Privacy policy

If your personal data is being processed, you are a data subject within the meaning of the GDPR and you are entitled to the following rights vis-à-vis the controller:

1. Right

of access You may request confirmation from the controller as to whether personal data relating to you is being processed by us.

If such processing is taking place, you may request the following information from the controller:

1. the purposes for which the personal data is being processed;
2. the categories of personal data being processed;
3. the recipients or categories of recipients to whom your personal data have been or will be disclosed;
4. the envisaged period for which your personal data will be stored or, if it is not possible to provide specific details, the criteria used to determine that period;
5. the existence of a right to rectification or erasure of the personal data concerning you, a right to restriction of processing by the controller, or a right to object to such processing;
6. the existence of a right to lodge a complaint with a supervisory authority;
7. any available information on the origin of the data, where the personal data are not collected from the data subject;
8. the existence of automated decision-making, including profiling, in accordance with Article 22(1) and (4) of the GDPR and – at least in such cases – meaningful information about the logic involved, as well as the significance and the intended consequences of such processing for the data subject.

You have the right to request information as to whether personal data concerning you is being transferred to a third country or to an international organisation. In this context, you may request to be informed of the appropriate safeguards pursuant to Article 46 of the GDPR in connection with the transfer.

2. Right to rectification

You have the right to request that the controller rectify and/or complete your personal data where the personal data concerning you are inaccurate or incomplete. The controller must carry out the rectification without undue delay.

3. Right to restriction of processing

You may request the restriction of the processing of personal data relating to you under the following conditions: 1

. where you contest the accuracy of the personal data relating to you for a period enabling the controller to verify the accuracy of the personal data;
2. where the processing is unlawful and you oppose the erasure of the personal data and instead request the restriction of its use;
3. where the controller no longer needs the personal data for the purposes of the processing, but you require it for the establishment, exercise or defend legal claims, or
4. where you have objected to the processing in accordance with Article 21(1) of the GDPR and it has not yet been determined whether the controller’s legitimate grounds override your grounds.

Where the processing of your personal data has been restricted, such data – apart from its storage – may only be processed with your consent or for the purposes of establishing, exercise or defence of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of an important public interest of the Union or a Member State.

If the restriction on processing has been imposed in accordance with the above conditions, you will be informed by the controller before the restriction is lifted.

4. Right to erasure

a. Obligation
to erase data You may request that the controller erase personal data relating to you without delay, and the controller is obliged to erase such data without delay if any of the following grounds apply: 1

. The personal data relating to you are no longer necessary for the purposes for which they were collected or otherwise processed.
2. You withdraw your consent on which the processing was based in accordance with Article 6(1)(a) or Article 9(2)(a) of the GDPR, and there is no other legal basis for the processing.
3. You object to the processing in accordance with Article 21(1) of the GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing in accordance with Article 21(2) of the GDPR.
4. The personal data relating to you has been processed unlawfully.
5. The erasure of the personal data relating to you is necessary for compliance with a legal obligation under Union law or the law of the Member States to which the controller is subject.
6. The personal data relating to you was collected in connection with information society services offered in accordance with Article 8(1) of the GDPR.

b. Notification to third
parties Where the controller has made the personal data concerning you public and is obliged to erase it pursuant to Article 17(1) of the GDPR, the controller shall, taking into account the available technology and the costs of implementation, take reasonable measures, including technical measures, to inform controllers processing the personal data that you, as the data subject, have requested the erasure of all links to that personal data or of copies or replicas of that personal data.

c. Exceptions
The right to erasure does not apply where the processing is

necessary 1. for the exercise of the right to freedom of expression and information;
2. to comply with a legal obligation which requires processing under Union or Member State law to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
3. for reasons of public interest in the area of public health in accordance with Article 9(2)(h) and (i) and Article 9(3) of the GDPR;
4. for archiving purposes in the public interest, scientific or historical research purposes or for statistical purposes in accordance with Article 89(1) of the GDPR, insofar as the right referred to in section (a) is likely to render impossible or seriously impair the achievement of the purposes of such processing; or
5. for the establishment, exercise or defence of legal claims.

5. Right to be informed

If you have exercised your right to rectification, erasure or restriction of processing vis-à-vis the controller, the controller is obliged to notify all recipients to whom your personal data have been disclosed of such rectification, erasure or restriction of processing, unless this proves impossible or involves a disproportionate effort.

You have the right to be informed by the controller of the identity of these recipients.

6. Right to data portability

You have the right to receive the personal data concerning you, which you have provided to the controller, in a structured, commonly used and machine-readable format. You also have the right to transmit this data to another controller without hindrance from the controller to whom the personal data was provided, provided that 1

. the processing is based on consent pursuant to Article 6(1)(a) of the GDPR or Article 9(2)(a) of the GDPR or on a contract pursuant to Article 6(1)(b) of the GDPR, and
2. the processing is carried out by automated means.

In exercising this right, you also have the right to have the personal data concerning you transferred directly from one controller to another, in so far as this is technically feasible. This must not adversely affect the freedoms and rights of other individuals.

The right to data portability does not apply to the processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

7. Right

to object You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you carried out on the basis of Article 6(1)(e) or (f) of the GDPR; this also applies to profiling based on these provisions.

The controller shall no longer process the personal data concerning you, unless it can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

Where personal data relating to you is processed for the purposes of direct marketing, you have the right to object at any time to the processing of personal data relating to you for the purposes of such marketing; this also applies to profiling insofar as it is related to such direct marketing.

If you object to processing for the purposes of direct marketing, the personal data concerning you will no longer be processed for those purposes. In connection with the use of information society services – notwithstanding Directive 2002/58/EC – you have the option of exercising your right to object by means of automated procedures using technical specifications.

8. Right to withdraw consent

under data protection law You have the right to withdraw your consent under data protection law at any time. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of that consent prior to its withdrawal.

9. Automated decision-making in individual cases, including profiling

You have the right not to be subject to a decision based solely on automated processing – including profiling – which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision 1

. is necessary for the conclusion or performance of a contract between you and the data controller,
2. is authorised by Union or Member State law to which the controller is subject, and that law provides for appropriate measures to safeguard your rights and freedoms as well as your legitimate interests; or
3. is based on your explicit consent.

However, such decisions must not be based on special categories of personal data as referred to in Article 9(1) of the GDPR, unless Article 9(2)(a) or (g) of the GDPR applies and appropriate measures have been taken to safeguard your rights and freedoms as well as your legitimate interests.

With regard to the cases referred to in (1) and (3), the controller shall take appropriate measures to safeguard your rights and freedoms as well as your legitimate interests, which shall include, at a minimum, the right to have a person from the controller intervene, to state your own point of view and to contest the decision.

10. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or the place where the alleged infringement occurred, if you consider that the processing of personal data relating to you infringes the GDPR.

The supervisory authority to which the complaint has been lodged shall inform the complainant of the progress and outcome of the complaint, including the possibility of a judicial remedy under Article 78 of the GDPR.

1. Facebook plugins (Like & Share buttons)

Plugins from the social network Facebook, provided by Facebook Inc., 1 Hacker Way, Menlo Park, California 94025, USA, are integrated into our website. You can recognise the Facebook plugins by the Facebook logo or the ‘Like’ button on our website. You can find an overview of the Facebook plugins here: https://developers.facebook.com/docs/plugins/. When you visit our website, the plugin establishes a direct connection between your browser and the Facebook server. This informs Facebook that you have visited our site using your IP address. If you click the Facebook ‘Like’ button whilst logged into your Facebook account, you can link the content of our pages to your Facebook profile. This enables Facebook to associate your visit to our pages with your user account. Please note that, as the provider of this website, we have no knowledge of the content of the data transmitted or how it is used by Facebook. Further information on this can be found in Facebook’s Privacy policy at: https://de-de.facebook.com/policy.php. If you do not wish Facebook to be able to associate your visit to our pages with your Facebook user account, please log out of your Facebook user account.

2. Twitter Plugin

Functions from the Twitter service are integrated into our website. These functions are provided by Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA. When you use Twitter and the ‘Retweet’ function, the websites you visit are linked to your Twitter account and made known to other users. Data is also transferred to Twitter in the process. Please note that, as the provider of this website, we have no knowledge of the content of the data transmitted or how it is used by Twitter. Further information on this can be found in Twitter’s Privacy policy at: https://twitter.com/privacy. You can change

your privacy settings on Twitter in your account settings at https://twitter.com/account/settings.

3. Google+ Plugin

Our pages use features from Google+. The provider is Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Collection and sharing of information: You can use the Google+ button to share information globally. The Google+ button enables you and other users to receive personalised content from Google and our partners. Google stores both the fact that you have given a +1 to a piece of content and information about the page you were viewing when you clicked +1. Your +1s may appear as recommendations alongside your profile name and photo in Google services, such as in search results or on your Google profile, or in other places on websites and in adverts across the internet.

Google records information about your +1 activity to improve Google services for you and others. To use the Google+ button, you need a public Google profile that is visible worldwide and must include at least the name you have chosen for that profile. This name is used across all Google services. In some cases, this name may also replace another name you have used when sharing content via your Google Account. The identity associated with your Google profile may be visible to users who know your email address or have other identifying information about you.

Use of the information collected: In addition to the purposes explained above, the information you provide will be used in accordance with Google’s applicable privacy policy. Google may publish aggregated statistics on users’ +1 activity or share these with users and partners, such as publishers, advertisers or affiliated websites.

4. Instagram Plugin

Features of the Instagram service are integrated into our pages. These features are provided by Instagram Inc., 1601 Willow Road, Menlo Park, CA 94025, USA.

If you are logged into your Instagram account, you can link the content of our pages to your Instagram profile by clicking the Instagram button. This enables Instagram to associate your visit to our website with your user account. Please note that, as the provider of this website, we have no knowledge of the content of the data transmitted or how it is used by Instagram. Further

information on this can be found in Instagram’s Privacy policy: https://instagram.com/about/legal/privacy/.

5. Pinterest Plugin

On our website, we use social plugins from the social network Pinterest, which is operated by Pinterest Inc., 808 Brannan Street, San Francisco, CA 94103-490, USA (“Pinterest”).

When you visit a page containing such a plugin, your browser establishes a direct connection to Pinterest’s servers. In doing so, the plugin transmits log data to Pinterest’s server in the USA. This log data may include your IP address, the addresses of the websites you have visited that also contain Pinterest features, the type and settings of your browser, the date and time of the enquiry, how you use Pinterest, and cookies.

Further information on the purpose, scope and further processing and use of the data by Pinterest, as well as your rights in this regard and options for protecting your privacy, can be found in Pinterest’s privacy policy: https://about.pinterest.com/de/privacy-policy.

6. YouTube

Our website uses plugins from the YouTube website, which is operated by Google. The operator of the website is YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA.

When you visit one of our pages featuring a YouTube plugin, a connection is established with YouTube’s servers. In doing so, the YouTube server is informed which of our pages you have visited.

If you are logged into your YouTube account, you allow YouTube to link your browsing behaviour directly to your personal profile. You can prevent this by logging out of your YouTube account.

The use of YouTube is in the interests of presenting our online services in an appealing manner. This constitutes a legitimate interest within the meaning of Article 6(1)(f) of the GDPR. Further information on the handling of user data can be found in YouTube’s Privacy policy at: https://www.google.de/intl/de/policies/privacy.

We have a company page on several social media platforms. Our aim is to provide further opportunities to find out about our company and to engage with us. We have company pages on the following social media platforms:

Facebook
, Instagram
, LinkedIn
and Xing

. When you visit or interact with a profile on a social media platform, your personal data may be processed. The information associated with a social media profile you use also regularly constitutes personal data. This includes messages and statements made whilst using the profile. Furthermore, when you visit a social media profile, certain information about your visit is often collected automatically, which may also constitute personal data.

1. Visiting a social media page

a. Facebook and Instagram

When you visit our Facebook or Instagram page, through which we present our company or individual products from our range, certain information about you is processed. The sole data controller for this processing of personal data is Facebook Ireland Ltd (Ireland/EU – ‘Facebook’). Further information on the processing of personal data by Facebook is available at https://www.facebook.com/privacy/explanation.

Facebook offers the option to object to certain data processing activities; relevant information and opt-out options can be found at https://www.facebook.com/settings?tab=ads.

Facebook provides us with anonymised statistics and insights for our Facebook and Instagram pages, which help us gain an understanding of the types of actions people take on our page (so-called ‘Page Insights’). These Page Insights are generated on the basis of certain information about people who have visited our page. This processing of personal data is carried out by Facebook and us as joint controllers. The processing serves our legitimate interest in analysing the types of actions taken on our page and improving our page based on these insights. The legal basis for this processing is Article 6(1)(f) of the GDPR. We are unable to link the information obtained via Page Insights to individual Facebook profiles that interact with our Facebook page. We have entered into an agreement with Facebook regarding processing as joint controllers, which sets out the allocation of data protection obligations between us and Facebook. Details regarding the processing of personal data for the purpose of generating Page Insights and the agreement concluded between us and Facebook can be found at https://www.facebook.com/legal/terms/information_about_page_insights_data.

With regard to this data processing, you have the option of exercising your data subject rights (see “Your Rights”) vis-à-vis Facebook as well. Further information on this can be found in Facebook’s Privacy policy at https://www.facebook.com/privacy/explanation.

Please note that, in accordance with Facebook’s privacy policy, user data may also be processed in the USA or other third countries. Facebook only transfers user data to countries for which an adequacy decision has been issued by the European Commission pursuant to Article 45 of the GDPR or on the basis of appropriate safeguards pursuant to Article 46 of the GDPR.

b. LinkedIn

LinkedIn Ireland Unlimited Company (Ireland/EU – ‘LinkedIn’) is generally the sole data controller for the processing of personal data when you visit our LinkedIn page. Further information on the processing of personal data by LinkedIn is available at https://www.linkedin.com/legal/privacy-policy?trk=homepage-basic_footer-privacy-policy.

When you visit our LinkedIn company page, follow this page or engage with it, LinkedIn processes personal data to provide us with statistics and insights in anonymised form. This enables us to gain an understanding of the types of actions that people take on our page (so-called ‘Page Insights’). To this end, LinkedIn processes, in particular, data that you have already provided to LinkedIn via the information in your profile, such as data on your role, country, sector, length of service, company size and employment status. In addition, LinkedIn will process information about how you interact with our LinkedIn company page, e.g. whether you are a follower of our LinkedIn company page. LinkedIn does not provide us with any of your personal data via Page Insights. We only have access to the aggregated Page Insights. Nor is it possible for us to draw conclusions about individual members from the information in the Page Insights. This processing of personal data within the scope of Page Insights is carried out by LinkedIn and us as joint controllers. This processing serves our legitimate interest in analysing the types of actions taken on our LinkedIn company page and in improving our company page based on these findings. The legal basis for this processing is Article 6(1)(f) of the GDPR. We have entered into an agreement with LinkedIn regarding processing as joint controllers, which sets out the allocation of data protection obligations between us and LinkedIn. The agreement is available at: https://legal.linkedin.com/pages-joint-controller-addendum. Accordingly, the following applies: LinkedIn

and we have agreed that LinkedIn is responsible for enabling you to exercise your rights under the GDPR. You can contact LinkedIn online via the following link (https://www.linkedin.com/help/linkedin/ask/PPQ?lang=de) or via the contact details provided in the privacy policy. You can contact the Data Protection Officer at LinkedIn Ireland via the following link: https://www.linkedin.com/help/linkedin/ask/TSO-DPO. You may also contact us using the contact details provided to exercise your rights in relation to the processing of personal data in the context of Page Insights. In such cases, we will forward your enquiry to LinkedIn.

LinkedIn and we have agreed that the Irish Data Protection Commission is the lead supervisory authority responsible for overseeing the processing of Page Insights. You always have the right to lodge a complaint with the Irish Data Protection Commission (see www.dataprotection.ie) or with any other supervisory authority. Please

note that, in accordance with LinkedIn’s Privacy Policy, personal data may also be processed by LinkedIn in the USA or other third countries. In doing so, LinkedIn only transfers personal data to countries for which the European Commission has issued an adequacy decision pursuant to Article 45 of the GDPR or on the basis of appropriate safeguards pursuant to Article 46 of the GDPR.

c. XING

New Work SE (Germany/EU) is generally the sole data controller for the processing of personal data when you visit our XING profile. Further information on the processing of personal data by New Work SE is available at https://privacy.xing.com/de/datenschutzerklaerung.

2. Processing of data you provide

to us via our social media pages We also process information that you have provided to us via our company page on the relevant social media platform. Such information may include the username used, contact details or a message sent to us. We generally only process this personal data if we have expressly asked you to provide it to us beforehand. We carry out this processing as the sole data controller. We process this data on the basis of our legitimate interest in contacting persons making enquiries. The legal basis for data processing is Article 6(1)(f) of the GDPR.

In addition, we may process such data provided for analysis and marketing purposes where appropriate. This processing is carried out on the legal basis of Article 6(1)(f) of the GDPR and serves our interest in further developing our services and informing you specifically about quotes. Further data processing may take place if you have given your consent (Article 6(1)(a) of the GDPR) or if this serves to fulfil a legal obligation (Article 6(1)(c) of the GDPR).

1. Google Analytics

This website uses features of the web analytics service Google Analytics. The provider is Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Google Analytics uses so-called ‘cookies’. These are text files that are stored on your computer and enable an analysis of your use of the website. The information generated by the cookie regarding your use of this website is usually transmitted to a Google server in the USA and stored there. The storage of Google Analytics cookies is based on Article 6(1)(f) of the GDPR. The website operator has a legitimate interest in analysing user behaviour in order to optimise both its website and its advertising.

a. IP anonymisation
We have enabled the IP anonymisation function on this website. This means that your IP address is truncated by Google within Member States of the European Union or in other signatory states to the Agreement on the European Economic Area before being transmitted to the USA. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and truncated there. On behalf of the operator of this website, Google will use this information to analyse your use of the website, to compile reports on website activity and to provide the website operator with other services relating to website and internet usage. The IP address transmitted by your browser as part of Google Analytics will not be merged with other data held by Google.

b. Browser plug-in
You can prevent cookies from being stored by adjusting the settings in your browser software; however, we would like to point out that, in this case, you may not be able to make full use of all the functions of this website. You can also prevent the collection of data generated by the cookie and relating to your use of the website (including your IP address) by Google, as well as the processing of this data by Google, by downloading and installing the browser plug-in available via the following link: https://tools.google.com/dlpage/gaoptout?hl=de.

c. Objecting to data collection
You can prevent Google Analytics from collecting your data by clicking on the following link. An opt-out cookie will be set, which prevents the collection of your data during future visits to this website: Disable Google Analytics. Further information on how Google Analytics handles user data can be found in Google’s Privacy policy: https://support.google.com/analytics/answer/6004245?hl=de.

d. Data processing
on behalf of a client We have entered into a data processing agreement with Google and fully comply with the strict requirements of the German data protection authorities when using Google Analytics.

e. Demographic features in Google Analytics
This website uses the ‘demographic features’ function of Google Analytics. This enables reports to be generated that provide information on the age, gender and interests of website visitors. This data is derived from Google’s interest-based advertising and from visitor data provided by third parties. This data cannot be attributed to any specific individual. You can disable this feature at any time via the ad settings in your Google Account, or generally prevent Google Analytics from collecting your data as described in the section ‘Objection to data collection’.

2. Use of SalesViewer® technology:

On this website, data is collected and stored using SalesViewer® technology from SalesViewer® GmbH on the basis of the website operator’s legitimate interests (Article 6(1)(f) of the GDPR) for marketing, market research and optimisation purposes.

To this end, a JavaScript-based code is used to collect company-related data and analyse its usage. The data collected using this technology is encrypted using a one-way function that cannot be reversed (known as hashing). The data is pseudonymised immediately and is not used to personally identify visitors to this website.

The data stored via SalesViewer is deleted as soon as it is no longer required for its intended purpose and provided that there are no statutory retention obligations preventing its deletion.

You may object to the collection and storage of data at any time with future effect by clicking on this link https://www.salesviewer.com/opt-out to prevent SalesViewer® from collecting data on this website in future. An opt-out cookie for this website will then be stored on your device. If you clear your cookies in this browser, you will need to click this link again.

1. Google Analytics Remarketing

Our websites use the features of Google Analytics Remarketing in conjunction with the cross-device features of Google AdWords and Google DoubleClick. The provider is Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

This feature enables the advertising audiences created using Google Analytics Remarketing to be linked to the cross-device features of Google AdWords and Google DoubleClick. In this way, interest-based, personalised advertising messages – which have been tailored to you based on your previous usage and browsing behaviour on one device (e.g. a mobile phone) – can also be displayed on another of your devices (e.g. a tablet or PC).

If you have given your consent, Google will link your web and app browsing history to your Google Account for this purpose. This enables the same personalised advertising messages to be displayed on any device on which you sign in with your Google Account.

To support this function, Google Analytics collects Google-authenticated user IDs, which are temporarily linked to our Google Analytics data in order to define and create audiences for cross-device advertising. You can permanently opt out of cross-device remarketing/targeting by disabling personalised advertising in your Google Account; to do so, follow this link: https://www.google.com/settings/ads/onweb/.

The aggregation of the data collected in your Google Account is based solely on your consent, which you may give or withdraw via Google (Article 6(1)(a) of the GDPR). In the case of data collection processes that are not consolidated in your Google Account (e.g. because you do not have a Google Account or have opted out of consolidation), the collection of data is based on Article 6(1)(f) of the GDPR. The legitimate interest arises from the fact that the website operator has an interest in the anonymised analysis of website visitors for advertising purposes. Further

information and the data protection provisions can be found in Google’s Privacy policy at: https://www.google.com/policies/technologies/ads/.

2. Google AdWords and Google Conversion Tracking

This website uses Google AdWords. AdWords is an online advertising programme provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States (“Google”).

As part of Google AdWords, we use what is known as conversion tracking. When you click on an advert placed by Google, a cookie is set for conversion tracking. Cookies are small text files that the web browser stores on the user’s computer. These cookies expire after 30 days and are not used to personally identify users. If the user visits certain pages on this website and the cookie has not yet expired, Google and we can recognise that the user clicked on the advert and was redirected to that page.

Each Google AdWords customer is assigned a different cookie. The cookies cannot be tracked across the websites of AdWords customers. The information collected via the conversion cookie is used to generate conversion statistics for AdWords customers who have opted in to conversion tracking. Clients are informed of the total number of users who have clicked on their advert and been redirected to a page tagged with a conversion tracking tag. However, they do not receive any information that can be used to personally identify users. If you do not wish to participate in tracking, you can object to this use by easily disabling the Google conversion tracking cookie via your web browser’s user settings. You will then not be included in the conversion tracking statistics.

The storage of “conversion cookies” is based on Article 6(1)(f) of the GDPR. The website operator has a legitimate interest in analysing user behaviour in order to optimise both its website and its advertising. Further

information on Google AdWords and Google Conversion Tracking can be found in Google’s privacy policy: https://www.google.de/policies/privacy/.

You can configure your browser so that you are notified when cookies are set and can choose to allow cookies only on a case-by-case basis, block the acceptance of cookies in specific cases or generally, and enable the automatic deletion of cookies when you close your browser. If you disable cookies, the functionality of this website may be restricted.

3. Google reCAPTCHA

We use “Google reCAPTCHA” (hereinafter “reCAPTCHA”) on our websites. The provider is Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”).

reCAPTCHA is designed to verify whether data entry on our websites (e.g. in a contact form) is carried out by a human or by an automated programme. To this end, reCAPTCHA analyses the behaviour of the website visitor based on various characteristics. This analysis begins automatically as soon as the website visitor enters the website. For the purposes of the analysis, reCAPTCHA evaluates various pieces of information (e.g. IP address, the length of time the website visitor spends on the website, or the mouse movements made by the user). The data collected during the analysis is forwarded to Google.

The reCAPTCHA analyses run entirely in the background. Website visitors are not notified that an analysis is taking place. Data processing is carried out on the basis of Article 6(1)(f) of the GDPR. The website operator has a legitimate interest in protecting its web services from malicious automated scraping and from spam.

Further information on Google reCAPTCHA and Google’s Privacy policy can be found via the following links: https://www.google.com/intl/de/policies/privacy/ and https://www.google.com/recaptcha/intro/android.html.

4. Facebook Pixel

Our website uses the Facebook visitor action pixel, provided by Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA (“Facebook”), for conversion tracking.

This enables the behaviour of website visitors to be tracked after they have been redirected to the provider’s website by clicking on a Facebook advert. This allows the effectiveness of Facebook adverts to be analysed for statistical and market research purposes, and enables future advertising campaigns to be optimised.

The data collected is anonymous to us as the operator of this website; we cannot draw any conclusions about the identity of users. However, the data is stored and processed by Facebook, meaning that a link to the respective user profile is possible and Facebook can use the data for its own advertising purposes, in accordance with Facebook’s Data Use Policy. This enables Facebook to display adverts on Facebook pages as well as outside of Facebook. As the website operator, we have no control over this use of the data. You can find further information on the protection of your privacy

in Facebook’s privacy policy: https://www.facebook.com/about/privacy/.

You can also disable the ‘Custom Audiences’ remarketing feature in the ad settings section at https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen.

To do this, you must be logged in to Facebook. If you do not have a Facebook account, you can opt out of behaviour-based advertising from Facebook on the European Interactive Digital Advertising Alliance website: http://www.youronlinechoices.com/de/praferenzmanagement/. 5

. Google Maps

This site uses the Google Maps service via an API. The provider is Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

To use the functions of Google Maps, it is necessary to store your IP address. This information is usually transferred to a Google server in the USA and stored there. The provider of this website has no influence over this data transfer.

The use of Google Maps is in the interests of presenting our online services in an appealing manner and ensuring that the locations specified on our website can be easily found. This constitutes a legitimate interest within the meaning of Article 6(1)(f) of the GDPR. Further

information on the handling of user data can be found in Google’s Privacy policy: https://www.google.de/intl/de/policies/privacy/.

We use IT service providers to deliver services, process your data, and maintain and support our website. These service providers process the data exclusively on our instructions and are obliged to comply with the applicable data protection regulations. Their use is necessary to maintain our IT infrastructure.

1. Scope of the processing of personal data

In order to process and carry out removal and transport orders, the personal data voluntarily provided to us is processed in our internal IT system. This includes details such

as: 1. Gender
2. First name and surname
3. Loading address, specifying street, house number, town and postcode
4. Unloading address, specifying street, house number, town and postcode
5. telephone number(s)
6. email address
7. date of order receipt. In

addition, details regarding the local conditions at the loading and unloading addresses are recorded. These include information on storeys, carrying distances and parking facilities. Furthermore, details and specific information regarding the nature and scope of the goods being transported are processed and stored.

Should a third party cover the costs of the services and orders commissioned from us, the details regarding the name, address and contact details of that party will also be processed and stored.

When carrying out international transport, additional data and documents required for customs clearance and customs procedures—and which must be submitted to the customs authorities—are also stored and processed. This primarily includes details of:

1. Gender
2. First name and surname
3. Loading address, specifying street, house number, town and postcode
4. Unloading address, specifying street, house number, town, postcode
; 5. Type and quantity of goods
being transported; 6. Date of change
of residence; 7. Duration of your stay
abroad; 8. Details of vehicles, provided these form part of the goods being transported.

The applications required for customs clearance both domestically and abroad, as well as any additional documents required under customs procedures, will be stored and processed accordingly.
The nature of the applications varies depending on the country of destination, the type of goods and their intended use. You will receive specific information on this during the course of order processing.

2. Legal basis for the processing of personal data

The legal basis for processing data for the fulfilment and execution of the removal and transport contract is Article 6(1)(a) and (b) of the GDPR. Furthermore, the legal basis for the processing of data in the context of customs clearance is Article 6(1)(c)

. 3. Purpose of data processing

The data is processed to ensure the fulfilment of the contract. Address and contact details are therefore an essential part of the freight contract. Data processing also takes place for the purpose of preparing a pre-contractual quote in response to your enquiry. When carrying out removal services, the transmission and processing of personal data is mandatory and limited to the specific purpose. 4

. Duration of storage

The data subject’s personal data will be erased or blocked as soon as the purpose for which it was stored no longer applies. Storage may also take place if this is provided for by European or national legislation in EU regulations, laws or other provisions to which the controller is subject. Data will also be blocked or deleted when a retention period prescribed by the aforementioned standards expires, unless there is a need to continue storing the data for the conclusion or performance of a contract.

5. Right to object and right

to erasure You may withdraw your consent to the processing of personal data at any time. To do so, you may contact us and object to the storage of your data, provided that the statutory provisions permit erasure.  In such cases, the performance of the contract may be prevented under certain circumstances. You may request that the

storage of personal data be objected to by telephone, post, fax or email using the following contact details:

Peter Niesen GmbH & Co. Internationale Möbelspedition KG

Robert-Blum-Str. 55
51373 Leverkusen
Germany

Tel: +49 (0)214 868 02 – 0
Fax: +49 (0)214 868 02 – 50
Email: info@niesen.de
www.niesen.de

Right to lodge a complaint with a supervisory authority

You may lodge a complaint with a supervisory authority at any time.
The following authority is responsible for our company, amongst others:

State Commissioner for Data Protection and Freedom
of Information, North Rhine-Westphalia
, PO Box 20 04 44
, 40102 Düsseldorf

, Tel.: +49 (0)211 38424-0
Fax: +49 (0)211 38424-10
Email: poststelle@ldi.nrw.de

Downloads:
• Privacy Notice for Customers – Niesen KG
• Privacy Notice for Customers – NSL Automotive
• Privacy Notice for Customers – NSL Container

Our premises are under video surveillance. You will find signs indicating this at our entrances. We would like to provide you with the following details regarding the surveillance.

Name and contact details of the data controller and, where applicable, their representative:

Peter Niesen GmbH & Co. Internationale Möbelspedition KG
Robert-Blum-Str. 55
51373 Leverkusen
Germany

Tel: +49 (0)214 868 02 – 0
Fax: +49 (0)214 868 02 – 50
Email: info@niesen.de
www.niesen.de

Contact details of the Data Protection Officer:

Frank Lierz
Karl-Wilhelm-Straße 1a
76359 Marxzell
Germany
Tel.: +49 (0)7248 93 59 883
Fax: +49 (0)7248 93 59 884
Email: info@frank-lierz-beratung.de
www.frank-lierz-beratung.de

Purposes and legal basis of data processing:

Article 6(1)(f) of the GDPR

Legitimate interests pursued:
Video surveillance is carried out to exercise our right to manage our premises, to prevent criminal offences and to preserve evidence in the event of criminal offences. The legal basis for video surveillance is Article 6(1)(f) of the GDPR, whereby our interests arise from the aforementioned purposes.

Retention period or criteria for determining the duration:
We store the video data for 10 days, after which it is deleted.

Information on the rights of data subjects

: The data subject has the right to request confirmation from the controller as to whether personal data concerning them is being processed; if so, they have the right to access such personal data and to receive the information specified in detail in Article 15 of the GDPR.

The data subject has the right to request from the controller the rectification without undue delay of any inaccurate personal data concerning them and, where applicable, the completion of any incomplete personal data (Article 16 of the GDPR).

The data subject has the right to request from the controller that personal data concerning them be erased without undue delay, provided that one of the grounds set out in detail in Article 17 of the GDPR applies, e.g. if the data are no longer necessary for the purposes for which they were collected (right to erasure).

The data subject has the right to request that the controller restrict processing if one of the conditions set out in Article 18 of the GDPR is met, e.g. if the data subject has objected to the processing, for the duration of the controller’s assessment.

The data subject has the right to object at any time, on grounds relating to their particular situation, to the processing of personal data concerning them. The controller shall then no longer process the personal data, unless it can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or the processing is necessary for the establishment, exercise or defence of legal claims (Article 21 of the GDPR).

Without prejudice to any other administrative or judicial remedy, every data subject has the right to lodge a complaint with a supervisory authority if the data subject considers that the processing of personal data relating to them infringes the GDPR (Article 77 of the GDPR). The data subject may exercise this right with a supervisory authority in the Member State of their habitual residence, place of work or the place where the alleged infringement occurred. In North Rhine-Westphalia, the competent supervisory authority is: State

Commissioner for Data Protection and Freedom of Information, North Rhine-Westphalia
PO Box 20 04 44 40102
Düsseldorf

Tel.: +49 (0)211 38424-0
Fax: +49 (0)211 38424-10
Email: poststelle@ldi.nrw.de

We, Niesen System Logistik GmbH, take the protection of your personal data very seriously. On the following pages, we would like to inform you about how we process the personal data of our suppliers, contact persons and other business associates, and what rights you have in relation to your personal data.

Wherever the term “data” is used below, it refers exclusively to personal data within the meaning of the General Data Protection Regulation.

The data controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws of the Member States, as well as other data protection provisions, is:

Niesen System Logistik GmbH
Robert-Blum-Str. 55
51373 Leverkusen
Germany
Tel: +49 (0)214 868 02 – 0
Email: info@niesen.de
www.niesen.de

Name and address of the Data Protection Officer
Frank Lierz
Telephone: +49 7248-9359883
Email: info@frank-lierz-beratung.de

General information on data processing

1. Scope of the processing of personal data

We process the personal data that we have received from you or from your company/employer. This includes, in particular: surname, first name, business contact details (for example, business address, telephone number, email address), as well as other personal data that you provide to us in the course of our business relationship, such as enquiries to our customer service team.

In addition, we also process data that we have lawfully obtained from other sources. This includes, in particular, data obtained from public sources, for example from your company’s website, commercial registers, address databases, business directories or other sources such as XING.

2. Purpose and legal basis for the processing of personal data

a) To fulfil contractual obligations in accordance with Article 6(1)(b) of the GDPR. We

process your personal data for the purposes of entering into, fulfilling and carrying out a business relationship with your company or employer. In particular, personal data is used for the purpose of establishing contact. Further purposes of data processing may arise from the respective contractual relationship.

b) On the basis of a balancing of interests pursuant to Article 6(1)(f) of the GDPR

In addition to processing your data for the purposes of fulfilling a contract, we also process your data on the basis of our legitimate interest or the legitimate interest of a third party, provided that your interests worthy of protection do not override these. This includes the following processing purposes: processing

your data for the purposes of supplier/business management, provided this is not already necessary in the context of the conclusion, fulfilment and performance of a contract. This also includes the operation of supplier portals or the conduct of supplier evaluations.

Asserting legal claims and defending against legal disputes; ensuring the security and operation of our IT systems, as well as the further development of these measures; preventing and investigating criminal offences; and implementing business management measures.

We process your data for the purposes set out in paragraph 2b, where possible in each individual case, in a pseudonymised form only. This means that you can no longer be directly identified by us in the course of the respective processing.

c) Processing of your data on the basis of legal requirements: Article 6(1)(c) of the GDPR. Where

the processing of personal data is necessary to comply with a legal obligation to which our company is subject, Article 6(1)(c) of the GDPR serves as the legal basis. This includes, for example, keeping records available for audits by public authorities (e.g. the tax office).

d) Processing of your data based on consent given by you in accordance with Article 6(1)(a)

Where we obtain the data subject’s consent for the processing of personal data for specific purposes, Article 6(1)(a) of the GDPR serves as the legal basis. The purposes of data processing are set out in the relevant consent.

For marketing communications regarding our products, services and quotes, subject to postal delivery, we will only contact you via communication channels for which we have received prior consent. Consent that has been given may be withdrawn at any time, without giving reasons, with effect for the future.

3. Disclosure of data

For the purpose of contract processing or fulfilment, the disclosure of personal data to suppliers within Germany and in other EU countries, insurance companies, clients, government authorities or organisations may be necessary in individual cases. This includes external IT service providers and is carried out in compliance with the requirements of Article 28 of the GDPR. Data is disclosed on the basis of legal obligations where overriding legal provisions apply.

4. Data erasure and retention period

Where necessary, we process your personal data for the duration of our business relationship; this also includes the initiation and fulfilment of a contract.

Furthermore, we are subject to various retention and documentation obligations arising, amongst other things, from the German Commercial Code (HGB) and the German Fiscal Code (AO). The retention and documentation periods specified therein extend for up to 10 years beyond the end of the business relationship or the pre-contractual legal relationship. We delete quotes that do not result in an order no later than 1 year after the quote was issued.

Ultimately, the retention period is also determined by the statutory limitation periods, which, for example, under Sections 195 et seq. of the German Civil Code (BGB), are generally three years, but may in certain cases extend to up to thirty years.

5. Your rights in the context

of data protection Using the contact details provided for Niesen System Logistik GmbH, you may exercise the following rights, provided the legal requirements are met:

• Access to your data stored by us and information regarding its processing (Article 15 of the GDPR)
• Rectification of inaccurate personal data (Article 16 of the GDPR)
• Erasure of your data stored by us (Art. 17 of the GDPR)
• Restriction of data processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)

Objection to the processing of your data by us (Art. 21 GDPR)

RIGHT TO OBJECT under Art. 21 GDPR. Where we process your data on the basis of legitimate interests (Article 6(1)(f) of the GDPR) or for the performance of a public task (Article 6(1)(e) of the GDPR), and if there are grounds relating to your particular situation that oppose such processing, you have the right to object to this processing in accordance with Article 21(1) of the GDPR. Furthermore, pursuant to Article 21(2) of the GDPR, you have the right to object to any form of processing for the purposes of direct marketing. Objections may be submitted in any form to the following addresses:

Niesen System Logistik GmbH
Robert-Blum-Str. 55
51373 Leverkusen
Germany
Tel: +49 (0)214 868 02 – 0
Email: info@niesen.de
www.niesen.de Right

to lodge a complaint with a supervisory authority: You may lodge a complaint with a supervisory authority at any time. The supervisory authority responsible for our company includes: State

Commissioner for Data Protection and Freedom of Information, North Rhine-Westphalia
, Kavalleriestr. 2–4, 40213 Düsseldorf

6. Provision of your data

You are only required to provide us with the personal data that we need to enter into, carry out and terminate our business relationship, or that we are required to collect under statutory provisions. If you do not provide us with this data, we may have to refuse to enter into the contract or may no longer be able to perform the contract.

7. Automated decision-making, including profiling, in accordance with Article 22(1)(4) of the GDPR.

We do not carry out any automated decision-making.

8. Current status of our privacy policy

As our data processing is subject to change, we will also update our privacy policy from time to time. Should there be any changes to the purposes of processing, we will inform you directly. Furthermore, we publish changes to our privacy policy at: https://www.niesen.de/kontakt/datenschutz. You will find the latest version there. You are also welcome to contact us if you would like a printed copy of our privacy policy sent to you by post.

Data protection notice for online meetings, teleconferences and webinars via ‘Teams’ organised by ‘Peter Niesen GmbH & Co. Internationale Möbelspedition KG’

We would like to inform you below about the processing of personal data in connection with the use of ‘Teams’.

Purpose of processing

We use the ‘Teams’ tool to conduct telephone conferences, online meetings, video conferences and/or webinars (hereinafter: ‘online meetings’). ‘Teams’ is a service provided by Microsoft Corporation, which is based in the USA.

Data controller The data controller responsible

for data processing directly related to the conduct of “online meetings” is Peter

Niesen GmbH & Co. Internationale Möbelspedition KG
Robert-Blum-Str. 55
51373 Leverkusen
Germany
Tel: +49 (0)214 868 02 – 0
Email: info@niesen.de
www.niesen.de

Please note: Where you access the ‘Teams’ website, the provider of ‘Teams’ is responsible for data processing. However, accessing the website is only necessary for using ‘Teams’ in order to download the software required to use ‘Teams’.

You can also use ‘Teams’ by entering the relevant meeting ID and, if necessary, any other access details for the meeting directly into the ‘Teams’ app.

If you do not wish to or are unable to use the ‘Teams’ app, the basic functions are also available via a browser version, which you can also find on the ‘Teams’ website.

Further information on data processing by Microsoft Corporation can be found at the following link:

What data is processed?

When using ‘Teams’, various types of data are processed. The scope of the data also depends on what information you provide before or whilst participating in an ‘online meeting’.

The following personal data is subject to processing:

User details: first name, surname, telephone number (optional), email address, password (if ‘single sign-on’ is not used), profile picture (optional), department (optional)

Meeting metadata: Topic, description (optional), participants’ IP addresses, device/hardware information

For recordings (optional): MP4 file of all video, audio and presentation recordings, M4A file of all audio recordings, text file of the online meeting chat.

When dialling in by telephone: details of the incoming and outgoing telephone numbers, country name, start and end times. Where applicable, further connection data, such as the device’s IP address, may be stored.

Text, audio and video data: You may have the option to use the chat functions during an ‘online meeting’. In this respect, the text you enter is processed in order to display it in the ‘online meeting’ and, where applicable, to record it in the minutes. To enable the display of video and the playback of audio, data from your device’s microphone and, where applicable, its video camera will be processed for the duration of the meeting. You can switch off or mute the camera or microphone yourself at any time via the ‘Teams’ application.

To take part in an ‘online meeting’ or enter the ‘meeting room’, you must at least provide your name.

Scope of processing

We use ‘Teams’ to conduct ‘online meetings’. If we wish to record ‘online meetings’, we will inform you of this transparently in advance and – where necessary – seek your consent. You will also be notified that the meeting is being recorded within the ‘Teams’ app.

Where necessary for the purpose of documenting the outcomes of an online meeting, we will log the chat content. However, this will not usually be the case.

In the case of webinars, we may also process questions asked by webinar participants for the purposes of recording and following up on webinars.

If you are registered as a user on ‘Teams’, reports relating to ‘online meetings’ (meeting metadata, dial-in details, questions and answers in webinars, and the polling function in webinars) may be stored in ‘Teams’.

Automated decision-making within the meaning of Article 22 of the GDPR is not used.

Legal basis for data processing

Where personal data relating to employees of ‘Peter Niesen GmbH & Co. Internationale Möbelspedition KG’ is processed, Section 26 of the German Federal Data Protection Act (BDSG) forms the legal basis for such processing. Should personal data be processed in connection with the use of ‘Teams’ which is not necessary for the establishment, carrying out or terminating the employment relationship, but is nevertheless an integral part of the use of ‘Teams’, then Article 6(1)(f) of the GDPR is the legal basis for the data processing. In such cases, our legitimate interest lies in the effective conduct of ‘online meetings’.

Furthermore, the legal basis for data processing when conducting ‘online meetings’ is Article 6(1)(b) of the GDPR, insofar as the meetings are held within the framework of contractual relationships. If no contractual relationship exists, the legal basis is Article 6(1)(f) of the GDPR. Here too, our interest lies in the effective conduct of ‘online meetings’.

Recipients / Disclosure of data

Personal data processed in connection with participation in ‘online meetings’ is, as a general rule, not disclosed to third parties, unless it is specifically intended for disclosure. Please note that, as with face-to-face meetings, content from ‘online meetings’ is often intended precisely to communicate information to customers, prospective customers or third parties and is therefore intended for disclosure.

Other recipients: The provider of ‘Teams’ necessarily gains access to the aforementioned data, insofar as this is provided for under our data processing agreement with ‘Teams’.

Data processing outside the European Union

‘Teams’ is a service provided by a US-based provider. Processing of personal data therefore also takes place in a third country. We have concluded a data processing agreement with the provider of ‘Teams’ which complies with the requirements of Article 28 of the GDPR.

An adequate level of data protection is guaranteed, on the one hand, by Microsoft Corporation’s ‘Privacy Shield’ certification and, on the other hand, by the conclusion of the so-called EU Standard Contractual Clauses.

Data Protection Officer

Mr Frank Lierz
Carl-Benz-Str. 31
76359 Marxzell
Germany
Tel.: +49 (0)7248 93 59 883
Email: info@frank-lierz-beratung.de www.frank-lierz-beratung.de

Your rights as a

data subject You have the right to access the personal data concerning you. You may contact us at any time to request such access.

In the event of a request for information that is not made in writing, we ask for your understanding that we may require you to provide evidence proving that you are the person you claim to be.

Furthermore, you have the right to rectification, erasure or restriction of processing, insofar as you are entitled to this by law. Finally, you have the right to object to processing within the framework of the statutory provisions.

A right to data portability also exists within the framework of data protection legislation.

Deletion of data

We generally delete personal data when there is no longer a need for further storage. A need may exist, in particular, if the data is still required to fulfil contractual obligations, or to assess, grant or defend against warranty and, where applicable, guarantee claims. In the event of statutory retention obligations, deletion will only be considered once the relevant retention period has expired.

Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority regarding our processing of personal data.

Changes to this privacy notice

We will revise this privacy notice in the event of changes to data processing or for any other reasons that make this necessary.

Date: 7 October 2025