Controller in the sense of data protection law

PROLIANCE GmbH
Leopoldstr. 21
80802 München
Germany

Phone: +49 89 2500 392 20
Email: info@proliance.ai
Website: www.proliance.ai

Contact Details of the Data Protection Officer

PROLIANCE GmbH
Data Protection Officer
Leopoldstr. 21
80802 München
E-Mail: dsb@proliance.ai‍

When contacting the data protection officer, please state the company your inquiry relates to. Please refrain from including sensitive information, such as a copy of your ID, in your inquiry.

Data Processing during Website Operation

Web Hosting

This website is hosted by an external service provider. Personal data collected on this website is stored on the host's servers. This may primarily include IP addresses, contact inquiries, meta and communication data, website access data, and other data generated via a website.

We collect the data listed to ensure a smooth connection to the website and the technically flawless provision of our services. The processing of this data is absolutely necessary to make the website available to you. The legal basis for processing the data is our legitimate interest in the correct presentation and functionality of our website in accordance with Art. 6 para. 1 lit. f GDPR.

We have concluded a data processing agreement with the provider in accordance with Art. 28 GDPR, in which we oblige them to protect our customers' data and not to pass it on to third parties.

Webflow

For the creation and hosting of our website, we use the services of Webflow, Inc. 398 11th Street, 2nd Floor, San Francisco, CA 94103, USA.

Description of Data Processing and Purpose

Webflow is a tool for creating and hosting websites. We use these services to provide you with our website.

Personal data collected on this website is stored on the servers of the hoster. This may primarily include IP addresses, contact inquiries, meta and communication data, website accesses, log files, and other data generated via a website.

Webflow also stores cookies or other recognition technologies that are necessary for displaying the page, providing website functions, and ensuring security (technically necessary cookies).

We use Webflow for the purpose of creating and providing our online presence.

Legal Basis for Data Processing

Insofar as we use cookies and similar technologies within the scope of integrating the service, or insofar as data is stored on or read from your terminal device by the service, this is done in accordance with § 25 para. 2 TDDDG. Subsequent data processing is carried out on the basis of Art. 6 para. 1 sentence 1 lit. f GDPR. Our legitimate interest lies in technically improving our website and making our online presence available efficiently.

Recipients

When using the service, the data collected via our websites is transmitted to the following recipients:

• Webflow, Inc. 398 11th Street, 2nd Floor, San Francisco, CA 94103, USA.

We generally have no influence over further data processing by the third-party provider.

Further information on how Webflow handles personal data can be found at https://webflow.com/legal/privacy and at https://webflow.com/legal/eu-privacy-policy.

Data Processing in Third Countries

When using the service, your data may also be processed in countries outside the European Union (EU) and the European Economic Area (EEA) in third countries, particularly in the USA.

For data transfers to the USA, there is an adequacy decision by the EU Commission pursuant to Art. 45 para. 1 GDPR regarding companies certified under the EU-U.S. Data Privacy Framework, which can be viewed under the following link: Data protection adequacy for non-EU countries.

Webflow, Inc. is certified under the EU-U.S. Data Privacy Framework and thus commits to complying with adequate data protection standards, which can be viewed under the following link: Participant Search (dataprivacyframework.gov).

When your data is transferred to other third countries for which no adequacy decision exists, there is a risk that local authorities may access your data for security and surveillance purposes without you being informed or able to appeal.

To ensure an adequate level of data protection when transferring your data to a third country, standard data protection clauses of the European Commission are concluded in accordance with Art. 46 para. 2 lit. c GDPR. These oblige the recipient of the data to process it in accordance with the European level of protection.

If the standard data protection clauses are not sufficient to ensure the level of protection, additional technical, contractual, or organizational measures are taken to secure the data transfer. Furthermore, it is regularly reviewed and assessed whether these additional measures continue to ensure an adequate level of data protection or whether further supplementary measures may need to be taken.

Storage Duration

By integrating the services, data is transmitted to the aforementioned recipients and stored there for a period of ANZAHL months.

Any further storage of the data processed by the service and provided to us in our own systems will take place for a period of ANZAHL months.

Amazon CloudFront (in conjunction with Webflow)

To provide our website, we use Amazon CloudFront, a service of Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg. The service is integrated by our hosting provider Webflow.

The aforementioned provider is the authorized EU representative of Amazon Web Services, Inc., P.O. Box 81226, Seattle, WA 98108-1226, USA.

Description of data processing and purpose

Amazon CloudFront enables us to quickly provide data to make our website available as optimally as possible. The service is a Content Delivery Network (CDN) operated by Amazon Web Services. The CDN uses proxy servers worldwide, allowing companies to quickly and securely deliver content such as web videos or other large media. To do this, proxy servers cache files locally, thereby improving access speed during downloads. In practice, this means that companies can offer data-rich content on their websites that users can access without long waiting times.

To make content from our websites available via the service, your personal data is transmitted to Amazon Web Services. The data processed includes, in particular:

• your IP address,
• the accessed website,
• the referrer URL,
• the browser used,
• the operating system used.

We use the service to provide our online presence as optimally as possible and without long loading times.

Legal basis for data processing

Insofar as we use cookies and similar technologies in connection with the integration of the service, or insofar as data is stored or read from your end device by the service, this is done in accordance with Section 25 (2) TDDDG. Subsequent data processing is carried out on the basis of Art. 6 (1) sentence 1 lit. f GDPR. Our legitimate interest lies in technically improving our website and making our online presence available efficiently.

Recipients

When using the service, the data collected via our websites is transmitted to the following recipients:

• Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg,
• Amazon Web Services, Inc., P.O. Box 81226, Seattle, WA 98108-1226, USA.

We generally have no influence over any further data processing by the third-party provider.

For more information on how AWS handles personal data, please refer to https://d1.awsstatic.com/legal/privacypolicy/AWS%20Privacy%20Notice%20-%202024-01-01_DE.pdf.

Data processing in third countries

When using the service, your data may also be processed in countries outside the European Union (EU) and the European Economic Area (EEA) in third countries, particularly in the USA.

For data transfers to the USA, an adequacy decision by the EU Commission exists pursuant to Art. 45 Para. 1 GDPR concerning companies certified under the EU-U.S. Data Privacy Framework, which can be viewed via the following link: Data protection adequacy for non-EU countries.

Amazon Web Services, Inc. is certified under the EU-U.S. Data Privacy Framework and thus commits to adhering to adequate data protection standards, which can be viewed via the following link: Participant Search (dataprivacyframework.gov).

If your data is transferred to other third countries for which no adequacy decision exists, there is a risk that local authorities may access your data for security and surveillance purposes without you being informed or able to exercise legal remedies.

To ensure an adequate level of data protection when transferring your data to a third country, standard data protection clauses of the European Commission are concluded in accordance with Art. 46 Para. 2 lit. c GDPR. These clauses oblige the recipient of the data to process it in accordance with the European level of protection.

If the standard data protection clauses are not sufficient to ensure the level of protection, additional technical, contractual, or organizational measures will be taken to secure the data transfer. Furthermore, it is regularly reviewed and assessed whether these additional measures continue to ensure an adequate level of data protection or if further supplementary measures may need to be taken.

Storage duration

By integrating these services on our websites, data is transmitted to the aforementioned recipients and stored there for as long as necessary to achieve the stated purposes. No further storage of the data processed by the service and provided to us occurs in our own systems.

CloudFlare (in conjunction with Webflow)

To provide our website, we use CloudFlare, a service of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. The service is integrated by our hosting provider Webflow.

Description of data processing and purpose

CloudFlare enables us to deliver data quickly to provide our website in the best possible way. The service is a Content Delivery Network (CDN). The CDN uses proxy servers worldwide, allowing companies to deliver content such as web videos or other large media quickly and securely. To do this, proxy servers cache files locally, thereby improving download access speed. In practice, this means companies can offer data-rich content on their websites that users can access without long waiting times.

Our hosting provider uses the CDN to make JavaScript files available. These files are used to provide modern functionalities even in older browsers that do not inherently support such features.

To make content from our websites available via the service, your personal data will be transmitted to the service providers. The data processed includes, in particular:

• your IP address,
• the accessed website,
• the referrer URL,
• the browser used,
• the operating system used.

We use the service to provide our online presence in the best possible way and without long loading times.

Legal Basis for Data Processing

Insofar as we use cookies and similar technologies in connection with the integration of the service, or insofar as data is stored on or read from your terminal device by the service, this is done in accordance with § 25 para. 2 TDDDG. Subsequent data processing is carried out on the basis of Art. 6 para. 1 sentence 1 lit. f GDPR. Our legitimate interest lies in technically improving our website and making our online presence available efficiently.

Recipients

When using the service, the data collected via our websites is transmitted to the following recipients:

• Cloudflare, Inc, 101 Townsend St, San Francisco, CA 94107, USA.

As a rule, we have no influence on further data processing by the third-party provider.

Further information on how the service provider handles personal data can be found at https://www.jsdelivr.com/terms/privacy-policy.

Data Processing in Third Countries

When using the service, your data may also be processed in third countries outside the European Union (EU) and the European Economic Area (EEA), particularly in the USA.

For data transfers to the USA, there is an adequacy decision by the EU Commission pursuant to Art. 45 para. 1 GDPR regarding companies certified under the EU-U.S. Data Privacy Framework, which can be viewed at the following link: Data protection adequacy for non-EU countries.

Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework and thus commits to complying with adequate data protection standards, which can be viewed at the following link: Participant Search (dataprivacyframework.gov).

If your data is transferred to other third countries for which no adequacy decision exists, there is a risk that local authorities may access your data for security and surveillance purposes without you being informed or able to exercise legal remedies.

To ensure an adequate level of data protection when transferring your data to a third country, standard data protection clauses of the European Commission are concluded in accordance with Art. 46 para. 2 lit. c GDPR. These clauses oblige the recipient of the data to process it in accordance with the European level of protection.

If the standard data protection clauses are not sufficient to ensure the level of protection, additional technical, contractual, or organizational measures are taken to secure the data transfer. Furthermore, it is regularly reviewed and assessed whether these additional measures continue to ensure an adequate level of data protection or whether further supplementary measures may need to be taken.

Storage Duration

By integrating these services on our websites, data is transmitted to the aforementioned recipients and stored there for as long as necessary to achieve the stated purposes. No additional data processed by the service and provided to us is stored in our own systems.

jsDelivr (in conjunction with Webflow)

To provide our website, we use jsDelivr, a service of Volentio JSDLimited, Suite 2a1, Northside House, Mount Pleasant, Barnet, EN4 9EB, United Kingdom. The service is integrated by our hosting provider Webflow.

Description of Data Processing and Purpose

The service enables us to quickly provide data to make our website available in the best possible way. The service is a Content Delivery Network (CDN). The CDN uses proxy servers worldwide, allowing companies to deliver content such as web videos or other large media quickly and securely. To do this, proxy servers cache files locally, thereby improving access speed during downloads. In practice, this means companies can offer data-rich content on their websites that users can access without long waiting times.

To be able to provide content for our websites via the service, your personal data is transferred to the service providers. The processed data includes, in particular:

• your IP address.
• the accessed website,
• the referrer URL,
• the browser used,
• the operating system used,

We use the service to provide our online presence in the best possible way and without long loading times.

Legal Basis for Data Processing

Insofar as we use cookies and similar technologies as part of the service integration, or insofar as data is stored on or read from your terminal device by the service, this is done in accordance with Section 25 (2) TDDDG. Subsequent data processing is carried out on the basis of Art. 6 para. 1 sentence 1 lit. f GDPR. Our legitimate interest lies in technically improving our website and making our online presence available efficiently.

Recipients

When using the service, the data collected via our websites is transferred to the following recipients:

• Volentio JSD Limited, Suite 2a1, Northside House, Mount Pleasant, Barnet, EN4 9EB, United Kingdom

Data Processing in Third Countries

When using the service, your data may also be processed in third countries outside the European Union (EU) and the European Economic Area (EEA), particularly in the United Kingdom.

For data transfers to the United Kingdom, an adequacy decision by the EU Commission exists in accordance with Art. 45 para. 1 GDPR, which can be viewed at the following link: Data protection adequacy for non-EU countries.

When your data is transferred to other third countries for which no adequacy decision exists, there is a risk that local authorities may access your data for security and surveillance purposes, without you being informed or able to appeal.

To ensure an adequate level of data protection when transferring your data to a third country, Standard Contractual Clauses (SCCs) of the European Commission are concluded in accordance with Art. 46 para. 2 lit. c GDPR. These clauses oblige the recipient of the data to process it in accordance with the European level of protection.

If the standard data protection clauses are insufficient to ensure the level of protection, additional technical, contractual, or organizational measures are taken to secure the data transfer. Furthermore, it is regularly reviewed and assessed whether these additional measures continue to ensure an adequate level of data protection or whether further supplementary measures may need to be taken.

Retention Period

By integrating the services on our websites, data is transmitted to the aforementioned recipients and stored there for as long as necessary to achieve the stated purposes. No further storage of the data processed by the service and provided to us takes place in our own systems.

Usage Data and Server Log Files

Description of Data Processing and Purpose

When you access our website, it is technically necessary for data to be transmitted from your internet browser to our web server. The following data is recorded during an ongoing connection for communication between your internet browser and our web server:

• Date and time of the request
• Name of the requested file
• Page from which the file was requested (Referrer URL)
• Access Status
• Web browser and operating system used
• (Full) IP address of the requesting computer
• Amount of Data Transferred

We collect the listed data to ensure a smooth connection to the website and a technically flawless provision of our services. The processing of this data is absolutely necessary to make the website available to you. The log files are used to evaluate system security and stability, as well as for administrative purposes.

Legal Basis for Data Processing

The legal basis for processing the data is our legitimate interest in the protection and functionality of our website in accordance with Art. 6 para. 1 sentence 1 lit. f GDPR.

Storage Duration

For reasons of technical security, particularly to prevent attack attempts on our web server, this data is stored by us for a short period. After a maximum of 7 days, the data is anonymized by shortening the IP address at the domain level, making it impossible to establish a connection to an individual user.

In anonymized form, the data may also be processed for statistical purposes. This data is never stored together with other personal data of the user, compared with other data sets, or passed on to third parties.

Data Processing in Connection with Cookies and Similar Technologies

Access to and Storage of Information on End Devices

By using our website, information (e.g., IP address) may be accessed or stored (e.g., cookies) on your end devices. This access or storage may involve further processing of personal data in accordance with the GDPR.

In cases where such access to information or storage of information is absolutely necessary for the technically flawless provision of our services, this is done on the basis of Section 25 (1) sentence 1, (2) no. 2 TDDDG. Any subsequent data processing may take place on the basis of Art. 6 (1) sentence 1 lit. f GDPR.

In cases where such a process serves other purposes (e.g., the needs-based design of our website), it is carried out only with your consent in accordance with Section 25 (1) TDDDG and Art. 6 (1) sentence 1 lit. a GDPR. Consent can be revoked at any time for the future. The provisions of the GDPR and the Federal Data Protection Act (BDSG) apply to the processing of your personal data.

Further information on the processing of your personal data and the relevant legal bases in this context can be found in the following sections on the specific processing activities on our website.

Cookies and similar technologies

General Information

On this website, we use services that employ cookies and similar technologies to store data in your device's browser and read already stored data. This may involve cookies, your browser's Local Storage, pixels, and so-called tags.

Cookies are small text files that can be stored and read on your device.

A distinction is made between session cookies, which are deleted as soon as you close your browser, and persistent cookies, which are stored beyond a single session for a specific period.

In addition to cookies, we may use your browser's Session Storage or Local Storage to store and retrieve data. We may also embed pixels in our websites. Pixels are small individualized image files that are loaded when a page is built and can be used to track user activities.

Finally, we may use tags on our websites. Tags are small HTML or JavaScript code fragments or markers that enable website analysis or user tracking services to distinguish or identify users and track specific user activities.

Further information on the cookies and similar technologies we use can be found below in the descriptions of the cookie categories and in our Consent Management Platform "Consent Pro", which is displayed to you when you visit our website. You can access "Consent Pro" again via the "Cookie Settings" link at the bottom of the website to change your settings.

Please note that without the use of certain cookies and similar technologies, our websites may not be displayed correctly, and some functions may no longer be technically available.

Category Essential

Services in this category may use cookies and similar technologies to store and read information on your device. We use these,

• to enable the display of the website and provide its basic functions, especially page navigation and access to secure areas,
• to enable the submission and revocation of consents,
• to protect our forms from abusive entries,
• to protect our website from cyberattacks and attempted fraud, and
• to enable the display of the website.

Some of the cookies and similar technologies used only contain information about specific settings and are not personally identifiable. We do not use them for the purpose of tracking your interactions, for measurement and statistical analysis, or for advertising purposes.

The use of services, as well as corresponding cookies and similar technologies in this category, is based on § 25 para. 2 no. 1, no. 2 TDDDG. Subsequent data processing is based on Art. 6 para. 1 sentence 1 lit. f GDPR.

Functional Category

Services or external content and media from third-party providers in this category may use cookies and similar technologies to store and read information on your device. We use these

• to enable the loading of content and media from third-party providers,
• to make our websites appealing to you and operate them efficiently and
• to provide you with certain settings and additional website functions.

The use of services, as well as corresponding cookies and similar technologies in this category, is based on your consent in accordance with § 25 para. 1 TDDDG. Subsequent data processing is based on your consent in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR.

Statistics Category

Services in this category may use cookies and similar technologies to store and read information on your device. We use these

• to count and distinguish you as an individual website visitor and to create statistical analyses of your interactions and your use of our websites,
• to design our websites according to needs and adapt them to user interactions,
• to test website adjustments and measure user reactions to them (A/B Testing) and
• to monitor the technical functionality of our website and enable troubleshooting.

For this purpose, individual pseudonymous identifiers (recognition features) consisting of numbers and letters are regularly stored in cookies on your device by us and the services when you visit our website, and are read again when you revisit it.

The use of pseudonyms allows for individual differentiation and recognition of users. However, the natural person behind a pseudonym cannot usually be directly identified, especially not by name, without further, additional data.

Other technologies may also be used regularly to read recognition features from your device, such as in the case of so-called browser or device fingerprinting, where data from properties of the browser you are using (e.g., type and version of the browser) and its configuration (e.g., preferred language), from properties of your device (e.g., manufacturer and model of your mobile phone, operating system), or from the hardware you are using (e.g., screen resolution) are used to pseudonymously recognize you as a distinct user.

The use of services, as well as corresponding cookies and similar technologies in this category, is based on your consent in accordance with § 25 para. 1 TDDDG. Subsequent data processing is based on your consent in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR.

Marketing Category

Services in this category may use cookies and similar technologies to store and read information on your device. We use these

• to count and distinguish you as an individual website visitor and to create statistical analyses of your interactions and your use of our websites,
• to track your interactions with advertisements placed by us via third-party providers on other websites across various end devices and websites (so-called conversion tracking),
• to understand and evaluate your interactions with our website and to then use this as the basis for targeted advertising campaigns in advertising networks, aimed at you or a specific target group to which you belong (so-called retargeting and remarketing),
• to improve the effectiveness of our advertising measures and to manage our advertising campaigns.

For this purpose, individual pseudonymous identifiers (recognition features) consisting of numbers and letters are regularly stored in cookies on your end device by us and the services when you visit another website or our website, and are read again when you revisit this or a new website.

Regularly, other technologies may also be used to read recognition features from your end device, such as in the case of so-called browser or device fingerprinting, where data from properties of the browser you use (e.g., type and version of the browser) and its configuration (e.g., preferred language) or from properties of your end device (e.g., manufacturer and model of your mobile phone, operating system) or the hardware you use (e.g., screen resolution) are used to pseudonymously recognize you as a distinct user.

If applicable, the processed pseudonymous recognition features may also be merged with other data by us or the providers of the services used.

Thus, the services we use and their providers can also exchange and compare recognition features (IDs) with each other to merge the features in case of a match (matching) and assign them to the same pseudonymous user (so-called ID Matching/ID Syncing). This enables cross-device, cross-platform, and cross-advertising network recognition and advertising targeting of website visitors.

If you identify yourself with your clear data such as name or email address, or enter your own user data on our websites, or log in to social networks or online services from third-party providers that also provide us with corresponding tracking and advertising services, pseudonymous recognition features can also be linked to your clear data or user data.

In this way, we or the service providers can create and evaluate comprehensive pseudonymous or non-pseudonymous user profiles to then use them for targeted advertising based on your interests.

The use of the services and corresponding cookies and similar technologies in this category is based on your consent in accordance with § 25 para. 1 TDDDG. Subsequent data processing is based on your consent in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR.

Consent Management via Consent Management Platform Consent Pro

On our websites, we use the Consent Management Platform Consent Pro from Finsweet Inc., 2093 Philadelphia Pike #5766, Claymont, DE 19703, USA.

Description of data processing and purpose

We use the service to manage your consent for the use of cookies and similar technologies, as well as the subsequent data processing.

If you provide consent via the banner of our Consent Management Platform, the service processes the following data:

• the IP address of the requesting computer,
• the description of the web browser and operating system used,
• the address of the website from which your consent was sent
• the date and time of consent,
• a pseudonymous and encrypted consent key (Consent ID).
• Your consent status, which serves as proof of your consent.

This data is logged on the provider's servers. In the context of data processing, cookies are used to store your consent status on your terminal device, to read it again upon revisiting the page, and to reconcile it.

In this way, we are able to check your consent status during all subsequent and future visits to our websites and, according to your decision regarding the use of cookies and other technologies, activate or deactivate them when you revisit the page.

The purpose of data processing is to centrally control cookies and similar technologies as well as integrated services on our website and to offer you an easy way to give and withdraw your consent declarations. This enables us to fulfill our legal obligations to obtain consent and our accountability according to Art. 5 (2) GDPR.

Legal Basis for Data Processing

Insofar as we use cookies and similar technologies in connection with the service, or insofar as data is stored on or read from your terminal device by the service, this is done in accordance with Section 25 (2) No. 2 TDDDG. Subsequent data processing is carried out on the basis of Art. 6 (1) sentence 1 lit. c GDPR.

Recipients

In the context of data processing, your data will be transferred to the following recipients:

• Finsweet Inc., 2093 Philadelphia Pike #5766, Claymont, DE 19703, USA

Data Processing in Third Countries

Your data will be transferred to Finsweet Inc. in the USA. As there is no adequacy decision by the EU Commission for data transfers to the USA, standard contractual clauses are concluded and further measures are taken to ensure an adequate level of data protection for these data transfers.

Additional information and further links can be found above in the section "General Information on Data Transfer to Third Countries".

Storage Duration

By integrating these services on our websites, data is transmitted to the aforementioned recipients and processed there for as long as necessary to achieve the stated purposes. Data processed by the service and provided to us is generally not stored beyond this in our own systems. In individual cases, data regarding the time, status, and scope of consent may be stored longer in our own systems, provided this is permissible for other purposes mentioned in this declaration.

Google Tag Manager

On our websites, we integrate the "Google Tag Manager" service from Google LLC, 1600Amphitheatre Parkway, Mountain View, California 94043, USA.

In the European Union (EU) and the European Economic Area (EEA), the service is offered by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Description of Data Processing and Purpose

"Google Tag Manager" is a Tag Management System (TMS) that enables us to integrate and manage additional website content in JavaScript or HTML code.

Specifically, this allows for the integration and management of so-called tags on our website. Tags are small code fragments or markers (web beacons, tracking pixels, or similar markers) that enable website analysis and user tracking services to distinguish or identify users.

The analysis of website visits and user tracking are not carried out by "Google Tag Manager" itself, but by the services used for these purposes, such as "Google Analytics" or other third-party solutions. Rather, "Google Tag Manager" merely serves to integrate and manage the tags required for analysis and tracking on our websites.

Since "Google Tag Manager" is provided by Google and reloaded from its servers when a page is accessed, the technically necessary usage data for accessing the page is also transmitted. In this respect, Google also receives your IP address, which is technically required to retrieve the content.

Legal Basis for Data Processing

The legal basis for the integration and use of the service is your consent, provided you have given it via our consent management platform "Consent Pro".

The use of cookies and similar technologies is based on Section 25 (1) TDDDG. The subsequent data processing is based on Art. 6 para. 1 sentence 1 lit. a GDPR.

Your consent is voluntary and can be revoked at any time with future effect. To exercise your right of revocation, please use the "Cookie Settings" link at the bottom of the website to reopen "Consent Pro" and change your settings.

Recipients

• When using the service, the data collected via our websites is transferred to the following recipients:
• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland,

Google LLC, 1600 Amphitheatre Parkway, Mountain View, California 94043, USA.

We generally have no influence over further data processing by the third-party provider.

Further information on how Google handles personal data can be found at .

Data Processing in Third Countries

For data transfers to the USA, there is an adequacy decision by the EU Commission pursuant to Art. 45 para. 1 GDPR regarding companies certified under the EU-U.S. Data Privacy Framework, which can be viewed at the following link: Data protection adequacy for non-EU countries.

[SEG SEGMENT 7]
When using the service, your data may also be processed in third countries outside the European Union (EU) and the European Economic Area (EEA), particularly in the USA.

Google LLC is certified under the EU-U.S. Data Privacy Framework and thus commits to complying with adequate data protection standards, which can be viewed at the following link: Participant Search (dataprivacyframework.gov).

When your data is transferred to other third countries for which no adequacy decision exists, there is a risk that local authorities may access your data for security and surveillance purposes, without you being informed or able to appeal.

To ensure an adequate level of data protection when transferring your data to a third country, standard data protection clauses of the European Commission pursuant to Art. 46 para. 2 lit. c GDPR are concluded. These clauses oblige the recipient of the data to process it in accordance with the European level of protection.

Insofar as the standard data protection clauses are insufficient to ensure the level of protection, additional technical, contractual, or organizational measures are taken to secure the data transfer. Furthermore, it is regularly reviewed and assessed whether these additional measures continue to ensure an adequate level of data protection or whether further supplementary measures may need to be taken.

Retention Period

By integrating the service on our websites, data is transmitted to the aforementioned recipients and processed there for as long as necessary to achieve the stated purposes.

Google Analytics

On our websites, we integrate the Google Analytics service from Google LLC, 1600 Amphitheatre Parkway, Mountain View, California 94043, USA.

In the European Union (EU) and the European Economic Area (EEA), the service is offered by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Description of data processing and purpose

"Google Analytics" creates user profiles based on pseudonyms (recognition features from cookie and device ID and other data about the device used or the so-called browser fingerprint) and usage data (e.g., name and address of the website content requested by your browser, referral links, description of the web browser and operating system used, and the IP address of the requesting device).

Also,

• demographic data (such as continent, country, region, city, age, gender, and user interests)
• Data on your interactions with search engines or other websites,
• Data on your interactions with our websites (subpages visited, data on visit times, button clicks, scroll depth, reading depth, as well as the use of filters, search functions, forms and other input and registration options, data on products and services viewed by you on our websites), as well as
• Data on your interactions with social media networks

collected and analyzed.

In this way, Google can pseudonymously recognize website visitors and the devices they use, count them as such, and assign them to specific demographic target groups, interest groups, or customer segments.

Visitors who have their own user account on Google platforms can also be identified by Google as visitors to our websites across devices.

Data collection and processing on our websites is carried out using cookies and JavaScript code, which is loaded when the page is accessed and executed in your device's browser. With the help of this JavaScript code, cookies can then be stored on your device and various information from your device, as well as from cookies stored there, can be read out. Details on the cookies used and similar technologies can be found above under "Data processing in connection with cookies and similar technologies" and via the information you can access through our consent management platform "Consent Pro".

From the processed information, Google creates aggregated statistics for us, from which we can see what interests the users of our websites and how many users have interacted with our websites and in what way.

We only receive aggregated statistics (aggregated data) from Google, from which we, as users of Google advertising services, cannot draw conclusions about individual persons.

We then use these insights for placing target group-oriented online advertising measures and marketing campaigns in advertising networks, particularly in Google advertising services.

Legal basis for data processing

The legal basis for integrating and using the service is your consent, provided you have given it via our consent management platform "Consent Pro".

The use of cookies and similar technologies is based on § 25 Para. 1 TDDDG. The subsequent data processing is based on Art. 6 Para. 1 S. 1 lit. a GDPR.

Your consent is voluntary and can be freely revoked at any time with future effect. To exercise your right of revocation, please use the "Cookie Settings" link at the bottom of the website to reopen "Consent Pro" and change your settings.

Recipients

When using the services, the data collected via our websites is transmitted to the following recipients:

• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland,
• Google LLC, 1600 Amphitheatre Parkway, Mountain View, California 94043, USA.

As a rule, we have no influence on further data processing by the third-party provider.

Further information on how Google handles personal data can be found at https://policies.google.com/privacy?hl=de.

Data Processing in Third Countries

When using the service, your data may also be processed in countries outside the European Union (EU) and the European Economic Area (EEA) in third countries, particularly in the USA.

For data transfers to the USA, an adequacy decision by the EU Commission exists pursuant to Art. 45 Para. 1 GDPR concerning companies certified under the EU-U.S. Data Privacy Framework, which can be viewed via the following link: Data protection adequacy for non-EU countries.

Google LLC is certified under the EU-U.S. Data Privacy Framework and is therefore committed to complying with adequate data protection standards, which can be viewed via the following link: Participant Search (dataprivacyframework.gov).

When your data is transferred to other third countries for which no adequacy decision exists, there is a risk that local authorities may access your data for security and surveillance purposes without you being informed or able to exercise legal remedies.

To ensure an adequate level of data protection when transferring your data to a third country, standard data protection clauses of the European Commission are concluded in accordance with Art. 46 Para. 2 lit. c GDPR. These oblige the data recipient to process the data in accordance with the European level of protection.

If the standard data protection clauses are insufficient to ensure the level of protection, additional technical, contractual, or organizational measures are taken to secure the data transfer. Furthermore, it is regularly reviewed and assessed whether these additional measures continue to ensure an adequate level of data protection or whether further supplementary measures may need to be taken.

Storage Duration

By integrating these services on our websites, data is transmitted to the aforementioned recipients and stored there for a period of 14 months. Any further storage of the data processed by the service and provided to us in our own systems does not occur.

Google advertising services and functions: Google Ads, Google Ads Conversion Tracking, Google Marketing Platform (formerly Google DoubleClick), Google AdSense, Google Ads Remarketing.

On our websites, we integrate Google advertising services and functions from Google LLC, 1600 Amphitheatre Parkway, Mountain View, California 94043, USA.

Within the European Union (EU) and the European Economic Area (EEA), services are offered by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Description of data processing and purpose

We use Google Marketing services and functions such as Google Ads, Google Ads Conversion Tracking, Google Ads Retargeting, and the Google Marketing Platform to be able to place and manage target group-oriented advertisements for our products and services via Google's advertising network, and to measure how successful these advertisements are.

Data collection and processing on our websites is carried out using cookies and JavaScript code, which is loaded when the page is accessed and executed in your device's browser. With the help of this JavaScript code, cookies can then be stored on your device and various information from your device and from cookies stored there can be read out. Details on the cookies used and similar techniques can be found above under "Data processing in connection with cookies and similar techniques" and via the information you can retrieve through our consent management platform "Consent Pro".

In this way, Google can pseudonymously recognize website visitors and the end devices they use. Visitors who have their own user account on Google platforms can also be identified by Google across devices as visitors to our websites.

If you click on an advertisement placed for us via Google, cookies for conversion tracking are set by the website or app of other providers. These are read again when our page is accessed. Data from the original website or app is processed to determine which search terms (keywords) you may have entered in a search engine, which advertisement or groups of advertisements you clicked on, and which of our online marketing campaigns the advertisement was assigned to.

Subsequently, we collect data on our websites about how you have used our website and how you have interacted with the website content, e.g., which subpages were accessed, which content was clicked or retrieved, or which forms or dialogues you used. The transformation of an advertisement into a specific action by the website visitor on a website is referred to as a conversion.

When "Google Analytics" is used simultaneously, we can evaluate your actions on our websites even more precisely with the data collected through it.

From the processed information, Google creates aggregated statistics for us within "Google Ads Conversion Tracking" in "Google Ads" and the "Google Marketing Platform", from which we can see how many users have reacted to our advertisements and in what way. We only receive aggregated statistics (aggregated data) from Google, from which we, as users of Google advertising services, cannot draw conclusions about individual persons.

Based on these statistics, we can optimize the effectiveness of our online advertising and manage our advertising strategy through Google advertising services.

Google Ads Remarketing then enables us to display interest- and target group-oriented advertisements during your further internet or app usage, based on websites and content you have visited with us, how you have used them, and what actions (conversions) you have taken on our websites.

Legal basis for data processing

The legal basis for integrating and using the service is your consent, provided you have given it via our consent management platform "Consent Pro".

The use of cookies and similar technologies is based on Section 25 (1) TDDDG. The subsequent data processing is based on Art. 6 (1) sentence 1 lit. a GDPR.

Your consent is voluntary and can be freely revoked at any time with effect for the future. To exercise your right of revocation, please use the "Cookie Settings" link at the bottom of the website to access "Consent Pro" again and change your settings.

Recipients

When using the services, the data collected via our websites is transmitted to the following recipients:

• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland,
• Google LLC, 1600 Amphitheatre Parkway, Mountain View, California 94043, USA.

We generally have no influence over further data processing by the third-party provider.

For more information on how Google handles personal data, please visit https://policies.google.com/privacy?hl=de.

Data Processing in Third Countries

When using the service, your data may also be processed in third countries outside the European Union (EU) and the European Economic Area (EEA), particularly in the USA.

For data transfers to the USA, there is an adequacy decision by the EU Commission pursuant to Art. 45 para. 1 GDPR concerning companies certified under the EU-U.S. Data Privacy Framework, which can be viewed via the following link: Data protection adequacy for non-EU countries.

Google LLC is certified under the EU-U.S. Data Privacy Framework and thus commits to adhering to adequate data protection standards, which can be viewed via the following link: Participant Search (dataprivacyframework.gov).

When your data is transferred to other third countries for which no adequacy decision exists, there is a risk that local authorities may access your data for security and surveillance purposes without you being informed or able to exercise legal remedies.

To ensure an adequate level of data protection when transferring your data to a third country, Standard Contractual Clauses of the European Commission are concluded in accordance with Art. 46 para. 2 lit. c GDPR. These clauses oblige the recipient of the data to process it in accordance with the European level of protection.

If the standard data protection clauses are not sufficient to ensure the level of protection, additional technical, contractual, or organizational measures are taken to secure the data transfer. Furthermore, it is regularly reviewed and assessed whether these additional measures continue to guarantee an adequate level of data protection or if further supplementary measures may need to be taken.

Storage Duration

By integrating these services on our websites, data is transmitted to the aforementioned recipients and processed there for as long as necessary to achieve the stated purposes. No further storage of the data processed by the service and provided to us occurs in our own systems.

Meta Pixel and other Meta Marketing Services and Functions: Meta Conversion Tracking, Meta Custom Audiences, Meta Retargeting, Meta Ads Manager

On our websites, we integrate the "Meta Pixel" from Meta Inc., 1 Hacker Way, Menlo Park, CA 94025, USA.

Within the European Union (EU) and the European Economic Area (EEA), the service is offered by Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland.

Description of Data Processing and Purpose

We use the Meta Pixel and other Meta marketing services and functions such as Meta Custom Audiences, Meta Conversion Tracking, Meta Retargeting, and Meta Ads Manager to display and manage targeted advertisements for our products and services on Meta social media platforms Facebook and Instagram, and to measure the success of these advertisements.

Data collection and processing on our website occur via the "Meta Pixel." This is a JavaScript code that is loaded and executed in your device's browser when a page is accessed. With the help of this JavaScript code, cookies can then be stored on your device, and various information can be read from your device and from cookies stored there.

This enables us to pseudonymously recognize website visitors and the devices they use. Visitors who have their own user account on Meta social media platforms can also be identified by Meta as visitors to our websites across different devices.

Furthermore, the "Meta Pixel" allows us to track and evaluate your interests based on the websites you visit and your interactions with our websites.

The information read out via the "Meta Pixel" includes, in particular,

• Information contained in the so-called HTTP header in your device's browser when you access a website, particularly usage data such as IP address, information about the web browser used, the page's location, the files retrieved, and the referral link indicating from which page you arrived at ours,
• Characteristics of the device you use when accessing our websites,
• Cookies that may already exist in your device's browser and have been set by Meta services, e.g., marketing cookies "_fbp" and "fr",
• Button click data, i.e., data about which buttons on the websites were clicked by visitors, the labels of these buttons, and all pages visited as a result of the button clicks. This includes, for example, clicking buttons in web forms for product inquiries or demonstrations, downloading documents, or booking appointments. 

From this information, Meta creates statistics for us within the "Meta Conversion Tracking" in the "Meta Ads Ad Manager", which allow us to see how many users reacted to our advertisements placed on the Meta Social Media Platforms and in what way. The transformation of an advertisement into an action by the website visitor is called a conversion. Based on these statistics, we can optimize the effectiveness of our advertising and manage our advertising strategy.

Furthermore, we use the information collected via the "Meta Pixel" on our websites to create "Meta Custom Audiences" (custom audiences) in the "Meta Ads Ad Manager" and to display targeted advertising for these audiences on the Meta Social Media Platform. For example, we can display ads on the platforms to website visitors who have previously shown interest in our products, services, or promotions and visited our websites within a certain period. This type of targeted advertising is called retargeting.

Legal Basis for Data Processing

The legal basis for the integration and use of the service is your consent, provided you have given it via our consent management platform "Consent Pro".

The use of cookies and similar technologies is based on Section 25 para. 1 TDDDG. The subsequent data processing is based on Art. 6 para. 1 sentence 1 lit. a GDPR.

Your consent is voluntary and can be freely revoked at any time with effect for the future. To exercise your right of revocation, please use the "Cookie Settings" link at the bottom of the website to access "Consent Pro" again and change your settings.

Recipients

When using the service, the data collected via our websites is transmitted to the following recipients:

• Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland,
• Meta Platforms Inc., 1 Hacker Way, Menlo Park, CA 94025, USA.

We generally have no influence over further data processing by the third-party provider.

Further information on how Meta handles personal data can be found at https://de-de.facebook.com/privacy/policy.

Data Processing in Third Countries

When using the service, your data may also be processed in third countries outside the European Union (EU) and the European Economic Area (EEA), particularly in the USA.

For data transfers to the USA, an adequacy decision by the EU Commission exists in accordance with Art. 45 para. 1 GDPR for companies certified under the EU-U.S. Data Privacy Framework, which can be viewed at the following link: Data protection adequacy for non-EU countries.

Meta Platforms Inc. is certified under the EU-U.S. Data Privacy Framework and thus commits to complying with adequate data protection standards, which can be viewed at the following link: Participant Search (dataprivacyframework.gov).

If your data is transferred to other third countries for which no adequacy decision exists, there is a risk that local authorities may access your data for security and monitoring purposes without you being informed or able to exercise legal remedies.

To ensure an adequate level of data protection when transferring your data to a third country, standard data protection clauses of the European Commission are concluded in accordance with Art. 46 para. 2 lit. c GDPR. These clauses oblige the recipient of the data to process it in accordance with the European level of protection.

If the standard data protection clauses are not sufficient to ensure the level of protection, additional technical, contractual, or organizational measures are taken to secure the data transfer. Furthermore, it is regularly checked and assessed whether these additional measures continue to ensure an adequate level of data protection or whether further supplementary measures may need to be taken.

Storage period

By integrating the services on our websites, data is transmitted to the aforementioned recipients and stored there for a period of 24 months.

Microsoft Advertising (Bing Ads)

On our websites, we integrate the service "Microsoft Advertising (Bing Ads)" from Microsoft Corporation, One Microsoft Way, Redmond WA 94043, USA.

In the European Union (EU) and the European Economic Area (EEA), the service is offered by Microsoft Ireland Operations, Ltd, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland.

Description of the data processing and its purpose

We use this service on our websites to measure the success of our advertisements placed via Microsoft Advertising (Bing Ads). For this purpose, we track how website visitors interact with the advertisements and their subsequent use of our websites. This involves tracking the conversion of an advertisement into an action by the website visitor (conversion tracking) with the aim of controlling and optimizing our online marketing measures.

If an advertisement placed by us via "Microsoft Advertising (Bing Ads)" is shown to you on other websites or if you click on it, these other websites will store a tracking cookie with a pseudonym assigned to us on your device, based on the consent you provided there. If you then visit our websites within the storage period of this cookie, this cookie will be read.

Additionally, when you visit our websites, other pseudonymous cookies are stored on your device to track your page views and interactions with our websites.

This way, Microsoft can determine for us whether an advertisement we placed was shown to you, if you clicked on it and subsequently visited our websites, and how you may have used our websites afterwards.

Specifically, when using Microsoft Advertising (Bing Ads), the following data types are collected and processed

• Website access data
  • IP address
  • Timestamp
  • Time zone
• Data of the device used to access the website
  • Hardware characteristics of the device
  • Information about the operating system
  • Information about the web browser used
  • Language settings of the end device
  • Pseudonymous recognition feature of the end device
• Data about the displayed advertisement
  • Data about the website where the ad was displayed
  • Website visitor's click on the ad
• Data on the usage behavior of our websites
  • visited webpages
  • Duration and number of visits
  • Mouse movements
  • Click path
  • Successful completion of the defined target action by the website visitor (Conversion)

From this information, Microsoft creates statistics for us, allowing us to see how many users reacted to our advertisements and in what way. Based on these statistics, we can optimize the effectiveness of our advertising campaigns and manage our advertising strategy.

Legal Basis for Data Processing

The legal basis for integrating and using the service is your consent, provided you have given it via our consent management platform "Consent Pro".

The use of cookies and similar technologies is based on § 25 (1) TDDDG. The subsequent data processing is based on Art. 6 (1) sentence 1 lit. a GDPR.

Your consent is voluntary and can be freely revoked at any time with future effect. To revoke your consent, please use the "Cookie Settings" link at the bottom of the webpage to reopen "Consent Pro" and change your settings.

Data Processing in Third Countries

When using the service, your data may also be processed in third countries outside the European Union (EU) and the European Economic Area (EEA), particularly in the USA.

For data transfers to the USA, there is an adequacy decision by the EU Commission pursuant to Art. 45 (1) GDPR regarding companies certified under the EU-U.S. Data Privacy Framework, which can be viewed at the following link: Data protection adequacy for non-EU countries.

Microsoft Corporation is certified under the EU-U.S. Data Privacy Framework and is therefore committed to adhering to appropriate data protection standards, which can be viewed at the following link: Participant Search (dataprivacyframework.gov).

When your data is transferred to other third countries for which no adequacy decision exists, there is a risk that local authorities may access your data for security and surveillance purposes without you being informed or able to seek legal remedies.

To ensure an adequate level of data protection when transferring your data to a third country, standard data protection clauses of the European Commission are concluded in accordance with Art. 46 para. 2 lit. c GDPR. These oblige the recipient of the data to process it in accordance with the European level of protection.

If the standard data protection clauses are not sufficient to ensure the level of protection, additional technical, contractual, or organizational measures are taken to secure the data transfer. Furthermore, it is regularly reviewed and assessed whether these additional measures continue to ensure an adequate level of data protection or whether further supplementary measures may need to be taken.

Recipients

When using the service, the data collected via our website is transmitted to the following recipients:

• Microsoft Ireland Operations, Ltd, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland
• Microsoft Corporation, One Microsoft Way, Redmond, WA 94043, USA

As a rule, we have no influence over further data processing by the third-party provider.

Further information on how Microsoft handles personal data can be found at https://privacy.microsoft.com/de-de/privacystatement.

Storage Period

By integrating the service on our websites, data is transmitted to the aforementioned recipients and stored there for as long as necessary to achieve the stated purposes.

LinkedIn Advertising Services and Features: LinkedIn Ads & Analytics, LinkedIn Conversion Tracking and Retargeting (Insight Tag), LinkedIn Ads & Analytics

On our websites, we integrate LinkedIn advertising services and functions from LinkedIn Corporation, 1000 W. Maude Ave., Sunnyvale, California 94085, USA.

In the European Union (EU) and the European Economic Area (EEA), "LinkedIn Conversion-Tracking" is offered as a service by LinkedIn Ireland Unlimited Company, Wilton Plaza, Gardner House 4,5,6, Dublin 2, Ireland, .

Description of data processing and purpose

If an advertisement placed by us via LinkedIn is displayed to you on other websites or if you click on it, these other websites will store a "LinkedIn Conversion-Tracking" cookie with a pseudonym assigned to us on your device, based on your consent given there.

If you subsequently visit our websites within the storage period of this cookie, this cookie and your usage data will be read on our websites using a pixel and JavaScript code (so-called "LinkedIn Insight Tag"). The following data will be processed:

• the name and address of the requested content,
• the date and time of the request,
• the description of the web browser and operating system used, including details of the language used,
• the referrer address, which indicates from which websites you arrived at ours,
• the IP address of the requesting computer,
• Your interactions with our websites (e.g., clicked content and events, form submissions, frequency of response).
• IP addresses of website visitors are by LinkedIn truncated so that personal identification is no longer possible.

If website visitors are also LinkedIn members, their user ID is also processed. IP addresses of members are not truncated but hashed to enable cross-device tracking. In addition to the user ID, demographic data such as the member's job title, company, and industry are also processed.

In this way, LinkedIn can determine that an advertisement placed by us was shown to you, or that you clicked on it and subsequently visited our websites, and possibly how you then used our websites.

The conversion of an advertisement into an action by the website visitor is referred to as a conversion. From this information, "LinkedIn Ads & Analytics" generates statistics for us, allowing us to see how many users reacted to our advertisements and in what way.

Based on these statistics, we can optimize the effectiveness of our advertising and manage our advertising strategy. In particular, LinkedIn Ads allows us to create target audiences for "LinkedIn Retargeting" (target-group-oriented advertising) based on this data and to address them via LinkedIn ads.

Legal basis for data processing

The legal basis for integrating and using the service is your consent, provided you have given it via our consent management platform "Consent Pro".

The use of cookies and similar technologies is based on Section 25 (1) TDDDG. The subsequent data processing is based on Art. 6 (1) sentence 1 lit. a GDPR.

Your consent is voluntary and can be freely revoked at any time with effect for the future. To exercise your right of revocation, please use the "Cookie Settings" link at the bottom of the webpage to access "Consent Pro" again and change your settings.

Recipients

When using the service, data collected via our websites is transmitted to the following recipients:

• LinkedIn Ireland Unlimited Company, Wilton Plaza, Gardner House 4,5,6, Dublin 2, Ireland,
• LinkedIn Corporation, 1000 W. Maude Ave., Sunnyvale, California 94085, USA.

We generally have no influence over further data processing by the third-party provider.

For more information on how the provider handles personal data, please visit https://www.linkedin.com/legal/privacy-policy.

Data Processing in Third Countries

When using the service, your data may also be processed in countries outside the European Union (EU) and the European Economic Area (EEA) in third countries, particularly in the USA.

For data transfers to the USA, there is an adequacy decision by the EU Commission pursuant to Art. 45 para. 1 GDPR regarding companies certified under the EU-U.S. Data Privacy Framework, which can be viewed at the following link: Data protection adequacy for non-EU countries.

LinkedIn Corporation is certified under the EU-U.S. Data Privacy Framework and thus commits to complying with adequate data protection standards, which can be viewed at the following link: Participant Search (dataprivacyframework.gov).

When transferring your data to other third countries for which no adequacy decision exists, there is a risk that local authorities may access your data for security and surveillance purposes without you being informed or being able to appeal.

To ensure an adequate level of data protection when transferring your data to a third country, Standard Contractual Clauses of the European Commission pursuant to Art. 46 para. 2 lit. c GDPR are concluded. These oblige the recipient of the data to process it in accordance with the European level of protection.

If the standard data protection clauses are not sufficient to ensure the level of protection, additional technical, contractual, or organizational measures are taken to secure the data transfer. Furthermore, it is regularly checked and assessed whether these additional measures continue to ensure an adequate level of data protection or whether further supplementary measures may need to be taken.

Data Retention Period

By integrating the services on our websites, data is transmitted to and stored by the aforementioned recipients. IP addresses of website visitors are truncated by LinkedIn so that personal identification is no longer possible. For LinkedIn members, IP addresses are not truncated but hashed to enable cross-device tracking. Direct member identifiers are removed within seven days to pseudonymize the data. These remaining pseudonymized data are then deleted within 90 days.

No further storage of the data processed by the service and provided to us takes place in our own systems.

Microsoft Clarity

On our websites, we integrate the service "Microsoft Clarity" from Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA.

In the European Union (EU) and the European Economic Area (EEA), the service is offered by Microsoft Ireland Operations, Ltd, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland.

Description of Data Processing and Purpose

We use the service to better understand, analyze, and evaluate the origin and type of our website visitors and their interaction with our websites.

The service provides statistical evaluations of certain individual values (e.g., pages visited per session, scroll depth, visitor dwell time, origin, type of device used), heatmaps (graphical highlighting of user clicks on individual web pages), as well as session recordings (playable records of individual users' interaction with our websites during a visit).

Cookies and similar technologies, especially JavaScript, are used to store and read data on your device. Further details can be found above under "Data Processing in Connection with Cookies and Similar Technologies".

Based on the results obtained, we try

• to understand the origin of our website visitors,
• to identify errors in the structure and design of the websites or insufficient compatibility with certain devices, browsers, or operating systems,
• to understand obstacles for visitors when using our websites and
• to identify the effectiveness of online advertising campaigns.

This allows us to understand how we can adapt and optimize our websites to existing demand and to manage our online advertising campaigns more effectively.

For these purposes, the service collects various information about website visits, the devices used, and a user's interactions with our websites on a pseudonymous basis.

Specifically, the following types of data are processed by the service:

• Pseudonymous user ID (Clarity User ID).
• Website visit data
  • IP address of the requesting device
  • Time of request
  • Number of visits
  • Time spent
  • Referring third-party websites
  • Pages visited
  • User's country of origin
• Device data
  • Type of device (PC, tablet, mobile device, other)
  • Screen resolution
  • Operating system
  • Web browser
• Interactions with the website
  • Mouse movements
  • Click behavior
  • Scrolling behavior
  • Entered text
  • Selected text
  • Clicked text
• Custom interactions and events (if applicable)
• Recording of the entire website visit (Session Recording)

Legal Basis for Data Processing

The legal basis for the integration and use of the service is your consent, provided you have given it via our consent management platform "Consent Pro".

The use of cookies and similar technologies is based on § 25 (1) TDDDG. The subsequent data processing is based on Art. 6 (1) sentence 1 lit. a GDPR.

Your consent is voluntary and can be freely revoked at any time with future effect. To exercise your right of withdrawal, please use the "Cookie Settings" link at the bottom of the webpage to reopen "Consent Pro" and change your settings.

Recipients

When using the service, data collected via our websites is transmitted to the following recipients:

• Microsoft Ireland Operations, Ltd, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland,
• Microsoft Corporation, One Microsoft Way, Redmond WA 94043, USA.

We generally have no influence over further data processing by the third-party provider.

Further information on how the service provider handles personal data can be found at https://privacy.microsoft.com/de-de/privacystatement.

Data Processing in Third Countries

When using the service, your data may also be processed in third countries outside the European Union (EU) and the European Economic Area (EEA), particularly in the USA.

For data transfers to the USA, an adequacy decision of the EU Commission pursuant to Art. 45 para. 1 GDPR exists with regard to companies certified under the EU-U.S. Data Privacy Framework, which can be viewed at the following link: Data protection adequacy for non-EU countries.

Microsoft Corporation is certified under the EU-U.S. Data Privacy Framework and thus commits to adhering to adequate data protection standards, which can be viewed at the following link: Participant Search (dataprivacyframework.gov).

When transferring your data to other third countries for which no adequacy decision exists, there is a risk that local authorities may access your data for security and surveillance purposes without you being informed or able to seek legal remedies.

To ensure an adequate level of data protection when transferring your data to a third country, Standard Contractual Clauses of the European Commission pursuant to Art. 46 para. 2 lit. c GDPR are concluded. These oblige the recipient of the data to process it in accordance with the European level of protection.

If the standard data protection clauses are not sufficient to ensure the level of protection, additional technical, contractual, or organizational measures are taken to secure the data transfer. Furthermore, it is regularly reviewed and assessed whether these additional measures continue to ensure an adequate level of data protection or whether further supplementary measures may need to be taken.

Retention period

By integrating the service on our websites, data is transmitted to the aforementioned recipients and stored there for a period of 13 months. Playable session recordings are deleted after just 30 days. Further storage of the data processed by the service and provided to us in our own systems does not take place.

Dealfront Leadfeeder

On our websites, we integrate the "Leadfeeder" service from Dealfront Group GmbH Durlacher Allee 73, 76131 Karlsruhe, Germany.

Description of data processing and purpose

We use the service on our websites to identify which companies have visited our websites and how visitors have used our content.

When using the service, the following data is processed using cookies and similar technologies:

• IP address
• MAC address
• Time and date of visit
• Source (previously visited website) and medium (device data, especially browser, operating system, and language)
• Number of pages visited
• Pages visited (title, URL, and duration of page visit)
• Visitor ID number
• Total duration of the visit
• Information on the visitor's location (domain and geolocation)
• viewed videos and downloaded files
• Use of website forms
• Name, origin, and industry of the visiting company

Leadfeeder identifies companies based on IP addresses using its own IP address database. The provider automatically filters out all users who visit our websites via private IP addresses and providers.

Using "Leadfeeder", we are able to categorize, analyze, and evaluate prospects based on their company type, their use of our websites, and their interests into segments and target groups, with the aim of identifying promising prospects.

Furthermore, the service provider provides us with a database containing contact details of relevant contacts in companies, enabling us to quickly and easily get in touch with potential customers by phone. The data for this comes from publicly accessible sources and databases.

The service also allows us to connect our other marketing systems and our customer and prospect data management software via interfaces, thereby supplementing existing information about customers and prospects.

Legal Basis for Data Processing

The legal basis for the integration and use of the service is your consent, provided you have given it via our consent management platform "Consent Pro".

The use of cookies and similar technologies is based on Section 25 (1) TDDDG. The subsequent data processing is based on Art. 6 (1) sentence 1 lit. a GDPR.

Your consent is voluntary and can be freely revoked at any time with effect for the future. To exercise your right of revocation, please use the "Cookie Settings" link at the bottom of the webpage to reopen "Consent Pro" and change your settings.

Recipients

When using the service, the data collected via our website is transmitted to the following recipients:

• Dealfront Group GmbH Durlacher Allee 73, 76131 Karlsruhe, Germany

Storage Period

By integrating the services on our websites, data is transmitted to the aforementioned recipients and processed there for as long as necessary to achieve the stated purposes.

Any further storage of the data processed by the service and provided to us in our own systems will occur as long as this is necessary for the fulfillment of other purposes mentioned in this declaration.

YouTube and YouTube Images

On our websites, we embed videos via YouTube, a social media platform of Google LLC, 1600 Amphitheatre Parkway, Mountain View, California 94043, USA.

In the European Union (EU) and the European Economic Area (EEA), the service is offered by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Description of Data Processing and Purpose

Since embedded videos are reloaded from the servers of the social media platform "YouTube" when the page is accessed, the technically necessary usage data for page access is also transmitted. In this respect, Google also receives your IP address, which is technically required to retrieve the content.

We have integrated the service on our websites in a data-saving "No Cookie Mode" to prevent the setting and reading of cookies for collecting information on user behavior, linking with user profiles, creating video statistics, improving user-friendliness, and preventing abusive actions by the provider. However, to prevent the setting and reading of such cookies, a cookie itself is stored in the memory of your device in "No Cookie Mode".

Details on the cookies and similar technologies used can be found above under "Data processing in connection with cookies and similar technologies" and via the information available through our consent management platform "Consent Pro".

Legal Basis for Data Processing

The legal basis for the integration and use of the service is your consent, provided you have given it via our consent management platform "Consent Pro".

The use of cookies and similar technologies is based on § 25 (1) TDDDG. The subsequent data processing is based on Art. 6 (1) sentence 1 lit. a GDPR.

Your consent is voluntary and can be revoked at any time with future effect. To exercise your right of revocation, please use the "Cookie Settings" link at the bottom of the webpage to reopen "Consent Pro" and change your settings.

Recipients

When using the services, the data collected via our websites is transferred to the following recipients:

• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland,
• Google LLC, 1600 Amphitheatre Parkway, Mountain View, California 94043, USA.

We generally have no influence over further data processing by the third-party provider.

Further information on how Google handles personal data can be found at https://policies.google.com/privacy?hl=de.

Data Processing in Third Countries

When using the service, your data may also be processed in third countries outside the European Union (EU) and the European Economic Area (EEA), particularly in the USA.

For data transfers to the USA, an adequacy decision by the EU Commission exists in accordance with Art. 45 (1) GDPR for companies certified under the EU-U.S. Data Privacy Framework, which can be viewed at the following link: Data protection adequacy for non-EU countries.

Google LLC is certified under the EU-U.S. Data Privacy Framework and thus commits to adhering to appropriate data protection standards, which can be viewed at the following link: Participant Search (dataprivacyframework.gov).

When your data is transferred to other third countries for which no adequacy decision exists, there is a risk that local authorities may access your data for security and surveillance purposes without you being informed or able to appeal.

To ensure an adequate level of data protection when transferring your data to a third country, standard data protection clauses of the European Commission are concluded in accordance with Art. 46 (2) lit. c GDPR. These clauses oblige the recipient of the data to process it in accordance with the European level of protection.

If the standard data protection clauses are not sufficient to ensure the level of protection, additional technical, contractual, or organizational measures are taken to secure the data transfer. Furthermore, it is regularly reviewed and assessed whether these additional measures continue to ensure an adequate level of data protection or whether further supplementary measures may need to be taken.

Storage Duration

By integrating the services on our websites, data is transmitted to the aforementioned recipients and processed there for as long as necessary to achieve the stated purposes. No further storage of the data processed by the service and provided to us takes place in our own systems.

Google Photos

On our websites, we integrate the service "Google Photos" from Google LLC, 1600 Amphitheatre Parkway, Mountain View, California 94043, USA.

Within the European Union (EU) and the European Economic Area (EEA), the services are offered by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Description of Data Processing and Purpose

Google Photos allows us to integrate and display image galleries on our website. Images are loaded via a server request, typically from a Google server in the USA. This transmits to the server which page of our website you have visited. Google also stores the IP address of the visitor's device browser.

We use Google Photos for optimization purposes, particularly to improve your experience on our website and to make its design more user-friendly.

Legal Basis for Data Processing

The legal basis for the integration and use of the service is your consent, provided you have given it via our consent management platform "Consent Pro".

The use of cookies and similar technologies is based on Section 25 (1) TDDDG. Subsequent data processing is based on Art. 6 (1) sentence 1 lit. a GDPR.

Your consent is voluntary and can be revoked at any time with future effect. To exercise your right of revocation, please use the "Cookie Settings" link at the bottom of the website to reopen "Consent Pro" and change your settings.

Recipients

When using the service, data collected via our websites is transmitted to the following recipients:

• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland,
• Google LLC, 1600 Amphitheatre Parkway, Mountain View, California 94043, USA.

We generally have no influence over further data processing by the third-party provider.

For more information on how Google handles personal data, please visit https://policies.google.com/privacy?hl=de.

Data Processing in Third Countries

When using the service, your data may also be processed in third countries outside the European Union (EU) and the European Economic Area (EEA), particularly in the USA.

For data transfers to the USA, there is an adequacy decision by the EU Commission pursuant to Art. 45 (1) GDPR regarding companies certified under the EU-U.S. Data Privacy Framework, which can be viewed at the following link: Data protection adequacy for non-EU countries.

Google LLC is certified under the EU-U.S. Data Privacy Framework and thus commits to complying with adequate data protection standards, which can be viewed at the following link: Participant Search (dataprivacyframework.gov).

When your data is transferred to other third countries for which no adequacy decision exists, there is a risk that local authorities may access your data for security and surveillance purposes without you being informed or able to appeal.

To ensure an adequate level of data protection when transferring your data to a third country, standard data protection clauses of the European Commission are concluded in accordance with Art. 46 (2) lit. c GDPR. These oblige the recipient of the data to process it in accordance with the European level of protection.

If the standard data protection clauses are not sufficient to ensure the level of protection, additional technical, contractual, or organizational measures are taken to secure the data transfer. Furthermore, it is regularly reviewed and assessed whether these additional measures continue to ensure an adequate level of data protection or whether further supplementary measures may need to be taken.

Storage Duration

By integrating the services on our websites, data is transmitted to the aforementioned recipients and processed there for as long as necessary to achieve the stated purposes. No further storage of the data processed by the service and provided to us takes place in our own systems.

Google Fonts

On our websites, we integrate Google Fonts web fonts from Google LLC, 1600 Amphitheatre Parkway, Mountain View, California 94043, USA.

In the European Union (EU) and the European Economic Area (EEA), the services are offered by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Description of Data Processing and Purpose

Google Fonts allows us to use web fonts. To do this, when you access our website, the necessary Google Fonts are loaded from your web browser into your browser cache. This is necessary so that your browser can display our texts with an improved visual appearance. If your browser does not support this function, a standard font from your computer will be used for display.

Since Google Fonts are provided by Google and reloaded from its servers when a page is accessed, the usage data technically required for page access is also transmitted. In this respect, Google also receives your IP address, which is technically necessary to retrieve the content.

We use Google Fonts for optimization purposes, particularly to improve your experience on our website and to make its design more user-friendly.

Legal Basis for Data Processing

The legal basis for integrating and using the service is your consent, provided you have given it via our "Consent Pro" consent management platform.

The use of cookies and similar technologies is based on Section 25 (1) TDDDG. The subsequent data processing is based on Art. 6 (1) sentence 1 lit. a GDPR.

Your consent is voluntary and can be freely revoked at any time with future effect. To exercise your right of revocation, please use the "Cookie Settings" link at the bottom of the website to reopen "Consent Pro" and change your settings.

Recipients

When using the service, the data collected via our websites is transmitted to the following recipients:

• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland,
• Google LLC, 1600 Amphitheatre Parkway, Mountain View, California 94043, USA.

We generally have no influence on further data processing by the third-party provider.

Further information on how Google handles personal data can be found at https://policies.google.com/privacy?hl=de.

Data Processing in Third Countries

When using the service, your data may also be processed in third countries outside the European Union (EU) and the European Economic Area (EEA), particularly in the USA.

For data transfers to the USA, an adequacy decision of the EU Commission pursuant to Art. 45 para. 1 GDPR exists for companies certified under the EU-U.S. Data Privacy Framework, which can be viewed at the following link: Data protection adequacy for non-EU countries.

Google LLC is certified under the EU-U.S. Data Privacy Framework and thus commits to complying with adequate data protection standards, which can be viewed at the following link: Participant Search (dataprivacyframework.gov).

When your data is transferred to other third countries for which no adequacy decision exists, there is a risk that local authorities may access your data for security and surveillance purposes without you being informed or able to exercise legal remedies.

To ensure an adequate level of data protection when transferring your data to a third country, Standard Contractual Clauses (SCCs) of the European Commission pursuant to Art. 46 para. 2 lit. c GDPR are concluded. These clauses oblige the data recipient to process the data in accordance with the European level of protection.

If the standard data protection clauses are insufficient to ensure the required level of protection, additional technical, contractual, or organizational measures are taken to secure the data transfer. Furthermore, it is regularly reviewed and assessed whether these additional measures continue to ensure an adequate level of data protection or if further supplementary measures may need to be implemented.

Data Retention Period

By integrating these services on our websites, data is transmitted to the aforementioned recipients and processed there for as long as necessary to achieve the stated purposes. No further storage of the data processed by the service and provided to us occurs in our own systems.

Contact Form and General Email Inquiries

Description of Data Processing and Purpose

If you send us inquiries via the contact form or email, your details from the inquiry form or email, including the personal data you provided, will be stored by us for processing your inquiry and for any follow-up questions.

An email address is required for contact, while providing your first and last name and phone number is voluntary. We will never share this data without your consent.

Legal Basis for Data Processing

The legal basis for processing your data is your and our legitimate interest in responding to your request pursuant to Art. 6 para. 1 sentence 1 lit. f GDPR, as well as, where applicable, Art. 6 para. 1 sentence 1 lit. b GDPR, if your request aims at concluding a contract.

Recipients

Within our company, we only disclose your personal data to departments and individuals who require this data to fulfill contractual and legal obligations or to implement our legitimate interest.

We may transfer your personal data to affiliated companies insofar as this is permissible within the scope of the purposes and legal bases set out in this privacy policy.

Your personal data is processed on our behalf based on data processing agreements pursuant to Art. 28 GDPR. In these cases, we ensure that the processing of personal data complies with the provisions of the GDPR. The categories of recipients in this case are internet service providers as well as providers of customer management systems and software.

Otherwise, data will only be transferred to recipients outside the company insofar as legal provisions permit or require it, the transfer is necessary for the processing and thus for the fulfillment of the contract or, at your request, for the implementation of pre-contractual measures, we have your consent, or we are authorized to provide information.

Under these conditions, recipients of personal data may include, for example:

• External Tax Advisor
• Public bodies and institutions (e.g., public prosecutor's office, police, supervisory authorities, tax office) if there is a legal or official obligation,
• Recipients to whom the disclosure is directly necessary for the establishment or fulfillment of a contract,
• Other data recipients, provided you have given us your consent for data transfer.

Data Processing in Third Countries

The processing of your data when using the service may also take place in countries outside the European Union (EU) and the European Economic Area (EEA) in third countries, particularly in the USA.

For data transfers to the USA, an adequacy decision of the EU Commission pursuant to Art. 45 para. 1 GDPR exists in relation to companies certified under the EU-U.S. Data Privacy Framework.

The RECIPIENT is certified under the EU-U.S. Data Privacy Framework and thus commits to complying with adequate data protection standards, which can be viewed at the following link: Participant Search (dataprivacyframework.gov).

When transferring your data to other third countries for which no adequacy decision exists, there is a risk that local authorities may access your data for security and surveillance purposes without you being informed or able to exercise legal remedies.

To ensure an adequate level of data protection when transferring your data to a third country, Standard Data Protection Clauses of the European Commission pursuant to Art. 46 para. 2 lit. c GDPR are concluded. These oblige the recipient of the data to process it in accordance with the European level of protection.

If the standard data protection clauses are insufficient to ensure the level of protection, additional technical, contractual, or organizational measures will be taken to secure the data transfer. Furthermore, it is regularly reviewed and assessed whether these additional measures continue to ensure an adequate level of data protection or whether further supplementary measures may need to be taken.

Storage Duration

Your data will be deleted after your request has been fully processed, as soon as no further queries are expected and provided no legal retention obligations prevent this.

HubSpot Prospect Data and Marketing Platform

On our websites, we integrate the "HubSpot" service from HubSpot, Inc., 2 Canal Park, Cambridge, MA 02141, USA.

In the European Union (EU) and the European Economic Area (EEA), the service is offered by HubSpot Ireland Limited, 1 Sir John Rogerson's Quay, Dublin 2, Ireland.

Description of data processing and purpose

The platform enables us to:

• the management of prospect and customer data,
• the analysis and evaluation of interactions with our websites,
• the creation, analysis, and evaluation of interactions with our social media presences, as well as for contacting and managing communications via social media,
• the execution and analysis of email marketing campaigns, as well as
• if applicable, the creation, enrichment, and evaluation of profiles of potential prospects,

with the aim of acquiring new prospects for our products and services, specifically targeting acquired prospects and existing customers with advertising, and optimizing our marketing strategy, particularly in online and email marketing, through evaluations and analyses.

Cookies and similar technologies, particularly JavaScript, are also used to store and read data on your device. Details on the cookies and similar technologies used can be found above under "Access to and Storage of Information on End Devices" and "Cookies and Similar Technologies," as well as in our Cookie Policy, which you can access via our "Consent Pro" consent management platform.

We use "HubSpot" for managing prospect and customer data.

For this purpose, we process personal data provided by you via forms and chat on our websites (salutation, first name, last name, contact details such as email address and phone number, and, if applicable, data about your company), information about which of our products you are interested in, and any other information you voluntarily provide to us. Furthermore, we also use the platform to manage our customer contacts, including the aforementioned data of our contact persons at customers.

We use "HubSpot" for the analysis and evaluation of website visits.

If you contact us via a form on our website and, in doing so, provide us with your contact details and, if applicable, further information, and give your consent, we collect data on your interactions and behavior on our website (e.g., filling out forms, downloading documents, playing media, etc.) and link this with your contact details and any other information you provide to us via the form.

We use this data to generate statistics to improve the attractiveness of our website, optimize the effectiveness of our marketing measures, and manage our advertising strategy.

We use HubSpot to analyze and evaluate interactions with our social media presences, as well as for contacting and managing communications via the social media platform

We publish posts and, if applicable, newsletters on our social media presences, such as LinkedIn, via HubSpot and analyze visitor interactions (e.g., sharing or liking posts, user interaction with newsletters, for example, the extent to which content was interacted with, specifically which links were clicked and to what extent the newsletter was read or skimmed). We use this data to generate statistics to improve the attractiveness of our social media presences, optimize the effectiveness of our marketing measures, and manage our advertising strategy.

We use "HubSpot" to communicate with you on our website via our chat function and to answer your inquiries.

In response to your inquiry, we process personal data provided by you (salutation, first name, last name, contact details such as email address and phone number, and, if applicable, data about your company), information about which of our products you are interested in, as well as any other information you voluntarily provide to us.

We also use "HubSpot" for the preparation and execution of email marketing and, if applicable, for email tracking.

If you give us separate consent on our website, we also use your email address to contact you via marketing emails and to inform you, through direct advertising, about our products and services, current events, promotions and events, and offers in a targeted manner.

If you also give us separate consent, you allow us to process data on whether you received and opened our marketing emails, which email client software you use, to what extent you interacted with the content, in particular which links you clicked, and to what extent you read or skimmed our emails. We use this data to generate statistics to improve the attractiveness of our marketing emails, optimize the effectiveness of our marketing measures, and manage our advertising strategy.

After your email address has been submitted via a form or chat on our website, you will receive an email from us with a link asking you to confirm your email address and thus subscribe to promotional emails. In this way, we want to ensure that only authorized persons subscribe to our promotional emails.

We use "HubSpot" for the creation, enrichment, and evaluation of prospect profiles.

We combine the data processed via the platform into a personalized profile, enrich it with data from other sources if necessary, evaluate it in the profile using score values and conduct analyses to infer which of our products and services, current events, promotions and events, and offers you are interested in, to which customer segment you can be assigned, and with what probability your interest in our products and services would lead to a contract conclusion.

For this purpose, we process the following data:

• regarding your personal data (salutation, first name, last name, contact details such as email address and phone number, and, if applicable, data about your company),
• regarding your use, interactions, and behavior on our website (e.g., page views, form submissions, document downloads, media playback, etc.),
• regarding your use of our marketing emails (receipt and opening, email client software used, click data, read rate),
• regarding your interactions with our social media presences.

In this way, we optimize our marketing measures and manage our advertising strategy to target you as effectively as possible.

Legal bases for data processing

The legal basis for using the platform to manage prospective customer and customer data is Art. 6 para. 1 sentence 1 lit. f GDPR. Our legitimate interest lies in effectively managing the contact data of potential prospects and customers and also using it for further data processing enabled by the platform.

The legal basis for integrating and using the platform on our websites for the analysis and evaluation of interactions with the website is your consent, provided you have given it via our consent management platform "Consent Pro" or by clicking the "All clear – Load form" button when using forms.

The use of cookies and similar technologies is based on Section 25 (1) TTDSG. The subsequent data processing is based on Art. 6 para. 1 sentence 1 lit. a GDPR.

Your consent is voluntary and can be freely revoked at any time with effect for the future. To exercise your right of revocation, please use the "Cookie Settings" link at the bottom of the website to reopen "Consent Pro" and change your settings.

The legal basis for the analysis and evaluation of interactions with our social media presences is your consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR, insofar as you have given this via the social media provider.

Your consent is voluntary and can be freely revoked at any time with effect for the future. How to exercise your right of revocation can be found in the privacy policy of the respective social media provider. Furthermore, regarding the data processed exclusively by us, you can exercise your right to object by contacting the data controller mentioned above.

The legal bases for contacting and handling communication via social media are your consent pursuant to Art. 6 (1) sentence 1 lit. a GDPR, insofar as you have given it via the social media provider. The legal basis for handling inquiries via our social media presences is Art. 6 (1) sentence 1 lit. f GDPR, as well as Art. 6 (1) sentence 1 lit. a GDPR insofar as you voluntarily provide us with information in correspondence. Our legitimate interest lies in being able to effectively answer your inquiry via the social media channel.

Your consent is voluntary and can be freely revoked at any time with effect for the future. To exercise your right of revocation regarding the processing of data voluntarily provided in correspondence, please contact the data controller using the contact details provided above.

The legal basis for processing your data in the context of email marketing and email tracking, including the evaluation of target groups and the analysis of the success of our email campaigns, as well as, where applicable, the legal basis for the creation and evaluation of prospect profiles, is also your consent, Art. 6 (1) sentence 1 lit. a GDPR, which, however, is obtained separately, e.g., through forms. If your data is used for advertising purposes in exchange for permanent access to our webinars, whitepapers, guides, checklists, and other templates and samples, the legal basis is Art. 6 (1) sentence 1 lit. b GDPR.

The use of cookies and similar technologies also takes place here on the basis of § 25 (1) TTDSG. The subsequent data processing is based on Art. 6 (1) sentence 1 lit. a GDPR.

Your consent is voluntary and can be freely revoked at any time with effect for the future. To exercise your right of revocation regarding data processing in the context of email marketing and email tracking, please use the unsubscribe link in our marketing emails or contact the data controller using the contact details provided above.

The legal basis for processing your data in the context of email marketing and email tracking, as well as the creation, enrichment, and evaluation of prospect profiles, is also your consent, which, however, is obtained separately, e.g., through forms.

The use of cookies and similar technologies also takes place here on the basis of § 25 (1) TTDSG. The subsequent data processing is based on Art. 6 (1) sentence 1 lit. a GDPR.

Your consent is voluntary and can be freely revoked at any time with effect for the future. To exercise your right of revocation regarding the execution of email marketing and email tracking, as well as the creation, enrichment, and evaluation of prospect profiles, please contact the data controller using the contact details provided above.

Recipients

When using the service, data collected via our websites is transferred to the following recipients:

• HubSpot Ireland Limited, 1 Sir John Rogerson's Quay, Dublin 2, Ireland,
• HubSpot, Inc., 2 Canal Park, Cambridge, MA 02141, USA.

Further information on how the service provider handles personal data can be found at https://legal.hubspot.com/de/privacy-policy.

Data Processing in Third Countries

When using the service, your data may also be processed in third countries outside the European Union (EU) and the European Economic Area (EEA), particularly in the USA.

For data transfers to the USA, there is an adequacy decision by the EU Commission pursuant to Art. 45 (1) GDPR regarding companies certified under the EU-U.S. Data Privacy Framework, which can also be viewed at the following link: Data protection adequacy for non-EU countries.

HubSpot Inc. is certified under the EU-U.S. Data Privacy Framework and thus commits to complying with adequate data protection standards, which can be viewed at the following link: Participant Search (dataprivacyframework.gov).

When your data is transferred to other third countries for which no adequacy decision exists, there is a risk that local authorities may access your data for security and surveillance purposes without you being informed or able to seek legal remedies.

To ensure an adequate level of data protection when transferring your data to a third country, Standard Contractual Clauses of the European Commission pursuant to Art. 46 (2) lit. c GDPR are concluded. These clauses oblige the data recipient to process the data in accordance with the European level of protection.

If standard data protection clauses are insufficient to ensure the required level of protection, additional technical, contractual, or organizational measures are implemented to secure data transmission. Furthermore, it is regularly reviewed and assessed whether these additional measures continue to ensure an adequate level of data protection or if further supplementary measures need to be taken.

Storage period

Unless otherwise stated, we store your data to the extent necessary, as long as this is required to achieve the aforementioned purposes. Subsequently, we delete your data, unless further data processing, possibly also in other systems, is permissible for other purposes based on a different legal basis or is mandatory for us (e.g., in the case of statutory retention or documentation obligations).

Data protection information for customers and other contractual or business partners as well as interested parties

Contract initiation, execution, fulfillment, and for carrying out pre-contractual measures in general

Description of data processing and purpose

We process your personal data insofar as it is necessary for contract initiation, execution, fulfillment, and for carrying out pre-contractual measures.

We only process data that is related to the establishment of a contract or pre-contractual measures. This may include general data about you or individuals in your company (name, address, contact details, etc.) as well as any other data you provide to us during the establishment of the contract.

Legal basis for data processing

Insofar as personal data is required for the initiation or execution of a contractual relationship or in the context of pre-contractual measures, processing is lawful according to Art. 6 para. 1 sentence 1 lit. b GDPR.

Sources

We process personal data that we receive from you by post, telephone, or email via forms on our website or through one of our social media profiles, in the context of initial contact or the establishment of a contractual relationship or pre-contractual measures.

Recipients

Within our company, we only disclose your personal data to departments and individuals who require this data to fulfill contractual and legal obligations or to implement our legitimate interest.

We may transfer your personal data to affiliated companies insofar as this is permissible within the scope of the purposes and legal bases set out in this privacy policy.

Your personal data is processed on our behalf based on data processing agreements in accordance with Art. 28 GDPR. In these cases, we ensure that the processing of personal data complies with the provisions of the GDPR. The categories of recipients in this case are internet service providers and providers of customer management systems and software.

Otherwise, data will only be transferred to recipients outside the company insofar as legal provisions permit or require it, the transfer is necessary for processing and thus fulfilling the contract or, upon your request, for carrying out pre-contractual measures, we have your consent, or we are authorized to provide information.

Under these conditions, recipients of personal data may include, for example:

• External tax advisor
• Public bodies and institutions (e.g., public prosecutor's office, police, supervisory authorities, tax office) when there is a legal or official obligation,
• Recipients to whom the disclosure is directly necessary for the initiation or fulfillment of a contract,
• Other data recipients, insofar as you have given us your consent for data transfer.

Storage period

Where necessary, we process and store your personal data for the duration of our business relationship or for the fulfillment of contractual purposes. This includes, among other things, the initiation and execution of a contract.

Furthermore, we are subject to various retention and documentation obligations, which arise, among other things, from the German Commercial Code (HGB) and the German Tax Code (AO). The prescribed retention and documentation periods there are two to ten years.

Finally, the storage period also depends on the statutory limitation periods, which, for example, according to §§ 195 et seq. of the German Civil Code (BGB), are generally three years, but in certain cases can also be up to thirty years.

Necessity of providing personal data

The provision of personal data for the decision on concluding a contract, fulfilling a contract, or carrying out pre-contractual measures is voluntary. However, we can only make a decision regarding contractual measures if you provide the personal data required for concluding the contract, fulfilling the contract, or carrying out pre-contractual measures.

Booking demo appointments with Demodesk

You can book an appointment for a non-binding consultation and a product demo via our websites.

For this purpose, we use the service "Demodesk Scheduling" from Demodesk GmbH, Franz-Joseph Straße 9, 80801, Munich, Germany.

Description of data processing and purpose

We use Demodesk Scheduling to enable interested parties to book appointments automatically. Demodesk uses cookies for this purpose.

In addition to the preferred date and company name, the following personal data is also processed by Demodesk:

• First and last name
• Email address
• Phone number

Legal basis for data processing

The legal basis for data processing is Art. 6 para. 1 sentence 1 lit. b GDPR, insofar as the booking person is our contractual partner, or Art. 6 para. 1 sentence 1 lit. f GDPR, insofar as the booking person is a contact person of a contractual partner.

The legal basis for data processing is Art. 6 para. 1 sentence 1 lit. b GDPR as well as Art. 6 para. 1 sentence 1 lit. f GDPR.

Our legitimate interest is to arrange a non-binding consultation with you as a potential customer or a contact person at a potential customer, and to carry out further pre-contractual measures if necessary.

Recipients

As part of using the service, the data collected via our websites is transmitted to the following recipients:

• Demodesk GmbH, Franz-Joseph Straße 9, 80801, Munich, Germany.

Further information on data processing by the service can be found here: https://demodesk.com/legal/privacy-policy-platform.

Storage Duration

By using the service, data is transmitted to the aforementioned recipients and stored there for as long as necessary to achieve the stated purposes.

Where necessary, we process and store your personal data for the duration of our business relationship or for the fulfillment of contractual purposes.

Otherwise, your data will be deleted as soon as prompt telephone contact with you has been made, was unsuccessful, or did not lead to a contract.

Booking Audit Appointments with Microsoft Bookings

For booking online appointments, we use the service "Microsoft Bookings" from Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA.

In the European Union (EU) and the European Economic Area (EEA), the service is offered by Microsoft Ireland Operations, Ltd, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland.

Description of data processing and purpose

When booking an appointment, we process mandatory information (first and last name, email address) of the booking person, as well as optional information such as address, phone number, company name, details regarding the auditing of affiliated companies, and the language of the audit discussion.

We use the service to enable you to book audit and re-audit appointments online and to efficiently manage appointment scheduling and administration.

The legal basis for data processing is Art. 6 para. 1 sentence 1 lit. b GDPR, insofar as the booking person is our contractual partner, or Art. 6 para. 1 sentence 1 lit. f GDPR, insofar as the booking person is a contact person of a contractual partner.

Our legitimate interest is to fulfill our contractual obligations.

Recipients

As part of using the service, the data collected via our websites is transmitted to the following recipients:

• Microsoft Ireland Operations, Ltd, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland,
• Microsoft Corporation, One Microsoft Way, Redmond WA 94043, USA.

Data Processing in Third Countries

When using the service, your data may also be processed in countries outside the European Union (EU) and the European Economic Area (EEA) in third countries, particularly in the USA.

For data transfers to the USA, an adequacy decision by the EU Commission exists pursuant to Art. 45 (1) GDPR for companies certified under the EU-U.S. Data Privacy Framework, which can be viewed via the following link: Data protection adequacy for non-EU countries.

Microsoft Corporation is certified under the EU-U.S. Data Privacy Framework and thus commits to adhering to adequate data protection standards, which can be viewed via the following link: Participant Search (dataprivacyframework.gov).

When your data is transferred to other third countries for which no adequacy decision exists, there is a risk that local authorities may access your data for security and surveillance purposes without you being informed or able to exercise legal remedies.

To ensure an adequate level of data protection when transferring your data to a third country, standard data protection clauses of the European Commission are concluded in accordance with Art. 46 (2) lit. c GDPR. These clauses oblige the recipient of the data to process it in accordance with the European level of protection.

If the standard data protection clauses are not sufficient to ensure the level of protection, additional technical, contractual, or organizational measures are taken to secure the data transfer. Furthermore, it is regularly checked and assessed whether these additional measures continue to ensure an adequate level of data protection or whether further supplementary measures may need to be taken.

Storage Duration

By using the service, data is transmitted to the aforementioned recipients and stored there for as long as necessary to achieve the stated purposes.

Where necessary, we process and store your personal data for the duration of our business relationship or for the fulfillment of contractual purposes.

Conducting Product Demonstrations with Storylane

On our websites, we integrate the service "Storylane" from Storylane Inc., 2261 Market Street #4813, San Francisco, CA 94114, USA.

Description of Data Processing and Purpose

We use this service to offer an interactive demo of our software on our website. This allows us to provide interested parties with an easy way to get an impression of our software and guide themselves through the demo.

When using the service, personal data, such as the website visitor's IP address, is processed to provide the software demo. Within the software demo, you can contact us via a corresponding form.

Furthermore, information about the interaction with the software demo and the user, such as the duration of the interaction, region of access, time of access, progress in the demo, and clicking on contact options, is collected. This data is used to optimize the software demo and measure its success in acquiring new prospects and customers.

Legal Basis for Data Processing

The legal basis for integrating and using the service is your consent, provided you have given it via our "Consent Pro" consent management platform.

The use of cookies and similar technologies is based on Section 25 (1) TDDDG. The subsequent data processing is based on Art. 6 (1) sentence 1 lit. a GDPR.

Your consent is voluntary and can be freely revoked at any time with future effect. To exercise your right of revocation, please use the "Cookie Settings" link at the bottom of the website to access our "Consent Pro" consent management platform again and change your settings.

Recipients

As part of using the service, the following recipients receive your data:

• Storylane Inc., 2261 Market Street #4813, San Francisco, CA 94114, USA

We generally have no influence on further data processing by the third-party provider.

Further information on how the service provider handles personal data can be found at Privacy Policy - Storylane | Interactive Product Demos

Data processing in third countries

When using the service, your data may also be processed in countries outside the European Union (EU) and the European Economic Area (EEA) in third countries, especially in the USA.

To ensure an adequate level of data protection when transferring your data to a third country, standard data protection clauses of the European Commission pursuant to Art. 46 para. 2 lit. c GDPR are concluded. These oblige the recipient of the data to process it in accordance with the European level of protection.

Insofar as the standard data protection clauses are not sufficient to ensure the level of protection, additional technical, contractual, or organizational measures are taken to secure the data transfer. Furthermore, it is regularly reviewed and assessed whether these additional measures continue to ensure an adequate level of data protection or whether further supplementary measures may need to be taken.

Storage duration

By integrating the service on our websites, data is transferred to the aforementioned recipients and stored there for a maximum of 90 days.

Conducting webinars with GoTo Webinar

To conduct our webinars, we use the GoTo Webinar service of GoToTechnologies Ireland Unlimited Company, 77 Sir John Rogerson's Quay, Block C, Suite 207, Grand Canal Docklands, Dublin 2, D02 VK60, Ireland.

Description of data processing and purpose

When using the service, the data you enter during participation, as well as data related to establishing the connection (session duration, established connections, hardware, equipment and devices used, IP addresses, location, language settings, operating system used, unique device identifiers, and, if applicable, diagnostic data for troubleshooting problems in providing the webinars) are processed.

We use the service to conduct our webinars and enable your participation.

Legal basis for data processing

The legal basis for data processing is Art. 6 para. 1 sentence 1 lit. b GDPR, insofar as the participating person is our contractual partner, or Art. 6 para. 1 sentence 1 lit. f GDPR, insofar as the participating person is a contact person for a customer or contractual partner. Our legitimate interest lies in fulfilling our contractual services.

Recipients

As part of using the service, the data collected via our websites is transferred to the following recipients:

• GoTo Technologies Ireland Unlimited Company, 77 Sir John Rogerson's Quay, Block C,Suite 207, Grand Canal Docklands, Dublin 2, D02 VK60, Ireland.

Storage Duration

By using the service, data is transmitted to the aforementioned recipients and stored there for as long as is necessary to achieve the stated purposes.

Where necessary, we process and store your personal data for the duration of our business relationship or for the fulfillment of contractual purposes.

Data Processing for Marketing Purposes

We process your personal data to contact you by post, phone, and email for direct marketing purposes, as well as to evaluate prospective customer data, conduct market research, and carry out customer satisfaction surveys.

Data Collection

Web Forms for Collecting Marketing Data

On our websites, we collect personal data via various web forms for the purpose of contacting you for promotional purposes, to promote the sale of our products, goods, or services through direct marketing.

These may be forms

• for signing up for newsletters, webinars, or events,
• for booking product demonstrations, or
• for downloading whitepapers and other documents,

act.

Further information on the scope of data processing, its purposes, legal bases, recipients, and the storage duration of the collected data can be found in the following sections.

Trade Fair Forms for Collecting Marketing Data

Description of Data Processing

At trade fairs, we may collect personal data via analog or digital forms for the purpose of contacting you for promotional purposes, to promote the sale of our products, goods, or services through direct marketing.

Further information on the scope of data processing, its purposes, legal bases, recipients, and the storage duration of the collected data can be found in the following sections.

Email Marketing

Existing Customer Marketing

Description of Data Processing and Purpose

We process your personal data (salutation, first name, last name, business email address for business contacts or private email address for consumers) that we receive in connection with a contract conclusion, for the purpose and in our legitimate interest of sending you or your company personalized direct marketing as existing customers for similar products, goods, and services related to the previous contract conclusion.

Legal Basis for Data Processing

The legal basis for this processing is Art. 6 para. 1 sentence 1 lit. f GDPR. Since we comply with the requirements of the exemption rule in § 7 para. 3 UWG and process exclusively personal data related to your professional activity for the purpose of achieving our goals, no overriding interests on your part that conflict with our interest in data processing are apparent, provided you have not yet objected to the processing.

You can object to data processing at any time with future effect, without incurring any costs other than the transmission costs according to the basic tariffs. To exercise your right to object, please use the unsubscribe link in our promotional emails or contact info@proliance.ai.

Recipients

As part of the data processing, your data will be transferred to the following recipients:

• HubSpot Ireland Limited, 1 Sir John Rogerson's Quay, Dublin 2, Ireland,
• HubSpot, Inc., 2 Canal Park, Cambridge, MA 02141, USA.

Data Processing in Third Countries

When using the service, your data may also be processed in countries outside the European Union (EU) and the European Economic Area (EEA) in third countries, particularly in the USA.

For data transfers to the USA, there is an adequacy decision by the EU Commission pursuant to Art. 45 para. 1 GDPR regarding companies certified under the EU-U.S. Data Privacy Framework, which can also be viewed at the following link: Data protection adequacy for non-EU countries.

HubSpot Inc. is certified under the EU-U.S. Data Privacy Framework and thus commits to complying with adequate data protection standards, which can be viewed at the following link: Participant Search (dataprivacyframework.gov).

When your data is transferred to other third countries for which no adequacy decision exists, there is a risk that local authorities may access your data for security and surveillance purposes, without you being informed or able to exercise legal remedies.

To ensure an adequate level of data protection when transferring your data to a third country, Standard Data Protection Clauses of the European Commission are concluded in accordance with Art. 46 para. 2 lit. c GDPR. These oblige the recipient of the data to process it in accordance with the European level of protection.

If the standard data protection clauses are not sufficient to ensure the level of protection, additional technical, contractual, or organizational measures are taken to secure the data transfer. Furthermore, it is regularly checked and assessed whether these additional measures continue to ensure an adequate level of data protection or whether further supplementary measures may need to be taken.

Storage Duration

We store your data for as long as necessary to achieve the aforementioned purpose or until you object to the data processing. Subsequently, we delete your data, unless data processing is still permissible or mandatory for us based on another legal basis (e.g., in the case of statutory retention obligations).

Consent to receive promotional emails and the newsletter, email tracking

Description of data processing and purpose

Furthermore, we process your personal data (salutation, first name, last name, business email address for business contacts) for the purpose of sending you or your company personalized promotional messages via email or our email newsletter and informing you about our products, goods, services, and offers, but only if you have given us your separate express consent to do so.

If you give us your consent, you also allow us to process data on whether you receive and open our marketing emails, the extent to which you interact with the content, specifically which links you click, and the extent to which you read or skim our emails (newsletter tracking).

Legal basis for data processing

The legal basis for this processing is your consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR. Your consent is voluntary and can be revoked at any time with future effect. The revocation of your consent does not affect the lawfulness of the data processing carried out until then. To exercise your right of revocation, please use the unsubscribe link in our promotional emails or newsletter, or use the contact details provided above under "Controller".

Recipients

In the context of data processing, your data will be transferred to the following recipients:

• HubSpot Ireland Limited, 1 Sir John Rogerson's Quay, Dublin 2, Ireland,
• HubSpot, Inc., 2 Canal Park, Cambridge, MA 02141, USA.

Data processing in third countries

When using the service, your data may also be processed in countries outside the European Union (EU) and the European Economic Area (EEA) in third countries, particularly in the USA.

For data transfers to the USA, there is an adequacy decision by the EU Commission pursuant to Art. 45 para. 1 GDPR concerning companies certified under the EU-U.S. Data Privacy Framework, which can be viewed at the following link: Data protection adequacy for non-EU countries.

HubSpot Inc. is certified under the EU-U.S. Data Privacy Framework and is therefore committed to complying with adequate data protection standards, which can be viewed at the following link: Participant Search (dataprivacyframework.gov).

When your data is transferred to other third countries for which no adequacy decision exists, there is a risk that local authorities may access your data for security and surveillance purposes without you being informed or being able to appeal.

To ensure an adequate level of data protection when transferring your data to a third country, standard data protection clauses of the European Commission are concluded in accordance with Art. 46 para. 2 lit. c GDPR. These clauses oblige the recipient of the data to process it in accordance with the European level of protection.

If the standard data protection clauses are not sufficient to ensure the level of protection, additional technical, contractual, or organizational measures will be taken to secure the data transfer. Furthermore, it will be regularly reviewed and assessed whether these additional measures continue to ensure an adequate level of data protection or whether further supplementary measures may need to be taken.

Storage duration

We store your data for as long as necessary to achieve the aforementioned purpose or until you object to the data processing. Subsequently, we will delete your data, unless further data processing is permissible or mandatory for us based on another legal ground (e.g., in the case of statutory retention obligations).

Receiving promotional emails in exchange for permanent access to webinars, whitepapers, guides, checklists, and other templates and samples

Description of data processing and purpose

Furthermore, we process your personal data (salutation, first name, last name, business email address for business contacts) for the purpose of contacting you or your company with personalized advertising via email or our email newsletter and informing you about our products, goods, services, and offers, only if you have given us your separate explicit consent for this.

If you give us your consent, you also allow us to process data on whether you received and opened our marketing emails, the extent to which you interacted with the content, in particular which links you clicked, and the extent to which you read or skimmed our emails (email tracking).

Legal basis for data processing

The legal basis for processing is Art. 6 para. 1 sentence 1 lit. b GDPR, insofar as you receive permanent access to our webinars, whitepapers, guides, checklists, and other templates and samples in exchange for the use of your data for promotional communication. The legal basis for email tracking is your consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR.

You can object to data processing for advertising purposes at any time. An objection does not affect the lawfulness of data processing carried out until then. To exercise your right to object, please use the unsubscribe link in our promotional emails or newsletter, or use the contact details provided above under 'Controller'.

Recipients

In the course of data processing, your data will be transferred to the following recipients:

• HubSpot Ireland Limited, 1 Sir John Rogerson's Quay, Dublin 2, Ireland,
• HubSpot, Inc., 2 Canal Park, Cambridge, MA 02141, USA.

Data processing in third countries

When using the service, your data may also be processed in third countries outside the European Union (EU) and the European Economic Area (EEA), particularly in the USA.

For data transfers to the USA, there is an adequacy decision by the EU Commission pursuant to Art. 45 para. 1 GDPR concerning companies certified under the EU-U.S. Data Privacy Framework, which can also be viewed at the following link: Data protection adequacy for non-EU countries.

HubSpot Inc. is certified under the EU-U.S. Data Privacy Framework and thus commits to complying with adequate data protection standards, which can be viewed at the following link: Participant Search (dataprivacyframework.gov).

When your data is transferred to other third countries for which no adequacy decision exists, there is a risk that local authorities may access your data for security and surveillance purposes without you being informed or able to exercise legal remedies.

To ensure an adequate level of data protection when transferring your data to a third country, standard data protection clauses of the European Commission are concluded in accordance with Art. 46 para. 2 lit. c GDPR. These clauses oblige the recipient of the data to process it in accordance with the European level of protection.

If the standard data protection clauses are insufficient to ensure the level of protection, additional technical, contractual, or organizational measures are taken to secure the data transfer. Furthermore, it is regularly reviewed and assessed whether these additional measures continue to ensure an adequate level of data protection or whether further supplementary measures may need to be taken.

Storage duration

We store your data for as long as necessary to achieve the aforementioned purpose or until you object to the data processing. We then delete your data, unless further data processing is permissible based on another legal basis or is mandatory for us (e.g., in the case of statutory retention obligations).

Telephonic advertising measures

Description of data processing and its purpose

If you are a business contact, we process your business phone number. If you are a consumer, we process your private phone number for the purpose of contacting you or your company personally by phone and informing you about our products, goods, services, and offers.

Legal Basis for Data Processing for Business Contacts

For business contacts, the legal basis for processing is Art. 6 para. 1 sentence 1 lit. f GDPR. Our legitimate interest lies in promoting the sale of our products, goods, and services through direct marketing.

Since we comply with the requirements of the exemption rule of Section 7 para. 3 UWG and process exclusively personal data related to your professional activity for the purpose of achieving our goals, no overriding interests on your part that conflict with our interest in data processing are apparent, provided you have not yet objected to the processing.

You can object to data processing at any time with effect for the future, without incurring costs other than the transmission costs according to the basic tariffs. To exercise your right to object, please use the contact details of the controller mentioned above.

Legal Basis for Data Processing for Consumers

For consumers, the legal basis for processing is your consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR in conjunction with Section 7a para. 1 UWG. Your consent is voluntary and can be revoked at any time with effect for the future. The revocation of your consent does not affect the lawfulness of the data processing carried out until then. To exercise your right of revocation, please use the contact details of the controller mentioned above.

Storage Duration

We store your data as long as it is necessary to achieve the aforementioned purpose or as long as you have not objected to the data processing. Subsequently, we delete your data, unless data processing is still permissible on the basis of another legal ground or is mandatory for us (e.g., in the case of statutory retention obligations).

Statistical evaluation and analysis of customer and prospective customer data, market research, and customer satisfaction surveys

Description of Data Processing and Purpose

We process data collected from you as a prospective customer, for example, via forms on our website, as well as data collected from you, if applicable, as a customer or employee of a customer in the context of pre-contractual measures or contract fulfillment, to find out which of our products and services prospective customers and customers are interested in, how we can potentially improve them, and how we can optimize our advertising measures. To address prospective customers more specifically with advertising, we form so-called target groups from the data. Your information from customer satisfaction surveys conducted by us may also be included in the analysis and evaluation.

For this purpose, we may collect your information and data regarding

• your company (e.g., size, industry)
• your position in the company,
• your country,
• your areas of interest or product categories,
• as well as the referral source, i.e., how you became aware of our company.

Legal Basis for Data Processing

The legal basis for processing your data is Art. 6 para. 1 sentence 1 lit. f GDPR. Our legitimate interests lie in further developing our products and services based on market requirements, better understanding the needs and interests of our customers and potential customers, and enabling targeted direct marketing on this basis.

Data retention period

We store your data as long as it is necessary to achieve the aforementioned purpose or as long as you have not objected to the data processing. Subsequently, we delete your data, unless data processing is still permissible based on another legal basis or is mandatory for us (e.g., in the case of existing legal retention obligations).

HubSpot Prospect Data and Marketing Platform

On our websites, we integrate the 'HubSpot' service from HubSpot, Inc., 2 Canal Park, Cambridge, MA 02141, USA.

In the European Union (EU) and the European Economic Area (EEA), the service is offered by HubSpot Ireland Limited, 1 Sir John Rogerson's Quay, Dublin 2, Ireland.

Description of data processing and purpose

The platform enables us

• the management of prospect and customer data,
• the analysis and evaluation of interactions with our websites,
• the creation, analysis, and evaluation of interactions with our social media presences, as well as for establishing contact and managing communication via social media,
• the execution and analysis of email marketing campaigns, as well as
• potentially the creation, enrichment, and evaluation of profiles of potential prospects,

with the aim of acquiring new prospects for our products and services, specifically targeting acquired prospects and existing customers with advertising, and optimizing our marketing strategy, particularly in online and email marketing, through evaluations and analyses.

Cookies and similar technologies, especially JavaScript, are also used to store and read data on your device. Details on the cookies and similar technologies used can be found above under 'Access to and Storage of Information on End Devices' and 'Cookies and Similar Technologies', as well as in our Cookie Policy, which you can access via our 'Consent Pro' consent management platform.

We use 'HubSpot' for managing prospect and customer data.

For this purpose, we process personal data provided by you via forms and chat on our websites (salutation, first name, last name, contact details such as email address and phone number, and potentially data about your company), information about which of our products you are interested in, as well as any other information you voluntarily provide to us. Furthermore, we also use the platform to manage our customer contacts, including the aforementioned data of our contact persons at customers.

We use 'HubSpot' for the analysis and evaluation of website visits.

We monitor and analyze the behavior of website visitors and their use of our websites. This allows us to pseudonymously identify and count returning visitors. We process data on how a visitor arrived at our websites (e.g., via web search, direct page access, social media sites, redirects from other websites, and potentially via marketing emails or other advertising campaigns), how many visits occurred, how long a stay lasted, and how many individual pages were accessed.

Furthermore, we also process additional data regarding your interactions and behavior on our website (e.g., filling out forms, downloading documents, playing media, etc.).

We use this data to generate statistics, to improve the attractiveness of our website, to optimize the effectiveness of our marketing measures, and to manage our advertising strategy.

We use HubSpot for the analysis and evaluation of interactions with our social media presences, as well as for contacting and managing communication via the social media platform.

We publish posts and, if applicable, newsletters on our social media presences, such as LinkedIn, via HubSpot and analyze visitor interactions (e.g., sharing or liking posts, user interaction with newsletters, for example, the extent to which the content was interacted with, in particular which links were clicked and the extent to which the newsletter was read or skimmed). We use this data to generate statistics, to improve the attractiveness of our social media presences, and to optimize the effectiveness of our marketing measures and manage our advertising strategy.

We use "HubSpot" to communicate with you on our website via our chat function and to answer your inquiries.

In the context of responding to your inquiry, we process personal data provided by you (salutation, first name, last name, contact details such as email address and phone number, and, if applicable, data about your company), information about which of our products you are interested in, and any other information you voluntarily provide to us.

We also use "HubSpot" for the preparation and execution of email marketing and, if applicable, for email tracking.

If you give us separate consent on our website, we also use your email address to contact you via marketing emails and to inform you, through direct advertising, about our products and services, current events, promotions and events, and offers in a targeted manner.

If you also give us separate consent, you allow us to process data on whether you receive and open our marketing emails, which email client software you use, the extent to which you have interacted with the content, in particular which links you have clicked, and the extent to which you have read or skimmed our emails. We use this data to generate statistics, to improve the attractiveness of our marketing emails, and to optimize the effectiveness of our marketing measures and manage our advertising strategy.

After your email address has been submitted via a form or chat on our website, you will receive an email from us with a link asking you to confirm your email address and thus subscribe to promotional emails. In this way, we want to ensure that only authorized persons subscribe to our promotional emails.

We use "HubSpot" for creating, enriching, and evaluating prospect profiles.

We combine the data processed via the platform into a personalized profile, enrich it with data from other sources if necessary, evaluate it in the profile using score values, and conduct analyses to infer which of our products and services, current events, promotions and events, and offers you are interested in, which customer segment you can be assigned to, and with what probability your interest in our products and services would lead to a contract conclusion.

For this purpose, we process the following data:

• regarding your person (salutation, first name, last name, contact details such as email address and phone number, and, if applicable, data about your company),
• regarding your use, interactions, and behavior on our website (e.g., page views, form submissions, document downloads, media playback, etc.),
• regarding your use of our marketing emails (receipt and opening, email client software used, click data, read rate),
• regarding your interactions with our social media presences.

In this way, we optimize our marketing measures and manage our advertising strategy to address you as targeted as possible.

Legal Bases for Data Processing

The legal basis for using the platform to manage prospective customer and customer data is Art. 6 para. 1 sentence 1 lit. f GDPR. Our legitimate interest lies in effectively managing the contact data of potential prospects and customers and also using it for further data processing enabled by the platform.

The legal basis for integrating and using the platform on our websites for analyzing and evaluating interactions with the website is your consent, provided you have given it via our "Consent Pro" consent management platform.

The use of cookies and similar technologies is based on § 25 para. 1 TTDSG. The subsequent data processing is based on Art. 6 para. 1 sentence 1 lit. a GDPR.

Your consent is voluntary and can be revoked at any time with future effect. To exercise your right of revocation, please use the "Cookie Settings" link at the bottom of the website to reopen "Consent Pro" and change your settings.

The legal basis for the analysis and evaluation of interactions with our social media presences is your consent pursuant to Art. 6 (1) sentence 1 lit. a GDPR, insofar as you have given it via the social media provider.

Your consent is voluntary and can be revoked at any time with future effect. You can find out how to exercise your right of revocation via the privacy policy of the respective social media provider. Furthermore, regarding data processed exclusively by us, you can exercise your right to object by contacting the data controller using the contact details provided above.

The legal bases for contacting and handling communication via social media are your consent pursuant to Art. 6 (1) sentence 1 lit. a GDPR, insofar as you have given it via the social media provider. The legal basis for handling inquiries via our social media presences is Art. 6 (1) sentence 1 lit. f GDPR, as well as Art. 6 (1) sentence 1 lit. a GDPR, insofar as you voluntarily provide us with information in correspondence. Our legitimate interest lies in being able to effectively answer your inquiry via the social media channel.

Your consent is voluntary and can be revoked at any time with future effect. To revoke your consent regarding the processing of data voluntarily provided in correspondence, please contact the data controller using the contact details provided above.

The legal basis for processing your data in connection with email marketing and email tracking, including the evaluation of target groups and the analysis of the success of our email campaigns, as well as, where applicable, the legal basis for the creation and evaluation of prospect profiles, is also your consent, Art. 6 (1) sentence 1 lit. a GDPR, which is obtained separately, for example, through forms. If your data is used for advertising purposes in exchange for permanent access to our webinars, whitepapers, guides, checklists, and other templates, the legal basis is Art. 6 (1) sentence 1 lit. b GDPR.

The use of cookies and similar technologies also takes place here on the basis of § 25 (1) TTDSG. The subsequent data processing is based on Art. 6 (1) sentence 1 lit. a GDPR.

Your consent is voluntary and can be revoked at any time with future effect. To revoke your consent regarding data processing in connection with email marketing and email tracking, please use the unsubscribe link in our marketing emails or contact the data controller using the contact details provided above.

The legal basis for processing your data in connection with email marketing and email tracking, as well as the creation, enrichment, and evaluation of prospect profiles, is also your consent, which is obtained separately, for example, through forms.

The use of cookies and similar technologies also takes place here on the basis of § 25 (1) TTDSG. The subsequent data processing is based on Art. 6 (1) sentence 1 lit. a GDPR.

Your consent is voluntary and can be revoked at any time with future effect. To revoke your consent regarding the execution of email marketing and email tracking, as well as the creation, enrichment, and evaluation of prospect profiles, please contact the data controller using the contact details provided above.

Recipients

When using the service, data collected via our websites is transferred to the following recipients:

• HubSpot Ireland Limited, 1 Sir John Rogerson's Quay, Dublin 2, Ireland,
• HubSpot, Inc., 2 Canal Park, Cambridge, MA 02141, USA.

Further information on how the service provider handles personal data can be found at https://legal.hubspot.com/de/privacy-policy.

Data Processing in Third Countries

When using the service, your data may also be processed in third countries outside the European Union (EU) and the European Economic Area (EEA), particularly in the USA.

For data transfers to the USA, there is an adequacy decision by the EU Commission pursuant to Art. 45 (1) GDPR concerning companies certified under the EU-U.S. Data Privacy Framework, which can be viewed at the following link: Data protection adequacy for non-EU countries.

HubSpot Inc. is certified under the EU-U.S. Data Privacy Framework and is therefore committed to maintaining appropriate data protection standards, which can be viewed at the following link: Participant Search (dataprivacyframework.gov).

When your data is transferred to other third countries for which no adequacy decision exists, there is a risk that local authorities may access your data for security and surveillance purposes, without you being informed or able to appeal.

To ensure an adequate level of data protection when transferring your data to a third country, standard data protection clauses of the European Commission pursuant to Art. 46 (2) lit. c GDPR are concluded. These oblige the recipient of the data to process it in accordance with the European level of protection.

If the standard data protection clauses are not sufficient to ensure the level of protection, additional technical, contractual, or organizational measures are taken to secure the data transfer. Furthermore, it is regularly checked and assessed whether these additional measures continue to ensure an adequate level of data protection or whether further supplementary measures may need to be taken.

Storage Period

Unless otherwise specified, we store your data to the extent necessary, as long as this is required to achieve the aforementioned purposes. Subsequently, we delete your data, unless further data processing, possibly also in other systems, is permissible for other purposes based on a different legal basis or is mandatory for us (e.g., in the case of statutory retention or documentation obligations).

Privacy Information for Applicants

Data Processing in the Application Procedure

Description of Data Processing and Purpose

We process your personal data insofar as this is necessary for the decision on establishing an employment relationship with us.

We only process data that is related to your application. This may include general personal data (name, address, contact details, etc.), information on your professional qualifications and schooling, information on professional development, and possibly other data that you submit to us in connection with your application.

If an employment relationship is established between you and us, we may further process the personal data already received from you for employment purposes, insofar as this is necessary for the performance or termination of the employment relationship or for the exercise or fulfillment of rights and obligations of the employee representation arising from a law or a collective agreement, a works or service agreement (collective agreement).

Legal Basis for Data Processing

The legal basis for this is Art. 88 GDPR in conjunction with Section 26 (1) BDSG or Art. 6 (1) sentence 1 lit. b GDPR for employment purposes, if this is necessary for the decision on establishing an employment relationship.

If you give us explicit consent to process personal data for specific purposes, the lawfulness of this processing is based on your consent pursuant to Section 26 (2) BDSG, Art. 6 (1) sentence 1 lit. a GDPR. Any given consent can be revoked at any time with future effect.

The legal basis for further processing for the purpose of establishing or terminating an employment relationship is Art. 88 GDPR in conjunction with Section 26 (1) BDSG or Art. 6 (1) sentence 1 lit. b GDPR.

Source

We process personal data that we receive from you during contact or your application via the upload function of our career portal, by post, or by email, or that you transmit to us via job portals and professional networks chosen by you.

Recipients

Within our company, we only disclose your personal data to departments and individuals who require this data to fulfill contractual and legal obligations or to implement our legitimate interest.

We may transfer your personal data to affiliated companies, insofar as this is permissible within the scope of the purposes and legal bases set out in this privacy policy.

Your personal data may be processed on our behalf based on data processing agreements in accordance with Art. 28 GDPR. In these cases, we ensure that the processing of personal data complies with the provisions of the GDPR.

In this case, the categories of recipients are internet service providers and providers of applicant management systems and software.

In the context of data processing, your data will be transmitted in particular to the following recipients:

• Personio GmbH, Rundfunkplatz 4, 80335 Munich, Germany.

Otherwise, data will only be transferred to recipients outside the company if legal provisions permit or require it, if the transfer is necessary to fulfill legal obligations, or if we have your consent.

Data Processing in Third Countries

A transfer to a third country is not intended.

Storage Period

We store your personal data for as long as it is necessary for the decision regarding your application. Your personal data or application documents will be deleted no later than six months after the conclusion of the application process (e.g., the announcement of the rejection decision), unless longer storage is legally required or permissible.

Furthermore, we only store your personal data to the extent that this is legally required or, in a specific case, necessary for the assertion, exercise, or defense of legal claims for the duration of a legal dispute.

In the event that you have consented to a longer storage period for your personal data, we will store it in accordance with your declaration of consent.

If an employment, training, or internship relationship is established following the application process, your data will, if necessary and permissible, initially continue to be stored and subsequently transferred to your personnel file.

Following the application process, you may receive an invitation to join our talent pool. This allows us to consider you for suitable vacancies in our applicant selection in the future. If we have your corresponding consent, we will store your application data in our talent pool in accordance with your consent or any future consents.

Necessity of Providing Personal Data

The provision of your personal data within the scope of application processes is voluntary. However, we can only make a decision regarding the establishment of an employment relationship or establish an employment relationship with you if you provide such personal data as is necessary for the application process.

data provided in our own systems does not take place.

Processing of Applicant Data via Online Forms

For the collection of applicant data via online forms, we use the HR and applicant management software Personio from Personio GmbH, Rundfunkplatz 4, 80335 Munich, Germany.

Description of Data Processing and Purpose

Personio allows us to store and manage received applicant data. If you submit your application data to us via the application form on our website, the data entered into the input mask will be transmitted to and stored by Personio. No automatic data processing by Personio takes place. Processing only occurs when our application form is used.

As part of your application, the service provider may process the following data in particular:

• Last name, First name,
• Phone number,
• Place of residence / Address,
• Email address,
• Salary expectations and start date
• CV,
• Certificates,
• Cover letter,
• Other uploaded attachments.

We use Personio exclusively for processing your application.

Legal Basis for Data Processing

Insofar as we use cookies and similar technologies as part of the service's integration, or insofar as data is stored on your device or read from it by the service, this is done in accordance with § 25 para. 2 TDDDG.

Subsequent data processing takes place for the purpose of initiating a contract or an employment relationship at the request of the data subjects, based on Art. 6 para. 1 sentence 1 lit. b GDPR and § 26 para. 1 sentence 1 BDSG.

Recipients

When using the service, the data collected via our websites is transmitted to the following recipients:

• Personio GmbH, Rundfunkplatz 4, 80335 Munich, Germany.

Further information on how Personio handles personal data can be found at https://www.personio.de/datenschutzerklaerung/.

Storage Duration

By integrating the services on our websites, data is transmitted to the recipients mentioned above and stored there for a period of six months after the completion of the application process. If, in individual cases, further storage of the data processed by the service and provided to us takes place in our own systems, the data will also be stored for a maximum of six months after the completion of the application process.

Privacy Information for Social Media Profiles

Below you will find information on how your data, collected through your use of our social media profiles on social networks and platforms, is handled.

Social Media Profiles

We maintain profiles, presences, pages, or fan pages on the following social media platforms:

Different Responsibilities and Roles

Depending on how the platform operators and we, as page operators, are involved in the processing of your personal data, the respective responsibility or role differs.

Thus, we can either be jointly responsible with the platform operator, or the platform operator is solely responsible.

Joint Controllership with Platform Operators

Joint Controllers

We share joint controllership with the following platform operators:

For the processing of your personal data in connection with your visit to the presence, profile, page, or fan page on the platforms, we, as the page operator, are jointly responsible with the providers of the respective platform if the platform operators provide aggregated information about visitors to our profiles, presences, pages, or fan pages (e.g., so-called "Insights" or "Analytics").

In cases of joint controllership, we have concluded agreements with the platform operators in accordance with Art. 26 GDPR concerning joint controllership for the processing of your personal data (e.g., Page Controller Addendum or Joint Controller Addendum).

This agreement specifies which data processing operations we or the respective platform operator are responsible for. You can view these agreements via the following links:

Further information on data processing by the platform operators can be found in their privacy policies:

Contacting the Data Protection Officers of the Platform Operators

You can contact the data protection officers of the platform operators here:

Data Processing in Joint Controllership

Access to and storage of information on end devices

When you access our profiles on the aforementioned platforms, the platform operator uses cookies and similar technologies on your device to store or read data from your device. This access or storage may be associated with further processing of personal data within the meaning of the GDPR.

In cases where such access to or storage of information is absolutely necessary for the technically flawless provision of services, this is done on the basis of Section 25 (1) sentence 1, (2) no. 2 TDDDG. Further data processing may take place on the basis of Art. 6 (1) sentence 1 lit. f GDPR.

In cases where such a process serves other purposes (e.g., the needs-based design of our website), it is carried out only with your consent in accordance with Section 25 (1) TDDDG and Art. 6 (1) sentence 1 lit. a GDPR. Consent can be revoked at any time for the future. The provisions of the GDPR and the Federal Data Protection Act (BDSG) apply to the processing of your personal data.

Further information on the use of cookies and similar technologies, as well as their legal bases, can be found in the respective privacy policy of the platform operator. Links to the respective privacy policies can be found above. For further questions, please contact the operator of the respective social media platform directly.

Data processing for advertising and market research purposes

As a rule, personal data on our social media profile is primarily processed for market research and advertising purposes by the platform operator. Insofar as data collection also takes place directly on our social media profile, we participate in the platform operator's data processing and are therefore jointly responsible with them in this respect.

During data processing, cookies and similar technologies are used, which enable the platform operator to recognize you when you visit a social media profile. Furthermore, for members of the social media platform, the platform operator extensively evaluates your interactions on the platform (clicks, comments, and likes) and processes the information you provide to the platform operator, such as your master data, profile picture, or name. In particular, demographic information (age, gender, country, industry, profession, etc.) from your own member profile may also be processed.

Usage profiles can be created using the collected data. These are then used by the platform operator to display advertisements, both within and outside the platform, that presumably match your interests.

Although we do not have direct access to the data processed by the platform operator, we also benefit from these data processing activities by placing advertisements, both within and outside the platforms, based on the target groups identified by the platform operator.

The legal basis for processing your personal data in this regard is your consent given to the platform operator in accordance with Art. 6 para. 1 lit. a GDPR.

Please note that we have no influence over the data collection and further processing carried out by the platform operators. Consequently, we cannot provide information on the extent, location, and duration for which data is stored by the platform operator.

Further information on this can be found in the privacy policy of the respective provider.

Data processing within the scope of „Insights“ or „Analytics“

Furthermore, your data is processed under joint responsibility in connection with so-called „Page Insights“ or „Page Analytics“.

„Page Insights“ or „Page Analytics“ are analysis functions provided by the platform operator, through which your master data, particularly demographic data, as well as data on your interactions with our profile, are collected jointly by the platform operator and us.

The platform operator then analyzes this data and creates summarized data (so-called aggregated data) for us, from which we can see which demographic target group has visited our profile and how our profile has been used by them.

In this respect, we also do not have direct access to the data processed by the platform operator. This data is provided to us by the platform operator only in aggregated form. This means that we cannot identify individual visitors or their interactions from the summarized data.

We then use this aggregated data to target our social media profile to specific audiences and generally to optimize it for the aforementioned advertising purposes (increasing the reach and visibility of our profile and evaluating the success of marketing campaigns).

The legal basis for processing your personal data in this regard is your consent given to the platform operator in accordance with Art. 6 para. 1 lit. a GDPR.

Please note that we have no influence over the data collection and further processing carried out by the platform operators. Consequently, we cannot provide information on the extent, location, and duration for which data is stored by the platform operator.

Further information on this can be found in the privacy policy of the respective provider.

Data processing based on consent

If you are asked by the respective platform operator for consent to processing for a specific, common purpose, the legal basis for processing is Art. 6 para. 1 lit. a., Art. 7 GDPR. Granted consent can be revoked at any time with effect for the future.

Recipients and Data Transfer to Third Countries

If we transfer personal data to the operators of social media platforms, the latter are the recipients of the data within the meaning of Art. 4 No. 9 GDPR.

When you visit our social media profiles, your data may also be processed in countries outside the European Union (EU) and the European Economic Area (EEA), in third countries, particularly in the USA.

For data transfers to the USA, an adequacy decision of the EU Commission exists pursuant to Art. 45 para. 1 GDPR concerning companies certified under the EU-U.S. Data Privacy Framework, which can be viewed at the following link: Data protection adequacy for non-EU countries.

When your data is transferred to other third countries for which no adequacy decision exists, there is a risk that local authorities may access your data for security and surveillance purposes without you being informed or able to exercise legal remedies.

To ensure an adequate level of data protection when transferring your data to a third country, standard data protection clauses of the European Commission are concluded in accordance with Art. 46 para. 2 lit. c GDPR. These oblige the recipient of the data to process it in accordance with the European level of protection.

If the standard data protection clauses are not sufficient to ensure the level of protection, additional technical, contractual, or organizational measures will be taken to secure the data transfer. Furthermore, it will be regularly reviewed and assessed whether these additional measures continue to ensure an adequate level of data protection or whether further supplementary measures may need to be taken.

Exercising Your Rights in Cases of Joint Responsibility

Your Rights as a Data Subject

If you, as a visitor to the site, wish to exercise your rights (information, rectification, erasure, restriction, data portability, complaint to a supervisory authority, objection or withdrawal), you can contact both the platform operator and us.

Responsibility of Platform Operators

If your personal data is processed by one of the social media platform operators listed below, this processing is carried out under the sole responsibility of the platform operator within the meaning of Art. 7 No. 4 GDPR.

We have no influence over the data processing by the platform operators. For further information, please check the privacy policy of the respective platform operator:

Regarding the assertion of your data subject rights, we point out that these can be most effectively asserted with the respective providers. Only they have access to the data collected from you. Should you still require assistance, please feel free to contact us at any time.

Our Own Responsibility

We are solely responsible for the following data processing activities via our social media profiles.

Data processing through the operation of the social media profile

When you visit or interact with our social media profile, we process your personal data.

This may include information you actively provide (comments, likes, and publicly available information such as your profile picture or name). Depending on the provider and your settings on the provider's platform, we may also be informed about who has viewed our profile within the platform.

The legal basis for processing personal data when operating our social media profile is Art. 6 para. 1 sentence 1 lit. f GDPR.

The legitimate interest lies in the promotional approach to visitors and in providing an effective communication and interaction possibility with our company on the social media platform.

Data processing upon contact

We ourselves collect personal data if you contact us, for example, via a contact form or a messenger function of the respective platform.

Which data is collected depends on your information and the contact details you provide or share. This data is stored by us for the purpose of processing the request and for any follow-up questions.

The legal basis for processing the data is our legitimate interest in responding to your request pursuant to Art. 6 para. 1 sentence 1 lit. f GDPR.

Your data will be deleted after your request has been finally processed, provided that no legal retention obligations prevent this. We consider processing to be final when the circumstances indicate that the matter in question has been conclusively clarified.

Data processing for contract execution

If your contact via a social network or other platform aims at concluding a contract for the delivery of goods or the provision of services with us, we process your data for the performance of the contract or for the implementation of pre-contractual measures, or for the provision of the desired services.

In this case, the legal basis for processing your data is Art. 6 para. 1 sentence 1 lit. b GDPR.

Your data will be deleted when it is no longer required for the performance of the contract or if it is clear that the pre-contractual measures will not lead to a contract conclusion corresponding to the purpose of the contact.

Please note, however, that it may also be necessary to store personal data of our contractual partners even after the conclusion of the contract in order to comply with contractual or legal obligations.

Data processing based on consent

If we request your consent for processing for a specific purpose, the legal basis for processing is Art. 6 para. 1 lit. a, Art. 7 GDPR. Consent given can be revoked at any time with future effect.

Other data processing activities

Documentation of data protection compliance

Description of data processing and its purpose

If you provide us with a declaration of consent, we process your personal data regarding the circumstances and time of its submission (if applicable, signature, email address, telephone or fax number, or IP address) in order to be able to demonstrate, within the scope of our accountability obligation pursuant to Art. 5 para. 2 GDPR, that you have consented to the data processing in question.

If you exercise your data subject rights under the GDPR towards us, we also process your personal data in order to be able to demonstrate, within the scope of our accountability obligation pursuant to Art. 5 para. 2 GDPR, that we have complied with the GDPR when processing your request.

Legal basis for data processing

The processing is carried out in each case on the basis of Art. 6 para. 1 sentence 1 lit. c GDPR or Art. 6 para. 1 sentence 1 lit. f GDPR. Our legitimate interest lies in being able to document compliance with the requirements of the GDPR as part of our accountability.

Recipients

Furthermore, it may happen that we forward your personal data in connection with your inquiry to our external company data protection officer, who supports us in complying with the requirements of the GDPR.

Storage Period

We store your data as long as this is necessary for achieving the aforementioned purpose. Data related to a given consent is regularly stored for up to 3 years from the end of the year in which we last made use of it. Data that we process in connection with the implementation of data subject rights is regularly stored for a period of 3 years from the end of the year in which you exercised your data subject right.

Subsequently, we delete your data, unless data processing, possibly also in other systems, is still permissible on the basis of another legal ground or is mandatory for us (e.g., in the case of existing statutory retention obligations).

Fulfillment of other legal obligations

Description of data processing and purpose

We process personal data if this is necessary for the fulfillment of a legal obligation. The scope of the data to be processed results from the legal obligation we must comply with.

Legal Basis for Data Processing

The legal basis for processing your data in these cases is Art. 6 para. 1 sentence 1 lit. c GDPR in conjunction with the respective legal norm that imposes such an obligation on us.

These may include, for example, norms from the Tax Code (AO), e.g., § 147 AO, the Commercial Code (HGB), e.g., § 257 HGB, or the Code of Criminal Procedure (StPO).

Recipients

If necessary, your data will be transmitted to the necessary extent to tax advisors, auditors, financial or investigative authorities, lawyers, experts, or courts.

Storage Period

We store your data to the necessary extent, as long as this is required for achieving the aforementioned purpose. The storage period results from specific legal regulations that oblige us to store or process data for up to 10 years, with the specific start of the retention periods being determined by the respective specific law.

Subsequently, we delete your data, unless data processing, possibly also in other systems, is still permissible on the basis of another legal ground.

Exercise or defense of legal claims

Description of data processing and purpose

Additionally, in individual cases, we process your data for the purpose and in the interest of asserting legal claims, for example, to enforce our claims due to unpaid invoices, provided your data is relevant for a legal dispute.

In addition, we process your data in individual cases for the purpose and in the interest of defending against legal claims brought against us, for example, in the assertion of claims for defects, if your data is relevant for a legal dispute.

Legal Basis for Data Processing

The legal basis for the processing of your data is Art. 6 para. 1 sentence 1 lit. f GDPR.

Recipients

If necessary, your data will be transmitted to tax advisors, auditors, financial or investigative authorities, lawyers, experts, or courts to the extent required.

Retention Period

We store your data on a case-by-case basis to the extent necessary, as long as this is required to achieve the aforementioned purpose. Subsequently, we delete your data, unless further data processing, possibly also in other systems, is still permissible on the basis of another legal basis or is obligatory for us (e.g., in the case of existing legal retention obligations).

Your Rights

Below you will find information on the data subject rights granted to you by applicable data protection law in relation to the controller regarding the processing of your personal data:

The right, pursuant to Art. 15 GDPR, to obtain information about your personal data processed by us. In particular, you can request information about the processing purposes, the category of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned storage period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, the origin of your data if it was not collected by us, and the existence of automated decision-making including profiling and, if applicable, meaningful information about its details.

The right, pursuant to Art. 16 GDPR, to request the immediate rectification of inaccurate or completion of your personal data stored by us.

The right, pursuant to Art. 17 GDPR, to request the erasure of your personal data stored by us, unless the processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise, or defence of legal claims.

The right, pursuant to Art. 18 GDPR, to request the restriction of the processing of your personal data, insofar as the accuracy of the data is contested by you, the processing is unlawful, but you oppose its erasure and we no longer need the data, but you require it for the establishment, exercise, or defence of legal claims, or you have objected to the processing pursuant to Art. 21 GDPR.

The right, pursuant to Art. 20 GDPR, to receive your personal data that you have provided to us in a structured, common, and machine-readable format or to request its transmission to another controller.

The right to lodge a complaint with a supervisory authority pursuant to Art. 77 GDPR. As a rule, you can contact the supervisory authority of the federal state where our registered office is located (as stated above) or, if applicable, that of your usual place of residence or work.

The right to withdraw granted consents pursuant to Art. 7 para. 3 GDPR: You have the right to withdraw consent to data processing at any time with future effect. In the event of withdrawal, we will immediately delete the data concerned, unless further processing can be based on a legal basis for processing without consent. The withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent until withdrawal.

Rights to Object

If your personal data is processed by us on the basis of legitimate interests pursuant to Art. 6 para. 1 sentence 1 lit. f GDPR, you have the right, pursuant to Art. 21 GDPR, to object to the processing of your personal data, provided that there are reasons arising from your particular situation. If the objection is directed against the processing of personal data for direct marketing purposes, you have a general right to object without the need to specify a particular situation.

If you wish to exercise your right of withdrawal or objection, an email to info@proliance.ai

Status of this Privacy Policy: 16.01.2025