Privacy policy

Privacy policy and additional data protection information

Status 18.09.2023 Version 1.2

Information on the handling of your personal data

1. An initial overview

At the time we collect your data, we must inform you in a clear, understandable way about how we handle your personal data. Here you will find a brief overview and in the following chapters you will find detailed information about

• who our company is and how you can contact us or our data controller; there we provide you with the relevant contact details;
• for what purpose we will use your personal data;
• which categories of personal data we will process from you;
• On what legal basis we will process your personal data;
• How long we will retain your personal data;
• Which recipients may receive your personal data;
• Whether the personal data will be transferred to a country outside the EU;
• That you have basic rights in the area of data protection, e.g. related to:
• Information
• Correction
• deletion
• restriction of processing
• Data portability
• objection or
• Detailed information in the case of automated decision-making.
• In addition, you will find further information on the handling of data from external and internal applicants,
• on the handling of data in the context of the use of our websites as well as online presences on social media sites,
• on the handling of data in the context of processing payments,
• on the handling of your data when using our newsletter service,
• and on the use of cloud services.

Please remember that personal data is required as part of our corporate work. Without personal data, we are not in a position to fulfill your wishes, to manage you as a contractual partner or to send you information about our activities, services or our company. Of course, we will only collect the data necessary for this purpose. Should we ask for additional data from you, we will inform you of this and point out that this information is voluntary. By the way, we do not carry out any automated decision-making processes.

Data protection has a very high priority for us. Therefore, we would like to inform you comprehensively and understandably about how we process your personal data - naturally in compliance with the applicable legal provisions, such as the European Data Protection Regulation (DSGVO), the German Federal Data Protection Act (BDSG) and all other relevant data protection regulations. We have defined how we handle personal data in our data protection management system and act accordingly.

If you think that our data protection declaration could be improved, we would be pleased to receive your comments and suggestions.

In addition, you have the option of contacting us directly or the responsible data protection supervisory authority(State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia, P.O. Box 20 04 44 40102 Düsseldorf, phone: 0211/384 24-0, fax: 0211/384 24-999, e-mail: poststelle@ldi.nrw.de, https://www.ldi.nrw.de) and to complain there if necessary.

Our data protection declaration and the other information on data protection are regularly reviewed and adapted as part of our data protection management. The latest version will be published on this page.

2. detailed information:

Contact details

Contact details of the responsible person

Quality Brands GmbH

Carlo-Schmid-Strasse 11

52146 Würselen

Phone: +49 (0)2405 6008111

E-mail: info@q-brands.de

3. purpose

Which data we process in detail and for what purpose we use it depends on the services you use with us. Details on the purposes of our data processing can be found in the respective contract documents, forms, declarations of consent and via other information provided to you in this context. This data protection information is part of our contract texts, website or other documents that we provide or have provided to you. Essentially, we process personal data by default for the following purposes:

• Customer and supplier administration
• Applicant management
• Employee administration
• Order management
• Operation of the websites at q-brands.de, www.bestellung.q-brandsdistribution.de and www.q-brandsdistribution.de, eu.cotopaxi.com, funkita.funkytrunks.de, and our online shops
• Publications on our websites and social media portals
• Management of training and event participants

In addition, we process your data in the cases listed below for the purpose of

• the dispatch (by post, e-mail, etc.) of company information, provided you have given us your consent to do so
• communication (analog and digital)
• obtaining information from credit agencies
• use of your e-mail address for marketing purposes, newsletters, etc.
• the fulfillment of legal requirements, such as tax laws, mandatory insurance, etc.
• the fulfillment of legal security, control and reporting obligations
• the archiving of data for security purposes and to fulfill verification obligations
• the disclosure in the context of official/judicial measures

4. categories

Data categories of personal data that we can process from you are, depending on your use of our offer or the contractual relationship existing with you, the following:

• Master data (e.g. name, telephone number, e-mail address, address, etc.), of customers (including potential ones), suppliers and service providers (including potential ones), of employees within the scope of the employment relationship, of applicants, training and event participants, other interested parties, as well as other categories of persons connected with the aforementioned persons, who may be involved within the scope of the respective affiliations (e.g. family members, employees of service providers and/or suppliers, etc.).
• Contact data for the aforementioned categories of persons (addresses, telephone numbers, e-mail addresses, etc.)
• Transaction data on the aforementioned categories of persons (interests, orders, participation in training courses and events of all kinds, etc.)
• Bank account data as well as data on payments and, if applicable, creditworthiness
• Usage data on websites and customer portals offered by us (IP address, time of calling up pages, pages visited, etc.)
• Consent data, for documentation of granted / revoked consents

5. legal basis

If you are in an employment relationship with us, we process your personal data for the establishment, implementation and termination of the associated contractual relationship on the basis of Art. 6 para. 1 lit. b in conjunction with Art. 88 DSGVO and §26 BDSG.

If we are in another contractual relationship or communicate within the framework of pre-contractual measures, however, the processing of personal data is carried out for the implementation of related contracts, implementation of measures and activities within this framework. These processing operations are based on Art. 6 para. 1 lit. b DSGVO.

In addition, we process your data for the purposes listed below on the basis of the following legal grounds in the case of:

• Customer administration (Art. 6 para. 1 lit. b DSGVO).
• Supplier administration (Art. 6 para. 1 lit. b DSGVO)
• Employee management (Art. 6 para. 1 lit. c DSGVO)
• Applicant administration (Art. 6 para. 1 lit. a and b DSGVO in conjunction with Art. 88 DSGVO, § 26 BDSG)
• Administration (Art. 6 para. 1 lit. c DSGVO)
• Operation and hosting of the company's websites, in particular to provide you with the retrieved, desired page content as well as to ensure the necessary security in their operation (Art. 6 para. 1 lit. f DSGVO)
• Publication of photos on the websites and social media portals (Art. 6 para. 1 lit. a DSGVO), provided you have given us your consent to do so
• Market and opinion research (Art. 6 para. 1 lit. a DSGVO), provided you have given us your consent to do so
• Use of your e-mail address for marketing purposes, newsletter (Art. 6 para. 1 lit. a DSGVO), provided you have given us your consent to do so
• Fulfillment of legal requirements, such as tax laws, etc. (Art. 6 para. 1 lit. c DSGVO)
• Fulfillment of legal control and reporting obligations (Art. 6 para. 1 lit. e DSGVO)
• Archiving of data for security purposes (Art. 6 para. 1 lit. c and, if applicable, f DSGVO)
• Fulfillment of obligations to provide evidence (Art. 6 para. 1 lit. c DSGVO)
• Disclosure in the context of official/judicial measures (Art. 6 para. 1 lit. e DSGVO).

In the event that we process further personal data about you on the basis of Art. 6 (1) (f) DSGVO - in the sense of a balancing of interests - we will inform you separately in advance.

6. storage

We process and store your data only as long as it is necessary for our activities and purposes or as long as legal retention obligations (e.g. HGB, AO, etc.) require it. In individual cases, this may result in personal data being stored for several years.

7. recipients

In principle, your personal data will only be made available to internal or external recipients who need them to fulfill contractual or legal obligations or to perform their tasks. This means that data will be passed on or disclosed

• to entities that process data as order processors or in joint responsibility with us (e.g. in the areas of HR, legal department, data centers, data disposal, customer administration, information and communication technology, website administration and hosting (incl. online shop administration and hosting), applicant management, payment processing, logistics and delivery, etc.).
• In the case of a legitimate interest to authorities, lawyers, associations, courts, appraisers, credit agencies, collection agencies, etc.
• In the case of a legal obligation to authorities, public agencies, social insurance carriers, etc.
• to possible other third parties if you have given us your express consent to do so.

Beyond this, we will not pass on your data.

Service providers that we have commissioned in the context of order processing or in the sense of joint responsibility may only use the data for the purposes for which we have passed it on to them. In principle, this is contractually regulated with these service providers and data processing there is subject to the same general conditions as with us.

8. data transfer outside the EU

As a rule, we do not transfer data to countries outside the European Union (EU) or the European Economic Area (EEA) (so-called third countries). Only in the case of data collection in the context of visiting our websites or online stores, the use of our newsletter, the use of cloud services and the visit of our presences on social media sites, data transfer to third countries (including unsafe third countries) cannot be excluded. Please refer here to the corresponding notes at the relevant places in this privacy policy.

9. data subject rights

You can assert your data protection rights against us under certain conditions:

• You have the right to receive information about your data stored by us according to the rules of Art. 15 DSGVO - if necessary with restrictions.
• If your data stored by us is inaccurate or incorrect, you can request that it be corrected in accordance with Article 16 of the GDPR.
• According to Art. 17 DSGVO, you can request that the personal data stored about you be deleted. However, this only applies as long as the deletion does not conflict with any other statutory provision.
• Provided that the requirements of Art. 18 DSGVO are met, you may request that the processing of your data be restricted.
• Under certain circumstances, you have the right to require us to provide you with your personal data under the conditions of Art. 20 DSGVO.
• You have the right at any time to revoke any consent given with effect for the future in accordance with Art. 7 (3) DSGVO. From this point on, your personal data will no longer be processed for the purposes to which you object. The objection can be made informally.

For example, if you have expressly consented in accordance with Art. 6 (1) (a) DSGVO, we will use your e-mail address to send you our newsletter on a regular basis. Unsubscribing is possible at any time, for example via a link at the end of each newsletter. Alternatively, you are also welcome to send your unsubscribe request at any time by e-mail to info@q-brands.de.

Within the framework of the existing contractual relationships with our customers, we send contract- and/or service-related information by e-mail to the contact e-mail addresses stored with us as customer information, especially in the service area. This includes, for example, information on upcoming maintenance and service intervals or current technical information on the products purchased from us. If you do not wish to receive this information, you can notify us at any time by sending an e-mail to info@q-brands.de or by clicking on the unsubscribe link provided in each customer information. If you would like to designate a different or additional contact person from your company to receive the information, please send us an e-mail to info@q-brands.de.

• In accordance with Art. 77 DSGVO, you have the right to complain to a supervisory authority. As a rule, you can contact the supervisory authority of your usual place of residence or workplace or our company headquarters for this purpose.
• If your personal data is processed on the basis of legitimate interests pursuant to Art. 6 (1) p. 1 lit. f DSGVO, you have the right to object to the processing of your personal data pursuant to Art. 21 DSGVO, provided that there are grounds for doing so that arise from your particular situation or the objection is directed against direct advertising. In the latter case, you have a general right of objection, which is implemented by us without specifying a particular situation.

If you wish to exercise any of the aforementioned rights, we kindly ask you to contact us in writing, if possible, at the above address of the responsible party (see contact details) or to contact us directly by e-mail via info@q-brands.de.

10 Additional information regarding data of external and internal applicants

Personal data relating to you is generally collected directly from you - for example, as part of the application process - on the basis of Art. 88 DSGVO, § 26 (1) BDSG.

In addition, we may also have received data from third parties (e.g. job boards such as Indeed, Stepstone or similar job agencies).

In addition, we may process personal data that we have permissibly obtained from publicly accessible sources (e.g. professional social networks).

The processed categories of personal data of applicants include, in particular, your master data (such as first name, last name, name affixes, nationality, personnel number), contact data (such as private address, (mobile) phone number, e-mail address), as well as the data of the entire application process (cover letter, curriculum vitae, employment or other references, proof of qualifications).

If you have also voluntarily provided special categories of personal data (such as health data, degree of disability, religious affiliation) in the letter of application or in the course of the application process, processing will only take place if you have expressly consented to this (Art. 9 (2) a DSGVO).

We process personal employee and applicant data on the basis of and in compliance with the European Data Protection Regulation (EU DSGVO), the German Federal Data Protection Act (BDSG) and all other relevant regulations in German labor law (e.g. AGG, BetrVG, SGB, etc.).

The primary purpose of processing your personal data as part of the application process is to carry out the application procedure, in particular to determine the extent to which you are suitable for the advertised position. The processing of your applicant data is necessary for the decision on the establishment of an employment relationship. The primary legal basis for this is Art. 88 DSGVO in conjunction with § 26 (1) BDSG.

10.1 Data transfer for internal and external applicants:

Within our company, we only disclose your personal data to those persons and bodies who need it to make a decision about your employment and to fulfill our legal and contractual obligations. Outside our company, we only disclose your personal data to bodies that process this data as order processors (applicant management).

In deviation from this, we only disclose your personal data - e.g. to investigating authorities - if we are legally obligated to do so.

10.2 Storage period for internal and external applicants:

Personal applicant data transmitted to us will be deleted as soon as it is no longer required for the above-mentioned purposes, at the latest after 6 months. This does not apply if you have expressly consented to a longer storage period, storage is required for evidence purposes, or legal regulations prevent deletion. For example, we retain your applicant data for as long as there is a possibility that you will assert legal claims against us, e.g. for violation of provisions of the AGG.

If, on the other hand, your application leads to the establishment of an employment contract with you, your data will be stored for the purposes of the usual administrative and organizational processes and for the implementation of the employment relationship until the employment relationship is terminated.

11 Additional information on the collection and storage of personal data when visiting our websites:

When you call up our websites, information is automatically sent to the server of our website and our customer portal by the browser used on your end device. This information is temporarily stored in a so-called log file. The following information is collected without your intervention and stored until automated deletion:

• IP address of the requesting computer,
• Host name of the requesting computer,
• Date and time of access,
• website from which the access is made (referrer URL),
• browser used and the browser version and the operating system of your computer.

The aforementioned data is processed by us for the following purposes:

• Ensuring a smooth connection setup of the website,
• Ensuring a comfortable use of our website,
• evaluation of system security and stability as well as
• for other administrative purposes.

The legal basis for data processing Art. 6 para. 1 lit. f DSGVO. Our legitimate interest is the operation of our website and the associated presentation of our company. In no case do we use the collected data for the purpose of drawing conclusions about your person.

Your data will be deleted as soon as it is no longer required for the stated purposes, at the latest after 6 months.

11.1 Cookies, analysis tools, plugins and other third-party elements

We use cookies on our site. These are small files that your browser automatically creates and that are stored on your end device (laptop, tablet, smartphone or similar) when you visit our site. Cookies do not cause any damage to your end device, do not contain viruses, Trojans or other malware. Cookies are small text files that are stored on your hard drive associated with the browser you are using and through which the entity that sets the cookie (in this case, us) receives certain information. Cookies cannot execute programs or transfer viruses to your computer. They are used to make the Internet offer as a whole more user-friendly and effective.

Information is stored in the cookie that is related to the specific end device used. However, this does not mean that we gain direct knowledge of your identity.

Our website uses cookies to the following extent:

• Transient cookies (temporary use)
• Persistent cookies (temporary use)

Transient cookies are automatically deleted as soon as you close the browser. These include, in particular, session cookies. These store a so-called session ID, with which various requests of your browser can be assigned to the common session. This allows your computer to be recognized when you return to the website.

Persistent cookies are automatically deleted after a specified duration, which may differ depending on the cookie. You can delete the cookies in the security settings of your browser at any time.

11.1.1 Required first-party cookies

The use of our required first-party cookies serves on the one hand to make the use of our offer more pleasant for you. Thus, we use so-called session cookies to recognize that you have already visited individual pages of our website. These are automatically deleted after you leave our site.

In addition, we also use temporary cookies to optimize user-friendliness, which are stored on your terminal device for a certain fixed period of time. If you visit our site again to use our services, it is automatically recognized that you have already been to our site and which entries and settings you have made so that you do not have to enter them again. This data is deleted after 6 months at the latest.

We process your data based on our legitimate interest in the external presentation of our company via the website you have accessed and to promote user-friendliness. The legal basis for the processing is Art. 6 para. 1 p. 1 lit. f DSGVO.

Most browsers accept cookies automatically. However, you can configure your browser so that no cookies are stored on your computer or a notice always appears before a new cookie is created. However, the complete deactivation of cookies may mean that you cannot use all the functions of our website.

This stored information is stored separately from any other data transmitted to us. In particular, the cookie data is not linked to your other data (e.g. in the case of contact inquiries or online applications).

11.1.2 Third-party cookies, plugins and other third-party elements

The third-party cookies, plugins and other third-party elements listed below and used by us are only used with your express consent and thus on the basis of Art. 6 (1) p. 1 lit. a DSGVO. You can revoke the consent you have given at any time with effect for the future. Failure to grant or revocation of consent may result in the website not being displayed correctly to you or you not being able to use all the functions of the website.

With the third-party cookies, plug-ins or other third-party elements that are used, we want to ensure a needs-based design and the ongoing optimization of our website.

The respective function descriptions, any recipients of the data, information on possible transfers to a third country and the storage period can be found in the following notes on the individual processing processes provided with third-party cookies, plugins or other third-party elements.

Google Analytics

We use Google Analytics, a web analytics service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google") on our pages, provided that you give us your consent to do so pursuant to Art. 49 (1) lit. a DSGVO. Cookies are used in this context. The information generated by the cookie about the use of the online offer by the users is usually transmitted to a Google server in the USA and stored there.

Google will use this information on our behalf for the purpose of evaluating your use of the website, compiling reports on website activity for website operators and providing other services relating to website activity and internet usage. In doing so, pseudonymous usage profiles of the users can be created from the processed data.

We only use Google Analytics with IP anonymization activated. This means that the IP address of the user is shortened by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there.

The IP address transmitted by the user's browser is not merged with other data from Google. Users can prevent the storage of cookies by setting their browser software accordingly; users can also prevent the collection of the data generated by the cookie and related to their use of the online offer to Google, as well as the processing of this data by Google, by refusing your consent to this or by downloading and installing the browser plugin available at the following link: http://tools.google.com/dlpage/gaoptout?hl=de.

For more information about Google's use of data, settings and opt-out options, please refer to Google's privacy policy (https://policies.google.com/privacy) as well as the settings for the display of advertisements by Google (https://adssettings.google.com/authenticated).

We have concluded the standard contractual clauses with Google in order to counteract the possibly missing or limited legal protection options and the lower data protection in the USA in contrast to the EU.

The users' personal data is deleted or anonymized after 14 months.

Google Tag Manager

We use the Google Tag Manager, a tag management system for the integration of tracking or statistical tools of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google") on our pages, provided that you give us your consent pursuant to Art. 49 (1) lit. a DSGVO. The Google Tag Manager itself does not create user profiles, does not store cookies to our knowledge and does not perform any independent analyses. It only serves to manage and play out the tools integrated via it. According to its own information, the Google Tag Manager does not record IP addresses or other personal data (https://support.google.com/tagmanager/answer/9323295?hl=de).

We have concluded the standard contractual clauses with Google in order to counteract the possible lack of or limited legal protection options and the lower level of data protection in the USA in contrast to the EU.

Google Web Fonts (local hosting)

For the uniform display of fonts, we use so-called web fonts on our websites, which are provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google"). These Google Fonts are installed locally on our site. A connection to Google servers does not take place, and therefore no data is passed on to Google. Further information on Google Web Fonts can be found at

https://developers.google.com/fonts/faq and in the privacy policy of Google

https://policies.google.com/privacy?hl=de.

Google Maps

We use Google Maps, a map service of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google") , onour pages, provided that you give us your consent pursuant to Art. 49 (1) lit. a DSGVO . To use the functions of Google Maps, it is necessary to store your IP address. This information about use of the online offer by users is usually transmitted to a Google server in the USA and stored there.

If you call up a website of our Internet presence that contains Google Maps, your browser establishes a direct connection with the Google servers, provided that you have consented to the use of Google Maps. Until you consent to the use of Google Maps, the service will not be loaded and no connection to Google's servers will be established.

The map content is transmitted by Google directly to your browser and integrated by it into the website. Therefore, we have no influence on the scope of the data collected by Google in this way. According to our knowledge, this is at least the following data:

• Date and time of the visit to the website in question,
• Internet address or URL of the website called up,
• IP address, (start) address entered as part of route planning.

We have no influence on the further processing and use of the data by Google and therefore cannot assume any responsibility for this.

We have concluded the standard contractual clauses with Google in order to counteract the possibly missing or limited legal protection options and the lower data protection in the USA in contrast to the EU.

The terms of use of Google Maps can be found at https://www.google.com/intl/de_de/help/terms_maps.html.

Google reCAPTCHA

We use Google reCAPTCHA on our site, an automated test by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google"), to distinguish humans from machines based on different interaction patterns and related parameters. For this purpose, reCAPTCHA analyzes the behavior of the website visitor based on various characteristics. This analysis begins automatically as soon as the website visitor enters the website, provided that you have consented to the use of reCAPTCHA. For the analysis, reCAPTCHA evaluates various information (e.g. IP address, time spent by the website visitor on the website or mouse movements made by the user). The data collected during the analysis is forwarded to Google. The reCAPTCHA analyses run entirely in the background. Website visitors are not informed separately or repeatedly that an analysis is taking place.

We have concluded the standard contractual clauses with Google in order to counteract the possible lack of or limited legal protection options and the lower level of data protection in the USA compared to the EU.

Intuition Machines hCaptcha

We use Intuition Machines hCaptcha on our sites, an automated test by Intuition Machines, Inc, 350 Alabama St, San Francisco, CA 94110, USA ("Intuition Machines"), to distinguish humans from machines based on different interaction patterns and related parameters. To do this, hCaptcha analyzes the behavior of the website visitor based on various characteristics. This analysis starts automatically as soon as the website visitor enters the website, provided that you have consented to the use of hCaptcha. For the analysis, hCaptcha evaluates various information (e.g. IP address, time spent by the website visitor on the website or mouse movements made by the user). The data collected during the analysis is forwarded to Intuition Machines. The hCaptcha analyses run entirely in the background. Website visitors are not notified separately or repeatedly that an analysis is taking place.

We have concluded the standard contractual clauses with hCaptcha in order to counteract the possible lack of or limited legal protection options and the lower level of data protection in the USA compared to the EU.

Shopify

We use the store system of the service provider Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland ("Shopify"), for the purpose of hosting and displaying the online store on the basis of processing on our behalf. All data collected in the course of using the store is processed on Shopify servers . As part of Shopify's aforementioned services, data may also be transferred to Shopify Inc, 150 Elgin St, Ottawa, ON K2P 1L4, Canada, Shopify Data Processing (USA) Inc, Shopify Payments (USA) Inc or Shopify (USA) Inc as part of further processing on our behalf. In the case of transfer of data to Shopify Inc. in Canada, the adequate level of data protection is guaranteed by adequacy decision of the European Commission. With regard to Shopify Data Processing (USA) Inc., Shopify Payments (USA) Inc. and Shopify (USA) Inc. in the USA, we have concluded the standard contractual clauses with Shopify in order to counteract the possible lack of or limited legal protection options and the lower level of data protection in the USA in contrast to the EU.

For further information on Shopify's data protection, please visit the following website:https://www.shopify.de/legal/datenschutz

Meta Pixel

We use Meta Pixel, a web analytics service provided by Meta Platforms Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, on our pages for conversion measurement. ("Meta"), provided that you give us your consent pursuant to Art. 49 (1) lit. a DSGVO. Cookies are used in this context. The information generated by the cookie about the use of the online offer by the users is usually transmitted to a server of Meta (possibly also in the USA) and stored there. These cookies enable Meta to match your user data with the data of your Meta account (e.g. Facebook, Instagram). The collected data is anonymous to us and cannot be viewed; we cannot draw any conclusions about the identity of the users. However, the data is stored and processed by Meta, so that a connection to the respective user profile (e.g. on Facebook) is possible and Meta can use the data for its own advertising purposes, in accordance with the Facebook Data Usage Policy. This allows Meta to enable the placement of advertisements on pages of Meta as well as outside of Meta. This use of the data cannot be influenced by us as the site operator.

For further information on data use by Meta, setting and objection options, please refer to Meta's privacy policy (https://www.facebook.com/privacy/policy/) as well as the settings for the display of advertisements by Meta (https://accountscenter.facebook.com/ad_preferences).

1. Online presence on socialMedia-sites

We maintain online presences within social networks and platforms such as Facebook and Instagram in order to be able to communicate with customers, interested parties and users active there and to inform them about our services and our company there. Withregard to the operation of these online presences, we are jointly responsible with the aforementioned providers.

We would like to point out that Facebook and Instagram in particular may process user data outside the European Union. This may result in risks for users because, for example, it could make it more difficult to enforce users' rights.

Furthermore, user data is usually processed by the platforms for market research and advertising purposes. For example, usage profiles can be created from the usage behavior and resulting interests of the users. The usage profiles can in turn be used, for example, to place advertisements within and outside the platforms that presumably correspond to the interests of the users. For these purposes, cookies are usually stored on the users' computers, in which the usage behavior and interests of the users are stored. Furthermore, data independent of the devices used by the users may also be stored in the usage profiles (especially if the users are members of the respective platforms and are logged in to them). We do not gain any access to the actual usage data. We only use general usage statistics to check the effectiveness of usage.

The processing of users' personal data is based on our legitimate interests in effectively informing users and communicating with users pursuant to Art. 6 (1) lit. f DSGVO .

For a detailed description of the respective processing and the options to object (opt-out), we refer to the information of the providers linked below.

In the case of requests for information and the assertion of user rights, we would also like to point out that these can be asserted most effectively with the providers. Only the providers have access to the users' data and can take appropriate measures and provide information directly. If you still need help, you can contact us.

• Facebook (Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) - Privacy Policy: https://de-de.facebook.com/privacy/policy/
• Instagram (Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025, USA) - Privacy policy: https://privacycenter.instagram.com/policy/

13. additional information on the processing of payments in the context of placing orders/orders

PayPal

We use the PayPal payment service of PayPal (Europe) S.à.r.l. et Cie, S.C.A. (22-24 Boulevard Royal L-2449, Luxembourg; "PayPal") on our websites and our online stores. The data processing serves the purpose of being able to offer you payment via the payment service. With the selection and use of payment via PayPal, the data required for payment processing is transmitted to PayPal in order to be able to fulfill the contract with you with the selected payment method. This processing is based on Art. 6 para. 1 lit. b DSGVO. All PayPal transactions are subject to the PayPal privacy policy. You can find this at https://www.paypal.com/de/webapps/mpp/ua/privacy-full.

PayPal Express

We use the PayPal Express payment service of PayPal (Europe) S.à.r.l. et Cie, S.C.A. (22-24 Boulevard Royal L-2449, Luxembourg; "PayPal") on our websites and our online stores. The data processing serves the purpose of being able to offer you payment via the PayPal Express payment service. To integrate this payment service, it is necessary for PayPal to collect, store and analyze data (e.g. IP address, device type, operating system, browser type, location of your device) when you call up the website. Cookies may also be used for this purpose. The cookies enable the recognition of your browser.

The processing of your personal data is based on Art. 6 (1) lit. f DSGVO from our overriding legitimate interest in a customer-oriented offer of various payment methods. You have the right to object to this processing of personal data relating to you at any time for reasons arising from your particular situation.

With the selection and use of PayPal Express, the data required for payment processing is transmitted to PayPal in order to be able to fulfill the contract with you with the selected payment method. This processing is based on Art. 6 para. 1 lit. b DSGVO. For more information on data processing when using the payment service PayPal Express, please refer to the associated privacy policy at www.paypal.com/de/webapps/mpp/ua/privacy-full.

PayPal Check-Out

We use the PayPal Check-Out payment service of PayPal (Europe) S.à.r.l. et Cie, S.C.A. (22-24 Boulevard Royal L-2449, Luxembourg; "PayPal") on our websites and our online stores. The data processing serves the purpose of being able to offer you payment via the payment service. With the selection and use of payment via PayPal, credit card via PayPal, direct debit via PayPal or "Pay Later" via PayPal, the data required for payment processing is transmitted to PayPal in order to be able to fulfill the contract with you with the selected payment method. This processing is based on Art. 6 para. 1 lit. b DSGVO.

Credit card via PayPal, direct debit via PayPal & "Pay later" via PayPal.

For individual payment methods such as credit card via PayPal, direct debit via PayPal or "Pay later" via PayPal, PayPal reserves the right to obtain credit information on the basis of mathematical-statistical methods using credit agencies, if necessary. For this purpose, PayPal transmits the personal data required for a credit check to a credit agency and uses the information received about the statistical probability of a payment default for a weighed decision on the establishment, implementation or termination of the contractual relationship. The credit information may include probability values (score values), which are calculated on the basis of scientifically recognized mathematical-statistical methods and in the calculation of which, among other things, address data are included. Your interests worthy of protection are taken into account in accordance with the statutory provisions. The data processing serves the purpose of credit assessment for a contract initiation. The processing is carried out on the basis of Art. 6 (1) lit. f DSGVO for our overriding legitimate interest in protecting against payment default when PayPal makes advance payments.

You have the right to object at any time to this processing of personal data relating to you based on Art. 6 (1) (f) DSGVO for reasons arising from your particular situation by notifying PayPal. The provision of the data is necessary for the conclusion of the contract with the payment method requested by you. Failure to provide it will result in the contract not being concluded with the payment method you have chosen.

For more information on data processing when using the PayPal Check-Out service, please refer to the associated privacy policy at www.paypal.com/de/webapps/mpp/ua/privacy-full.

Third-party providers via PayPal

When paying via the payment method of a third-party provider, the data required for payment processing is transmitted to PayPal. This processing takes place on the basis of Art. 6 para. 1 lit. b DSGVO. For the execution of this payment method, the data may then be forwarded by PayPal to the respective provider. This processing takes place on the basis of Art. 6 para. 1 lit. b DSGVO. Local third-party providers may be, for example:

- Sofort (SOFORT GmbH, Theresienhöhe 12, 80339 Munich, Germany).

- giropay (Paydirekt GmbH, Stephanstr. 14-16, 60313 Frankfurt am Main, Germany)

Purchase on account via PayPal

When paying via the payment method purchase on account, the data required to process the payment is first transmitted to PayPal. For the execution of this payment method, the data is then transmitted by PayPal to Ratepay GmbH (Franklinstraße 28-29, 10587 Berlin; "Ratepay") in order to be able to fulfill the contract with you with the selected payment method. This processing is based on Art. 6 para. 1 lit. b DSGVO. If necessary, Ratepay carries out a credit check on the basis of mathematical-statistical procedures (probability or score values) using credit agencies according to the procedure already described above. The data processing serves the purpose of credit assessment for a contract initiation. The processing is carried out on the basis of Art. 6 (1) lit. f DSGVO from our overriding legitimate interest in protecting against payment default when Ratepay makes advance payments. For more information on data protection and which credit agencies Ratpay uses, please visit https://www.ratepay.com/legal-payment-dataprivacy/ and https://www.ratepay.com/legal-payment-creditagencies/.

Klarna payment options

We use the payment service of Klarna Bank AB (publ) (Sveavägen 46, 111 34 Stockholm, Sweden; "Klarna") on our websites and online stores. With the selection and use of payment via Klarna, the data required for payment processing is transmitted to Klarna in order to be able to fulfill the contract with you with the selected payment method. This processing is based on Art. 6 para. 1 lit. b DSGVO.

"Pay Later" (invoice), "Pay Now" (payment by direct debit), "Financing" (installment purchase).

For individual payment methods such as "Pay Later" (invoice), "Pay Now" (payment by direct debit), "Financing" (installment purchase), Klarna reserves the right, if necessary, to obtain credit information on the basis of mathematical-statistical methods using credit agencies.

For this purpose, Klarna transmits the personal data required for a credit check, such as first and last name, address, gender, e-mail address, IP address and data related to the order for the purpose of identity and credit assessment to a credit agency and uses the information received about the statistical probability of non-payment for a weighted decision on the establishment, implementation or termination of the contractual relationship. The credit information may include probability values (score values), which are calculated on the basis of scientifically recognized mathematical-statistical methods and in the calculation of which, among other things, address data are included. Your interests worthy of protection are taken into account in accordance with the statutory provisions. The data processing serves the purpose of credit assessment for a contract initiation. The processing is carried out on the basis of Art. 6 (1) lit. f DSGVO for our overriding legitimate interest in protection against payment default when Klarna makes advance payments. You have the right to object at any time to this processing of personal data concerning you based on Art. 6 (1) (f) DSGVO for reasons arising from your particular situation by notifying Klarna. The provision of the data is necessary for the conclusion of the contract with the payment method requested by you. Failure to provide it will result in the contract not being concluded with the payment method you have chosen.

Further information, in particular to which credit agencies Klarna passes on your personal data, can be found for Germany at https://cdn.klarna.com/1.0/shared/content/legal/terms/0/de_de/credit_rating_agencies and for Austria at https://cdn.klarna.com/1.0/shared/content/legal/terms/0/de_at/credit_rating_agencies.

Your personal data will be treated by Klarna in accordance with the applicable data protection regulations and as specified in Klarna's data protection policy for Germany under https://cdn.klarna.com/1.0/shared/content/legal/terms/0/de_de/privacy and for Austria under https://cdn.klarna.com/1.0/shared/content/legal/terms/0/de_at/privacy.

SOFORT

We use the payment service provider SOFORT GmbH, (Theresienhöhe 12, 80339 Munich, Germany; "SOFORT") for payment processing on our websites and online stores. Sofort GmbH is a company of the Klarna Group (Klarna Bank AB (publ), Sveavägen 46, 11134 Stockholm, Sweden). The data processing serves the purpose of being able to offer you various payment methods through the payment processing via the payment service provider SOFORT. If you have chosen the payment option, the data required for payment processing will be transmitted to SOFORT. This data processing is based on Art. 6 para. 1 lit. b DSGVO. For more information on data processing when using the payment service provider SOFORT, please visit https://www.sofort.com/1.0/shared/content/legal/terms/de-DE/SOFORT/.

Amazon Payments

We use the payment service Amazon Pay of Amazon Payments Europe s.c.a., 38 avenue J.F. Kennedy, L-1855 Luxembourg (hereinafter: "Amazon Payments") on our websites and online stores. With the selection and use of payment via Amazon Payments, the data required for payment processing is transmitted to Amazon Payments in order to be able to fulfill the contract with you with the selected payment method. This processing is based on Art. 6 para. 1 lit. b DSGVO. The transfer of your data takes place exclusively for the purpose of payment processing with the payment service provider Amazon Payments and only insofar as it is necessary for this purpose. For more information on data processing when using the Amazon Payments service, please visit: https://pay.amazon.de/help/201212490.

Apple Pay

We use the payment service Apple Pay of Apple Inc, Infinite Loop, Cupertino, CA 95014, telephone: +1 408 996 1010, represented in Europe by Apple Operations Europe, Hollyhill Industrial Estate, Hollyhill, Cork, Republic of Ireland (hereinafter "Apple Pay") on our websites and online stores. With the selection and use of payment via Apple Pay, the data required for payment processing is transmitted to Apple Pay in order to be able to fulfill the contract with you with the selected payment method. This processing takes place on the basis of Art. 6 para. 1 lit. b DSGVO. The transfer of your data takes place exclusively for the purpose of payment processing with the payment service provider Apple Pay and only insofar as it is necessary for this purpose. For more information on data processing when using the Apple Pay service, please visit: https://support.apple.com/de-de/HT201469, https://support.apple.com/de-de/HT203027 and https://www.apple.com/legal/privacy/de-ww/

Shopify Payments and Shop Pay

We use the Shopify Payments payment service of Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland ("Shopify Payments") on our websites and online stores. With the selection and use of payment via Shopify Payments as well as the Shop Pay function, the data required for payment processing is transmitted to Shopify in order to be able to fulfill the contract with you with the selected payment method. This processing takes place on the basis of Art. 6 para. 1 lit. b DSGVO. The transfer of your data takes place exclusively for the purpose of payment processing with the payment service provider Shopify Payments and only insofar as it is necessary for this purpose. For more information on data processing when using the Shopify Payments service, please visit: https://www.shopify.com/payments, https://help.shopify.com/en/manual/payments/shopify-payments,https://www.shopify.de/legal/datenschutz and https://help.shopify.com/de/manual/payments/shop-pay.

14 Newsletter

You will only receive our newsletter if you give us your consent in accordance with Art. 6 Para. 1 lit. a DSGVO, i.e. you agree to receive our newsletter. For sending the newsletter, we use the service provider Mailchimp of Rocket Science Group LLC, 675 Ponce De Leon Ave NE, Suite 5000, Atlanta, GA 30308, USA.

Mailchimp is a service with which, among other things, the dispatch of newsletters can be organized and analyzed. The legal basis for the use of Mailchimp is your consent pursuant to Art. 6 (1) lit. a DSGVO. When you enter your data for the purpose of receiving our newsletter (usually your email address), this data is stored on Mailchimp's servers in the USA. With the help of Mailchimp, we can analyze our newsletter campaigns. When you open an email sent with Mailchimp, a file contained in the email (known as a web beacon) connects to Mailchimp's servers in the USA. This makes it possible to determine whether a newsletter message has been opened and which links, if any, have been clicked. In addition, technical information is recorded (e.g. time of retrieval, IP address, browser type and operating system). This information cannot be assigned to the respective newsletter recipient. It is used exclusively for the statistical analysis of newsletter campaigns. The results of these analyses can be used to better adapt future newsletters to the interests of the recipients.

If you do not agree with this analysis by Mailchimp, you can revoke your consent at any time and unsubscribe from our newsletter. For this purpose, we provide you with a corresponding link in each newsletter. The legality of data processing operations that have already taken place remains unaffected by the revocation. The data you have provided to us for the purpose of receiving the newsletter will be stored by us or the newsletter service provider until we receive your revocation and your unsubscription from the newsletter and will be deleted from the newsletter distribution list after you have unsubscribed from the newsletter. Data that has been stored by us for other purposes remains unaffected by this.

15. cloud services

We use software services accessible via the Internet and running on the servers of their providers (so-called "cloud services", also referred to as "software as a service"), e.g. "Microsoft Teams" or "Microsoft 365" for the following purposes: exchange of documents, content and information with specific recipients or for authenticated and 2-factor secured login of users as well as chats and participation in audio and video conferences.

In this context, personal data may be processed and stored on the servers of the providers to the extent that these are components of communication processes with us or are otherwise processed by us as set out in the context of this privacy policy. This data may include, in particular, master data and contact data of users, data on transactions, contracts, other processes and their contents. Cloud service providers also process usage data and metadata used by them for security purposes and service optimization. In this context, personal data may be transferred to the cloud service providers in insecure third countries such as the USA. For this reason, we have concluded the EU standard contractual clauses with the providers to ensure a sufficient level of data protection.

Insofar as we use the cloud services to provide forms or other documents and content for other users or publicly accessible websites, the providers may store cookies on the users' devices for the purposes of web analytics or to remember users' settings (e.g. in the case of media control).

Notes on legal bases: If we ask for consent to use the cloud services, the legal basis of the processing is consent pursuant to Art. 6 (1) lit. a DSGVO. Furthermore, their use may be a component of our (pre)contractual services pursuant to Art. 6 (1) lit. b DSGVO, provided that the use of the cloud services has been agreed within this framework. Otherwise, user data is processed on the basis of our legitimate interests pursuant to Art. 6 (1) lit. f DSGVO (i.e., interest in efficient and secure management and collaboration processes).

Types of data processed: inventory data (e.g., names, addresses), contact data (e.g., email, phone numbers), content data (e.g., text input, photographs, videos), usage data (e.g., websites visited, interest in content, access times), meta/communication data (e.g., device information, IP addresses).

Data subjects: Customers, employees (e.g. employees, applicants, former employees), prospective customers, communication partners.

Purposes of processing: office and organizational procedures.

Legal basis: consent (Art. 6 para. 1 p. 1 lit. a DSGVO), contract performance and pre-contractual inquiries (Art. 6 para. 1 p. 1 lit. b. DSGVO), legitimate interests (Art. 6 para. 1 p. 1 lit. f. DSGVO), consent according to Art. 6 para. 1 lit. a DSGVO in case of transfer to servers in the USA.

Services used and service providers:

Microsoft Cloud Services: cloud storage services; service providers: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399 USA; website: microsoft.com/en-en; security information: www.microsoft.com/de-de/trustcenter.

16. rights of use imprint data

We expressly object to the use of our contact data, published within the framework of the imprint obligation, by third parties for the purpose of sending unsolicited advertising and information material.

We expressly reserve the right to take legal action in the event of the unsolicited sending of advertising information, for example through spam mails.

17. creation

This declaration has been prepared in cooperation with:

Dapro Serv GmbH Phone : +49 (0) 241-55967796

Auf der Hüls 128 E-mail : info@daproserv.com

52068 Aachen Web : www.daproserv.com