Privacy

Data protection information

1. Controller; data protection officer

The controller within the meaning of the EU General Data Protection Regulation (GDPR) and other national data protection laws of the Member States, as well as other data protection provisions, is:

Captiva GmbH
Siemensstr. 9
85221 Dachau
Germany
Tel.: +49 8131 5695-0
Fax: +49 8131 5695-500
E-mail: info@ecom-trading.de

The controller's data protection officer can be reached by e-mail at datenschutz@captiva-power.com and at the following postal address:

CB ADDATA GmbH
Christian Bößl
Reitmeierfeld 23
94099 Ruhstorf a.d. Rott
Telephone: +49 8531 978 447 0

2. General information on data processing

1. Description and scope of data processing

As a matter of principle, we process our users' personal data only in so far as this is necessary to provide a functioning website and our content and services.

2. Legal basis for processing personal data

In so far as we obtain the consent of the data subject for processing operations involving personal data, Art. 6(1)(a) GDPR serves as the legal basis.

Where personal data are processed because this is necessary for the performance of a contract to which the data subject is party, Art. 6(1)(b) GDPR serves as the legal basis. This also applies to processing operations that are necessary in order to carry out pre-contractual measures.

In so far as processing of personal data is necessary for compliance with a legal obligation to which our company is subject, Art. 6(1)(c) GDPR serves as the legal basis.

If processing is necessary to safeguard a legitimate interest of our company or of a third party, and if the interests, fundamental rights and freedoms of the data subject do not override the first-mentioned interest, then Art. 6(1)(f) GDPR serves as the legal basis for the processing. If you have questions about this balancing of interests, you can contact us or our data protection officer at any time.

3. Recipients

As a matter of principle we pass your personal data on to other recipients only where this is necessary in order to fulfil the purposes described, where you have given us your consent to do so, or where we are entitled or obliged to do so by law or on the basis of a court or official order. In general, the following recipients in particular may be involved:

• External service providers (e.g. IT, marketing, printing, logistics, debt collection, disposal of files and data media
• Public authorities (e.g. tax authorities, courts, public prosecutors)
• Potential and actual acquirers of the company

4. Transfer of personal data to third countries

As a matter of principle, your personal data are processed in Germany and elsewhere in Europe. If, by way of exception, your personal data are processed in countries outside the European Union or the European Economic Area (so-called third countries), this takes place only in so far as specific safeguards ensure that an adequate level of data protection exists for this. We typically take the following safeguards:

• Adequacy decision of the EU Commission for recipients in Andorra, Argentina, Canada, the Faroe Islands, Guernsey, Israel, the Isle of Man, Japan, Jersey, New Zealand, South Korea, Switzerland, Uruguay, and in the United Kingdom of Great Britain and Northern Ireland (further information at https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en)
• Standard contractual clauses pursuant to Art. 46(2) GDPR for other recipients (further information at https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en)
• Derogations pursuant to Art. 49 GDPR for other recipients.

5. Erasure of data and storage period

The personal data of the data subject are erased or blocked as soon as the purpose of storage ceases to apply. The periods necessary for this are assessed by careful consideration, in the course of which we examine closely whether the data processing is necessary:

• If we process your personal data on the basis of your consent, we do so at most until you withdraw your consent.
• If we process your personal data on the basis of our legitimate interests, we do so at most until you lodge a justified objection.
• Data may also be stored beyond this where the European or national legislator has provided for it in Union regulations, laws or other provisions to which the controller is subject. Data are blocked or erased when a storage period prescribed by the standards named expires, unless there is a need for the data to be stored further for the conclusion or performance of a contract. The most important statutory retention obligations arise from Section 257 of the German Commercial Code (HGB) and Section 147 of the German Fiscal Code (AO) and are six and ten years respectively. Statutory limitation periods under Sections 195 et seq. of the German Civil Code (BGB) can be up to thirty years, the standard limitation period being three years.

These data protection notices may contain more detailed information for individual cases.

6. Voluntary provision of data or obligation to provide it

As a matter of principle you only have to provide us with the personal data that are necessary for the respective processing purpose. If you do not provide necessary data (for example data required for the conclusion of a contract, or data required by law), the respective processing purpose may not be achievable. This may mean, for example, that a contract cannot be concluded or that certain services cannot be provided.

7. Origin of your personal data

For the most part we process personal data that we receive directly from you.

If, by way of exception, we process personal data that we have not received directly from you, this concerns data that we lawfully obtain from publicly accessible sources (e.g. the internet, the press, commercial and association registers) or that are made available to us lawfully by third parties.

3. Applications and the application process

1. Description and scope of data processing

We collect and process applicants' personal data for the purpose of handling the application process. Processing may also take place electronically. This is the case in particular where an applicant submits the relevant application documents electronically, for example by e-mail. As a matter of principle we process only the data that are necessary in order to carry out the application process, such as:

• Surname, first name
• E-mail address
• Telephone number
• Possible start date
• Salary expectations
• Details of career history and qualifications

Please note that unencrypted e-mail is generally not a secure means of communication for applications. We recommend that applicants send them as encrypted e-mail.

2. Legal basis for processing personal data

The legal basis for processing applicant data is Art. 6(1)(b) GDPR.

Where longer storage of the application documents beyond the specific application process is desired — so that the application can also be considered for other positions with us, for instance — the legal basis for this is consent pursuant to Art. 6(1)(a) GDPR (in conjunction with Section 26(2) BDSG).

3. Purpose of the data processing

Personal data are processed exclusively in order to carry out the application process.

4. Sources of personal data in applications

In so far as we receive applications, and with them personal data, via external recruitment service providers, we process personal data from that source accordingly.

5. Storage period, right to object and right to have data removed

If the controller concludes a contract of employment with an applicant, the data submitted are stored for the purpose of handling the employment relationship, in compliance with the statutory provisions. If the controller does not conclude a contract of employment with the applicant, the application documents are erased automatically six months after notification of the rejection decision, provided that the data subject has not consented to longer storage and that no other legitimate interests of the controller prevent erasure. Another legitimate interest in this sense is, for example, an obligation to provide evidence in proceedings under the German General Equal Treatment Act (AGG).

If an applicant decides to object to the processing of their personal data, this may make it more difficult to carry out the application process.

4. Provision of the website and creation of log files

1. Description and scope of data processing

Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing device.

The following data are collected in the process:

• the user's browser type/version;
• the user's operating system;
• the user's IP address/internet service provider;
• date/time of access;
• websites from which the user's system reaches our website;
• websites accessed by the user's system via our website.

The data are stored in our system's log files. These data are not stored together with other personal data of the user.

2. Legal basis for processing personal data

The legal basis for the temporary storage of the data and the log files is Art. 6(1)(f) GDPR.

3. Purpose of the data processing

Temporary storage of the IP address by the system is necessary in order to enable the website to be delivered to the user's device. For this, the user's IP address has to remain stored for the duration of the session.

Storage in log files takes place in order to ensure that the website functions properly. The data also help us to optimise the website and to ensure the security of our information technology systems. The data are not evaluated for marketing purposes in this context.

These purposes also constitute our legitimate interest in the data processing pursuant to Art. 6(1)(f) GDPR.

4. Storage period, right to object and right to have data removed

The data are erased as soon as they are no longer necessary to achieve the purpose for which they were collected. Where data are collected in order to provide the website, this is the case when the respective session has ended.

Where the data are stored in log files, this is the case after seven days at the latest. Storage beyond that is possible. In that case the users' IP addresses are erased or obscured, so that the accessing client can no longer be identified.

Collecting the data in order to provide the website, and storing the data in log files, is absolutely necessary for the operation of the website. Consequently the user has no right to object in this respect.

5. Newsletter; product recommendations for similar goods; direct advertising by post

1. Newsletter

1.1. Description and scope of the data processing

On our website you have the option of subscribing to a free newsletter with which we inform you about our current offers of interest. The only mandatory detail for sending the newsletter is your e-mail address. Providing further, separately marked data is voluntary and is used so that we can address you personally.

For registration for our newsletter we use the so-called double opt-in procedure. This means that after you have registered we send an e-mail to the e-mail address you have given, in which we ask you to confirm that you wish to receive the newsletter. You have to confirm your registration within 24 hours in order to activate it. In addition, we store the IP addresses you used and the times of registration and confirmation. The purpose of the procedure is to be able to prove your registration and, where applicable, to investigate possible misuse of your personal data.

After your confirmation we store your e-mail address for the purpose of sending you the newsletter.

1.2. Legal basis for the data processing

We send you our newsletter on the basis of your consent, Art. 6(1)(a) GDPR.

The legal basis for the data processing within the double opt-in procedure and in connection with proof of your consent is Art. 6(1)(c) in conjunction with Art. 5(1)(a), Art. 5(2), Art. 7(1) GDPR and Art. 6(1)(f) GDPR.

1.3. Purpose of the data processing

The e-mail address is collected in order to deliver the newsletter correctly. Other personal data collected during the registration process serve to prevent misuse and to prove your consent.

These purposes also constitute our legitimate interest in the data processing pursuant to Art. 6(1)(f) GDPR.

1.4. Storage period, right to object and right to have data removed

The data are erased as soon as they are no longer necessary to achieve the purpose for which they were collected. The user's e-mail address is stored for as long as the newsletter subscription is active.

The subscription can be cancelled by the user concerned at any time with future effect, by withdrawing the consent given. For this purpose there is, in particular, an unsubscribe link at the end of every newsletter. A user can, however, also contact us directly by other means in order to unsubscribe from the newsletter (e.g. by e-mail to info@captiva-power.de ).

If you unsubscribe from our newsletter or withdraw your consent, you are removed from our newsletter distribution list without delay and your personal data are erased. We may, however, store your e-mail address and the proof of your consent, in our interest in and for the purpose of proving your consent and in order to defend against possible claims, for the duration of the statutory limitation period, i.e. three years.

If you do not confirm your registration for our newsletter within 24 hours under the double opt-in procedure, your information is deleted automatically.

2. Product recommendations for similar goods

2.1. Description and scope of the data processing

In addition to handling the contract, we use the e-mail address you provided in connection with the purchase of goods or services in order to inform you regularly by e-mail, as direct advertising, about our own similar goods. This happens irrespective of whether you have subscribed to the newsletter or not.

2.2. Legal basis for the processing

The legal basis for sending product recommendation e-mails following the sale of goods or services is Art. 6(1)(f) GDPR in conjunction with Section 7(3) UWG (German Act Against Unfair Competition).

2.3. Purpose of the data processing

The user's e-mail address is collected in order to deliver relevant product recommendation e-mails.

These purposes also constitute our legitimate interest in the data processing pursuant to Art. 6(1)(f) GDPR.

2.4. Storage period, right to object and right to have data removed

The data are erased as soon as they are no longer necessary to achieve the purpose for which they were collected.

You can object to the use of your e-mail address for sending product information at any time, without incurring any costs other than the transmission costs at basic rates. You can lodge your objection by clicking the link provided in every product recommendation e-mail or by e-mail to info@captiva-power.de.

3. Direct advertising by post

3.1. Description and scope of the data processing

We use the postal address you provided (together with your name) in connection with the purchase of goods or services in order to inform you regularly by letter as direct advertising (for example to send you offers of interest and information about our products).

3.2. Legal basis for the processing

The legal basis for direct advertising by post is Art. 6(1)(f) GDPR.

3.3. Purpose of the data processing

Your name and address are also collected in order to send you direct advertising by post. Under Recital 47 GDPR, the processing of personal data for direct marketing purposes may be regarded as processing carried out for a legitimate interest. In this context it should be borne in mind in particular that a customer relationship exists between you and us as a result of your purchase, and that we therefore have a legitimate interest in continuing to inform you about current offers.

These purposes also constitute our legitimate interest in the data processing pursuant to Art. 6(1)(f) GDPR.

3.4. Storage period, right to object and right to have data removed

The data are erased as soon as they are no longer necessary to achieve the purpose for which they were collected.

You can object to this form of direct advertising by post at any time. You can lodge your objection by e-mail to info@captiva-power.de or by sending a message (e.g. fax or letter) to the contact details given in this data protection information.

6. Forms and contact by e-mail

1. Description and scope of data processing

When you contact us via a form on our website or by e-mail, the data you provide (your e-mail address and, where applicable, further data you give) are transmitted to us and stored by us. The data are not passed on to third parties in this context. The data are used exclusively in order to process the conversation.

If and in so far as this is necessary for the initiation, establishment, performance and/or termination of a legal transaction with our company, we process your personal data further. If the data processing is necessary for the conclusion of a contract, then failure to provide the data may make the conclusion, performance and/or termination of a legal transaction with our company impossible.

2. Legal basis for processing personal data

The legal basis for processing the data transmitted in the course of making contact is also Art. 6(1)(f) GDPR.

If the purpose of the contact is to conclude a contract, then Art. 6(1)(b) GDPR is an additional legal basis for the processing.

3. Purpose of the data processing

The personal data from the input form are processed solely in order to deal with your enquiry. We cannot answer your enquiries if you do not provide us with your personal data. The other personal data processed while the form is being submitted serve to prevent misuse of the contact form.

These purposes also constitute our legitimate interest in the data processing pursuant to Art. 6(1)(f) GDPR.

4. Storage period, right to object and right to have data removed

We erase the data arising in this context once storage is no longer necessary, or we restrict the processing if statutory retention obligations exist.

You can object to the processing. Your right to object exists on grounds relating to your particular situation. You can send us your objection using the contact details given in the section „Responsible provider“.

7. Use of cookies and similar technologies

1. Description and scope of data processing

Our website uses technologies with which information can be stored on your device (e.g. computer, notebook, mobile telephone), or which enable access to information already stored on your device. If a user calls up a website, for example, a cookie may be stored on the user's operating system. This cookie may contain a characteristic string of characters that allows the browser to be identified uniquely when the website is called up again. In this way the following data, for example, can be transmitted in pseudonymised form:

• frequency of page views
• use of website functions

Some elements of our site require the calling user to be identifiable even after moving to another page. This website uses various types of cookies. When our website is called up, users are informed about the use of these technologies by an information banner.

The storage of information on your device, or access to information already stored on your device, generally takes place only on the basis of consent given by you (Section 25(1) TTDSG). Without your consent, information is stored on your device, or information already stored on your device is accessed, only where this is strictly necessary in order to provide a telemedia service expressly requested by you (Section 25(2) TTDSG).

2. Legal basis for processing personal data

The legal basis for processing personal data using cookies is legitimate interests, Art. 6(1)(f) GDPR. In so far as we use cookies for statistical or marketing purposes, this takes place exclusively on the basis of your consent, Art. 6(1)(a) GDPR.

3. Purpose of the data processing

Cookies and similar technologies serve (1) to enable us to provide this website and the functions fundamentally necessary for this website, (2) to analyse the use of our website (e.g. which pages were visited most often) in order to make the website more user-friendly, (3) to enable personalised advertising to be shown, and (4) to enable us to measure the success of our marketing activities. The settings in the Privacy Settings.

4. Storage period, right to object and right to have data removed

The operating period of cookies and similar technologies generally depends on your visit to our website, i.e. cookies are deleted when you leave our website, for instance (so-called „session cookies“). The operating period of cookies and similar technologies may also be governed by a set expiry date. The operating period of cookies and similar technologies requiring consent ends in every case when you withdraw your consent. If you withdraw your consent, the lawfulness of the storage of information on your device, or of access to information already stored on your device, up to the point of withdrawal is not affected. If you do not accept cookies and similar technologies requiring consent, you suffer no disadvantage as a result. There is no obligation to give consent to cookies and similar technologies requiring consent.

You will find further details of the cookies and similar technologies we use via „Cookie Details“ in the Privacy Settings.

By changing the settings in your internet browser you can disable or restrict the transmission of cookies. Cookies already stored can be deleted at any time. This can also happen automatically, by setting the maximum storage period in your browser settings. If cookies are disabled for our website, it may no longer be possible to use all the functions of the website to their full extent.

The following links will help you to set your browser to refuse or accept cookies in the most commonly used browsers:

• Internet Explorer / Windows Edge: http://windows.microsoft.com/de-de/windows-vista/block-or-allow-cookies
• Mozilla Firefox: https://support.mozilla.org/de/kb/cookies-erlauben-und-ablehnen
• Google Chrome: https://support.google.com/chrome/answer/95647?hl=de
• Safari: https://support.apple.com/de-de/guide/deployment/depf7d5714d4/web
• Opera: http://help.opera.com/Windows/10.20/de/cookies.html

8. Further plugins and tools

1. Web analytics tools, Google Analytics

1.1. Description and scope of the data processing

On our website we use Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter: Google), in order to evaluate the use of our website and to compile reports on website activity from it. With the help of this web analysis we can see, for example, at what time our website is visited, which functions or content are used most often, and in which areas our website needs to be optimised.

1.2. Legal basis for processing personal data

The legal basis for processing users' personal data is consent, Art. 6(1)(a) GDPR.

1.3. Purpose of the data processing

We use Google Analytics in order to be able to analyse the use of our website and improve it regularly. The statistics obtained allow us to improve what we offer and make it more interesting for you as a user.

1.4. Storage period, right to object and right to have data removed

The processed data are erased as soon as they are no longer necessary to achieve the purpose. With Google Analytics this is the case after 14 months.

You can withdraw your consent at any time with future effect. Your consent can be withdrawn via the Privacy Settings. If you withdraw your consent, your data are no longer used for the purposes named and your personal data are erased. The lawfulness of the processing carried out on the basis of the consent up to the withdrawal is not affected.

As already mentioned, you can prevent cookies from being stored by setting your browser software accordingly; we point out, however, that in this case you may not be able to use all the functions of this website to their full extent. You can also prevent the data generated by the cookie and relating to your use of the website (including your IP address) from being collected by Google, and prevent Google from processing these data, by downloading and installing the browser add-on available at the following link: http://tools.google.com/dlpage/gaoptout?hl=de.

You can also prevent the data generated by the cookie and relating to your use of the website (including your IP address) from being collected by Google, and prevent Google from processing these data, by not giving your consent to the setting of the cookie.

1.5. Cross-device analysis

This website also uses Google Analytics for a cross-device analysis of visitor flows. In your Google account, under „My data“, „personal data“, you can disable the cross-device analysis of your use.

1.6. Demographic characteristics

This website uses the „demographic characteristics“ function of Google Analytics. This makes it possible to produce reports containing statements about the age, gender and interests of site visitors. These data come from interest-based advertising by Google and from visitor data supplied by third parties. These data cannot be attributed to any specific person. You can disable this function at any time via the ad settings in your Google account, or prohibit the collection of your data by Google Analytics altogether, as described under „Objection to data collection“.

2. Embedding of YouTube videos

We have embedded YouTube videos in our online offering which are stored on http://www.YouTube.com and can be played from our website. If you have consented to data about you being processed and stored by embedded YouTube elements, that consent serves as the legal basis for the data processing, Art. 6(1)(a) GDPR.

By visiting the website, YouTube receives the information that you have called up the relevant sub-page of our website. In addition, the data named under III. of this statement are transmitted. This happens irrespective of whether YouTube provides a user account through which you are logged in, or whether no user account exists. If you are logged in to your Google account, your data are attributed directly to your account. If you do not want them attributed to your profile at YouTube, you have to log out before activating the button. YouTube stores your data as usage profiles and uses them for the purposes of advertising, market research and/or designing its website to meet demand. Such an evaluation is carried out in particular (even for users who are not logged in) in order to provide advertising that meets demand and to inform other users of the social network about your activities on our website. You have a right to object to the creation of these user profiles, and in order to exercise it you must contact YouTube.

You will find further information on the purpose and scope of the data collection and its processing by YouTube in the privacy policy. There you will also find further information on your rights and the settings available to protect your privacy: https://www.google.de/intl/de/policies/privacy.

3. Social media, fan pages

3.1. Description and scope of the data processing

We operate so-called „fan pages“ on various platforms so that we can also present ourselves through such company pages.

In some cases we use the analysis facilities made available by the service providers in order to obtain statistical evaluations („insights“). Different cookies and similar technologies may be used by the various service providers for this. We have no direct knowledge of the visitor's identity. In so far as you are registered with a user account at the respective service provider, the platform operators can link your data to that user account and process them for their own purposes.

As the operator of the following pages, we are joint controllers together with the respective service providers within the meaning of Art. 4(7) GDPR.

• Facebook, provided by Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin, D02, Ireland (hereinafter: Facebook);
• Google LLc., 1600 Amphitheatre Parkway Mountain View, CA 94043, USA, (hereinafter: Youtube);
• Instagram, provided by Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin, D02, Ireland (hereinafter: Instagram);
• X Corp., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA (hereinafter: X);

The following information applies:

• Facebook: Facebook's terms of use can be accessed at https://www.facebook.com/legal/terms. You will find information on Facebook's data protection at https://www.facebook.com/privacy/center/ and https://www.facebook.com/legal/terms/page_controller_addendum;
• Youtube: YouTube's terms of use can be accessed at https://www.youtube.com/t/terms. You will find information on YouTube's data protection at https://policies.google.com/privacy;
• Instagram: Instagram's terms and conditions can be accessed at https://help.instagram.com/581066165581870/. You will find information on Instagram's data protection at https://www.instagram.com/accounts/privacy_and_security/;
• X: X's terms and conditions can be accessed at https://twitter.com/de/tos. You will find information on X's data protection at https://twitter.com/de/privacy;

The following data, among others, may be processed in this context:

• IP addresses
• device- and browser-related data
• usage-related information
• location data

On our website, social media buttons from these social networks are used in some places. In order to increase the protection of your data when you visit our website, these buttons are not embedded without restriction as plugins, but only using an HTML link. This form of embedding ensures that when a page of our website containing such buttons is called up, no connection is yet established with the servers of the service provider of the respective social network.

If you click one of the buttons, a new window of your browser opens and calls up the page of the respective service provider, on which you can (where applicable after entering your login details) press the Like or Share button, for example.

3.2. Legal basis for processing personal data

The legal basis for the data processing is the legitimate interest under Art. 6(1)(f) GDPR. It is our legitimate interest to be able to present ourselves through our respective fan page and to use insights to analyse how our fan page is used.

3.3. Purpose of the data processing

The purpose of the Facebook fan page is to present our company on Facebook and to analyse the use of our Facebook fan page, so that we can design and optimise it to meet demand on the basis of what we learn. In order to promote our business objectives better, the service providers may also make demographic and geographic evaluations available to us, which we can use in order to place interest-based advertisements. If you are registered with the respective platform, a cross-device evaluation may also take place.

The service providers use some of the information in order to distribute and improve their advertising system on the respective platform.

3.4. Right to object and right to have data removed

You can object to the data processing at any time.

Facebook: As a user you can influence the extent to which your user behaviour may be recorded under the settings for advertising preferences. Further ways of objecting are offered by the settings (available at https://www.facebook.com/settings) or by the form for exercising the right to object provided by Facebook (available at https://www.facebook.com/help/contact/612141586937373).

Youtube: As a user, processing by YouTube can be objected to via the settings in your account (available at https://adssettings.google.com/authenticated) . You will find more information on how to adjust the privacy settings in the help section (available at https://support.google.com/youtube/topic/9257518?hl=de&ref_topic=9257107,3230811,3256124,&sjid=14435722167943552034-EU).

Twitter: Processing by Twitter can be objected to in part. You will find more information on this in the help centre (available at https://help.twitter.com/de/safety-and-security/privacy-controls-for-tailored-ads).

3.5. Further information

Facebook is the primary point of contact for exercising data subject rights, in so far as Facebook, as the provider of the social network, is the only party with direct access to the necessary information and can take any necessary measures and provide information. If our support should nevertheless be required, we can be contacted at any time.

You can assert your data subject rights regarding our YouTube channel against us and against Google.

4. Google Tag Manager

On our website we use "Google Tag Manager", a service provided by Google Ireland Limited, Google Building Gordon House, Barrow St, Dublin 4, Ireland (hereinafter referred to as "Google"). Google Tag Manager allows us as marketers to manage website tags through a single interface. The Google Tag Manager tool is a domain via which tags (a JavaScript tag, for example) are implemented. Google Tag Manager triggers other tags, which may in turn collect data. Google Tag Manager does not access data processed by the tags that are loaded. Cookies implemented with Google Tag Manager can be managed via the cookie banner. Where something has been disabled, that setting remains in place for the respective tracking tags. Information about the third-party provider: Google Ireland Limited, Google Building Gordon House, Barrow St, Dublin 4, Ireland. You can find further information on data protection on the following Google websites:

• Privacy policy: https://policies.google.com/privacy?hl=de&gl=de
• Google Tag Manager FAQ: https://www.google.com/intl/de/tagmanager/faq.html
• Google Tag Manager terms of use: https://www.google.com/intl/de/tagmanager/use-policy.html

9. Consent Management Platform

1. Description and scope of data processing

On our website we use a so-called Consent Management Platform (CMP) provided by consentmanager GmbH, Eppendorfer Weg 183, 20253 Hamburg (hereinafter: ConsentManager), in order to manage and document your consents and privacy settings regarding data processing and regarding cookies and similar technologies, so that we can meet our obligations under data protection and privacy law. The following data may be processed in this context:

• IP addresses
• consent-related information and privacy settings

2. Legal basis for processing personal data

The data processing is necessary in order to comply with legal obligations to which we are subject. This also constitutes our legitimate interest under Art. 6(1)(f) GDPR.

3. Purpose of the data processing

The purpose of using it is to be able to manage and document consents and privacy settings regarding data processing and regarding cookies and similar technologies, so that we can meet our obligations under data protection and privacy law.

4. Storage period, right to object and right to have data removed

The processed data are erased as soon as they are no longer necessary to achieve the purpose.

10. Rights of the data subject

If personal data about you are processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis the controller:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to be notified (Art. 19 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)
• Right to withdraw consent given under data protection law (Art. 7(3) GDPR)
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)