Privacy

The definitions set out in Article 4 GDPR apply to this privacy policy.

Below we would like to provide you with information about data protection. This privacy policy is intended to inform you, in accordance with the General Data Protection Regulation (GDPR), about the processing of your personal data on this website and within our company.

Scope of the processing of personal data: As a matter of principle, we process personal data of our users only to the extent necessary to provide a functional website as well as our content and services. The processing of personal data of our users generally takes place only with the user's consent. An exception applies in cases where prior consent cannot be obtained for factual reasons and the processing of the data is permitted by law. No automated decision-making within the meaning of Article 22 GDPR takes place.

Below you will find your rights as a data subject and the most important information on how to exercise these rights.

AS A DATA SUBJECT, YOU HAVE THE RIGHT, ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION, TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU THAT IS BASED ON ARTICLE 6(1)(E) OR (F) GDPR; THIS ALSO APPLIES TO PROFILING BASED ON THOSE PROVISIONS. THE RESPECTIVE LEGAL BASIS ON WHICH PROCESSING IS BASED CAN BE FOUND IN THIS PRIVACY POLICY. IF YOU OBJECT, WE WILL NO LONGER PROCESS YOUR PERSONAL DATA UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS. IF YOUR PERSONAL DATA IS PROCESSED FOR THE PURPOSE OF DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH MARKETING; THIS ALSO APPLIES TO PROFILING INSOFAR AS IT IS RELATED TO SUCH DIRECT MARKETING. IN SUCH CASES, NO REASONS NEED TO BE GIVEN. AS A CONSEQUENCE OF YOUR OBJECTION, WE WILL NO LONGER PROCESS YOUR DATA FOR THE PURPOSES OF DIRECT MARKETING.

• Right of access (Art. 15 GDPR): You have the comprehensive right to know whether and which personal data we have stored about you, for which purposes it is processed and to which recipients it may have been disclosed. You may also request a copy of this information. We will then provide the requested information in a common format.
• Right to rectification (Art. 16 GDPR): If the data we hold about you is incorrect, outdated or incomplete, you have the right to demand that it be corrected or completed without undue delay. You can initiate this by sending us a brief notice identifying the data to be corrected so that we can promptly update your records.
• Right to erasure (Art. 17 GDPR): Under certain conditions, for example if the data is no longer needed for the original purposes or you withdraw your consent, you may request that we permanently delete your data, provided that no statutory retention obligations prevent deletion.
• Right to restriction of processing (Art. 18 GDPR): You may request the restriction of processing of your data if, for example, you contest the accuracy of the data or the processing is unlawful, but you prefer restricted use instead of deletion. In this case, we will mark the data so that, apart from storage, it may only be processed with your consent. To exercise this right, an informal declaration stating the reason for the requested restriction is sufficient.
• Right to data portability (Art. 20 GDPR): You have the right to receive the data you provided to us in a structured, commonly used and machine-readable format or to request that it be transmitted directly to another controller, where technically feasible. You can request this transfer from us, after which we will provide the data promptly to you or to the new controller.
• Right to withdraw consent (Art. 7 para. 3 GDPR): You may withdraw consent once given for data processing at any time with effect for the future, without stating reasons. Processing carried out before the withdrawal remains lawful.
• Right to lodge a complaint (Art. 77 GDPR): If you believe that the processing of your data violates applicable data protection law, you have the right to lodge a complaint with a data protection supervisory authority. You may contact the authority at your usual place of residence, your place of work or the place of the alleged infringement. This right exists in addition to other administrative or judicial remedies. To exercise your respective rights, an informal message by email or post to the contact details provided above is generally sufficient. In the case of cookies, you can withdraw your consent at any time by using our consent tool.

For the processing activities carried out by us, we indicate the applicable legal basis in each case below. Processing may also be based on several legal bases. The legal bases are as follows:

• Consent (Art. 6 para. 1 lit. a GDPR): The data subject has given consent to the processing of personal data concerning them for one or more specific purposes.
• Performance of a contract and pre-contractual inquiries (Art. 6 para. 1 lit. b GDPR): Processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract.
• Legal obligation (Art. 6 para. 1 lit. c GDPR): Processing is necessary for compliance with a legal obligation to which our company is subject (for example statutory retention obligations).
• Legitimate interest (Art. 6 para. 1 lit. f GDPR): Processing is necessary for the purposes of the legitimate interests pursued by our company or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.

When you use our website, it may be technically necessary to access information (for example your IP address) or to store data (for example cookies) on your device. The following specific legal bases apply to such access:

• Strictly necessary access (Section 25 para. 2 no. 2 TDDDG): Access to information or the storage of data is strictly necessary in order to ensure the technically error-free provision of our services.
• Consent to access (Section 25 para. 1 TDDDG): If the process serves other purposes (for example analysis or user-oriented design), access or storage takes place only with your consent (Art. 6 para. 1 lit. a GDPR). This consent can be withdrawn at any time with effect for the future. The subsequent processing of your personal data is permissible only if it is justified by a corresponding legal basis under the GDPR (for example your consent, performance of a contract or legitimate interest). Detailed information about the legal bases relied upon in individual cases can be found in the following sections on the specific functions of our website.

In some sections of this privacy policy, we inform you how long we or companies processing data on our behalf store your data. If such information is missing, we store your data until the purpose of the data processing no longer applies, you object to the processing or you withdraw your consent to the processing.

We also use tools on our website from companies that transfer your data to the United States and store and, where applicable, further process it there. The European Commission has adopted an adequacy decision for the EU-US Data Privacy Framework. This means that the United States ensures an adequate level of protection for personal data transferred from the EU to US companies. The Data Privacy Framework therefore allows European companies to transfer data to certified US companies without having to implement additional data protection safeguards. A list of all certified companies is available here: https://www.dataprivacyframework.gov/s/participant-search

During your visit to the website, we use the SSL procedure (Secure Socket Layer) in conjunction with the highest level of encryption supported by your browser. You can recognize an encrypted connection by the fact that the address line of the browser changes from "http://" to "https://" and by the lock symbol in your browser line.

The provision of personal data for the decision on entering into a contract, for contract performance or for carrying out pre-contractual measures is voluntary. However, we can make a decision within the framework of contractual measures only if you provide such personal data as is necessary for the conclusion of the contract, contract performance or pre-contractual measures.

Below we inform you about the individual processing activities on this website.

The provision of the website includes, in particular, hosting and technically necessary server logging.

Our website is hosted on a server operated by an external service provider (hoster). Personal data collected on this website is stored on the hoster's servers. This may in particular include IP addresses, contact inquiries, meta and communication data, website accesses and other data generated via a website. Our hoster is:

americk GmbH & Co. KG
Prinzenallee 1
40549 Duesseldorf

We collect the listed data in order to ensure a smooth connection setup of the website and the technically error-free provision of our services. Processing of this data is strictly necessary to provide you with the website. The legal basis for processing the data is our legitimate interest in the correct presentation and functionality of our website pursuant to Art. 6 para. 1 lit. f GDPR. We have concluded a data processing agreement with the provider in accordance with Art. 28 GDPR, under which the provider is obliged to protect our customers' data and not to pass it on to third parties.

When our website is accessed, the browser used on your end device automatically sends information to our web server. This information is temporarily stored in so-called server log files. The following data is collected without any action on your part:

• IP address of the requesting device,
• date and time of access,
• name and URL of the retrieved file,
• website from which access is made (referrer URL),
• browser used and, where applicable, the operating system of your device as well as the name of your access provider.

To enable you to visit our website securely and conveniently, we process the above data on the basis of Art. 6 para. 1 lit. f GDPR.

Our legitimate interest lies in establishing the connection without technical errors, ensuring system stability and security (for example defence against attacks) and managing our administrative processes efficiently.

We automatically delete the server log files after [number] days. Further storage takes place only insofar as this is necessary for evidentiary purposes in the event of security incidents (for example to investigate misuse or fraud). In such cases, the data is exempt from deletion until the respective incident has been conclusively clarified.

Below we provide information about the use of cookies, consent management and the categories of cookies used on this website.

To make visiting our website attractive and to enable the use of certain functions, we use so-called cookies. These are small text files that are stored on your end device (laptop, tablet, smartphone, etc.) when you visit a website. Some cookies are technically necessary for the website to function at all. Other cookies help us analyze user behavior or optimize marketing measures.

We use the "Consent Management System" from Cookiebot (Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark) on this website. This is used to manage the placement of cookies and, where applicable, to obtain and document your consent.

When using Cookiebot, the following data is transmitted to Usercentrics A/S:

• IP address (in anonymized form)
• Date and time of the consent or change
• The URL from which the consent was submitted
• An anonymized, random and encrypted key (consent ID)
• The selected consent status

The data is processed on the basis of Art. 6 para. 1 sentence 1 lit. f GDPR. The interest lies in ensuring legally compliant and technically sound consent management. In addition, the data is processed on the basis of Art. 6 para. 1 sentence 1 lit. c GDPR, as there is a legal obligation to obtain consent for non-essential cookies (Section 25 para. 1 TDDDG) and to be able to prove this consent (Art. 5 para. 2 GDPR).

The data is stored for as long as necessary to fulfill the legal obligations to provide proof or until you withdraw your consent. By default, the consent log data is retained for 12 months and then automatically deleted unless statutory retention obligations prevent deletion.

We have concluded a data processing agreement with Usercentrics A/S in accordance with Art. 28 GDPR. This ensures that the service provider processes the data strictly in accordance with our instructions and in compliance with the GDPR.

Cookiebot's privacy policy is available at: https://www.cookiebot.com/de/privacy-policy/

We distinguish between the following cookie categories on our website. Via the Cookiebot banner, you can manage the non-essential categories individually:

• Necessary: These cookies are technically essential in order for the website to be usable (for example page navigation, session management, shopping cart, storage of the consent status). Without these cookies, the website will not function properly. Legal basis: Section 25 para. 2 no. 2 TDDDG in conjunction with Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in ensuring the functionality and security of the website.
• Preferences: These cookies allow the website to remember information that influences the behavior or appearance of the website (for example your preferred language or region). Legal basis: consent (Section 25 para. 1 TDDDG, Art. 6 para. 1 lit. a GDPR).
• Statistics: These cookies help us understand how visitors interact with websites by collecting and reporting information. Legal basis: consent (Section 25 para. 1 TDDDG, Art. 6 para. 1 lit. a GDPR).
• Marketing: These cookies are used to follow visitors across websites. The intention is to display ads that are relevant and engaging for the individual user. Legal basis: consent (Section 25 para. 1 TDDDG, Art. 6 para. 1 lit. a GDPR). Any subsequent processing or disclosure of your personal data to third parties takes place exclusively on the basis of your consent, which you can withdraw at any time with effect for the future.

You can change or withdraw your selection at any time via the settings in the banner. The button is located at the bottom left. If you want to prevent cookies from being stored in general, you can do so via your internet browser settings. Please note that individual functions of our website may not work or may work only to a limited extent if you completely deactivate the use of cookies in your browser.

The following overview gives you transparency about the cookies used individually on this website, their providers (including possible transfers to third countries), the exact processing purpose and the precise storage period. This list is generated automatically by Cookiebot and updated with each scan of our website. You can also view your current status here and change or withdraw your consent at any time with effect for the future.

If you send us a message via the contact form provided on this website, the information you provide in the form, including the contact details entered there, will be stored by us for the purpose of processing the inquiry and in case of follow-up questions.

This data includes:

• First name, last name (or name)
• Email address
• Telephone number
• Company
• Message/inquiry (free text)
• Selection/subject (for example "Product advice / partnership")
• Proof of consent

During the sending process, your consent to the processing of the data is obtained and reference is made to this privacy policy. Therefore, Art. 6 para. 1 lit. a GDPR is the legal basis for processing this data. You may withdraw your consent at any time with effect for the future.

The legal basis for processing the proof of consent is additionally Art. 6 para. 1 lit. c GDPR.

We delete your data without delay as soon as one of the following conditions is met:

• Your inquiry has been processed conclusively.
• You request deletion of the data.
• You withdraw your consent to storage.

This does not apply where we are legally obliged to retain the data. Proof of consent is stored for 3 years and then deleted without delay. This data is not passed on to third parties without your express consent.

Below we provide information about third-party tools and integrated services used on this website.

This website embeds videos from YouTube. The operator of the service is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.

When you visit one of our pages on which YouTube is embedded, a connection to YouTube's servers is established. In the process, personal data is transmitted to YouTube (including to the United States), in particular:

• Your IP address (to deliver the video to your browser),
• the referrer URL (which of our pages you visited),
• as well as device and browser information (for example operating system, browser type and language settings).

If you are logged into your YouTube account, you enable YouTube to assign your browsing behavior directly to your personal profile. You can prevent this by logging out of your YouTube account.

We use YouTube in enhanced privacy mode. According to YouTube, videos played in enhanced privacy mode are not used to personalize browsing on YouTube. Ads displayed in enhanced privacy mode are also not personalized. In enhanced privacy mode, no cookies are set to analyze user behavior. Instead, so-called local storage elements are stored in the user's browser.

These include, among other things:

• Unique identifiers (IDs) for counting video views and fraud prevention,
• User preferences (for example selected volume or video quality),
• Bandwidth information for optimal playback.

This data can be used to recognize the end device (so-called device fingerprinting). Details on enhanced privacy mode can be found here: https://support.google.com/youtube/answer/171780

After activating a YouTube video, further data processing operations may be triggered over which we have no influence. If corresponding consent has been requested, processing takes place exclusively on the basis of Art. 6 para. 1 lit. a GDPR and Section 25 para. 1 TDDDG, insofar as the consent covers the storage of cookies or access to information on the user's end device (for example local storage or device fingerprinting) within the meaning of the TDDDG. Consent can be withdrawn at any time. Further information on data protection at YouTube can be found in their privacy policy: https://policies.google.com/privacy?hl=en

The company is certified under the Data Privacy Framework. Further information is available here: https://www.dataprivacyframework.gov/participant/5780

We use Google Fonts to ensure a consistent and visually appealing presentation of our website. To protect your privacy, however, these fonts are intended to be provided locally. Therefore, when our website is accessed, no connection should be established to Google servers (for example Google Ireland Ltd. or Google LLC).

The use is based on Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in the technically secure, low-maintenance and visually consistent presentation of our online presence without additional external data requests. If your browser does not support web fonts, a standard font from your computer will be used.

If you send us an application (for example by email or post), we process the associated personal data in order to assess your suitability for the position and to carry out the application process.

To provide the applicant management system, we use the services of Personio SE & Co. KG, Rundfunkplatz 4, 80335 Munich, Germany. Applicant data is processed via Personio's servers as part of data processing in accordance with Art. 28 GDPR.

This data regularly includes:

• Master data (for example first name, last name, date of birth, address)
• Contact data (email address, telephone number)
• Qualification data (CV, certificates, references)
• Other information that you voluntarily provide as part of your application

The legal basis for processing is Section 26 para. 1 BDSG (initiation of an employment relationship) and, additionally, Art. 6 para. 1 lit. b GDPR. If you give us consent to be included in a talent pool, Art. 6 para. 1 lit. a GDPR is the legal basis; you may withdraw this consent at any time with effect for the future.

We delete your data without delay as soon as one of the following conditions is met:

• The application process has been completed with a rejection (storage then takes place for a maximum of 6 months after notification of the rejection in order to comply with obligations under the General Equal Treatment Act).
• You withdraw your application.
• You withdraw your consent to storage (for example for the talent pool).

This does not apply if statutory retention obligations exist or you have expressly consented to longer storage. This data is not passed on to third parties without your express consent.