Privacy Policy

1. Data Protection at a Glance

General Information

The following notes provide a simple overview of what happens to your personal data when you visit this website.
Personal data means all data by which you can be personally identified. Detailed information on data protection
can be found in the full privacy policy below this text.

Data Collection on This Website

Who is responsible for data collection on this website?
Data processing on this website is carried out by the website operator. Their contact details can be found in the section
“Notice Concerning the Controller” in this privacy policy.

How do we collect your data?
On the one hand, your data is collected when you provide it to us. This can be data that you enter into a contact form, for example.
Other data is collected automatically or with your consent when you visit the website by our IT systems. This mainly includes
technical data (e.g., internet browser, operating system, or time of page access). This data is collected automatically as soon as you enter this website.

What do we use your data for?
Part of the data is collected to ensure error-free provision of the website. Other data may be used to analyze your user behavior.

What rights do you have regarding your data?
You have the right at any time to obtain free information about the origin, recipients, and purpose of your stored personal data.
You also have the right to request the rectification or deletion of this data. If you have given consent to data processing,
you may revoke this consent at any time with effect for the future. You also have the right, under certain circumstances,
to request restriction of the processing of your personal data. Furthermore, you have the right to lodge a complaint with
the competent supervisory authority. You can contact us at any time regarding this and other questions on the subject of data protection.

Analytics Tools and Third-Party Tools

When visiting this website, your browsing behavior may be statistically evaluated. This is done primarily with so-called analytics programs.
Detailed information about these analytics programs can be found in the privacy policy below.

2. Hosting

IONOS

We host our website with IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany (“IONOS”).
When you visit our website, IONOS collects various log files including your IP address. Details can be found in the
IONOS privacy policy: https://www.ionos.de/terms-gtc/terms-privacy.

The use of IONOS is based on Art. 6(1)(f) GDPR. We have a legitimate interest in a presentation of our website that is as reliable
as possible. If consent has been requested, processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR;
consent can be revoked at any time.

Data Processing Agreement

We have concluded a Data Processing Agreement (DPA) with the provider named above. This is a contract required by data protection law,
ensuring that this provider processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

3. General Notes and Mandatory Information

Data Protection

The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially
and in accordance with the statutory data protection regulations as well as this privacy policy. When you use this website,
various personal data will be collected. Personal data is data with which you can be personally identified. This privacy policy
explains what data we collect and what we use it for. It also explains how and for what purpose this happens.
We point out that data transmission over the Internet (e.g., communication by email) may have security gaps. Complete protection of
data against access by third parties is not possible.

Notice Concerning the Controller

The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing
of personal data (e.g., names, email addresses, etc.).

Storage Period

Unless a more specific storage period is specified in this privacy policy, your personal data will remain with us until the purpose
for data processing no longer applies. If you make a justified request for deletion or revoke your consent to data processing, your data
will be deleted unless we have other legally permissible grounds for storing your personal data (e.g., retention periods under tax or
commercial law); in the latter case, deletion will occur after these grounds no longer apply.

Notice on Data Transfer to the USA and Other Third Countries

We use, among other things, tools from companies based in the USA or other third countries that are not secure under data protection law.
When these tools are active, your personal data may be transferred to these third countries and processed there. We point out that no data
protection level comparable to that in the EU can be guaranteed in these countries. For example, US companies are obligated to hand over
personal data to security authorities without the possibility for you as a data subject to take legal action. It cannot therefore be excluded
that US authorities (e.g., intelligence services) process, evaluate, and permanently store your data located on US servers for surveillance
purposes. We have no influence on these processing operations.

Revocation of Your Consent to Data Processing

Many data processing operations are only possible with your express consent. You may revoke consent you have already given at any time.
The lawfulness of the data processing carried out before the revocation remains unaffected by the revocation.

Right to Object to Data Collection in Special Cases and to Direct Marketing (Art. 21 GDPR)

IF DATA PROCESSING IS BASED ON ART. 6(1)(E) OR (F) GDPR, YOU HAVE THE RIGHT AT ANY TIME, ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION,
TO OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA; THIS ALSO APPLIES TO PROFILING BASED ON THESE PROVISIONS. IF YOU OBJECT, WE WILL NO LONGER
PROCESS YOUR PERSONAL DATA CONCERNED UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS,
RIGHTS, AND FREEDOMS OR THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE, OR DEFENSE OF LEGAL CLAIMS (ART. 21(1) GDPR).

IF YOUR PERSONAL DATA IS PROCESSED FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF YOUR PERSONAL
DATA FOR SUCH MARKETING; THIS ALSO APPLIES TO PROFILING INSOFAR AS IT IS CONNECTED WITH SUCH DIRECT MARKETING. IF YOU OBJECT, YOUR PERSONAL DATA
WILL SUBSEQUENTLY NO LONGER BE USED FOR DIRECT MARKETING PURPOSES (ART. 21(2) GDPR).

Right to Lodge a Complaint with the Competent Supervisory Authority

In the event of violations of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the
Member State of their habitual residence, place of work, or the place of the alleged infringement. The right to lodge a complaint is without
prejudice to other administrative or judicial remedies.

Right to Data Portability

You have the right to have data that we process on the basis of your consent or in performance of a contract handed over to you or to a third party
in a commonly used, machine-readable format. If you request the direct transfer of the data to another controller, this will be done only as far as
it is technically feasible.

SSL/TLS Encryption

For security reasons and to protect the transmission of confidential content, such as orders or inquiries sent to us as the site operator,
this site uses SSL/TLS encryption. You can recognize an encrypted connection by the browser address line changing from “http://” to “https://”
and by the lock icon in your browser line. If SSL/TLS encryption is activated, the data you transmit to us cannot be read by third parties.

Access, Deletion, and Rectification

Within the framework of applicable legal provisions, you have the right at any time to free information about your stored personal data,
its origin and recipients, and the purpose of data processing and, if applicable, a right to rectification or deletion of this data.
You can contact us at any time regarding this and other questions about personal data.

Right to Restrict Processing

You have the right to request the restriction of processing of your personal data. The right to restrict processing exists in the following cases:

• If you contest the accuracy of your personal data stored by us, we usually need time to verify this. For the duration of the review, you have the right to request restriction of processing of your personal data.
• If the processing of your personal data was/is unlawful, you may request restriction of data processing instead of deletion.
• If we no longer need your personal data, but you need it for the exercise, defense, or establishment of legal claims, you have the right to request restriction of processing instead of deletion.
• If you have objected pursuant to Art. 21(1) GDPR, a balance must be struck between your interests and ours. As long as it is not yet clear whose interests prevail, you have the right to request restriction of processing of your personal data.

If you have restricted the processing of your personal data, such data—apart from its storage—may only be processed with your consent or for the
establishment, exercise, or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important
public interest of the European Union or a Member State.

4. Data Collection on This Website

Cookies

Our internet pages use “cookies.” Cookies are small text files that do not harm your device. They are either stored temporarily for the duration
of a session (session cookies) or permanently (persistent cookies) on your device. Session cookies are deleted automatically after your visit.
Persistent cookies remain stored on your device until you delete them yourself or they are automatically deleted by your web browser.
Third-party cookies may also be stored on your device when you enter our site (third-party cookies). These enable us or you to use certain
services of the third party (e.g., cookies for processing payment services).

Cookies necessary for the electronic communication process (necessary cookies), for the provision of certain functions you desire (functional cookies,
e.g., for the shopping cart), or for optimization of the website (e.g., cookies for measuring the web audience) are stored on the basis of Art. 6(1)(f) GDPR
unless another legal basis is specified. The website operator has a legitimate interest in storing cookies for the technically error-free and optimized
provision of its services. Where consent to store cookies has been requested, the relevant cookies are stored exclusively on the basis of this consent
(Art. 6(1)(a) GDPR); consent can be revoked at any time. You can set your browser so that you are informed about the setting of cookies and allow cookies
only in individual cases, exclude the acceptance of cookies in certain cases or in general, and activate the automatic deletion of cookies when closing the
browser. Disabling cookies may limit the functionality of this website.

Where cookies from third-party companies or for analytics purposes are used, we will inform you separately within this privacy policy and, if necessary,
request consent.

Consent with Borlabs Cookie

Our website uses the Borlabs Cookie consent technology to obtain your consent to store certain cookies in your browser or to use certain technologies
and to document this in a data-protection-compliant manner. Provider of this technology is Borlabs – Benjamin A. Bornschein, Rübenkamp 32, 22305 Hamburg, Germany.
When you enter our website, a Borlabs cookie is stored in your browser in which the consents you have given or the revocation of these consents are stored.
This data is not passed on to the provider of Borlabs Cookie. The collected data is stored until you ask us to delete it, delete the Borlabs cookie yourself,
or the purpose for data storage no longer applies. Mandatory legal retention periods remain unaffected. Details on data processing by Borlabs Cookie can be found at
https://de.borlabs.io/kb/welche-daten-speichert-borlabs-cookie/.
The use of the Borlabs Cookie consent technology is carried out to obtain the legally required consents for the use of cookies. The legal basis is Art. 6(1)(c) GDPR.

Contact Form

If you send us inquiries via the contact form, your details from the inquiry form, including the contact details you provide there, will be stored by us
for the purpose of processing the inquiry and in case of follow-up questions. We do not pass on this data without your consent. The processing of this data
is based on Art. 6(1)(b) GDPR if your request is related to the performance of a contract or is necessary for pre-contractual measures. In all other cases,
processing is based on our legitimate interest in the effective handling of inquiries addressed to us (Art. 6(1)(f) GDPR) or on your consent (Art. 6(1)(a) GDPR) if requested.
The data you enter in the contact form remains with us until you request deletion, revoke your consent to storage, or the purpose for data storage no longer applies
(e.g., after your request has been processed). Mandatory statutory provisions—especially retention periods—remain unaffected.

Inquiry by Email, Phone, or Fax

If you contact us by email, phone, or fax, your inquiry including all resulting personal data (name, inquiry) will be stored and processed by us for the purpose of handling your request.
We do not pass on this data without your consent. The processing of this data is based on Art. 6(1)(b) GDPR if your request is related to the performance of a contract or necessary for
pre-contractual measures. In all other cases, processing is based on our legitimate interest in effectively handling inquiries (Art. 6(1)(f) GDPR) or on your consent (Art. 6(1)(a) GDPR) if requested.
The data sent by you in contact inquiries remains with us until you request deletion, revoke your consent to storage, or the purpose for data storage no longer applies (e.g., after your request has been processed).
Mandatory legal provisions—especially statutory retention periods—remain unaffected.

5. Social Media

Facebook Plugins (Like & Share Button)

This website integrates plugins of the social network Facebook. Provider is Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland.
According to Facebook, the collected data is also transferred to the USA and other third countries. You can recognize Facebook plugins by the Facebook logo
or the “Like” button on this website. An overview of Facebook plugins can be found here:
Facebook Plugins.
When you visit this website, a direct connection between your browser and the Facebook server is established via the plugin.
Facebook thereby receives the information that you have visited this website with your IP address. If you click the Facebook “Like” button while logged into your Facebook account,
you can link the content of this website to your Facebook profile. Facebook can thereby assign the visit to this website to your user account.
We point out that, as the provider of these pages, we have no knowledge of the content of the transmitted data or of its use by Facebook.
Further information can be found in Facebook’s privacy policy:
facebook.com/privacy/explanation.

The use of Facebook plugins is based on Art. 6(1)(f) GDPR. The website operator has a legitimate interest in the broadest possible visibility in social media.
If consent has been requested, processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR; consent can be revoked at any time.
Where personal data is collected on our website with the aid of the tool described and transmitted to Facebook, we and Facebook Ireland Limited are jointly responsible for this data processing (Art. 26 GDPR).
Joint responsibility is limited solely to the collection of the data and its transmission to Facebook. Any processing by Facebook after transfer is not part of the joint responsibility.
Our joint obligations are set forth in an agreement on joint processing:
Controller Addendum.
Data transfer to the USA is based on the EU Commission’s Standard Contractual Clauses (SCCs). Details:
EU Data Transfer Addendum,
Help,
Policy.

If you do not want Facebook to be able to assign your visit to this website to your Facebook user account, please log out of your Facebook account.

Twitter Plugin

Functions of the Twitter service are integrated on this website. These functions are provided by Twitter International Company,
One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland. By using Twitter and the “Re-Tweet” function, the websites you visit are linked to your Twitter account
and disclosed to other users. Data is also transmitted to Twitter. We point out that, as the provider of these pages, we have no knowledge of the content of the transmitted data
or of its use by Twitter. Further information can be found in Twitter’s privacy policy: twitter.com/privacy.
The use of the Twitter plugin is based on Art. 6(1)(f) GDPR. The website operator has a legitimate interest in the broadest possible visibility in social media.
If consent has been requested, processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR; consent can be revoked at any time.
Data transfer to the USA is based on the EU Commission’s SCCs. Details:
Controller-to-Controller Transfers.
You can change your privacy settings on Twitter in the account settings at
twitter.com/account/settings.

Instagram Plugin

Functions of the Instagram service are integrated on this website. These functions are offered by Facebook Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.
If you are logged into your Instagram account, you can link the content of this website to your Instagram profile by clicking the Instagram button.
Instagram can thereby assign the visit to this website to your user account. We point out that, as the provider of these pages, we have no knowledge of the content of the transmitted data
or of its use by Instagram. Storage and analysis of data are based on Art. 6(1)(f) GDPR. If consent has been requested, processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR.
Where personal data is collected on our website with the aid of the tool described and transmitted to Facebook/Instagram, we and Facebook Ireland Limited are jointly responsible for this data processing (Art. 26 GDPR).
Joint responsibility is limited solely to the collection of the data and its transmission to Facebook/Instagram. Any processing by Facebook/Instagram after transfer is not part of the joint responsibility.
Our joint obligations are set forth in an agreement on joint processing:
Controller Addendum.
Data transfer to the USA is based on the EU Commission’s SCCs. Details:
EU Data Transfer Addendum,
Instagram Help,
Facebook Help.
Further information can be found in Instagram’s privacy policy:
instagram.com/about/legal/privacy/.

6. Analytics and Advertising

Google Analytics

This website uses functions of the web analytics service Google Analytics. Provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.
Google Analytics enables the website operator to analyze the behavior of website visitors. In doing so, the website operator receives various usage data such as page views,
time spent, operating systems used, and origin of the user. Google may combine this data into a profile that is assigned to the respective user or their device.
We can also record your mouse and scroll movements and clicks with Google Analytics. Furthermore, Google Analytics uses various modeling approaches to supplement the collected
data sets and applies machine learning technologies in data analysis. Google Analytics uses technologies (e.g., cookies or device fingerprinting) that enable recognition of the user
for the purpose of analyzing user behavior. The information collected by Google about the use of this website is generally transmitted to a Google server in the USA and stored there.

The use of this analysis tool is based on Art. 6(1)(f) GDPR. The website operator has a legitimate interest in analyzing user behavior in order to optimize both its web offering and its advertising.
If consent has been requested (e.g., consent to store cookies), processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR; consent can be revoked at any time.
Data transfer to the USA is based on the EU Commission’s SCCs. Details:
privacy.google.com/businesses/controllerterms/mccs/.

Browser Plugin

You can prevent the collection and processing of your data by Google by downloading and installing the browser plugin available at:
tools.google.com/dlpage/gaoptout.
More information on how Google Analytics handles user data can be found in Google’s privacy policy:
support.google.com/analytics/answer/6004245.

Storage Period

Data stored by Google at user and event level that is linked to cookies, user identifiers (e.g., User ID), or advertising IDs
(e.g., DoubleClick cookies, Android advertising ID) is anonymized or deleted after 14 months.
Details: support.google.com/analytics/answer/7667196.

IONOS WebAnalytics

This website uses the analytics services of IONOS WebAnalytics (“IONOS”). Provider is 1&1 IONOS SE, Elgendorfer Straße 57, D-56410 Montabaur, Germany.
In the context of analyses with IONOS, visitor numbers and behavior (e.g., number of page views, duration of website visit, bounce rates), visitor sources
(i.e., the page from which the visitor comes), visitor locations, and technical data (browser and operating system versions) can be analyzed.
For this purpose, IONOS stores in particular:

• Referrer (previously visited website)
• Requested website or file
• Browser type and version
• Operating system used
• Device type used
• Time of access
• IP address in anonymized form (used only to determine the location of access)

According to IONOS, data collection is completely anonymized so it cannot be traced back to individuals. IONOS WebAnalytics does not store cookies.
Storage and analysis of the data are based on Art. 6(1)(f) GDPR. If consent has been requested, processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR.
Further information on data collection and processing by IONOS WebAnalytics can be found in the IONOS privacy policy:
ionos.de/terms-gtc/index.php?id=6.

Data Processing Agreement

We have concluded a DPA with the provider named above. This contract ensures that the provider processes the personal data of our website visitors
only in accordance with our instructions and in compliance with the GDPR.

Facebook Pixel

This website uses Facebook’s visitor action pixel for conversion measurement. Provider is Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland.
According to Facebook, the collected data is also transferred to the USA and other third countries. This allows the behavior of site visitors to be tracked after
they have clicked on a Facebook ad and been redirected to the provider’s website. This allows evaluation of the effectiveness of Facebook ads for statistical and
market research purposes and optimization of future advertising measures.

The collected data is anonymous to us as the operator of this website; we cannot draw any conclusions about the identity of users.
However, the data is stored and processed by Facebook so that a connection to the respective user profile is possible and Facebook can use the data for its own
advertising purposes in accordance with Facebook’s Data Usage Policy. This enables Facebook to place ads on Facebook pages and outside of Facebook.
We as the site operator cannot influence this use of data. The use of Facebook Pixel is based on Art. 6(1)(f) GDPR (or Art. 6(1)(a) GDPR if consent was requested).
Data transfer to the USA is based on the EU Commission’s SCCs. Details:
EU Data Transfer Addendum and
Help.
Where personal data is collected on our website with the aid of the tool described and transmitted to Facebook, we and Facebook Ireland Limited are jointly responsible
for this data processing (Art. 26 GDPR). Joint responsibility is limited solely to the collection of the data and its transmission to Facebook. Any processing by Facebook
after transfer is not part of the joint responsibility. Our joint obligations are set forth in an agreement on joint processing:
Controller Addendum.

Further information on protecting your privacy can be found in Facebook’s data policy:
facebook.com/about/privacy/.
You can also deactivate the “Custom Audiences” remarketing function in the ad settings at
facebook.com/ads/preferences (you must be logged in).
If you do not have a Facebook account, you can disable usage-based advertising from Facebook on the website of the European Interactive Digital Advertising Alliance:
youronlinechoices.com/uk/your-ad-choices/.

7. Plugins and Tools

YouTube with Enhanced Privacy Mode

This website embeds videos from YouTube. Operator of the pages is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.
We use YouTube in enhanced privacy mode. According to YouTube, this mode ensures that YouTube does not store any information about visitors to this website
before they watch the video. However, data transfer to YouTube partners is not necessarily excluded by the enhanced privacy mode. YouTube establishes a connection
to the Google DoubleClick network whether you watch a video or not. As soon as you start a YouTube video on this website, a connection to YouTube’s servers is established.
The YouTube server is informed which of our pages you have visited. If you are logged into your YouTube account, you enable YouTube to assign your browsing behavior
directly to your personal profile. You can prevent this by logging out of your YouTube account.

Furthermore, after starting a video, YouTube may store various cookies on your device or use comparable recognition technologies (e.g., device fingerprinting).
In this way, YouTube can obtain information about visitors to this website. This information is used, among other things, to compile video statistics, improve user-friendliness,
and prevent fraud. Additional data processing operations may be triggered after a YouTube video starts, over which we have no influence. The use of YouTube is in the interest
of an appealing presentation of our online offerings. This constitutes a legitimate interest within the meaning of Art. 6(1)(f) GDPR. If consent has been requested,
processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR; consent can be revoked at any time. Further information about data protection at YouTube can be found in their privacy policy:
policies.google.com/privacy.

Wordfence

We have integrated Wordfence on this website. Provider is Defiant Inc., 800 5th Ave Ste 4100, Seattle, WA 98104, USA (“Wordfence”).
Wordfence serves to protect our website against unwanted access or malicious cyberattacks. For this purpose, our website establishes a permanent connection
to Wordfence servers so that Wordfence can compare its databases with accesses made on our website and block them if necessary.
The use of Wordfence is based on Art. 6(1)(f) GDPR. If consent has been requested, processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR;
consent can be revoked at any time. Data transfer to the USA is based on the EU Commission’s SCCs. Details:
wordfence.com/help/general-data-protection-regulation/.

Data Processing Agreement

We have concluded a DPA with the provider named above. This contract ensures that the provider processes the personal data of our website visitors
only in accordance with our instructions and in compliance with the GDPR.

8. eCommerce and Payment Providers

Processing of Data (Customer and Contract Data)

We collect, process, and use personal data only insofar as it is necessary for the establishment, content, or modification of the legal relationship
(inventory data). This is based on Art. 6(1)(b) GDPR, which permits the processing of data for the fulfillment of a contract or pre-contractual measures.
We only collect, process, and use personal data regarding the use of this website (usage data) to the extent necessary to enable or bill the user for
the use of the service. The collected customer data will be deleted after completion of the order or termination of the business relationship.
Statutory retention periods remain unaffected.

Data Transfer upon Contract Conclusion for Online Shops, Merchants, and Shipping of Goods

When you order goods from us, we transmit your personal data to the transport company entrusted with the delivery and to the payment service provider
entrusted with payment processing. Only the data required by the respective service provider to fulfill its task will be disclosed. The legal basis is
Art. 6(1)(b) GDPR. If you have given the corresponding consent pursuant to Art. 6(1)(a) GDPR, we will transmit your email address to the transport
company entrusted with the delivery so that it can inform you by email about the shipping status of your order; you can revoke this consent at any time.

Data Transfer upon Contract Conclusion for Services and Digital Content

We transmit personal data to third parties only if this is necessary within the scope of contract processing, for example to the credit institution
entrusted with payment processing. Any further transmission of the data does not take place or only if you have expressly consented to the transmission.
Your data will not be transferred to third parties without express consent, e.g., for advertising purposes. The basis for data processing is Art. 6(1)(b) GDPR.

Credit Checks

For a purchase on account or any other payment method where we make an advance payment, we may carry out a credit check (scoring). For this purpose,
we transmit the data you have entered (e.g., name, address, age, or bank details) to a credit agency. Based on this data, the probability of a payment
default is determined. In the event of an excessive risk of non-payment, we may refuse the respective payment method. The credit check is carried out on the
basis of contract fulfillment (Art. 6(1)(b) GDPR) and to avoid payment defaults (legitimate interest pursuant to Art. 6(1)(f) GDPR). If consent has been obtained,
the credit check is carried out on the basis of this consent (Art. 6(1)(a) GDPR); consent can be revoked at any time.