL

DHL Paket GmbH, Sträßchensweg 10, postcode/city: 53113 Bonn, telephone: +49/ (0) 228/ 18 20, email: impressum.paket[at]dhl.com;
https://www.dhl.de/en/toolbar/footer/datenschutz.html

DHL Freight

DHL Freight GmbH, Godesberger Allee 102-104, 53175 Bonn, Germany, telephone: +49/ (0) 228/377880, [email protected];

https://www.dhl.de/en/toolbar/footer/datenschutz.html

DPD

DPD Deutschland GmbH, Wailandtstraße 1, 63741 Aschaffenburg, Germany, [email protected], Tel. 06021 843-0,
https://www.dpd.com/de/en/datenschutz/

UPS

UPS Europa SA, Ave Ariane 5, Brussels, B-1200, Belgium,
https://www.ups.com/de/en/support/shipping-support/legal-terms-conditions/privacy-notice

VS Logistic

VS Verwaltungs- und Beteiligungsges. mbH, Alfred-Nobel-Str. 11, 97080 Würzburg, Germany, Tel. +49 (0)931 / 900 74-0,
https://www.vs-logistics.com/j/privacy

DACHSER

DACHSER SE, Thomas-Dachser-Straße 2, 87439 Kempten, Germany, Tel.: +49 831 5916 0, [email protected],
https://www.dachser.de/de/datenschutz-277#!/collapsible-846

Schäflein

Schäflein AG, Am Etzberg 7, 97520 Röthlein, Tel.: +49 (0) 9723 9069-0, Germany, info@schäflein.de
https://www.schaeflein.de/en/privacy-policy

(4) Disclosure of data

when using online payment service providers If, during the ordering process, you decide to pay using one of the online payment service providers we offer, your contact details will be transmitted to them as part of the order you have placed. The lawfulness of the transfer of data is based on Art. 6 (1) (b) GDPR, for the purpose of implementing the payment method you have chosen, and our legitimate interests pursuant to Art. 6 (1) (f) GDPR, to enable user-friendly and uncomplicated payment processing.

The personal data transmitted to the online payment service provider usually includes your first name, surname, address, telephone number, IP address, email address, or other data required for order processing, as well as data related to the order, such as the number of items, item number, invoice amount and taxes as a percentage, invoice information, etc. This transfer is necessary to process your order with the payment method you have selected, in particular to confirm your identity, to administer your payment and the customer relationship.

Please note, however, that personal data may also be passed on by the online payment service provider to service providers, subcontractors or other affiliated companies, insofar as this is necessary to fulfil the contractual obligations arising from your order or if the personal data is to be processed on behalf of the provider.

Depending on the selected payment method, e.g. invoice or direct debit, the personal data transmitted to the provider will be forwarded by the provider to credit agencies. This transmission serves to verify your identity and creditworthiness in relation to the order you have placed. For information on which credit agencies are involved and which data is generally collected, processed, stored and passed on by the respective provider, please refer to the respective privacy policies of the providers:

PayPal

PayPal (Europe) S.à.r.l. & Cie. S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg at
https://www.paypal.com/de/webapps/mpp/ua/privacy-full

Unzer

Unzer Luxembourg S.A: société anonyme, 1, Place du Marché, L-6755 Grevenmacher, Tel.: +352-2763 9919, [email protected]
https://www.unzer.com/en/data-protection

(5) Credit card payment

If you choose to pay by credit card, we collect and process your personal data and forward it to the card-issuing institution for payment processing and to comply with legal requirements, such as customer authentication in accordance with the EU Payment Services Directive PSD2. This involves the following data:

(personal data collected as part of a payment process such as purchase on account, purchase by instalments or direct debit, in which goods or services are paid for – e.g. title, first name, surname, billing address, delivery address, account details, email address, telephone number, date of birth, IP address together with the data required to execute the transaction (items, invoice amount, interest, number of instalments, due dates, total amount, invoice number, tax amount, currency, order date and time) and creditworthiness data obtained from credit agencies and other cooperation partners in a manner permissible under data protection law).

This data is forwarded for payment processing in accordance with Art. 6 (1) (b) GDPR and to fulfil our legal obligation to carry out strong customer authentication in accordance with Art. 6 (1) (c) GDPR in conjunction with Directive EU 2015/2366 (PSD 2) and the Payment Services Supervision Act (ZAG) for the purpose of combating money laundering and prosecuting criminal offences.

The technical processing of credit card payments is carried out by the payment service provider Unzer E-Com GmbH, Vangerowstraße 18, 69115 Heidelberg, Germany. This provider has been commissioned for the technical control of payment transactions, including the implementation of the 3D Secure 2.0 procedure in accordance with Art. 28 GDPR. Other recipients of the data are the banks involved (on the one hand, the card-issuing bank – the issuer – and, on the other hand, the merchant's credit card-accepting bank – the acquirer).

The data protection provisions of Unzer E-Com GmbH can be found at
https://www.unzer.com/en/data-protection//

f) Newsletter

Newsletter content and registration data

Our newsletter will only be sent to you, statistical surveys and analyses will only be carried out, and the registration process will only be logged if you have subscribed to it and given your consent in accordance with Art. 6 (1) (a) GDPR and § 25 (1) TTDSG. The content of the newsletter is described in detail when you subscribe to the newsletter. To subscribe to the newsletter, you only need to provide your email address. If you provide further voluntary information, such as your name and/or gender, this will be used exclusively for the personalisation of the newsletter addressed to you. Double opt-in and logging For security reasons, we use the double opt-in procedure for registration for our newsletter so that no one can register with someone else's email address. After registering for our newsletter, you will therefore first receive an email asking you to confirm your registration. Your registration will only become effective once you have confirmed it. Furthermore, your registration for the newsletter will be logged. This logging includes the storage of the time of registration and confirmation, the data you have provided and your IP address. If you make changes to your data, these changes will also be logged.

Revocation

If you no longer wish to receive our newsletter, you can revoke your consent at any time for the future. To do so, you can click on the link to unsubscribe from the newsletter at the end of each newsletter or send us an email to the following email address: [email protected] The revocation of consent does not affect the lawfulness of the processing carried out on the basis of the consent until revocation.

Use of Maileon

If you subscribe to our newsletter, this is done exclusively with your express consent in accordance with Art. 6 (1) lit. a GDPR as part of a double opt-in procedure. Your email address is processed solely for the purpose of sending our newsletter and measuring its success (e.g. opens, clicks) so that we can tailor our offering to the interests of our subscribers.

The newsletter is sent and statistically evaluated using Maileon, a service provided by XQueue GmbH, Christian-Pleß-Str. 11-13, 63069 Offenbach am Main. We have concluded a contract with Maileon for order processing in accordance with Art. 28 GDPR. The data collected from you when you subscribe to the newsletter is stored on servers in Germany and processed exclusively on our behalf.

Further information can be found in Maileon's privacy policy:
https://maileon.com/privacy-policy/

The use of the mailing service provider Maileon is based on our legitimate interests pursuant to Art. 6 para. 1 sentence 1 lit. f GDPR. Our interest is in the use of a user-friendly and secure newsletter system that serves both our business interests and meets the expectations of users.

g) Contact form

We provide a form on our website so that you can contact us at any time. To use the contact form, you must provide a name for a personal salutation and a valid email address so that we know who the enquiry comes from and can process it.

If you send us enquiries via the contact form, your details from the enquiry form, including the contact details you provided there and your IP address, will be processed in accordance with Art. 6 (1) (b) and (f) GDPR for the purpose of implementing pre-contractual measures taken in response to your enquiry or for the purpose of safeguarding our legitimate interests, namely the exercise of our business activities.

The enquiries and the associated data will be deleted no later than 3 months after receipt, unless they are required for a further contractual relationship.

h) Application form

We provide a form on our website that you can use to apply for a job with us. Your personal data from the application will be processed in accordance with our data protection policy for applicants.

This form is used in our legitimate interest in the simple and secure transmission of your application documents, Art. 6 (1) (f) GDPR.

i) Chat

We use a chat service from Tawk.to on our website. This is live chat software from tawk.to Inc. (187 East Warm Springs Rd, SB298, Las Vegas, NV, 89119).

The following data is collected and processed from you during the live chat.

• Chat history
• Name provided
• IP address
• Country of origin
• Pages visited
• Duration of visit to the pages
• Further personal information, depending on the details provided (e.g. email address, telephone number)

The chat is used for real-time communication.

Processing is carried out on the basis of Art. 6(1)(f) GDPR in accordance with our legitimate interest in direct and customer-friendly communication.

Further information about tawk.to can be found here: https://www.tawk.to/data-protection/gdpr-2/

We have concluded the standard contractual clauses with tawk.to.

j) Use of Google Maps

Our website uses the Google Maps API. By using Google Maps, information about your use of this website (including your IP address) may be transmitted to a Google server (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) in the USA and stored there.

Google may transfer the information obtained through Maps to third parties if required by law or if third parties process this data on behalf of Google. However, your IP address will not be associated with any other data held by Google. Nevertheless, we must point out that it would be technically possible for Google to identify individual users based on the data received.

We have no influence on whether your personal data and personality profiles are processed by Google for other purposes. If you want to avoid this at all costs, you can deactivate the Google Maps service and thus prevent data transfer to Google. To do this, simply deactivate JavaScript in your browser. In this case, no data will be transferred, but you will no longer be able to use the map display on our website.

The Google privacy policy can be found here.[https://www.google.com/policies/privacy/?hl=de]

By integrating Google Maps, Google Fonts are also dynamically reloaded without the website operator or visitor actively determining this. These web fonts are integrated via a server call, usually a Google server in the USA. This may result in the following information being transmitted to the server and stored by Google:

• Name and version of the browser used
• Website from which the request was triggered (referrer URL)
• Operating system of your computer
• Screen resolution of your computer
• IP address of the requesting computer
• Language settings of the browser or operating system used by the user

For more information, please refer to Google's privacy policy, which you can access here: www.google.com/fonts#AboutPlace:about www.google.com/policies/privacy/

The use of Google Maps is a service for you so that you can locate our premises and, if necessary, plan your visit to us more effectively. The use of Google Maps is based on your consent in accordance with Art. 6 (1) (a) GDPR.

k) Google Tag Manager

We use Google Tag Manager from Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) on our website. Google Tag Manager is an administration and management tool in which other tracking and/or statistics tools can be centrally managed and played out.

When you visit our website and give your consent in accordance with Art. 6 (1) (a) GDPR, Google Tag Manager collects and processes your IP address, which may also be transferred to the USA. However, Google Tag Manager does not create any user profiles or analyses itself.

The Google privacy policy can be found here. https://www.google.com/policies/privacy/?hl=de

10. Analysis and tracking tools

We use the analysis and tracking tools listed below on our website. These serve to ensure the ongoing optimisation of our website and to design it in line with requirements.

We use these tools on the basis of your consent in accordance with Art. 6 (1) (a) GDPR. You can revoke your consent at any time by changing your cookie settings. Processing remains lawful until revocation.

The respective data processing purposes and data categories can be found in the corresponding tools. We would like to point out that we have no influence on whether and to what extent the service providers carry out further data processing.

l) Google Analytics

We use Google Analytics, a web analytics service provided by Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, hereinafter "Google") on our website.

Google Analytics uses cookies in this context (see section 7). The information generated by the cookie about your use of this website, such as

• Name and version of the browser used
• operating system of your computer
• Website from which access is made (referrer URL)
• IP address of the requesting computer
• Time of the server request

are usually transferred to a Google server in the USA and stored there.

Your IP address is automatically anonymised by Google before it is recorded via EU domains and servers. Therefore, your IP address is not logged or stored.

On our behalf, Google will use this information to evaluate your use of our website, to compile reports on website activity and to provide us with other services relating to website activity and internet usage. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data.

We have concluded a contract with Google for order processing. Please click here for an overview of data protection at Google. [https://support.google.com/analytics/answer/6004245]

m) Google Remarketing

We use the remarketing function of Google Analytics to target advertising campaigns – including Google AdWords campaigns – to visitors to our website.

Based on your previous visits to our website, relevant advertisements will be presented to you when you visit other websites in the Google Display Network.

The DoubleClick cookie enables Google, ourselves and other third-party providers to display targeted advertising that corresponds to your interests as determined by your previous visits to our website and/or other websites. This advertising may be displayed on websites belonging to Google and/or other operators of the Google advertising network. We also use Google Analytics advertising features to analyse the effectiveness of our own advertising campaigns.

If you have agreed in your Google account that your web and app browsing history will be linked to your Google account and that information from your Google account will be used to personalise ads, Google will use data about you together with Google Analytics data to create target group lists for cross-device remarketing. To do this, Google Analytics first collects Google-authenticated IDs for you as a user on our website that are linked to your Google account. Google Analytics then temporarily links these IDs to Google Analytics data to optimise our target groups.

Please click here for an overview of data protection at Google.
https://support.google.com/analytics/answer/6004245

n) Google Ads conversion tracking

We use Google Ads, an online advertising programme from Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), on our website. Conversion tracking is also used in this process. With this tool, Google Ads places a cookie on your device when you visit our website via a Google advertisement.

The cookie does not serve any personal traceability purpose. If you visit our website as a user and the cookie is still active, we and Google can recognise that you clicked on the corresponding ad and were redirected to our site. Each Google Ads customer is assigned a different cookie. Cookies cannot be tracked across the websites of Ads customers.

The data collected by conversion cookies is used to create conversion statistics for Ads customers. As a Google Ads customer, we can thus find out the total number of users who responded to our ad and were then redirected to a website that has been tagged with a conversion tracking tag. This allows us to measure the success of individual advertising measures. We do not receive any information during this process that could be used to personally identify you as a user.

When using Google Ads, your browser automatically establishes a direct connection to the Google server and, if you have a Google account and are logged in, can assign the visit to your account. If you do not have a Google account, Google will assign you your own ID. We have no influence on what further data Google collects and stores.

For more information about Google's privacy policy, please visit:
http://www.google.de/policies/privacy/

o) LinkedIn conversion tracking

We use LinkedIn's conversion tracking feature on our website. This allows us to target you with advertisements after you have visited our website. In addition, LinkedIn provides reports on how successful our advertisements are and how users generally interact with our site. If you have logged in via LinkedIn before visiting our site, this will be recognised as part of conversion tracking and you will be associated with our site as a visitor with your LinkedIn account.

Further information can be found in LinkedIn's privacy policy:
https://www.linkedin.com/legal/privacy-policy?_l=de_DE

You also have the option to opt out of interest-based advertising via LinkedIn. This can be done via the following link:
https://www.linkedin.com/psettings/enhanced-advertising

p) Microsoft Advertising Conversion Tracking

We use the Microsoft Advertising advertising programme on our website, which is provided and operated by Microsoft Ireland Operations Limited, One Microsoft Place, South Country Business Park, Leopardstown, Dublin, Ireland 18, D18 P521 ("Microsoft").

With the help of the Microsoft Advertising programme, we can place advertisements in various search engines and networks. In order to identify which advertisement or keyword brought you to our website, we have implemented Universal Event Tracking (UET) on our site. This is a conversion tracking tag that allows us to learn more about your user behaviour on our websites. We use this information to optimise our advertisements and offers and better tailor them to your needs.

Microsoft collects, processes and uses information via cookies to create usage profiles using pseudonyms. These usage profiles are used to analyse visitor behaviour and are used to display advertisements. No personal information about the user's identity is processed.

Microsoft Advertising may collect the following information, among other things:

• Information about the browser you use and the device you use
• Identifiers (tags) assigned by Microsoft
• Website or advertisement from which access is made (referrer URL)
• IP address of the requesting computer
• Access duration and time.

We have concluded a contract with Microsoft for order processing, which ensures that your data will be processed in accordance with European data protection standards.

It cannot be ruled out that personal data may also be processed by the service provider in the USA, as the parent company Microsoft Corporation has its headquarters in the USA.

Further information on data protection and the cookies used by Microsoft can be found on the Microsoft website: https://privacy.microsoft.com/de-de/privacystatement

q) Microsoft Clarity

We use the analysis service "Microsoft Clarity" from Microsoft Corporation, One Microsoft Way, Redmond, WA 98052 USA on our website.

Here, usage and user-related information, such as IP address, location, time or frequency of visits to our website, is transferred to a Microsoft server in the USA and stored there. We have activated the anonymisation function at Microsoft so that your IP address is only processed in truncated form.

This data is used to evaluate your visit to our website and your usage behaviour so that we can improve and optimise our services.

We have agreed on standard contractual clauses with Microsoft.

Further information on data protection can be found at
https://privacy.microsoft.com/de-de/privacystatement

r) Meta Pixel

We use the "conversion pixel" or visitor action pixel from Meta Platforms Ireland Ltd. (4 Grand Canal Square, Grand Canal Harbour, Dublin 2 Ireland). By calling up this pixel from your browser, Meta Platforms can subsequently recognise whether a Facebook advertisement was successful, i.e. whether it led to an online purchase.

We only receive statistical data from Meta Platforms that is not related to any specific person. This allows us to measure the effectiveness of Facebook advertisements for statistical and market research purposes. In particular, if you are logged in to Facebook, we refer you to their privacy policy at https://www.facebook.com/about/privacy/

11. Rights of the data subject

You have the following rights:

a) Information

In accordance with Art. 15 GDPR, you have the right to request information about your personal data processed by us. This right to information includes information about

• the purposes of processing
• the categories of personal data
• the recipients or categories of recipients to whom your data has been or will be disclosed
• the planned storage period or at least the criteria for determining the storage period
• the existence of a right to rectification, erasure, restriction of processing or objection
• the existence of a right to lodge a complaint with a supervisory authority
• the origin of your personal data, if it was not collected by us
• the existence of automated decision-making, including profiling and, where applicable, meaningful information about its details

b) Rectification

Under Article 16 of the GDPR, you have the right to have inaccurate or incomplete personal data stored by us corrected without delay.

c) Erasure

Under Article 17 of the GDPR, you have the right to request the immediate erasure of your personal data stored by us, unless further processing is necessary for one of the following reasons:

• the personal data is still necessary for the purposes for which it was collected or otherwise processed
• for exercising the right of freedom of expression and information
• for compliance with a legal obligation which requires processing by European Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
• for reasons of public interest in the area of public health pursuant to Art. 9(2)(h) and (i) and Art. 9(3) GDPR
• for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes pursuant to Art. 89(1) GDPR, insofar as the right referred to in section a) is likely to render impossible or seriously impair the achievement of the objectives of this processing
• for the establishment, exercise or defence of legal claims

d) Restriction of processing

You may request the restriction of the processing of your personal data for one of the following reasons in accordance with Art. 18 GDPR:

• You dispute the accuracy of your personal data.
• The processing is unlawful and you refuse to have the personal data deleted.
• We no longer need the personal data for the purposes of processing, but you need it for the assertion, exercise or defence of legal claims.
• You object to the processing pursuant to Art. 21(1) GDPR.

e) Notification

If you have requested the rectification or erasure of your personal data or a restriction of processing pursuant to Art. 16, Art. 17(1) and Art. 18 GDPR, we will inform all recipients to whom your personal data has been disclosed, unless this proves impossible or involves disproportionate effort. You may request that we inform you of these recipients.

f) Transfer

You have the right to receive your personal data that you have provided to us in a structured, commonly used and machine-readable format.

You also have the right to request the transfer of this data to a third party, provided that the processing was carried out using automated procedures and is based on consent in accordance with Art. 6 (1) (a) or Art. 9 (2) (a) or on a contract in accordance with Art. 6 (1) (b) GDPR.

g) Revocation

In accordance with Art. 7(3) GDPR, you have the right to withdraw your consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. In future, we may no longer continue the data processing that was based on your withdrawn consent.

h) Complaint

In accordance with Art. 77 GDPR, you have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data violates the GDPR.

i) Objection

If your personal data is processed on the basis of legitimate interests pursuant to Art. 6 (1) (f) GDPR, you have the right to object to the processing of your personal data pursuant to Art. 21 GDPR, provided that there are reasons for this arising from your particular situation or the objection is directed against direct marketing. In the latter case, you have a general right of objection, which we will implement without you having to specify your particular situation. If you wish to exercise your right of revocation or objection, simply send an email to [email protected]

j) Automated decision-making in individual cases, including profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision

i. is necessary for the conclusion or performance of a contract between you and us

ii. is authorised by European Union or Member State law to which we are subject and that law provides for appropriate measures to safeguard your rights and freedoms and legitimate interests

iii. is based on your explicit consent

However, these decisions may not be based on special categories of personal data pursuant to Art. 9 (1) GDPR, unless Art. 9 (2) (a) or (g) GDPR applies and appropriate measures have been taken to protect your rights and freedoms and your legitimate interests.

With regard to the cases referred to in i) and iii), we take appropriate measures to safeguard your rights and freedoms and your legitimate interests, including at least the right to obtain human intervention on our part, to express your point of view and to contest the decision.

12. Changes to the privacy policy

If we change the privacy policy, this will be indicated on the website.

As of 26 September 2025