Data Protection Declaration

Table of Contents

1. Information on the Collection of Personal Data and Contact Details of the Controller
2. Data Collection When You Visit Our Website
3. Hosting & Content Delivery Network
4. Cookies
5. Contacting Us
6. Data Processing When Opening a Customer Account and for Contract Processing
7. Use of Client Data for Direct Advertising
8. Processing of Data for the Purpose of Order Handling
9. Web Analysis Services
10. Retargeting / Remarketing / Referral Advertising
11. Site Functionalities
12. Tools and Miscellaneous
13. Rights of the Data Subject
14. Duration of Storage of Personal Data

1) Information on the Collection of Personal Data and Contact Details of the Controller

1.1 We are pleased that you are visiting our website and thank you for your interest. On the following pages, we inform you about the handling of your personal data when using our website. Personal data is all data with which you can be personally identified.

1.2 The controller in charge of data processing on this website, within the meaning of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, is BIO GREEN PRODUCTS LTD, 52 Holme Slack Lane, PR1 6EY Preston, United Kingdom, Tel.: +441772368023, E-Mail: info@biogreen.co.uk. BIO GREEN PRODUCTS LTD is registered with the Information Commissioner's Office (ICO) under registration reference: ZB379062. The controller in charge of the processing of personal data is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.

2) Data Collection When You Visit Our Website

2.1 When using our website for information only, i.e. if you do not register or otherwise provide us with information, we only collect data that your browser transmits to our server (so-called "server log files"). When you visit our website, we collect the following data that is technically necessary for us to display the website to you:

• Our visited website
• Date and time at the moment of access
• Amount of data sent in bytes
• Source/reference from which you came to the page
• Browser used
• Operating system used
• IP address used (if applicable: in anonymized form)

Data processing is carried out in accordance with Art. 6 (1) point f UK GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data will not be passed on or used in any other way. However, we reserve the right to check the server log files subsequently, if there are any concrete indications of illegal use.

2.2 This website uses SSL or TLS encryption for security reasons and to protect the transmission of personal data and other confidential content (e.g. orders or inquiries to the controller). You can recognize an encrypted connection by the character string https:// and the lock symbol in your browser line.

3) Hosting & Content Delivery Network

3.1 Shopify

For the hosting of our website and the display of the page content, we use the system of the following provider: Shopify International Limited, Victoria Buildings, 2nd floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland

Data is also transferred to: Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada

All data collected on our website is processed on the provider's servers. We have concluded an order processing agreement with the provider, ensuring the protection of our site visitors' data and prohibiting unauthorised disclosure to third parties.

3.2 Cloudflare

We use a content delivery network offered by the following provider: Cloudflare Inc., 101 Townsend St. San Francisco, CA 94107, USA

This service enables us to deliver large media files such as graphics, page content or scripts faster via a network of regionally distributed servers. The processing is carried out to protect our legitimate interest in improving the stability and functionality of our website pursuant to Art. 6 (1) point f UK GDPR. We have concluded an order processing agreement with the provider, ensuring the protection of our site visitors' data and prohibiting unauthorised disclosure to third parties.

4) Cookies

In order to make your visit to our website more attractive and to enable the use of certain functions, we use cookies, i.e. small text files that are stored on your end device. In some cases, these cookies are automatically deleted again after the browser is closed (so-called "session cookies"), in other cases, these cookies remain on your end device for longer and allow page settings to be saved (so-called "persistent cookies"). In the latter case, you can find the duration of the storage in the overview of the cookie settings of your web browser.

If personal data is also processed by individual cookies set by us, the processing is carried out either in accordance with Art. 6 (1) point b UK GDPR for the performance of the contract, in accordance with Art. 6 (1) point a UK GDPR in the case of consent given or in accordance with Art. 6 (1) point f UK GDPR to safeguard our legitimate interests in the best possible functionality of the website as well as a customer-friendly and effective design of the page visit.

You can set your browser in such a way that you are informed about the setting of cookies and you can decide individually about their acceptance or exclude the acceptance of cookies for certain cases or in general. Please note that the functionality of our website may be limited if cookies are not accepted.

5) Contacting Us

5.1 Facebook Chat

This website uses a live chat system offered by the following provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland

The processing of personal data transmitted via chat is carried out either in accordance with Art. 6 (1) point b UK GDPR, to the extent necessary for the initiation or execution of the contract, or in accordance with Art. 6 (1) point f UK GDPR based on our legitimate interest in the effective support of our site visitors. Unless otherwise required by law, your data transmitted will be deleted once the relevant facts have been conclusively clarified. Furthermore, additional information may be collected and evaluated by means of cookies for the purpose of creating pseudonymised user profiles. However, this information will not be used to identify you personally and will not be merged with other data records. The placing of cookies may be prevented by appropriate browser settings. You may object to the collection and storage of data for the purpose of creating a pseudonymised user profile at any time with effect for the future. We have concluded an order processing agreement with the provider, ensuring the protection of our site visitors' data and prohibiting unauthorised disclosure to third parties.

5.2 LiveChat

This website uses a live chat system offered by the following provider: LiveChat Software S.A., al. Debowa 3, 53-134 Wroclaw, Poland

The processing of personal data transmitted via chat is carried out either in accordance with Art. 6 (1) point b UK GDPR, to the extent necessary for the initiation or execution of the contract, or in accordance with Art. 6 (1) point f UK GDPR based on our legitimate interest in the effective support of our site visitors. Unless otherwise required by law, your data transmitted will be deleted once the relevant facts have been conclusively clarified. We have concluded an order processing agreement with the provider, ensuring the protection of our site visitors' data and prohibiting unauthorised disclosure to third parties.

5.3 Pipedrive

This website uses a live chat system offered by the following provider: Pipedrive OU, Mustamae tee 3a, Tallinn, 10615, Estonia

The processing of personal data transmitted via chat is carried out either in accordance with Art. 6 (1) point b UK GDPR, to the extent necessary for the initiation or execution of the contract, or in accordance with Art. 6 (1) point f UK GDPR based on our legitimate interest in the effective support of our site visitors. Unless otherwise required by law, your data transmitted will be deleted once the relevant facts have been conclusively clarified. We have concluded an order processing agreement with the provider, ensuring the protection of our site visitors' data and prohibiting unauthorised disclosure to third parties.

5.4 Shopify Inbox

This website uses a live chat system offered by the following provider: Shopify International Limited, Victoria Buildings, 2nd floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland

Data can also be transmitted to: Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada

The processing of personal data transmitted via chat is carried out either in accordance with Art. 6 (1) point b UK GDPR, to the extent necessary for the initiation or execution of the contract, or in accordance with Art. 6 (1) point f UK GDPR based on our legitimate interest in the effective support of our site visitors. Unless otherwise required by law, your data transmitted will be deleted once the relevant facts have been conclusively clarified. We have concluded an order processing agreement with the provider, ensuring the protection of our site visitors' data and prohibiting unauthorised disclosure to third parties.

5.5 Anthropic Claude

On this website, we have integrated an artificial intelligence software solution from the following provider to offer autonomous customer support: Anthropic Ireland Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland

Data may also be transferred to: Anthropic PBC, USA

Via an API-based integration, visitors can submit text-based inquiries regarding offers, website functionalities, orders placed, and the exercise of contractual rights. These inquiries are then answered and processed by the provider's language models. The collection and further processing of personal data is solely for the purpose of handling the specific request. The processing of website visitor input for the purpose of training and further developing the provider's AI language models is expressly prohibited.

Data processing is based on our legitimate interest in effectively supporting our website visitors and automating customer support in accordance with Art. 6 (1) point f UK GDPR. We have concluded an order processing agreement with the provider, which ensures the protection of our website visitors' data and prohibits unauthorised disclosure to third parties. For the transfer of data to the USA, the provider relies on standard contractual clauses to ensure compliance with the UK level of data protection.

5.6 Google Gemini

On this website, we have integrated an artificial intelligence software solution from the following provider to offer autonomous customer support: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland

Data may also be transferred to: Google LLC, USA

Via an API-based integration, visitors can submit text-based inquiries which are answered and processed by the provider's language models. The collection and further processing of personal data is solely for the purpose of handling the specific request. The processing of website visitor input for training AI language models is expressly prohibited. Data processing is based on our legitimate interest in accordance with Art. 6 (1) point f UK GDPR. We have concluded an order processing agreement with the provider. For data transfers to the USA, the provider participates in the UK-US data protection framework. Further information: https://support.google.com/gemini/answer/13594961

5.7 OpenAI

On this website, we have integrated an artificial intelligence software solution from the following provider to offer autonomous customer support: OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland

Data may also be transferred to: OpenAI OpCo, LLC, USA

Via an API-based integration, visitors can submit text-based inquiries which are answered and processed by the provider's language models. The collection and further processing of personal data is solely for the purpose of handling the specific request. The processing of website visitor input for training AI language models is expressly prohibited. Data processing is based on our legitimate interest in accordance with Art. 6 (1) point f UK GDPR. We have concluded an order processing agreement with the provider. For the transfer of data to the USA, the provider relies on standard contractual clauses to ensure compliance with the UK level of data protection.

5.8 Loox

For rating reminders, we use the services offered by the following provider: Loox Online Ltd, Rehov Har Sinai 2, 6581602 Tel Aviv-Yafo, Israel

We transmit your e-mail address and, if applicable, other customer data to the provider exclusively on the basis of your express consent in accordance with Art. 6 (1) point a UK GDPR to allow the provider to contact you by e-mail with a rating reminder. You can revoke your consent at any time with effect for the future. We have concluded an order processing contract with the provider, ensuring the protection of our site visitors' data and prohibiting unauthorised disclosure to third parties.

5.9 eDesk

We use the e-mail ticketing system of the following provider to process customer requests: xSellco Limited, Two Haddington Buildings, Haddington Road, Dublin 4, D04 HE94, Ireland

If you make contact requests by e-mail via our website, these are stored and organised in the ticketing system to enable chronological processing and to improve the service experience. Personal data collected includes surname, first name and e-mail address. The legal basis for the processing of this data is our legitimate interest in the efficient design of our customer service in accordance with Art. 6 (1) point f UK GDPR. We have concluded an order processing agreement with the provider, which ensures the protection of our website visitors' data and prohibits unauthorised disclosure to third parties.

5.10 When you contact us (e.g. via contact form or e-mail), personal data is collected. This data is stored and used exclusively for the purpose of responding to your request or for establishing contact and for the associated technical administration. The legal basis for processing data is our legitimate interest in responding to your request in accordance with Art. 6 (1) point f UK GDPR. If your contact is aimed at concluding a contract, the additional legal basis for the processing is Art. 6 (1) point b UK GDPR. Your data will be deleted after final processing of your enquiry, provided there are no legal storage obligations to the contrary.

6) Data Processing When Opening a Customer Account and for Contract Processing

Pursuant to Art. 6 (1) point b UK GDPR, personal data will continue to be collected and processed to the extent required in each case if you provide us with this data when opening a customer account. The data required for opening an account can be found in the input mask of the corresponding form on our website. Deletion of your customer account is possible at any time and can be done by sending a message to the above address of the person responsible. After deletion of your customer account, your data will be deleted, provided that all contracts concluded via it have been fully processed, no legal retention periods are opposed and no legitimate interest on our part in the continued storage exists.

7) Use of Client Data for Direct Advertising

7.1 Subscribe to our e-mail newsletter

If you register for our e-mail newsletter, we will regularly send you information about our offers. The only mandatory data for sending the newsletter is your e-mail address. The provision of further data is voluntary and will be used to address you personally. We use the so-called double opt-in procedure for sending the newsletter. This means that we will only send you an e-mail newsletter once you have expressly confirmed that you consent to receiving newsletters. By activating the confirmation link, you give us your consent for the use of your personal data pursuant to Art. 6 (1) point a UK GDPR. When you register for the newsletter, we store your IP address as well as the date and time of registration for the purpose of tracing any possible misuse of your e-mail address at a later date. You can unsubscribe from the newsletter at any time via the link provided in the newsletter or by sending a message to the responsible person named at the beginning.

7.2 Sending the newsletter to existing customers

If you have provided us with your e-mail address when purchasing products, we reserve the right to regularly send you offers for products similar to those already purchased by e-mail, in accordance with the Privacy and Electronic Communications Regulations (PECR) applicable in the United Kingdom. Data processing is carried out solely on the basis of our legitimate interest in personalised direct advertising pursuant to Art. 6 (1) point f UK GDPR. If you have initially objected to the use of your e-mail address for this purpose, we will not send you an e-mail. You are entitled to object to the future use of your e-mail address for advertising purposes at any time by notifying the controller named at the beginning of this document.

7.3 Klaviyo

Our e-mail newsletters are sent via this provider: Klaviyo Inc., 125 Summer Street, Floor 6, Boston, MA, 02110, USA

On the basis of our legitimate interest in effective and user-friendly newsletter marketing, we pass on the data you provided when registering for the newsletter to this provider in accordance with Art. 6 (1) point f UK GDPR so that they can send the newsletter on our behalf. Subject to your express consent pursuant to Art. 6 (1) point a UK GDPR, the provider also carries out a statistical analysis of the success of newsletter campaigns by means of web beacons or tracking pixels in the emails sent. You can revoke your consent to newsletter tracking at any time with effect for the future. We have concluded an order processing agreement with the provider. For data transfers to the USA, the provider participates in the UK-US data protection framework.

7.4 Pipedrive

Our e-mail newsletters are also sent via this provider: Pipedrive OU, Mustamae tee 3a, Tallinn, 10615, Estonia

On the basis of our legitimate interest in effective newsletter marketing, we pass on the data you provided when registering for the newsletter to this provider in accordance with Art. 6 (1) point f UK GDPR so that they can send the newsletter on our behalf. Subject to your express consent pursuant to Art. 6 (1) point a UK GDPR, the provider also carries out a statistical analysis of newsletter campaigns. You can revoke your consent at any time. We have concluded an order processing agreement with the provider.

7.5 Shopify Email

Our e-mail newsletters are also sent via this provider: Shopify International Limited, Victoria Buildings, 2nd floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland

Data is also transferred to: Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada

On the basis of our legitimate interest in effective newsletter marketing, we pass on the data you provided when registering for the newsletter to this provider in accordance with Art. 6 (1) point f UK GDPR so that they can send the newsletter on our behalf. Subject to your express consent pursuant to Art. 6 (1) point a UK GDPR, the provider also carries out a statistical analysis of newsletter campaigns. You can revoke your consent at any time. We have concluded an order processing agreement with the provider.

7.6 Notification by e-mail of stock availability

If our online shop provides the possibility of informing you by e-mail about the time of availability for selected, temporarily unavailable items, you can subscribe to our e-mail notification service for product availability. The only mandatory information needed is your e-mail address. We use the double opt-in procedure for this service. By activating the confirmation link, you consent to the use of your personal data in accordance with Art. 6 (1) point a UK GDPR. You can cancel the e-mail notification service at any time by sending a message to the controller named at the beginning.

7.7 Advertising by post

Based on our legitimate interest in personalised direct mail, we reserve the right to store your name and postal address in accordance with Art. 6 (1) point f UK GDPR and to use this data for sending offers and information on our products by letter post. You can object to the storage and use of your data for this purpose at any time by sending an appropriate message to the controller.

8) Processing of Data for the Purpose of Order Handling

8.1 Insofar as necessary for the processing of the contract for delivery and payment purposes, the personal data collected by us will be passed on to the commissioned transport company and the commissioned credit institution in accordance with Art. 6 (1) point b UK GDPR.

If we owe you updates for goods with digital elements or for digital products on the basis of a corresponding contract, we will process the contact data provided by you when placing the order in order to inform you personally about upcoming updates within the legally stipulated period of time pursuant to Art. 6 (1) point c UK GDPR.

8.2 We work with external shipping partners to fulfil our contractual obligations to our customers. We pass on your name as well as your delivery address exclusively for the purpose of delivering goods to a shipping partner selected by us, pursuant to Art. 6 (1) point b UK GDPR.

8.3 Use of special service providers for fulfilment

8.4 Amazon
We use the following provider for order processing: Amazon EU S.a r.l., 38 avenue John F. Kennedy, L-1855 Luxembourg
Name, address and, if applicable, other personal data will be passed on to the provider in accordance with Art. 6 (1) point b UK GDPR exclusively for the purpose of processing the online order.

8.5 PlentyONE
We use the following provider for order processing: PlentyONE GmbH, Johanna-Waescher-Strasse 7, 34131 Kassel, Germany
Your name, address, and any other personal data will be passed on to the provider in accordance with Art. 6 (1) point b UK GDPR solely for the purpose of processing your online order.

8.6 Passing on Personal Data to Shipping Service Providers

Deutsche Post
We use the following provider as transport service provider: Deutsche Post AG, Charles-de-Gaulle-Strasse 20, 53113 Bonn, Germany
We pass on your e-mail address and/or telephone number to the provider in accordance with Art. 6 (1) point a UK GDPR prior to delivery of the goods for the purpose of coordinating a delivery date or for delivery notification, if you have given your express consent in the ordering process. Otherwise, we will only pass on the name of the recipient and the delivery address to the supplier for the purpose of delivery in accordance with Art. 6 (1) point b UK GDPR. The consent can be revoked at any time with effect for the future.

DHL
We use the following provider as transport service provider: Deutsche Post AG, Charles-de-Gaulle-Strasse 20, 53113 Bonn, Germany
We pass on your e-mail address and/or telephone number to the provider in accordance with Art. 6 (1) point a UK GDPR prior to delivery of the goods for the purpose of coordinating a delivery date or for delivery notification, if you have given your express consent in the ordering process. Otherwise, we will only pass on the name of the recipient and the delivery address for the purpose of delivery in accordance with Art. 6 (1) point b UK GDPR. The consent can be revoked at any time with effect for the future.

DHL Express
We use the following provider as transport service provider: DHL Express Germany GmbH, Heinrich-Bruning-Str. 5, 53113 Bonn, Germany
We pass on your e-mail address and/or telephone number to the provider in accordance with Art. 6 (1) point a UK GDPR prior to delivery of the goods for the purpose of coordinating a delivery date or for delivery notification, if you have given your express consent in the ordering process. Otherwise, we will only pass on the name of the recipient and the delivery address for the purpose of delivery in accordance with Art. 6 (1) point b UK GDPR.

DPD
We use the following provider as transport service provider: DPD Deutschland GmbH, Wailandtstrasse 1, 63741 Aschaffenburg, Germany
We pass on your e-mail address and/or telephone number to the provider in accordance with Art. 6 (1) point a UK GDPR prior to delivery of the goods for the purpose of coordinating a delivery date or for delivery notification, if you have given your express consent in the ordering process. Otherwise, we will only pass on the name of the recipient and the delivery address for the purpose of delivery in accordance with Art. 6 (1) point b UK GDPR.

FedEx
We use the following provider as transport service provider: FedEx Express Germany GmbH, Langer Kornweg 34 k, 65451 Kelsterbach, Germany
We pass on your e-mail address and/or telephone number to the provider in accordance with Art. 6 (1) point a UK GDPR prior to delivery of the goods for the purpose of coordinating a delivery date or for delivery notification, if you have given your express consent in the ordering process. Otherwise, we will only pass on the name of the recipient and the delivery address for the purpose of delivery in accordance with Art. 6 (1) point b UK GDPR.

8.7 Use of Payment Service Providers

Apple Pay
If you choose the payment method "Apple Pay" of Apple Distribution International (Apple), Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, the payment processing is carried out via the "Apple Pay" function of your terminal device operated with iOS, watchOS or macOS. Apple Pay uses security features built into the hardware and software of your device to protect your transactions. For the purpose of payment processing, your information provided during the ordering process, along with information about your order, will be transmitted to Apple in encrypted form. If personal data is processed in the described transmissions, the processing is carried out exclusively for the purpose of payment processing in accordance with Art. 6 (1) point b UK GDPR. Apple retains anonymised transaction data to improve Apple Pay and other Apple products and services. For more information about Apple Pay privacy, please visit: https://support.apple.com/en-gb/HT203027

Google Pay
If you choose the payment method "Google Pay" of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"), the payment processing is carried out via the "Google Pay" application of your mobile device. For the purpose of payment processing, your information provided during the ordering process, together with the information about your order, will be forwarded to Google. If personal data are processed in the described transmissions, the processing is carried out exclusively for the purpose of payment processing in accordance with Art. 6 (1) point b UK GDPR. Further information on data protection at Google Pay can be found at: https://payments.google.com/payments/apis-secure/get_legal_document?ldo=0&ldt=privacynotice&ldl=en

PayPal
Online payment methods from the following provider are available on this website: PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. If you select a payment method of the provider, your payment data provided during the ordering process will be passed on to the provider in accordance with Art. 6 (1) point b UK GDPR exclusively for the purpose of processing payment. In order to safeguard our legitimate interest in determining the solvency of our customers, this data may be passed on to the provider for the purpose of a credit check in accordance with Art. 6 (1) point f UK GDPR. You can object to this processing of your data at any time by sending a message to us or to the provider.

Shopify Payments
Online payment methods from the following provider are available on this website: Shopify International Limited, Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland. If you select a payment method of the provider, your payment data provided during the ordering process will be passed on to the provider in accordance with Art. 6 (1) point b UK GDPR exclusively for the purpose of processing payment.

9) Web Analysis Services

9.1 Google (Universal) Analytics

This website uses Google (Universal) Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"). Google Analytics uses cookies to help the website analyse how users use the site. This website uses Google Analytics exclusively with the extension "_anonymizeIp()", which ensures anonymization of the IP address. The IP address transmitted by your browser within the framework of Google Analytics is not combined with other Google data.

All processing described above is only carried out if you have given us your express consent in accordance with Art. 6 (1) point a UK GDPR. You can withdraw your consent at any time via the "Cookie Consent Tool" provided on the website. We have concluded an order processing agreement with Google. For data transfers to the USA, the provider participates in the UK-US data protection framework. Further information: https://policies.google.com/privacy?hl=en

Demographics
Via a special function called "Demographics", Google Analytics also enables the compilation of statistics with statements about the age, gender and interests of site visitors. This allows the definition and differentiation of user groups for the purpose of target-group-optimized marketing measures. However, data sets collected via "Demographics" cannot be assigned to a specific person.

Google Signals
On this website, the "Google Signals" service can also be used as an extension of Google Analytics. With Google Signals, cross-device reports can be created by Google. If you have activated "personalised ads" in your Google account settings and you have linked your internet-enabled devices to your Google account, Google can analyse user behaviour across devices, provided you have given your consent in accordance with Art. 6 (1) point a UK GDPR.

UserIDs
As an extension of Google Analytics, the "UserIDs" function can also be used on this website. By assigning individual UserIDs, we can have Google create cross-device reports. This means that your usage behaviour can also be analysed across devices if you have given your corresponding consent in accordance with Art. 6 (1) point a UK GDPR and are logged into your personal account on different end devices.

9.2 Shopify Analytics

This website uses the web analytics service provided by: Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland

Data is also transferred to: Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada

Using cookies and/or comparable technologies, the service collects and stores pseudonymised visitor data to evaluate it for statistical analyses of user behaviour on our website. All processing described above is only carried out if you have given us your express consent in accordance with Art. 6 (1) point a UK GDPR. You can revoke your consent at any time via the "Cookie Consent Tool" on the website. We have concluded an order processing agreement with the provider.

10) Retargeting / Remarketing / Referral Advertising

10.1 Meta Pixel

Within our online offering, we use the "Meta Pixel" service of Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland ("Meta"). Meta Pixel enables Meta to determine visitors to our online offering as a target group for the display of adverts and to track whether users have been redirected to our website after clicking on an advert (so-called "conversion tracking"). The data collected is anonymous to us and does not allow us to draw any conclusions about the identity of users. All processing described above is only carried out with your express consent in accordance with Art. 6 (1) point a UK GDPR. You can revoke your consent at any time via the "Cookie Consent Tool" on the website. We have concluded an order processing contract with the provider. Data can also be transferred to: Meta Platforms Inc., USA. For data transfers to the USA, the provider has joined the UK-US data protection framework.

10.2 Google Ads Remarketing

This website uses the online advertising program "Google Ads" and conversion tracking of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"). We use Google Ads to draw attention to our attractive offers on external websites. The conversion tracking cookie is set when a user clicks on an ad placed by Google and usually loses its validity after 30 days. All processing is only carried out with your express consent in accordance with Art. 6 (1) point a UK GDPR. You can withdraw your consent at any time via the "Cookie Consent Tool" on the website. Further information: https://policies.google.com/privacy

10.3 Google Ads Conversion Tracking

We use Google Ads conversion tracking to measure the effectiveness of our advertising campaigns. The conversion tracking cookie is set when a user clicks on an ad placed by Google. All processing is only carried out with your express consent in accordance with Art. 6 (1) point a UK GDPR. You can revoke your consent at any time via the "Cookie Consent Tool" on the website. You can also permanently object to the setting of cookies by downloading and installing the Google browser plug-in available at: https://www.google.com/settings/ads/plugin?hl=en. For data transfers to the USA, the provider participates in the UK-US data protection framework.

10.4 Google Ads Conversion Tracking without Cookies

This website uses Google Ads Conversion Tracking exclusively without the use of cookies. Instead, the local memory of your browser is used to store an individual ID assigned by Google. If the information collected has a personal reference, the processing is carried out in accordance with Art. 6 (1) point f UK GDPR on the basis of our legitimate interest in the statistical evaluation of the success of our advertising campaigns. For data transfers to the USA, the provider participates in the UK-US data protection framework. Further information: https://policies.google.com/privacy

10.5 Google Marketing Platform

This website uses the online marketing tool Google Marketing Platform of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("GMP"). GMP uses cookies to serve ads relevant to users and to improve campaign performance reports. All processing described above is only carried out with your express consent in accordance with Art. 6 (1) point a UK GDPR. You can revoke your consent via the "Cookie Consent Tool" on the website. For data transfers to the USA, the provider participates in the UK-US data protection framework. Further information: https://policies.google.com/privacy

11) Site Functionalities

11.1 Facebook plugins

Plugins of the social network of Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (Facebook) are used on our website. The plugins are initially deactivated and only activated with your consent in accordance with Art. 6 (1) point a UK GDPR. Data can also be transferred to: Meta Platforms Inc., USA. We have concluded an order processing agreement with the provider.

11.2 Instagram plugins

Plugins of the social network of Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (Instagram) are used on our website. The plugins are initially deactivated and only activated with your consent in accordance with Art. 6 (1) point a UK GDPR. Data can also be transferred to: Meta Platforms Inc., USA. We have concluded an order processing agreement with the provider.

11.3 LinkedIn plugins

Plugins of the social network of LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland are used on our website. The plugins are initially deactivated and only activated with your consent in accordance with Art. 6 (1) point a UK GDPR. Data can also be transferred to: LinkedIn Inc., USA. We have concluded an order processing agreement with the provider.

11.4 Pinterest plugins

Plugins of the social network of Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland are used on our website. The plugins are initially deactivated and only activated with your consent in accordance with Art. 6 (1) point a UK GDPR. Data can also be transferred to: Pinterest Inc., USA. We have concluded an order processing agreement with the provider.

11.5 YouTube Videos

This website uses plugins to display and play videos from Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 ESW5, Ireland. Data may also be transmitted to: Google LLC., USA. All processing, in particular the setting of cookies, only takes place with your express consent in accordance with Art. 6 (1) point a UK GDPR. You can revoke your consent via the "Cookie Consent Tool" on the website.

11.6 Google Maps

Our website uses Google Maps (API) of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"). When you access sub-pages containing Google Maps, information about your use of our website (such as your IP address) is transmitted to and stored by Google. Personal data may also be transmitted to the servers of Google LLC in the USA. To the extent required by law, we have obtained your consent to the processing of your data in accordance with Art. 6 (1) point a UK GDPR. Further information: https://policies.google.com/privacy?hl=en

11.7 Google Web Fonts

This site uses web fonts from Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland. Data is also transferred to: Google LLC, USA. The processing of personal data is only carried out with your express consent in accordance with Art. 6 (1) point a UK GDPR. You can revoke your consent via the "Cookie Consent Tool" on the website.

11.8 Google reCAPTCHA

On this website, we use the CAPTCHA service of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland. Data may also be transmitted to: Google LLC, USA. The service checks whether an input is made by a natural person or by automated processing, with the aim of blocking spam and similar automated malicious attacks. If processing is carried out on the basis of cookies, these will only be set with your express consent in accordance with Art. 6 (1) point a UK GDPR. If processing is carried out without cookies, the legal basis is our legitimate interest in preventing abuse in accordance with Art. 6 (1) point f UK GDPR. We have concluded an order processing contract with the provider. For data transfers to the USA, the provider participates in the UK-US data protection framework.

12) Tools and Miscellaneous

12.1 DATEV

For the execution of accounting, we use the cloud-based accounting software of DATEV eG, Paumgartnerstr. 6-14, 90429 Nuremberg, Germany. The provider processes invoices and bank transactions of our company. Insofar as personal data is also processed in this context, the processing is carried out in accordance with Art. 6 (1) point f UK GDPR on the basis of our legitimate interest in the efficient organisation and documentation of our business transactions.

12.2 Cookie Consent Tool

This website uses a cookie consent tool to obtain effective user consent for cookies and cookie-based applications that require consent. The tool is displayed to users when they access the page. Using the tool, all cookies requiring consent are only loaded if the respective user provides the corresponding consent. The tool sets technically necessary cookies to save your cookie preferences. If personal data is processed for the purpose of storing cookie settings, this is done in accordance with Art. 6 (1) point f UK GDPR and Art. 6 (1) point c UK GDPR. Further information on the operator and the setting options of the cookie consent tool can be found directly in the corresponding user interface on our website.

13) Rights of the Data Subject

13.1 The applicable data protection law grants you the following comprehensive rights of data subjects vis-a-vis the data controller with regard to the processing of your personal data:

• Right of access by the data subject pursuant to Art. 15 UK GDPR
• Right to rectification pursuant to Art. 16 UK GDPR
• Right to erasure ("right to be forgotten") pursuant to Art. 17 UK GDPR
• Right to restriction of processing pursuant to Art. 18 UK GDPR
• Right to be informed pursuant to Art. 19 UK GDPR
• Right to data portability pursuant to Art. 20 UK GDPR
• Right to withdraw a given consent pursuant to Art. 7 (3) UK GDPR
• Right to lodge a complaint with the ICO pursuant to Art. 77 UK GDPR: https://ico.org.uk

13.2 RIGHT TO OBJECT

IF, WITHIN THE FRAMEWORK OF A CONSIDERATION OF INTERESTS, WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR PREDOMINANT LEGITIMATE INTEREST, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THIS PROCESSING WITH EFFECT FOR THE FUTURE ON THE GROUNDS THAT ARISE FROM YOUR PARTICULAR SITUATION.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED. HOWEVER, WE RESERVE THE RIGHT TO FURTHER PROCESSING IF WE CAN PROVE COMPELLING REASONS WORTHY OF PROTECTION FOR PROCESSING WHICH OUTWEIGH YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FREEDOMS, OR IF THE PROCESSING SERVES TO ASSERT, EXERCISE OR DEFEND LEGAL CLAIMS.

IF WE PROCESS YOUR PERSONAL DATA FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF YOUR PERSONAL DATA WHICH ARE USED FOR DIRECT MARKETING PURPOSES. YOU MAY EXERCISE THE OBJECTION AS DESCRIBED ABOVE. IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED FOR DIRECT ADVERTISING PURPOSES.

14) Duration of Storage of Personal Data

The duration of the storage of personal data is based on the respective legal basis, the purpose of processing and - if relevant - on the respective legal retention period (e.g. commercial and tax retention periods).

If personal data is processed on the basis of an express consent pursuant to Art. 6 (1) point a UK GDPR, this data is stored until the data subject revokes his consent.

If there are legal storage periods for data that is processed within the framework of legal or similar obligations on the basis of Art. 6 (1) point b UK GDPR, this data will be routinely deleted after expiry of the storage periods if it is no longer necessary for the fulfilment of the contract or the initiation of the contract and/or if we no longer have a justified interest in further storage.

When processing personal data on the basis of Art. 6 (1) point f UK GDPR, this data is stored until the data subject exercises his right of objection in accordance with Art. 21 (1) UK GDPR, unless we can provide compelling grounds for processing worthy of protection which outweigh the interests, rights and freedoms of the data subject, or the processing serves to assert, exercise or defend legal claims.

If personal data is processed for the purpose of direct marketing based on Art. 6 (1) point f UK GDPR, this data is stored until the data subject exercises his right of objection pursuant to Art. 21 (2) UK GDPR.

Unless otherwise stated in the information contained in this declaration on specific processing situations, stored personal data will be deleted if it is no longer necessary for the purposes for which it was collected or otherwise processed.

You also have the right to lodge a complaint with the supervisory authority in the United Kingdom, the Information Commissioner's Office (ICO): https://ico.org.uk