Data protection declaration

1) Introduction and contact details of the controller

1.1 We are pleased that you are visiting our website and thank you for your interest. Below we inform you about how we handle your personal data when you use our website. Personal data are all data with which you can be personally identified.

1.2 The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is MyLoodus GmbH, Bayrische Str. 8, 01069 Dresden, Germany, phone: 015237117122, email: info@myloodus.com. The controller responsible for the processing of personal data is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.

2) Data collection when you visit our website

2.1 When our website is used purely for information, that is, if you do not register or otherwise transmit information to us, we collect only the data that your browser transmits to the page server (so-called "server log files"). When you access our website, we collect the following data, which are technically necessary for us to display the website to you:

• Our website visited
• Date and time at the moment of access
• Amount of data sent, in bytes
• Source/referrer from which you reached the page
• Browser used
• Operating system used
• IP address used (where applicable, in anonymised form)

Processing is carried out pursuant to Art. 6 (1) (f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data are not passed on or otherwise used. We reserve the right, however, to check the server log files afterwards if there are concrete indications of unlawful use.

2.2 For security reasons and to protect the transmission of personal data and other confidential content (for example orders or enquiries to the controller), this website uses SSL or TLS encryption. You can recognise an encrypted connection by the character string "https://" and the lock symbol in your browser line.

3) Hosting and content delivery network

3.1 Wix

For the hosting of our website and the display of the page content we use the system of the following provider: Wix HQ, 6350671, Nemal Tel Aviv St 40, Tel Aviv-Yafo, Israel

Data are also transmitted to: Wix Inc., 500 Terry A. Francois Boulevard, San Francisco, California 94158, USA

All data collected on our website are processed on the provider's servers.
We have concluded a data-processing agreement with the provider which ensures the protection of the data of visitors to our pages and prohibits unauthorised disclosure to third parties.

Where data are transmitted to the provider's location, an adequate level of data protection is ensured by an adequacy decision of the European Commission.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which, on the basis of an adequacy decision of the European Commission, ensures compliance with the European level of data protection.

3.2 Cloudflare

We use a content delivery network of the following provider: Cloudflare Inc., 101 Townsend St. San Francisco, CA 94107, USA

This service enables us to deliver large media files such as graphics, page content, or scripts more quickly through a network of regionally distributed servers. Processing is carried out to safeguard our legitimate interest in improving the stability and functionality of our website pursuant to Art. 6 (1) (f) GDPR. We have concluded a data-processing agreement with the provider which ensures the protection of the data of visitors to our pages and prohibits unauthorised disclosure to third parties.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which, on the basis of an adequacy decision of the European Commission, ensures compliance with the European level of data protection.

3.3 Wix (wixstatic)

We use a content delivery network of the following provider: Wix HQ, 6350671, Nemal Tel Aviv St 40, Tel Aviv-Yafo, Israel

Data may also be transmitted to:

• Wix Inc., 500 Terry A. Francois Boulevard, San Francisco, California 94158, USA
• Fastly Inc., 475 Brannan St. #300, San Francisco, CA 94107, USA
• Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland
• Amazon Web Services, Inc., 410 Terry Avenue North, Seattle, WA 98109, USA

This service enables us to deliver large media files such as graphics, page content, or scripts more quickly through a network of regionally distributed servers. Processing is carried out to safeguard our legitimate interest in improving the stability and functionality of our website pursuant to Art. 6 (1) (f) GDPR. We have concluded a data-processing agreement with the provider which ensures the protection of the data of visitors to our pages and prohibits unauthorised disclosure to third parties.

Where data are transmitted to the provider's location, an adequate level of data protection is ensured by an adequacy decision of the European Commission.

For data transfers to the USA, the data recipients have joined the EU-US Data Privacy Framework, which, on the basis of an adequacy decision of the European Commission, ensures compliance with the European level of data protection.

4) Cookies

To make your visit to our website attractive and to enable the use of certain functions, we use cookies, that is, small text files that are stored on your device. Some of these cookies are automatically deleted when the browser is closed (so-called "session cookies"). Some of these cookies remain on your device for longer and make it possible to store page settings (so-called "persistent cookies"). In the latter case, you can find the storage period in the cookie-settings overview of your web browser.

Where personal data are also processed by individual cookies that we use, the processing is carried out pursuant to Art. 6 (1) (b) GDPR in order to perform the contract, pursuant to Art. 6 (1) (a) GDPR if consent has been given, or pursuant to Art. 6 (1) (f) GDPR to safeguard our legitimate interests in the best possible functionality of the website and in a customer-friendly and effective design of the page visit.

You can set your browser so that you are informed about the setting of cookies and decide individually whether to accept them, or so that you can exclude the acceptance of cookies for certain cases or in general.

Please note that if cookies are not accepted, the functionality of our website may be restricted.

5) Contact

When you contact us (for example by contact form or email), personal data are processed exclusively for the purpose of handling and answering your enquiry and only to the extent required for that purpose.

The legal basis for the processing of these data is our legitimate interest in answering your enquiry pursuant to Art. 6 (1) (f) GDPR. If your contact is aimed at a contract, an additional legal basis for the processing is Art. 6 (1) (b) GDPR. Your data are deleted when it can be inferred from the circumstances that the matter concerned has been finally clarified and provided that no statutory retention obligations stand in the way.

6) Data processing when a customer account is opened

Pursuant to Art. 6 (1) (b) GDPR, personal data continue to be collected and processed to the extent required in each case if you provide them to us when opening a customer account. Which data are required to open an account can be seen from the input mask of the corresponding form on our website.

Your customer account can be deleted at any time by a message to the address of the controller stated above. After your customer account has been deleted, your data are deleted once all contracts concluded through it have been fully performed, no statutory retention periods stand in the way, and we no longer have a legitimate interest in continued storage.

7) Use of customer data for direct marketing

Registration for our email newsletter

If you register for our email newsletter, we regularly send you information about our offers. The only mandatory information for sending the newsletter is your email address. The provision of further data is voluntary and is used so that we can address you personally. For sending the newsletter we use the so-called double opt-in procedure, which ensures that you receive newsletters only after you have expressly confirmed your consent to receive the newsletter by activating a verification link sent to the email address given.

By activating the confirmation link you give us your consent to the use of your personal data pursuant to Art. 6 (1) (a) GDPR. We store the IP address registered by the internet service provider (ISP) and the date and time of registration so that any misuse of your email address can be traced at a later time. The data we collect when you register for the newsletter are used strictly for that purpose.

You can unsubscribe from the newsletter at any time through the link provided in the newsletter or by a corresponding message to the controller named at the beginning. After unsubscription, your email address is deleted from our newsletter distribution list without delay, unless you have expressly consented to further use of your data or we reserve a further use of data that is permitted by law and about which we inform you in this declaration.

8) Data processing for order handling

8.1 Where necessary for the performance of the contract for delivery and payment purposes, the personal data we collect are passed on, pursuant to Art. 6 (1) (b) GDPR, to the commissioned transport company and the commissioned credit institution.

Where, on the basis of a corresponding contract, we owe you updates for goods with digital elements or for digital products, we process the contact data you transmitted when ordering in order to inform you personally within the scope of our statutory information duties pursuant to Art. 6 (1) (c) GDPR. Your contact data are used strictly for the purpose of notices about updates that we owe and are processed by us for this purpose only to the extent necessary for the respective notice.

8.2 Disclosure of personal data to shipping service providers

- DHL

As a transport service provider we use the following provider: DHL Paket GmbH, Charles-de-Gaulle-Str. 20, 53113 Bonn, Germany

We pass on your email address and/or telephone number to the provider pursuant to Art. 6 (1) (a) GDPR before delivery of the goods, for the purpose of agreeing a delivery date or announcing delivery, if you have given your express consent to this during the order process. Otherwise, for the purpose of delivery, we pass on only the recipient's name and the delivery address to the provider pursuant to Art. 6 (1) (b) GDPR. Disclosure takes place only to the extent necessary for delivery of the goods. In that case, prior agreement of the delivery date with the provider, or a delivery announcement, is not possible.

Consent can be withdrawn at any time with effect for the future vis-à-vis the controller named above or vis-à-vis the provider.
- DHL Express

As a transport service provider we use the following provider: DHL Express Germany GmbH, Heinrich-Brüning-Str. 5, 53113 Bonn, Germany

We pass on your email address and/or telephone number to the provider pursuant to Art. 6 (1) (a) GDPR before delivery of the goods, for the purpose of agreeing a delivery date or announcing delivery, if you have given your express consent to this during the order process. Otherwise, for the purpose of delivery, we pass on only the recipient's name and the delivery address to the provider pursuant to Art. 6 (1) (b) GDPR. Disclosure takes place only to the extent necessary for delivery of the goods. In that case, prior agreement of the delivery date with the provider, or a delivery announcement, is not possible.

Consent can be withdrawn at any time with effect for the future vis-à-vis the controller named above or vis-à-vis the provider.

8.3 Use of payment service providers

- Apple Pay

If you choose the payment method "Apple Pay" of Apple Distribution International (Apple), Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, payment is processed through the "Apple Pay" function of your device running iOS, watchOS, or macOS by charging a payment card stored with "Apple Pay". Apple Pay uses security functions built into the hardware and software of your device to protect your transactions. Releasing a payment therefore requires entry of a code previously set by you and verification by means of the "Face ID" or "Touch ID" function of your device.

For the purpose of payment processing, the information you provided during the order process, together with the information about your order, is passed on to Apple in encrypted form. Apple then encrypts these data again with a developer-specific key before the data are transmitted to the payment service provider of the payment card stored in Apple Pay in order to carry out the payment. The encryption ensures that only the website through which the purchase was made can access the payment data. After the payment has been made, Apple sends your device account number and a transaction-specific, dynamic security code to the originating website in order to confirm that the payment was successful.

Where personal data are processed in the transmissions described, the processing takes place exclusively for the purpose of payment processing pursuant to Art. 6 (1) (b) GDPR.

Apple retains anonymised transaction data, including the approximate purchase amount, the approximate date and time, and whether the transaction was completed successfully. Anonymisation completely excludes any personal reference. Apple uses the anonymised data to improve "Apple Pay" and other Apple products and services.

If you use Apple Pay on the iPhone or the Apple Watch to complete a purchase that you made through Safari on the Mac, the Mac and the authorisation device communicate over an encrypted channel on Apple's servers. Apple does not process or store any of this information in a format that can identify you. You can disable the ability to use Apple Pay on your Mac in the settings of your iPhone. Go to "Wallet & Apple Pay" and disable "Allow Payments on Mac".

Further information on data protection for Apple Pay is available at the following internet address: https://support.apple.com/de-de/HT203027
- Google Pay

If you choose the payment method "Google Pay" of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"), payment is processed through the "Google Pay" application of your mobile device running at least Android 4.4 ("KitKat") and equipped with an NFC function, by charging a payment card stored with Google Pay or a payment system verified there (for example PayPal). Releasing a payment via Google Pay of more than EUR 25 requires that your mobile device first be unlocked by the verification measure set up in each case (such as facial recognition, password, fingerprint, or pattern).

For the purpose of payment processing, the information you provided during the order process, together with the information about your order, is passed on to Google. Google then transmits your payment information stored in Google Pay to the originating website in the form of a one-time transaction number, with which a completed payment is verified. This transaction number contains no information about the real payment data of the means of payment stored with Google Pay. It is created and transmitted as a numeric token that is valid once. In all transactions via Google Pay, Google acts only as an intermediary for processing the payment. The transaction is carried out exclusively in the relationship between the user and the originating website by charging the means of payment stored with Google Pay.

Where personal data are processed in the transmissions described, the processing takes place exclusively for the purpose of payment processing pursuant to Art. 6 (1) (b) GDPR.

Google reserves the right, for every transaction made via Google Pay, to collect, store, and evaluate certain transaction-specific information. This includes the date, time, and amount of the transaction, the merchant's location and description, a description provided by the merchant of the goods or services purchased, photos that you have attached to the transaction, the name and email address of the seller and buyer or of the sender and recipient, the payment method used, your description of the reason for the transaction, and, where applicable, the offer associated with the transaction.

According to Google, this processing takes place exclusively pursuant to Art. 6 (1) (f) GDPR on the basis of the legitimate interest in proper accounting, the verification of transaction data, and the optimisation and maintenance of the Google Pay service.

Google also reserves the right to combine the processed transaction data with further information that Google collects and stores when other Google services are used.

The terms of use of Google Pay can be found here:

https://payments.google.com/payments/apis-secure/u/0/get_legal_document?ldo=0&ldt=googlepaytos&ldl=de
Further information on data protection for Google Pay is available at the following internet address:
https://payments.google.com/payments/apis-secure/get_legal_document?ldo=0&ldt=privacynotice&ldl=de
- PayPal

One or more online payment methods of the following provider are available on this website: PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg

If you select a payment method of the provider in which you perform in advance, the payment data you provided during the order process (including name, address, bank and payment-card information, currency, and transaction number) and information about the content of your order are passed on to the provider pursuant to Art. 6 (1) (b) GDPR. In this case your data are disclosed exclusively for the purpose of payment processing with the provider and only to the extent necessary for that purpose.

If you select a payment method in which we perform in advance, you are also asked during the order process to provide certain personal data (first and last name, street, house number, postcode, town, date of birth, email address, telephone number, and, where applicable, data on an alternative means of payment).

In order to safeguard our legitimate interest in determining your ability to pay in such cases, we pass these data on to the provider pursuant to Art. 6 (1) (f) GDPR for the purpose of a credit check. On the basis of the personal data you provided and further data (such as the basket, invoice amount, order history, and payment experience), the provider checks whether the payment option you selected can be granted with regard to payment and/or default risks.

The credit report may contain probability values (so-called score values). Where score values influence the result of the credit report, they are based on a scientifically recognised mathematical-statistical procedure. Address data, among other things, but not exclusively, are included in the calculation of the score values.

You can object to this processing of your data at any time by a message to us or to the provider. The provider may nevertheless remain entitled to process your personal data where this is necessary for payment processing in accordance with the contract.
- PayPal Checkout

This website uses PayPal Checkout, an online payment system of PayPal that consists of PayPal's own payment methods and local payment methods of third-party providers.

When paying via PayPal, by credit card via PayPal, by direct debit via PayPal, or, if offered, "Pay Later" via PayPal ("Später Bezahlen"), we pass your payment data on to PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter "PayPal") in the course of payment processing. Disclosure takes place pursuant to Art. 6 (1) (b) GDPR and only to the extent necessary for payment processing.

For the payment methods credit card via PayPal, direct debit via PayPal, or, if offered, "Pay Later" via PayPal ("Später bezahlen"), PayPal reserves the right to carry out a credit check. For this purpose your payment data may be passed on to credit agencies pursuant to Art. 6 (1) (f) GDPR on the basis of PayPal's legitimate interest in determining your ability to pay. PayPal uses the result of the credit check with regard to the statistical probability of payment default for the purpose of deciding whether to provide the respective payment method. The credit report may contain probability values (so-called score values). Where score values influence the result of the credit report, they are based on a scientifically recognised mathematical-statistical procedure. Address data, among other things, but not exclusively, are included in the calculation of the score values. You can object to this processing of your data at any time by a message to PayPal. PayPal may nevertheless remain entitled to process your personal data where this is necessary for payment processing in accordance with the contract.

If the PayPal payment method "purchase on invoice" ("Rechnungskauf") is available and selected, your payment data are first transmitted to PayPal in preparation for the payment, whereupon PayPal forwards them to Ratepay GmbH, Franklinstraße 28-29, 10587 Berlin ("Ratepay") in order to carry out the payment. The legal basis in each case is Art. 6 (1) (b) GDPR. In this case Ratepay carries out, in its own name, an identity and credit check to determine ability to pay in accordance with the principle already described above and passes your payment data on to credit agencies on the basis of the legitimate interest in determining ability to pay pursuant to Art. 6 (1) (f) GDPR. A list of the credit agencies that Ratepay may use can be found here: https://www.ratepay.com/legal-payment-creditagencies/

If a local third-party provider's payment method is used, your payment data are first passed on to PayPal pursuant to Art. 6 (1) (b) GDPR in preparation for the payment. Depending on your selection of an available local payment method, PayPal then transmits your payment data to the corresponding provider pursuant to Art. 6 (1) (b) GDPR in order to carry out the payment:

- Apple Pay (Apple Distribution International (Apple), Hollyhill Industrial Estate, Hollyhill, Cork, Ireland)
- Google Pay (Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland)
- iDeal (Currence Holding BV, Beethovenstraat 300 Amsterdam, the Netherlands)
- bancontact (Bancontact Payconiq Company, Rue d'Arlon 82, 1040 Brussels, Belgium)
- blik (Polski Standard Płatności sp. z o.o., ul. Czerniakowska 87A, 00-718 Warsaw, Poland)
- eps (PSA Payment Services Austria GmbH, Handelskai 92, Gate 2
1200 Vienna, Austria)
- MyBank (PRETA S.A.S, 40 Rue de Courcelles, F-75008 Paris, France)
- Przelewy24 (PayPro SA, Kanclerska 15A, 60-326 Poznań, Poland)

Further data-protection information can be found in PayPal's privacy policy: https://www.paypal.com/de/legalhub/paypal/privacy-full
- Sofortüberweisung

One or more online payment methods of the following provider are available on this website: Klarna Bank AB (publ), Sveavägen 46, 11134 Stockholm, Sweden

If you select a payment method of the provider in which you perform in advance (for example credit-card payment), the payment data you provided during the order process (including name, address, bank and payment-card information, currency, and transaction number) and information about the content of your order are passed on to the provider pursuant to Art. 6 (1) (b) GDPR. In this case your data are disclosed exclusively for the purpose of payment processing with the provider and only to the extent necessary for that purpose.
- Wix Payments

One or more online payment methods of the following provider are available on this website: Wix HQ, 6350671, Nemal Tel Aviv St 40, Tel Aviv-Yafo, Israel

If you select a payment method of the provider in which you perform in advance (for example credit-card payment), the payment data you provided during the order process (including name, address, bank and payment-card information, currency, and transaction number) and information about the content of your order are passed on to the provider pursuant to Art. 6 (1) (b) GDPR. In this case your data are disclosed exclusively for the purpose of payment processing with the provider and only to the extent necessary for that purpose.

Within the scope of the services mentioned above, data may also be transmitted, through further processing on our behalf, to Wix Inc., 500 Terry A. Francois Boulevard, San Francisco, California 94158, USA.

Where data are transmitted to the provider's location, an adequate level of data protection is ensured by an adequacy decision of the European Commission.

For the transfer of data to the USA, the provider relies on standard contractual clauses of the European Commission, which are intended to ensure compliance with the European level of data protection.

9) Page functions

9.1 Facebook plugins

Plugins of the social network of the following provider are used on our website: Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland

These plugins enable direct interactions with content on the social network.

In order to increase the protection of your data when you visit our website, the plugins are initially deactivated and integrated into the page by means of a so-called "2-click" or "Shariff" solution.

This integration ensures that when a page of our website that contains such plugins is accessed, no connection is yet established with the provider's servers.

Only when you activate the plugins and thereby give your consent to the data transfer pursuant to Art. 6 (1) (a) GDPR does your browser establish a direct connection to the provider's servers. In this process, regardless of a login to an existing user profile, information about the device you use (including your IP address), your browser, and your page history is transmitted to the provider to a certain extent and may be further processed there.

If you are logged in to an existing user profile on the provider's social network, information about interactions carried out through the plugins is also published there and displayed to your contacts.
You can withdraw your consent at any time by clicking the activated plugin again to deactivate it. Withdrawal does not affect the data that have already been transferred to the provider.

Data may also be transmitted to: Meta Platforms Inc., USA

We have concluded a data-processing agreement with the provider which ensures the protection of the data of visitors to our pages and prohibits unauthorised disclosure to third parties.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which, on the basis of an adequacy decision of the European Commission, ensures compliance with the European level of data protection.

9.2 Instagram plugins

Plugins of the social network of the following provider are used on our website: Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland

These plugins enable direct interactions with content on the social network.

In order to increase the protection of your data when you visit our website, the plugins are initially deactivated and integrated into the page by means of a so-called "2-click" or "Shariff" solution.

This integration ensures that when a page of our website that contains such plugins is accessed, no connection is yet established with the provider's servers.

Only when you activate the plugins and thereby give your consent to the data transfer pursuant to Art. 6 (1) (a) GDPR does your browser establish a direct connection to the provider's servers. In this process, regardless of a login to an existing user profile, information about the device you use (including your IP address), your browser, and your page history is transmitted to the provider to a certain extent and may be further processed there.

If you are logged in to an existing user profile on the provider's social network, information about interactions carried out through the plugins is also published there and displayed to your contacts.
You can withdraw your consent at any time by clicking the activated plugin again to deactivate it. Withdrawal does not affect the data that have already been transferred to the provider.

Data may also be transmitted to: Meta Platforms Inc., USA

We have concluded a data-processing agreement with the provider which ensures the protection of the data of visitors to our pages and prohibits unauthorised disclosure to third parties.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which, on the basis of an adequacy decision of the European Commission, ensures compliance with the European level of data protection.

9.3 Google Sign-In

We provide a single sign-on function of the following provider on our website: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland

In addition to a transmission of data to the provider location named above, data may also be transmitted to: Google LLC, USA

If you have an account with the provider, you can log in with these account data in order to create a user account or to register on our website.

When this page is visited, a direct connection between your browser and the provider's servers can be established through this login function, even if you do not have an account with the provider or are not logged in to one. The provider thereby receives the information that you have visited our page. The information collected in this respect (possibly including your IP address) is transmitted by your browser directly to a server of the provider and stored there. The information is not used to identify you personally and is not passed on to third parties.

These data-processing operations take place pursuant to Art. 6 (1) (f) GDPR on the basis of our legitimate interest in a user-friendly and interactive design of our online presence.

If you press the login button in order to register on our website with the data of your account with the provider, the provider transmits to us, exclusively on the basis of your express consent pursuant to Art. 6 (1) (a) GDPR, the general and publicly accessible information stored in your account (user ID, name, address, email address, age, and gender).

We store and use the data transmitted by the provider to set up a user account with the necessary data (salutation, first name, last name, address data, country, email address, date of birth), if you have released these to the provider. Conversely, on the basis of your consent, data (for example information about your browsing or purchasing behaviour) can be transferred by us to your account with the provider.

The consent given can be withdrawn at any time with effect for the future vis-à-vis us.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which, on the basis of an adequacy decision of the European Commission, ensures compliance with the European level of data protection.

Further information on Google's data protection can be found here: https://business.safety.google/intl/de/privacy/

10) Tools and other matters

Cookie consent tool

This website uses a so-called "cookie consent tool" to obtain effective user consents for cookies and cookie-based applications that require consent. The "cookie consent tool" is displayed to users when a page is accessed, in the form of an interactive user interface on which consents for certain cookies and/or cookie-based applications can be given by ticking boxes. Through the use of the tool, all cookies/services that require consent are loaded only if the respective user gives the corresponding consents by ticking boxes. This ensures that such cookies are set on the user's device only if consent has been given.

The tool sets technically necessary cookies in order to store your cookie preferences. Personal user data are generally not processed in this process.

If, in an individual case, personal data (such as the IP address) are nevertheless processed for the purpose of storing, assigning, or logging cookie settings, this takes place pursuant to Art. 6 (1) (f) GDPR on the basis of our legitimate interest in legally compliant, user-specific, and user-friendly consent management for cookies and thus in a legally compliant design of our internet presence.

A further legal basis for the processing is Art. 6 (1) (c) GDPR. As controller we are under a legal obligation to make the use of cookies that are not technically necessary dependent on the respective user's consent.

Where necessary, we have concluded a data-processing agreement with the provider which ensures the protection of the data of visitors to our pages and prohibits unauthorised disclosure to third parties.

Further information on the operator and the setting options of the cookie consent tool can be found directly in the corresponding user interface on our website.

11) Rights of the data subject

11.1 The applicable data-protection law grants you the following data-subject rights (rights of access and intervention) vis-à-vis the controller with regard to the processing of your personal data. For the respective conditions for exercising them, reference is made to the legal basis cited:

• Right of access pursuant to Art. 15 GDPR;
• Right to rectification pursuant to Art. 16 GDPR;
• Right to erasure pursuant to Art. 17 GDPR;
• Right to restriction of processing pursuant to Art. 18 GDPR;
• Right to notification pursuant to Art. 19 GDPR;
• Right to data portability pursuant to Art. 20 GDPR;
• Right to withdraw consents given pursuant to Art. 7 (3) GDPR;
• Right to lodge a complaint pursuant to Art. 77 GDPR.

11.2 RIGHT TO OBJECT

IF WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTEREST WITHIN THE SCOPE OF A BALANCING OF INTERESTS, YOU HAVE THE RIGHT AT ANY TIME, ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION, TO OBJECT TO THIS PROCESSING WITH EFFECT FOR THE FUTURE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED. FURTHER PROCESSING REMAINS RESERVED, HOWEVER, IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS, AND FREEDOMS, OR IF THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE, OR DEFENCE OF LEGAL CLAIMS.

IF YOUR PERSONAL DATA ARE PROCESSED BY US IN ORDER TO CARRY OUT DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH MARKETING. YOU CAN EXERCISE THE OBJECTION AS DESCRIBED ABOVE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED FOR DIRECT-MARKETING PURPOSES.

12) Duration of storage of personal data

The duration of the storage of personal data is measured by the respective legal basis, by the purpose of processing, and, where relevant, additionally by the respective statutory retention period (for example commercial and tax retention periods).

Where personal data are processed on the basis of express consent pursuant to Art. 6 (1) (a) GDPR, the data concerned are stored until you withdraw your consent.

If there are statutory retention periods for data that are processed in the context of legal or quasi-legal obligations on the basis of Art. 6 (1) (b) GDPR, these data are routinely deleted after the retention periods have expired, unless they are still required for performance or initiation of a contract and/or we continue to have a legitimate interest in further storage.

Where personal data are processed on the basis of Art. 6 (1) (f) GDPR, these data are stored until you exercise your right to object under Art. 21 (1) GDPR, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defence of legal claims.

Where personal data are processed for the purpose of direct marketing on the basis of Art. 6 (1) (f) GDPR, these data are stored until you exercise your right to object under Art. 21 (2) GDPR.

Unless the other information in this declaration about specific processing situations provides otherwise, stored personal data are otherwise deleted when they are no longer necessary for the purposes for which they were collected or otherwise processed.