Varovanje podatkov

We are delighted that you are interested in our company. Data protection is of particularly high importance to the management of KopfHolding GmbH.

The processing of personal data, such as the name, address, email address or telephone number of a data subject, is carried out in accordance with the General Data Protection Regulation and in compliance with the country-specific data protection provisions applicable to Kopf Holding GmbH. Through this Privacy Policy, our company wishes to inform the public about the nature, scope and purpose of the personal data collected,usedand processed by us on our websites. Furthermore, this Privacy Policy informs data subjects about the rights to which they are entitled.

As the controller, Kopf Holding GmbH has implementednumeroustechnical and organisational measures to ensure the most complete protection possible of personal data processed via its websites. Nevertheless, absolute protection cannot be guaranteed. For this reason, every data subject is free totransmitpersonal data to us by alternative means, for example by telephone.

1. Definitions

The Privacy Policy of Kopf Holding GmbH is based on the terminology used when the General Data Protection Regulation (GDPR) was enacted. Our Privacy Policy should be easy for the public, as well as our customers and business partners, to read and understand. To ensure this, we would like to explain the terminology used in advance.

Among other terms, we use the following terms in this Privacy Policy:

a) Personal data

Personal data means any information relating to an identified or identifiable natural person (hereinafter referred to as the “data subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data,an online identifier or to one or more special characteristics that are an expression of the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

b) Data subject

A data subject is any identified or identifiable natural person whose personal data are processed by the controller.

c) Processing

Processing means any operation or set of operations which is performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration,retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

d) Restriction of processing

Restriction of processing is the marking of stored personal data with the aim of limiting their processing in the future.

e) Profiling

Profiling means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work,economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

f) Pseudonymisation

Pseudonymisation means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.

g) Controller or controller responsible for processing

Controller or controller responsible for processing means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. Where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.

h) Processor

Processor means a natural or legal person, public authority,agencyor other body which processes personal data on behalf of the controller.

i) Recipient

Recipient means a natural or legal person, public authority,agencyor another body, to which the personal data aredisclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiryin accordance withUnion or Member State law shall not be regarded as recipients.

j) Third party

Third party means a natural or legal person, public authority, agency or body other than the data subject, controller,processorand persons who,under the direct authority of the controller or processor, are authorised to process personal data.

k) Consent

Consent means any freely given, specific,informedand unambiguousindicationof the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

2. Name and address of the controller and the data protection officer

The controller is the

Kopf Holding GmbH
Heinkelstraße, 25
73230 Kirchheim/Teck
Deutschland
Tel.: +49 (0) 7021 / 97 55-50
E-Mail: info@zinkpower.com
Website:www.zinkpower.com

You can reach our data protection officer at kopf-dpogermany@eversheds-sutherland.com or at our postal address with the addition “data protectionofficer“.

3. Cookies

The websites of Kopf Holding GmbH use cookies. Cookies are text files that are placed and stored on a computer system via an Internet browser.

Numerous websites and servers use cookies. Many cookiescontaina so-called cookie ID. A cookie ID is a unique identifier of the cookie. It consists of a string of characters by which websites and servers can be assigned to the specific Internet browser in which the cookie was stored. This enables the visited websites and servers to distinguish the data subject’s individual browser from other Internet browsers thatcontainother cookies. A specific Internet browser can be recognised andidentifiedby meansofthe unique cookie ID.

By using cookies, Kopf Holding GmbH can provide users of these websites with more user-friendly services that would not be possible without the placement of cookies.

By means ofa cookie, the information and offers on our websites can be optimised for the benefit of the user. As already mentioned,cookies enable usto recognise the users of our websites. The purpose of this recognition is to make it easier for users to use our websites. For example, a user of a website that uses cookies does not have to enter their data again each time they visit the website, because the website and the cookie stored on the user’s computer system take care of this.

A distinction is made between temporary cookies (also called session cookies) and permanent cookies with regard to the storage period of cookies. Temporary cookies are deleted at the latest when the website is left (session). Permanent cookies remain stored even after leaving the website until their specified duration.

As a general rule, we use cookies on the basis of your consent, unless the sole purpose of a cookie is to carry out the transmission of a communication over a public telecommunications network or the cookie is strictly necessary to provide a service explicitly requested by you (necessary cookies).

We use a consent management solution through which you and we can manage your consents. Your consents are stored to avoid asking you again and to be able to demonstrate the consents you have given. The legal basis for the retention of consent (including its continued retention) is Art. 6(1)(c) in conjunction with Art. 5(1)(a), (2), Art. 7(1) GDPR and Art. 6(1)(f) GDPR (our interest in demonstrating consent). Consent is stored server-side or by means of a so-called “opt-in cookie” so that the consent can be attributed. The consent is stored for three years after withdrawal of consent.

The necessary cookies used by us for this purpose are:

Cookiename	Cookieduration
zp_consent	30days

To maintain users’ temporary session (Session) and to enable requests to be assigned to the same user, we use the following necessary cookie:

Cookiename	Cookieduration
ASP.NET_SessionId	Session

The data subject can prevent cookies from being placed by our websites at any time by selecting the corresponding setting under “Cookie settings” and thereby permanently object to cookies being placed or withdraw consent already given. Furthermore, cookies that have already been placed can be prevented or deleted at any time via an Internet browser or other software programs. This is generally possible in all common Internet browsers. If the data subject deactivates the placement of cookies in the Internet browser used, not all functions of our website may be fully usable.

4. Collection of general data and information

The websites of Kopf Holding GmbH collect a series of general data and information each time a data subject or an automated system accesses them. This general data and information are stored in the server log files. The following may be collected: (1) the browser types and versions used, (2) the operating system used by the accessing system, (3) the website from which an accessing system reaches our website (so-called referrer), (4) the sub-pages accessed via an accessing system on our website, (5) the dateand time of access to the website, (6) an Internet Protocol address (IP address), (7) the Internet service provider of the accessing system and (8) other similar data and information that serve to avert danger in the event of attacks on our information technology systems or to ensure security and operation.

When using this general data and information, Kopf Holding GmbH does not draw any conclusions about the data subject. Rather, this information is needed to (1) deliver the content of our websites correctly, (2) optimise the content of our websites and the advertising for them, (3) ensure the continued functionality of our information technology systems and the technology of our websites, and (4) provide law enforcement authorities with the information necessary for prosecution in the event of a cyberattack.Kopf Holding GmbH therefore evaluates this data and information statistically on the one hand and also with the aim of increasing data protection and data security in our company, in order ultimately to ensure an optimal level of protection for the personal data we process. The server log file data is stored separately from all personal data provided by a data subject. The legal basis for the data processing is the legitimate interestpursuant toArt. 6(1)(f) GDPR, with the purposes described above constituting our legitimate interests, or the consent you have givenpursuant toArt. 6(1)(a) GDPR.Wedeletedatanolaterthanaftertwoyears.

5. Registration and login functions on our website

The data subject may have theoptionof registering on the respective website of the controller by providing personal data and using login functions.Which personal data are used for this purpose isdeterminedby the relevant input mask used for registration or login. The personal data entered by the data subject aregenerally usedexclusively for the purpose and in the interests of registration or login and security. Registration and login constitute a security measure, for example against misuse or unauthorised use. One or more processors may be involved in the processing.

Registration on the controller’s website also results in the IP address assigned to the data subject by the Internet Service Provider (ISP), as well as the date and time of registration, being stored. This data is stored in order to prevent misuse of our services. In addition, this data enables any criminal offences committed to be investigated if necessary. In this respect, storing this data is necessary to secure authorised access. As a general rule, this data is not disclosed to third parties unless there is a legal obligation to disclose it or disclosure serves the purpose of law enforcement.

The registration of the data subject by voluntarily providing personal data enables the controller to offer the data subject content or services that, by their nature, can only be offered to registered users. Registered users are free to amend the personal data provided during registration at any time or to have them completely deleted from the controller’s records.

The legal basis for the data processing is the legitimate interest pursuant to Art. 6(1)(f) GDPR, with the purposes described above constituting our legitimate interests, or performance of a contract and implementation of pre-contractual measures (Art. 6(1)(b) GDPR). The data is generally deleted upon deregistration or logout.

6. Google Maps

Data subjects may use the mapping services of Google Maps on the basis of their consent (Art. 6(1)(a) GDPR). Google Maps provides visual representations of interactive (country) maps and geographical information, as well as map functions, including route planning. For this purpose, technical data (e.g. the IP address) and usage data (e.g. the address or location entered in the search function) are intended to be processed. The provider of the mapping service is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The data is deleted no later than after two years. Further information on data protection and cookies at Google can be found at https://business.safety.google/privacy/?hl=de or https://policies.google.com/technologies/cookies?hl=de. 

7. Contactoption

The websites of Kopf Holding GmbHcontaininformation that enables rapid electronic contact with our company and direct communication with us, which also includes a general address for electronic mail (email address). If a data subject contacts the controller by email or via a contact form, the personal data transmitted by the data subject will be processed. Personal data voluntarily transmitted by a data subject to the controller will be processed for the purposes of processing the request or contacting the data subject. This personal data is notdisclosedto third parties. The legal basis for data processing is Art. 6(1)(b) GDPR or our corresponding interest in answering your enquiry andmaintainingthe user or business relationship (Art. 6(1)(f) GDPR). The data isgenerally storeduntil the contact has been concluded (e.g. the enquiry has been dealt with) or until the statutory retention periods have expired (up to ten years).

8. Processing of personal data in business relationships

We process personal data of the contact persons of our business partners (e.g. suppliers and customers) for the purpose of handling the business relationship and fulfilling statutory requirements. The processing is carried outon the basis ofArt. 6(1)(f) GDPR (our legitimate interest is communicating with the customer’s contact persons). The processing is also carried outon the basis ofArt. 6(1)(c) GDPR, as we may be legally obliged to store personal data, e.g. in connection with tax and commercial law matters. We also process this data in our IT systemson the basis ofArt. 6(1)(f) GDPR (our legitimate interest is the simplified maintenance of the customer relationship and making contact). We may store the data for up to ten years.

9. Routine erasure and blocking of personal data

The controller generally processes and stores the data subject’s personal data only for the period necessary to achieve the purpose of storage or where this has been provided for by the European legislator or another legislator in laws or regulations to which the controller is subject.

If the purpose of storage ceases to apply or a storage period prescribed by the European legislator or another competent legislator expires, the personal data are routinely blocked or erasedin accordance withthe statutory provisions.

10. Rights of the data subject

a) Right to confirmation

Every data subject has the right to request confirmation from the controller as to whether personal data concerning them are being processed.

b) Right of access

Every person affected by the processing of personal data has the right to obtain from the controller, at any time and free of charge, information about the personal data stored concerning them and a copy of this information.Furthermore, the data subject has the right to the following information:

o the purposes of the processing

o the categories of personal data being processed

o the recipients or categories of recipients to whom the personal data have been or will bedisclosed,in particular recipientsin third countries or international organisations

o where possible, the planned period for which the personal data will be stored or, if this is not possible, the criteria fordeterminingthat period

o the existence of a right to rectification or erasure of personal data concerning them or to restriction of processing by the controller or of a right to object to this processing

o the existence of a right to lodge a complaint with a supervisory authority

o where the personal data are not collected from the data subject: all available information about the source of the data

o the existence of automated decision-making, including profiling,pursuant toArt. 22(1) and (4) GDPR and, at least in these cases, meaningful information about the logic involved and the scope and intended effects of such processing for the data subject

Furthermore, the data subject has a right of access to information as to whether personal data have been transferred to a third country or an international organisation. If this is the case, the data subject also has the right to obtain information about theappropriate safeguardsrelating to the transfer.

c) Right to rectification

Every person affected by the processing of personal data has the right to request the immediate rectification of inaccurate personal data concerning them. Furthermore, the data subject has the right,taking into accountthe purposes of the processing, to have incomplete personal data completed, includingby means ofproviding a supplementary statement.

d) Right to erasure (“right to beforgotten“)

Every person affected by the processing of personal data has the right to request from the controller that the personal data concerning them be erased without delay. The controller isgenerally obligedto erase personal data without delay if one of the following reasons applies:

o Thepersonal data were collected or otherwise processed for purposes for which they are no longer necessary.

o Thedata subject withdraws their consent on which the processing was basedpursuant toArt. 6(1)(a) GDPR or Art. 9(2)(a) GDPR, and there is no other legal basis for the processing.

o Thedata subject objects to the processingpursuant toArt. 21(1) GDPR and there are no overriding legitimate grounds for the processing, or the data subject objects to the processingpursuant toArt. 21(2) GDPR.

o Thepersonal data were processed unlawfully.

o Theerasure of personal data is necessary for compliance with a legal obligation under Union or Member State law to which the controller is subject.

o Thepersonal data were collected in relation to information society services offeredpursuant toArt. 8(1) GDPR.

Where the personal data have been made public by Kopf Holding GmbH and our company, as controller, is obliged to erase the personal data pursuant to Art. 17(1) GDPR, Kopf Holding GmbH shall, taking account of available technology and the cost of implementation, take reasonable steps, including technical measures, to inform other controllers which are processing the published personal data that the data subject has requested the erasure by such other controllers of any links to, or copy or replication of, those personal data, insofar as the processing is not necessary.

e) Right to restriction of processing

Every person affected by the processing of personal data has the right torequestthat the controller restrict processing where one of the following conditions is met:

o Theaccuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data.

o Theprocessing is unlawful, the data subject opposes the erasure of the personal data and requests the restriction of their use instead.

o Thecontroller no longer needs the personal data for the purposes of processing, but the data subjectrequiresthem for the establishment,exerciseor defence of legal claims.

o Thedata subject has objected to processingpursuant toArt. 21(1) GDPR and it has not yet beenestablishedwhether the legitimate grounds of the controller override those of the data subject.

f) Right to data portability

Every person affected by the processing of personal data has the right to receive the personal data concerning them, which they have provided to a controller, in a structured, commonly used and machine-readable format, and has the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where the processing is based on consent pursuant to Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR or on a contract pursuant to Art.6(1)(b) GDPR and the processing is carried out by automated means, provided that the processing is not necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

When exercising the right to data portabilitypursuant toArt. 20(1) GDPR, the data subject has the right to have the personal data transmitted directly from one controller to another, where technicallyfeasible.

g) Right to object

Every person affected by the processing of personal data has the right, on grounds relating to theirparticular situation, to object at any time to processing of personal data concerning them which is based on Art. 6(1)(e) or (f) GDPR.This alsoappliestoprofilingbasedonthoseprovisions.

Kopf Holding GmbH shall no longer process the personal data in the event of an objection, unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or the processing serves the establishment, exercise or defence of legal claims.

Where Kopf Holding GmbH processes personal data for the purpose of direct marketing, the data subject has the right to object at any time to the processing of personal data for such marketing. This also applies to profiling to the extent that it is related to such direct marketing. If the data subject objects to Kopf Holding GmbH processing their personal data for the purposes of direct marketing, Kopf Holding GmbH will no longer process the personal data for these purposes.

h) Automated decision-making in individual cases, including profiling

Every person affected by the processing of personal data has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them. This shall not apply if the decision (1) is not necessary for entering into, or performance of, a contract between the data subject and the controller, or (2) is authorised by Union or Member State law to which the controller is subject and which lays down suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests, or (3) is based on the data subject’s explicit consent.

Where the decision (1) is necessary for entering into, or performance of, a contract between the data subject and the controller or (2) is based on the data subject’s explicit consent, Kopf Holding GmbH shall implement suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests, which include at least the right to obtain human intervention on the part of the controller, to express their point of view and to contest the decision.

i) Right to withdraw consent under data protection law

Every person affected by the processing of personal data has the right to withdraw their consent to the processing of personal data at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

j) Exercise of your rights and right to lodge a complaint

To exercise these rights (further information can be found at https://ec.europa.eu/info/law/law-topic/data-protection/reform/rights-citizens/my-rights_de), please contact us asindicatedabove. If you believe that we have notcomplied withthe data protection provisions when processing your personal data, you may lodge a complaint with the competent supervisory authoritypursuant toArt. 77 GDPR.

11. Data protection in job applications and the application process

The controller collects and processes the personal data of applicants (applicant data such as cover letters,CVsand certificates) for the purpose of handling the application process and carrying out pre-contractual measures.The legal basis for the data processing is Art. 6(1)(b) GDPR.The processing may also be carried out electronically. This is particularly the case where an applicantsubmitsthe relevant application documents electronically,for example by email or via a web formlocatedon the respective website, to the controller. In the context of the application process, we may use the recruiting software or applicant management solution ofsoftgardene-recruiting GmbH,Tauentzienstr. 14, 10789 Berlin, orPersonioSE & Co. KG,Seidlstr. 3,
80335 München. If the controller concludes an employment contract with an applicant, the data transmitted will be stored for the purpose of handling the employment relationship in compliance with the statutory provisions. If the controller does not conclude an employment contract with the applicant, the application documents will be automaticallydeletedup to three months after notification of the rejection decision, unless other legitimate interests of the controller oppose deletion. Another legitimate interest in this sense is, for example, an obligation to provide evidence in proceedings under the General Act on Equal Treatment (AGG). In addition, applicants may, with their consent, be included in our “Talent Pool” for up to one year after the end of the application process if they wish to be considered for further positions with the controller. After deletion, metadata without personal reference may still be available to us for statistical analyses (for example, the proportion of women and men among applicants, number of applications per period).

12. Data protection provisions on the use of Google Analytics (with anonymisation function)

The controller has integrated Google Analytics (with anonymisation function). Google Analytics is a web analytics service. Web analytics means the collection,gathering and evaluation of data about the behaviour of website visitors.A web analytics service collects, among other things, data about the website from which a data subject came to a website (so-called referrer), which sub-pages of the website were accessed or how often and for how long a sub-page was viewed.The data processed therefore consists of technical data (e.g. online identifiers such as IP addresses, the types of devices used and operating systems) and usage data (e.g.time of access, the location from which access originated and the frequency of visits to our website by the data subject, origin of visitors, clicks). Web analytics is primarily used to optimise a website and to analyse the cost-effectiveness of online advertising.

The operator of the Google AnalyticscomponentisGoogle Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

The controller uses web analytics with an anonymisation function provided by Google.By means ofthis addition, Google truncates and anonymises the IP address of the data subject’s Internet connection.

The purpose of the Google Analyticscomponentis to analyse visitor traffic on our website. The controller uses the data and information obtained, among other things, to evaluate the use of our website, to compile online reports for us showing activity on our websites,and to enable further services connected with the use of our website.

For Google Analytics, we place cookies on the data subject’s information technology system. What cookies are has already been explained above. By placing the cookies, weare able toanalyse the use of our website. Each time one of the individual pages of this website, which is operated by the controller and on which a Google Analytics component has been integrated, is accessed, the respective Google Analytics component automatically causes the Internet browser on the data subject’s information technology system to transmit data to Google for the purpose of online analysis.In the course ofthis technical process, Google becomes aware of personal data, such as the data subject’s IP address, which Google uses, among other things, to trace the origin of visitors and clicks andsubsequentlyto enable commission settlements.

The cookies used by us for this purpose are:

Cookiename	Cookieduration
_ga	13monthsand 4days
_ga0XK7F545WT	13monthsand 4days

The data subject can prevent cookies from being placed by our website at any time, as already described above (e.g.by makingan appropriate settingin the Internet browser used) and thereby permanently prevent cookies from being placed.

The data subject also has theoptionof preventing Google Analytics from collecting data generated by Google Analytics in connection with the use of this website and preventing Googlefrom processing that data. To do so, the data subject can download and install a browser add-on under the link https://tools.google.com/dlpage/gaoptout. This browser add-on informs Google Analytics via JavaScript that no data or information about visits to websites may be transmitted to Google Analytics. If the data subject’s information technology system isdeleted,formattedor reinstalledat a later date, the data subject must install the browser add-on againin order todeactivate Google Analytics. If the browser add-on is uninstalled or deactivated by the data subject or anotherperson within their sphere of control, the browser add-on may be reinstalled or reactivated.

The legal basis for data processing and the use of cookies in connection with Google Analytics is your consent in each case. The data isdeletedno later than after two years.

Further information and Google’s applicable data protection provisions can be accessed at https://www.google.de/intl/de/policies/privacy/and at http://www.google.com/analytics/terms/de.html.Further information on cookies is available at https://policies.google.com/technologies/cookies?hl=de. Google Analytics is explained in more detail at this linkhttps://www.google.com/intl/de_de/analytics/.

13. Data protection provisions on the use of Google Ads

The controller has integrated Google Ads. Google Ads is an online advertising service that allows advertisers to place advertisements both in Google’s search engine results and in the Google advertising network. Google Ads allows an advertiser to define certain keywords in advance,by means ofwhich an advertisement is displayed in Google’s search engine results only when the user retrieves a keyword-relevant search result with the search engine. In the Google advertising network, advertisements are distributed on thematically relevant websitesby means ofan automatic algorithm andtaking into accountthe previously defined keywords.

The operator of the Google Ads services isGoogle Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

The purpose of Google Ads is to promote our website by displaying interest-based advertising on the websites of third-party companies and in the search engine results of Google’s search engine, and to display third-party advertising on our website.

If a data subject reaches our website via a Google advertisement, Google places a so-called conversion cookie on the data subject’s information technology system. What cookies are has already been explained above. A conversion cookie expires after up to thirty days and is not used toidentifythe data subject.By means ofthe conversion cookie, provided that the cookie has not yet expired, it is tracked whether certain sub-pages, for example the shopping cart of an online shop system, have been accessed onour website. The conversion cookie enables both us and Google to track whether a data subject who reached our website via a Google Ads advertisement generated revenue, i.e. completed or abandoned a purchase of goods.

The data and information collectedthrough the use ofthe conversion cookie are used by Google to create visitor statistics for our website. We in turn use these visitor statistics todeterminethe total number of users referred to us throughGoogle Ads advertisements, i.e. todeterminethe success or failure of the respective Google Ads advertisement and to optimise our Google Ads advertisements for the future. Neither our company nor other Google Ads advertisers receive information from Google that could be used toidentifythe data subject.

The conversion cookie stores personal information, such as the websites visited by the data subject.Accordingly, each time our websites are visited, personal data,including the IP address of the Internet connection used by the data subject, is transmitted to Google. The data processed therefore consists of technical data (e.g.online identifiers such as IP addresses) and usage data (e.g. page views, interactions with advertisements). Google maydisclosethe personal data collected through this technical process to third parties.

The cookies used by us for this purpose are:

Cookiename	Cookieduration
_gcl_au	2monthsand 29days

As already described above, the data subject can at any time also prevent cookies from being placed by withdrawing consent or by makingan appropriate settingin the Internet browser used and thereby permanently object to cookies being placed. Such a setting in the Internet browser used would also prevent Google from placing a conversion cookie on the data subject’s information technology system. In addition, a cookie already placed by Google Ads can bedeletedat any time via the Internet browser or othersoftware programs.

The data subject also has theoptionof preventing interest-based advertising by Google. To do this, the data subject can also access the linkwww.google.de/settings/adsfrom each Internet browser they use and make the desired settings there.

The legal basis is your consent. Wedeletethe data no later than after two years.

Further information and Google’s applicable data protection provisions can be accessed athttps://www.google.de/intl/de/policies/privacy/.Further information on cookies is available athttps://policies.google.com/technologies/cookies?hl=de.

14. GooglereCAPTCHA

We use Google reCAPTCHA provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to protect our websites, in particular our email forms, against fraud and misuse in our interest. In particular, we wish to determine whether entries are made by humans. The data processed may include technical data (e.g. IP address) and interactions (e.g. answering questions or selecting images). The legal basis is consent.

Wedeletethe data no later than after two years.

Further information on data protection and cookies at Google can be found at https://business.safety.google/privacy/?hl=de or https://policies.google.com/technologies/cookies?hl=de. 

15. Google Tag Manager

We use Google Tag Manager provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, a tag management system that supports the analysis of our websites and trackingin order toprocess technical data and usage data.

The cookies used by us for this purpose are:

Cookiename	Cookieduration
_ga	13monthsand 4days
_ga0XK7F545WT	13monthsand 4days

The legal basis for the data processing or the cookies used is consent.

Wedeletethe data no later than after two years.

Further information on data protection and cookies at Google can be found at https://business.safety.google/privacy/?hl=de or https://policies.google.com/technologies/cookies?hl=de. 

16. Microsoft Clarity 

We use Microsoft Clarity provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, to evaluate aggregated information using heatmaps and analyse user interactions, page views, navigation and browsing behaviour in relation to our websites, so that we can improve and adapt our websites on the basis of this information, including usage profiles created from it.

The data processed therefore consists of technical data (e.g. online identifiers such as IP addresses, device types and operating systems used, browser type and version, screen resolution) and usage data (e.g.time of access, the location from which access originated, pages visited, content accessed, time spent, mouse or scrolling movements and the frequency of visits to our website by the data subject, origin of visitors, clicks).

The cookies used by us for this purpose are:

Cookiename	Cookieduration
_clck	12months
_clsk	1day

The cookies used by Microsoft are:

Cookiename	Cookieduration
MUID	12monthsand 25days
MR	7days
ANONCHK	7days
SM	Session

The legal basis for the data processing or the cookies used is consent.

Wedeletethe data no later than after two years.

Further information on data protection and cookies at Microsoft can be found at https://clarity.microsoft.com and at https://privacy.microsoft.com/de-de/privacystatement.

17. Facebook Pixel

We use the Facebook Pixel of Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, to analyse our websites and for tracking. The Facebook Pixel enables Meta and us to store and track website visits across websites. For this purpose, technical data (e.g. IP addresses)and usage data (e.g. website visits, interactions with websites) are processed, which may also be sent to Meta.On the basis ofthe usage data, Meta and we can create audiences for interest-based content and advertising (“MetaAds“) and conduct market research and assess the effectiveness of advertising measures throughstatistical analyses.By means ofso-called “conversion measurement”,we can alsodeterminewho was redirected to our websites through advertising. Our Meta Ads are displayed only to users on Meta’s platforms and those of partners cooperating with Meta (“AudienceNetwork“, see alsohttps://www.facebook.com/audiencenetwork/) who are interested in our websites or have shown certain interests, such as an interest in our products or topics presented, where we have transmitted these to Meta (“CustomAudiences“).

The cookies used by us for this purpose are:

Cookiename	Cookieduration
_fbp	3monthsand1day

The legal basis for the data processing or the cookies used is consent.

We delete the data no later than after two years.

We also draw attention to the agreement on joint controllership, which designates Meta as a joint controller of the joint processing and which we have concluded with Meta in order to define the respective responsibilities for fulfilling the obligations under the GDPR with regard to joint controllership as described in Meta’s terms of use (https://www.facebook.com/legal/controller_addendum). The agreement on joint controllership provides that Meta requires a legal basis under data protection law with regard to data processing by Meta and that we require such a legal basis with regard to our own data processing. It also provides that we make the information set out here available, while Meta is responsible for facilitating the exercise of the rights under Articles 15–20 GDPR with regard to the personal data stored by Meta following the joint processing, so that Meta is your primary point of contact in this respect. Joint controllership is limited to the collection and transmission of personal data to Meta. Further information can also be found under Social Media.

Further information on data protection at Meta, in particular on the controller responsible at Meta, Meta’s contact details, the data protection officer and further information on the legal bases on which Meta relies, how Meta processes personal data and how to exercise rights against Meta, and on cookies at Meta, can be found at https://www.facebook.com/privacy/policy/ or https://www.facebook.com/privacy/policies/cookies.

18. YouTube

On our websites, we embed video content from YouTube, which is obtained from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. In order to display the video content, Google processes technical data such as the IP address. In addition, Google may use technical data (e.g. operating system, browser) and usage data (e.g. page views, interactions with content) to conduct statistical analyses and for marketing purposes. Google uses the following cookies for this purpose:

Cookiename	Cookieduration
_Secure-BUCKET	6months
_Secure-ENID	1day
AEC	6months
NID	6months
SOCS	13months

We use YouTube on the basis of consent. As a general rule, we process personal data for as long as video content is accessed.

Further information on data protection and cookies at Google can be found at https://business.safety.google/privacy/?hl=de or https://policies.google.com/technologies/cookies?hl=de. 

19. Social Media

We use social media platforms to (i) present ourselves on social media, (ii) remain in contact and interact with you, and (iii) analyse how our social media content is received so that we can design and optimise it accordingly. When you interact with us on social media platforms, we may receive and process social media data (“social media data”) from platform providers or directly from you. Depending on the platform, social media data includes (i) reach metrics such as impressions, page views, profile visits, unique users and access to sub-pages, (ii) audience insights such as demographic information, follower growth and trend analyses over time, (iii) engagement data such as impressions, reactions, click-through rates, likes, shares, comments, link clicks, engagement rates, saves, retweets and replies. We process social media data on the basis of our legitimate interest in accordance with the purposes stated above or your consent. We delete social media data no later than two years after its collection.

We are active on the following social media platforms:

• LinkedIn, LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland.Information on data protection at LinkedIn can be found athttps://www.linkedin.com/legal/privacy-policy.Information on joint controllership and the related agreement can be found at https://legal.linkedin.com/pages-joint-controller-addendum. We have agreed that: (1) we are joint controllers with LinkedIn for the processing of Page Insights data; (2) LinkedIn assumes primary responsibility and is mainly responsible for providing you with information about the joint processing and enabling you to exercise your rights under the GDPR; (3) the Irish data protection authority is the lead supervisory authority for processing carried out under the joint controllership.
• Facebook, Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.Information on data protection at Facebook can be found athttps://www.facebook.com/privacy/policy/.Information on joint controllership and the related agreement can be found athttps://www.facebook.com/legal/terms/page_controller_addendum.We have agreed that: (1) we are joint controllers with Meta for the processing of Page Insights data; (2) Meta assumes primary responsibility and is mainly responsible for providing you with information about the joint processing and enabling you to exercise your rights under the GDPR; (3) the Irish data protection authority is the lead supervisory authority for processing carried out under the joint controllership.
• Instagram, Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.Information on data protection at Instagram can be found athttps://privacycenter.instagram.com/policy. Information on joint controllership and the related agreement can be found athttps://www.facebook.com/legal/terms/page_controller_addendum.We have agreed that: (1) we are joint controllers with Meta for the processing of Insights data; (2) Meta assumes primary responsibility and is mainly responsible for providing you with information about the joint processing and enabling you to exercise your rights under the GDPR; (3) the Irish data protection authority is the lead supervisory authority for processing carried out under the joint controllership.

20. Legal basis for processing

Art. 6(1)(a) GDPR serves as the legal basis for our company’s processing operations for which we obtain consent for a specific processing purpose. If the processing of personal data is necessary for the performance of a contract to which the data subject is a party, as is the case, for example, with processing operations that are necessary for the delivery of goods or the provision of another service or consideration, the processing is based on Art. 6(1)(b) GDPR. The same applies to processing operations that are necessary for carrying out pre-contractual measures, for example in cases of enquiries about our products or services. If our company is subject to a legal obligation by which the processing of personal data becomes necessary, such as for the fulfilment of tax obligations, the processing is based on Art. 6(1)(c) GDPR. In rare cases, the processing of personal data may become necessaryin order toprotect the vital interests of the data subject or another natural person. This would be the case, for example, if a visitor were injured at our company and their name, age, health insurancedetailsor other vital information then had to be passed on to a doctor, hospital or other third parties. In that case, the processing would be based on Art. 6(1)(d) GDPR.Ultimately, processingoperations could also be based on Art. 6(1)(f) GDPR. Processing operations are based on this legal basis if the processing is necessary to safeguard the legitimate interest of our company or a third party, provided that the interests, fundamentalrightsand freedoms of the data subject do not override that interest. We arepermittedto carry out such processing operationsin particular becausethey have been specifically mentioned by the European legislator. In this respect, it took the view that a legitimate interest could be assumed where the data subject is a customer of the controller (second sentence of Recital 47 GDPR).

21. Legitimate interests pursued by the controller or by a third party

Where the processing of personal data is based on Art. 6(1)(f) GDPR, our legitimate interest is the conduct of our business for the benefit of the well-being of all our employees and our shareholders, as well as our legitimate business, legal and reputational interests in pursuing the purposes described in this Privacy Policy.

22. Period for which personal data are retained

Weretainyour personal data only for as long as necessary to fulfil the purposes described. The periods necessary for this are reviewed through careful balancing, during which we examine the necessity of the data processing in detail:

If we process your personal dataon the basis ofyour consent, we willgenerally retainit until you withdraw your consent.

Otherwise, weretainyour personal data only to the extent that this is necessary to fulfil our contractual and statutory obligations or to preserve evidence within the framework of the statutory limitation periods. The most important statutory retention obligations arise from commercial and/or tax law and amount to six or ten years, respectively. The statutory limitation periods are up to thirty years, with the regular limitation periodgenerally beingthree years.

After the applicable retention periods have expired, we will securely erase or anonymise your personal data.

23. Recipients or categories of recipients of personal data

We disclose your personal data to other recipients only if this is necessary to fulfil the purposes described, you have given us your consent to do so, or we are legally entitled or obliged to doso, orare entitled or obliged to do so by a court or official authorisation.

If this is necessary for the purposes described above, we may disclose your personal data to

• other group companies that need your personal data in order, for example, to provide us with central services,
• other joint controllers, as described in this Privacy Policy, who process your personal data jointly with us (you can also obtain further information via the contact details provided above),
• service providers and business partners who need your personal data to provide their services to us, in particular
• administrativeservices(e.g.documentserviceproviders),
• customer service and support services (e.g. call centre,helpdeskor customer relationship management providers),
• finance and accounting services (e.g. accountants, banks, credit assessment service providers, insurers, payment serviceprovidersor tax advisers),
• IT and telecommunications services (e.g. cloud service providers, data hosting centres, software providers, IT maintenance and support providers or providers of electronic communications services or network operators),
• legal and compliance services (e.g. auditors, lawyers),
• marketing and sales services (e.g. marketing and advertising, social mediaplatformsor other media companies),
• strategy and business development services (e.g. management consultants, business intelligenceprovidersor other consultants),
• public authorities that need your personal data to perform their public tasks (e.g. courts for legal disputes, tax authorities for tax administration or law enforcement authorities),
• other parties, such as potential purchasers of our company (e.g.in the event ofa sale,mergeror acquisition), counterparties, including their service providers (e.g. in legal disputes), or other recipients at your direction.

24. Transfer of personal data to third countries

As a general rule, your personal data are processed in Germany and in other European countries. If your personal data are processed in countries outside the European Union or the European Economic Area (so-called third countries), this only takes place where certain safeguards ensure that an adequate level of data protection exists for this purpose.Typically,wetakethefollowingsafeguardsforthispurpose:

Adequacy decision of the European Commission: recipients in Andorra, Argentina, Brazil, Canada, Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, Republic of Korea, Switzerland, United Kingdom, United States of America, Uruguay (Further information at https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en).

Standard contractual clauses: other recipients (Further information at https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en)

Exceptionspursuant toArt. 49 GDPR: other recipients.

Further information about transfers to third countries or copies of these safeguards can be requested from the contact addresses mentioned above.

25. Statutory or contractual provisions for the provision of personal data; necessity for the conclusion of a contract; obligation of the data subject to provide the personal data;possible consequencesof failure to provide the personal data

We inform you that the provision of personal data is partly required by law (e.g. tax regulations) or may also result from contractual provisions (e.g. information about the contractual partner). In some cases, it may be necessary for a contract to be concluded for a data subject to provide us with personal data, which we mustsubsequentlyprocess. For example, the data subject is obliged to provide us with personal data if our company concludes a contract with them. Failure to provide the personal data would mean that the contract could not be concluded with the data subject.Before providing personal data, the data subject must contact one of our employees. Our employee will inform the data subject on a case-by-case basis whether the provision of the personal data is required by law or contract or is necessary for the conclusion of the contract, whether there is an obligation to provide the personal data, and what the consequences of failure to provide the personal data would be.

26. Existence of automated decision-making

As a responsible company, we do not use automated decision-making.

This Privacy Policy was prepared using the privacy policy generator ofDatenschutzbeauftragterin cooperation with RC GmbH and the file-sharing lawyers of WBS-LAW.