Datenschutzerklärung (Stand 06. Juli 2020)

We process your personal data for the technical provision of our website on the basis of the following legal principles:

· for the execution of a contract or for the implementation of pre-contractual measures in accordance with Article 6(1)(b) GDPR, if you visit our website to find out about our products and our events; and

· to safeguard our legitimate interests in accordance with Article 6(1)(f) GDPR, in order to make the website available to you from a technical point of view. Our legitimate interest lies in being able to provide you with an attractive, technically functioning and user-friendly website and to take measures to protect our website against cyber risks and to prevent cyber risks arising for third parties from our website.

1.2. Statistical analysis of website usage and increase in reach In order to statistically analyse the use of our website, we use Google Analytics and therefore cookies, which enable an analysis of your surfing behaviour. This enables us to improve the quality of our website and its content. We learn how the website is used and are thus able to constantly optimise our offering.

The information obtained in the course of the statistical analysis of our website is not combined with your other data collected within the framework of the website.

Our processing of your personal data to statistically analyse the use of our website is based on the following legal principles:

· Your consent according to Article 6(1)(a) GDPR.

· With regard to the use of tag managers to install cookies to protect our legitimate interests in accordance with Article 6(1)(f) GDPR, our legitimate interest lies in measuring the reach of our website, statistically analysing the use of our website and thereby enabling the optimisation of our web offering in order to be able to offer you a user-friendly website oriented to your usage behaviour.

a. Google Tag Manager On our website we use Google Tag Manager provided by Google Inc. Google Tag Manager is a solution that allows marketers to manage website tags through an interface. The Google Tag Manager service itself (which implements the tags) is a cookie-less domain and does not collect any personal data. The Google Tag Manager service triggers other tags which themselves may collect data. Google Tag Manager does not access this data. If disabled at the domain or cookie level, it will remain disabled for all tracking tags implemented with Google Tag Manager.

b. Adobe Typekit We use Adobe Typekit to display fonts on our website. Adobe Typekit is a service enabling access to a font library provided by Adobe Systems Incorporated, 345 Park Avenue, San Jose, CA 95110-2704, USA (Adobe). When you access a page, your browser loads the required web fonts into your browser

cache to display text and fonts correctly. In the course of providing the Typekit service, no cookies are placed or used to provide the fonts. In order to provide the Typekit service, Adobe may collect font information that is used to identify the website itself and the associated Typekit account. Information is also collected about the operating system, the browser and the browser version you use, as well as the use of AdBlockers. Further information can be found on the information page on data protection at Adobe Typekit as well as in the Adobe privacy policy.

c. Google Analytics On our website we use the Google Analytics, a web analysis service provided by Google Inc. Google Analytics uses cookies, which are text files placed on your computer, to help the website analyse how users use the website. The information generated by the cookie regarding your use of our website is usually transferred to a Google server in the USA where it is stored. If IP anonymisation is activated on our website, your IP address will be shortened by Google beforehand within the member states of the European Union or other signatories to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transferred to a Google server in the USA and shortened there. Google uses this information on our behalf to evaluate your use of the website in order to compile reports on website activities and provide other services related to website and Internet use to the website operator. The IP address sent by your browser within the scope of Google Analytics will not be linked to any other data held by Google.

On our website we use Google Analytics with the extension “_anonymizeIp()”. This means that IP addresses are further processed in a shortened form, thereby excluding the possibility of direct personal references.

We process your personal data within the framework of Google Analytics on the legal basis of a consent granted by you in accordance with Article 6(1)(a) GDPR.

You can revoke a consent once given by

· preventing the storage of cookies by selecting the appropriate settings on your browser software; however, please note that if you do so, you may not be able to use all the functions of this website to their full extent;

· downloading and installing the browser plug-in available at the following link http://tools.google.com/dlpage/gaoptout?hl=en or

· clicking on this link to prevent Google Analytics from collecting data on our website in the future. An opt-out cookie will then be stored on your device. Please note that you must activate the opt-out cookie in every browser you use on all of your end devices and that you may need to reactivate it once you delete all cookies in a browser.

Further information on the terms of use of and data protection at Google Analytics can be found at https://marketingplatform.google.com/about/analytics/terms/us/, and https://policies.google.com/?hl=en-GB&gl=de

d. Google Ads DoubleClick On our site, we also use Google Ads DoubleClick to register and report your actions on the website after you view or click on one of a provider’s ads; the purpose of this is to measure the effectiveness of an ad and display targeted advertising to you. The Google Analytics cookie is also used for this purpose when you visit our website. In this case, both cookies automatically enable interest-based advertising by means of a pseudonymous cookie ID and on the basis of the pages you visit.

Any further processing of data only takes place if you have given Google your consent to link your web and app browsing history to your Google account and use information from your Google account to personalise ads you see on the web. If in this case you are logged in to Google while visiting our website, Google will use your information along with Google Analytics data to create and define target audience lists for cross-device remarketing. To do this, your personal data is temporarily linked by Google with Google Analytics data in order to form target groups.

We process your personal data within the framework of Google Ads DoubleClick on the legal basis of a consent granted by you in accordance with Article 6(1)(a) GDPR.

You can revoke a consent once given by

· preventing the storage of cookies by selecting the appropriate settings on your browser software; however, please note that if you do so, you may not be able to use all the functions of this website to their full extent;

· activating the DoubleClick cookie via this link https://adssettings.google.com/anonymous?sig=ACi0TCgiir2wkIRCNHUQ4C_aW4yJgcu6sul8HGvp2SWcPktG3umS9aUyUB8koBhRzkzOqyaTC8gVbzveMWB_ZSyQwSqswXtstg&hl=en

Further information on the terms of use of and data protection at Google Ads DoubleClick can be found at https://policies.google.com/technologies/ads?hl=en.

e. YouTube YouTube, a service of Google Ireland Limited, is integrated for you on our website.

When you visit an individual page on this site that has a YouTube video embedded in it, your Internet browser will download information from YouTube to display the video and video controls. During this process, data (such as your IP address and the sub-page you visited) is transmitted to YouTube if you access a video by clicking on it specifically. YouTube content is integrated only in “enhanced data protection mode”. This is provided by YouTube itself and thus ensures that YouTube does not initially store any cookies on your device. If you have a YouTube account, YouTube can recognise which specific YouTube video sub-page you visited and, if necessary, link this information to your user profile, for example to suggest similar videos to you. The video does not need to be played in order for the data transmission to take place.

For more information on the terms of use of and data protection at YouTube, please visit https://policies.google.com/technologies/partner-sites?hl=en.

f. Social links

Links to services such as Pinterest, Instagram, Facebook and YouTube are integrated on the website. After clicking on the link, you will be redirected to the page of the respective provider, i.e. only then will user information be transferred to the respective provider. For information on how your data is handled when using the websites of other providers, please refer to the respective data protection statements of these provider

2. Active use of the website

In addition to the purely informational use of our website, you can also use our website in an active capacity to order one of our products, register for an event, subscribe to our newsletter or contact us. In addition to the above-mentioned processing of your personal data during informational use,

we then also process further personal data from you which we require to process your order or to process and answer your enquiry.

2.1. User enquiries In order to be able to process and answer your enquiries to us, e.g. via the contact form or to our e-mail address, we process the personal data provided by you in this context. In all cases this includes your name and e-mail address in order to send you an answer, as well as any other information you send us in the context of your message.

The processing of your personal data to answer user inquiries has the following legal basis:

· to safeguard our legitimate interests in accordance with Article 6(1)(f) GDPR; our legitimate interest lies in answering customer enquiries properly.

2.2. Compliance with legal regulations We process your personal data also to fulfil other legal obligations which apply to us in connection with the processing of the order. This includes in particular retention periods applicable under commercial, trade or tax law.

In these cases we process your personal data on the following legal basis:

· to fulfil a legal obligation to which we are subject in accordance with Article 6(1)(c) GDPR in connection with commercial, trade or tax law, insofar as we are obliged to record and store your data.

2.3. Legal enforcement We also process your personal data in order to assert our rights and enforce our legal claims. We likewise process your personal data to be able to defend ourselves against legal claims. Finally, we process your personal data to the extent that this is necessary to defend against or prosecute criminal offences.

We process your personal data for these purposes on the following legal basis:

· to safeguard our legitimate interests in accordance with Article 6(1)(f) GDPR, insofar as we assert legal claims or defend ourselves in legal disputes or we prevent or investigate criminal offences.

C. LINKS

Some sections of our websites contain links to third-party websites. These websites are subject to their own data protection principles. We are not responsible for the operation of these, including how they handle data. If you send information to or through such third-party sites, you should review the privacy policies of those sites before providing them with any personally identifiable information.

D. CATEGORIES OF RECIPIENTS

Initially, only our employees gain knowledge of your personal data. We also share your personal data, to the extent permitted or required by law, with other recipients who perform services for us in connection with our website. We limit the disclosure of your personal data to what is necessary, in particular to process your order. In some cases our service providers receive your personal data as processors and are then strictly bound by our instructions when handling your personal data. In some cases, the

Below is a list of the categories of recipients of your personal data:

· IT service providers for the administration and hosting of our website

· Debt collection agencies and legal advisers for the assertion of our claims

E. THIRD COUNTRY TRANSFER

During the use of Google’s tools, we transfer your shortened IP address to the USA. The data transfer is based on the EU Commission’s implementing decision (EU) 2016/1250 of 12 July 2016 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection provided by the EU-US data protection shield.

Apart from this, we do not transfer your personal data to countries outside the EU or EEA or to international organisations.

F. DURATION OF STORAGE

1. Informational use of the website

When using our website for purely informational purposes, we store your personal data on our servers exclusively for the duration of your visit to our website. After you have left our website, your personal data is deleted immediately.

Cookies installed by us are usually also deleted after you leave our website. This does not apply, however, to cookies for storing your cookie selection. These are stored for one year. Cookies from Google Analytics and/or its cookie integration via Google Ads DoubleClick remain stored for two years. According to the information available to us, cookies that become active through the use of YouTube are usually stored for up to eight months. However, you have the possibility to delete installed cookies yourself at any time.

2. Active use of the website

In the case of active use of our website, we store your personal data initially for the duration of answering your enquiry or for the duration of our business relationship.

In addition, we store your personal data until any legal claims arising from the relationship with you become statute-barred, in order to use it as evidence if necessary. The limitation period is usually between one and three years, but can also be up to 30 years.

When the statute of limitations comes into effect, we delete your personal data, unless there is a legal obligation to keep records, for example, under the German Commercial Code (Sections 238, 257 (4) HGB) or the German Fiscal Code (Section 147 (3) (4) AO). These retention obligations can be between two to ten years.

G. YOUR RIGHTS AS A DATA SUBJECT

In accordance with legal requirements you are entitled to the following rights as a data subject, which you can assert against us:

Right to information: According to Article 15 GDPR you are entitled at any time to request confirmation from us as to whether we are processing personal data relating to you; if this is the case, you are also entitled according to Article 15 GDPR to obtain information on this personal data

and certain other information (including purposes of processing, categories of personal data, categories of recipients, planned storage period, the origin of the data, the use of automated decision-making and, in the case of transfer to third countries, the appropriate guarantees), and to obtain a copy of your data.

Right to rectification: According to Article 16 GDPR you are entitled to demand that we correct the personal data stored about you if it is incorrect or inaccurate.

Right to erasure: According to Article 17 GDPR you are entitled to demand that we immediately delete personal data relating to you. The right to erasure among other things does not apply if the processing of the personal data is necessary for (i) the exercise of the right to freedom of expression and information, (ii) the fulfilment of a legal obligation to which we are subject (e.g. statutory retention obligations) or (iii) the assertion, exercise or defence of legal claims.

Right to restriction of the processing: According to Article 18 GDPR you are entitled to demand that we restrict the processing of your personal data.

Right to data portability: According to Article 20 GDPR you are entitled to demand that we provide you with the personal data you have provided to us, namely in a structured, common and machine-readable format.

Right of revocation: You have the right to revoke your consent to the processing of personal data at any time with effect for the future.

Right of appeal: According to Article 21 GDPR you are entitled to object to the processing of your personal data, meaning that we are obliged to stop processing your personal data. The right of objection exists only within the limits provided for in Article 21 GDPR. It is also possible that a termination of the processing may conflict with our interests, meaning that we are entitled to process your personal data despite your objection.

Right to lodge a complaint with a supervisory authority According to Article 77 GDPR you have the right to lodge a complaint with a supervisory authority, in particular in the Member State in which you are resident or you have your place of work or the place of the suspected infringement, if you consider that the processing of personal data relating to you is in breach of the GDPR. The right of appeal is without prejudice to any other administrative or judicial remedy.

The supervisory authority responsible for us is:

Der Hamburgische Beauftrage für Datenschutz und Informationsfreiheit Ludwig-Erhard Straße 22 20459 Hamburg Telephone: 040/428544040 Fax: 040/428544000 E-mail: mailbox@datenschutz.hamburg.de

However, we recommend that you always address a complaint to our data protection officer first.

Your requests to exercise your rights should, if possible, be addressed in writing to the above address or directly to our data protection officer.

H. SCOPE OF YOUR OBLIGATIONS TO PROVIDE DATA

In principle, you are not obliged to provide us with your personal data. However, if you do not do so, we will not be able to make our website available to you, we will not be able to answer your

enquiries to us and we will not be able to enter into a contract with you. Personal data that we do not necessarily need for the above-mentioned purposes of processing is marked with “if applicable” or another indication that it is voluntary information.

I. AUTOMATED DECISION MAKING / PROFILING

We do not use automated decision-making or profiling (an automated analysis of your personal circumstances).