Privacy Notice

1. General information

1.1 Controller and data protection officer

The controller within the meaning of Art. 4 No. 7 GDPR is Falken Tyre Europe GmbH.

Falken Tyre Europe GmbH Berliner Straße 74-76, 63065 Offenbach

Tel: +49-(0)69-247 5252-0 Fax: +49-(0)69-247 52 52-11

You can reach our data protection officer at

Falken Tyre Europe GmbH for the attention of the Data Protection Officer Berliner Straße 74-76, 63065 Offenbach E-mail: ds@falkentyre.com

1.2 Collection and processing of personal data

As a rule, you can visit the Falken Tyre website without us requiring any personal data from you. Personal data is only collected if you provide it to us voluntarily, for example as part of an enquiry or application.

1.3 Purpose of the data processing

If Falken Tyre processes personal data, this is done for the purposes stated in this data protection notice.

2. Visiting our Website

We collect and store the IP address assigned to your computer in order to transmit the content you access on our website to your computer (e.g. texts, images and files made available for download, etc.) (see Art. 6 para. 1 lit. b GDPR) and to enable the technical provision of our website.

We also process this data to detect and track misuse. In this respect, the legal basis is Art. 6 para. 1 lit. f GDPR. Our legitimate interest in data processing lies in ensuring the proper functioning of our website and the transactions conducted via it.

If you have consented to the processing of personal data (see Art. 6 para. 1 lit. a GDPR), you can withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

2.1 Technical provision of the website

For the purpose of the technical provision of the website, it is necessary for us to process certain automatically transmitted information from you so that your browser can display our website and you can use the website. This information is automatically collected each time you visit our website and stored in our server log files. This information relates to the computer system of the accessing computer. The following information is collected:

• IP address;

• Browser type/version (e.g.: Firefox 59.0.2 (64 bit));

• Browser language (e.g.: German);

• Operating system used (e.g. Windows 10);

• Internal resolution of the browser window;

• Screen resolution;

• Javascript activation;

• Java on / off;

• Cookies on / off;

• Colour depth;

• Time of access.

2.2 Website tracking - use of cookies

Statistical analysis of website use and increasing reach

For the purpose of statistical analysis of the use of our website, we use Google Ads/Adsense, Google Remarketing, Google Tag Manager, Google Analytics, Google Conversion Tracking, LinkedIn Insight Tag and thus cookies, which enable an analysis of your surfing behaviour. This enables us to improve the quality of our website and its content. We learn how the website is used and can therefore constantly optimise our offering.

The information collected by the tools and cookies may include the data listed under ‘2.1 Technical provision of the website’. It is also possible that the addresses of the websites visited that have corresponding linked functions as well as your use of these websites and functions are also processed.

The information obtained as part of the statistical analysis of our website is not merged with your other data collected on the website.

We use cookies in some areas to make our website user-friendly for you and to optimise it to your needs. A cookie is a small file that is stored locally on your computer as soon as you visit a website. If you visit the website again with the same end device, the cookie indicates, for example, that it is a repeat visit. Cookies also enable us to analyse the use of our website. Basically, the browser has been configured so that you can use the website anonymously, i.e. without being tracked. The information in the cookies cannot be used to identify you personally and cannot be used to identify you on third-party websites, including the websites of analytics providers. Your personal data may only be processed in cases where you consent to this.

We use the following types of cookies:

• Essential cookies

These cookies are essential for the functioning of our website. This is, for example, the allocation of anonymous session IDs for bundling several queries to a web server or the error-free functioning of logins and orders.

• Functional cookies

These cookies help us to save settings you have selected or support other functions when you navigate our website. For example, we can remember your preferred settings for your next visit or save your login details for certain areas of our website.

• Statistics cookies

These cookies collect information about how you use our website (e.g. internet browser used, number of visits, pages viewed or time spent on the website). We receive the information collected with the help of these cookies in aggregated form so that we are unable to personally identify the visitor.

You can declare your consent or rejection of cookies - including for web tracking - via your web browser settings. You can configure your browser so that the acceptance of cookies is refused in principle or you are informed in advance when a cookie is stored. In this case, however, the functionality of the website may be impaired (e.g. when placing orders). Your browser also offers a function for deleting cookies (e.g. via Delete browser data). Further information on this can be found in the operating instructions or, as a rule, in the settings of your Internet browser.

• Consent with ConsentManager

Our website uses the consent technology of ConsentManager to obtain your consent to the storage of certain cookies on your end device or to the use of certain technologies and to document this in compliance with data protection regulations. The provider of this technology is Jaohawi AB, Håltegelvägen 1b, 72348 Västerås, Sweden, website:

https://www.consentmanager.de (hereinafter referred to as ‘ConsentManager’).

When you enter our website, a connection is established to ConsentManager's servers in order to obtain your consent and other declarations regarding the use of cookies. ConsentManager then stores a cookie in your browser in order to be able to assign the consents you have given or revoked. The data collected in this way is stored until you ask us to delete it, delete the ConsentManager provider cookie yourself or the purpose for data storage no longer applies. Mandatory statutory retention obligations remain unaffected.

ConsentManager is used to obtain the legally required consent for the use of cookies. The legal basis for this is Art. 6 para. 1 lit. c GDPR.

2.3 Google Analytics

This website uses Google Analytics for web analytics. This is a service provided by Google Ireland Limited (‘Google’), a company incorporated and operated under Irish law (registration number: 368047) with its registered office at Gordon House, Barrow Street, Dublin 4, Ireland (‘Google’). Google Analytics uses ‘cookies’. The information generated by the cookie about your use of our website (including your IP address) is transferred to Google's computer and stored there. If you consent to the use of cookies (see Art. 6 para. 1 lit. a GDPR), Google anonymises the information obtained from the cookies. The anonymisation represents a processing of your data, which, however, only takes place based on your consent. It cannot be ruled out that data processing will take place outside the scope of EU law.

However, if IP anonymisation is activated on this website, your IP address will first be truncated by Google within member states of the European Union or in other states party to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there. Google will use this information on behalf of the operator of this website for the purpose of evaluating your use of the website, compiling reports on website activity for website operators and providing other services relating to website activity and internet usage.

However, if IP anonymisation is activated on this website, your IP address will first be truncated by Google within member states of the European Union or in other signatory states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there. On behalf of the operator of this website, Google will use this information to analyse your use of the website, to compile reports on website activity and to provide the website operator with other services relating to website activity and internet usage. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data. You may refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of this website. You can also prevent Google from collecting the data generated by the cookie and relating to your use of the website (including your IP address) and from processing this data by Google by downloading and installing the browser plug-in available at the following link http://tools.google.com/dlpage/gaoptout?hl=de.

You can prevent Google Analytics from collecting your data by clicking on the following link. An opt-out cookie will be set to prevent the future collection of your data when you visit this website: Deactivate Google Analytics.

You can find more information on terms of use and data protection at http://www.google.com/analytics/terms/de.html or at https://www.google.de/intl/de/policies/ . Please note that on this website, Google Analytics has been extended by the code ‘anonymizeIP’ to ensure anonymised collection of IP addresses (so-called IP masking).

The use of this service is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TDDDG. Consent can be revoked at any time.

Data transfer to the USA is based on the standard contractual clauses of the EU Commission and the EU-U.S. Data Privacy Framework.

Details can be found here:

https://policies.google.com/privacy/frameworks https://privacy.google.com/businesses/controllerterms/mccs/ https://www.dataprivacyframework.gov/s/

2.4 Google Tag Manager

This website uses Google Tag Manager. Google Tag Manager is a solution with which Falken can manage website tags via an interface. The Tag Manager tool itself (which implements the tags) is a cookie-less domain and does not collect any personal data. The tool triggers other tags, which in turn may collect data. Google Tag Manager does not access this data. If a deactivation has been made at domain or cookie level, this remains in place for all tracking tags that are implemented with Google Tag Manager.

2.5 Google Ads

Falken Tyre uses Google Ads. Google Ads is an online advertising programme of Google Ireland Limited (‘Google’), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Ads enables us to display adverts in the Google search engine or on third-party websites when the user enters certain search terms into Google (keyword targeting). Furthermore, targeted adverts can be displayed based on the user data available at Google (e.g. location data and interests) (target group targeting). As the website operator, we can evaluate this data quantitatively by analysing, for example, which search terms led to the display of our advertisements and how many advertisements led to corresponding clicks.

The use of this service is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TDDDG. Consent can be revoked at any time.

Data transfer to the USA is based on the standard contractual clauses of the EU Commission and the EU-U.S. Data Privacy Framework.

Details can be found here:

https://policies.google.com/privacy/frameworks https://privacy.google.com/businesses/controllerterms/mccs/ https://www.dataprivacyframework.gov/s/

2.6 Google reCAPTCHA

This website uses the captcha service Google reCAPTCHA from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter: ‘Google’) to distinguish between humans and machine programmes (bots). Google reCAPTCHA thus makes an important contribution to the security and stability of the website, as abusive attacks (e.g. DDoS attacks) can be effectively prevented. Google reCAPTCHA is integrated into the website using JavaScript and evaluates user behaviour by forwarding data such as your IP address, information about the operating system, mouse movements, keyboard strokes and the time you spend on the website to Google servers.

If you are also logged in to Google with an existing user account at the same time as visiting our website, Google may also be able to associate your visit to our website with your user behaviour. Google may also send other cookies to your browser. We would like to point out that, as the provider of our websites, we have no precise knowledge of the content of the transmitted data or its use by Google, nor do we have any possibility of further restricting the transmission of data to Google and its partners.

If you are also logged in to Google with an existing user account while visiting our websites, Google may also be able to associate your visit to our websites with your user behaviour. In addition, other cookies may be sent to your browser by Google. We would like to point out that, as the provider of our websites, we have no precise knowledge of the content of the transmitted data or its use by Google, nor do we have any possibility of further restricting the transmission of data to Google and its partners. According to the information provided by Google, Google stores the data as user profiles and uses them for the purposes of advertising, market research and/or customised design of its websites. Such an analysis is carried out in particular (even for users who are not logged in) to provide customised advertising.

The purpose and scope of the data collection and the further processing and use of the data, including the deletion periods by Google, as well as your rights in this regard and setting options to protect your privacy can be found in Google's information, e.g. the data protection declaration at https://www.google.com/intl/de/policies/privacy/. We do not store any data from this processing ourselves.

The data processing takes place on the basis of your consent (Art. 6 para. 1 lit. a GDPR, § 25 para. 1 TDDDG).

2.7 Google Maps

This site uses the map service Google Maps. The provider is Google Ireland Limited (‘Google’), Gordon House, Barrow Street, Dublin 4, Ireland.

To use the functions of Google Maps, it is necessary to save your IP address. This information is usually transmitted to a Google server in the USA and stored there. The provider of this site has no influence on this data transfer. If Google Maps is activated, Google may use Google Fonts for the purpose of standardising the display of fonts. When you call up Google Maps, your browser loads the required web fonts into your browser cache in order to display texts and fonts correctly.

The use of Google Maps is in the interest of an appealing presentation of our online offers and to make it easy to find the places we have indicated on the website. This constitutes a legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR. If a corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TDDDG, insofar as the consent includes the storage of cookies or access to information in the user's terminal device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent can be revoked at any time.

Data transfer to the USA is based on the standard contractual clauses of the EU Commission and the EU-U.S. Data Privacy Framework:

https://privacy.google.com/businesses/gdprcontrollerterms/ https://privacy.google.com/businesses/gdprcontrollerterms/sccs/ https://www.dataprivacyframework.gov/s/

You can find more information on the handling of user data in Google's privacy policy: https://policies.google.com/privacy?hl=de

2.8 Integration of social network plug-ins

Our website uses buttons for the following social networks:

• Facebook/ Instagram, Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland

• Google/ YouTube, Google Ireland Limited Gordon House, Barrow Street, Dublin 4, Ireland

• X, X Corp, 1355 Market St, Suite 900, San Francisco, CA 94103, USA

• Xing, New Work SE, Am Strandkai 1, 20354 Hamburg, GermanyLinkedIn, LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland

The buttons are labelled with the logo of the respective social network. However, these are not the usual social plug-ins, but buttons with stored links. The buttons must be activated (clicked) separately by you. As long as these buttons are not clicked, no data is transferred to the social networks. Only when you click on the buttons and thereby declare your consent to communication with the servers of the social network do the buttons become active and the connection is established.

After clicking, the button corresponds to a so-called share plug-in. The social network is provided with information about the page you have visited, which you can share with your contacts in your social network. If you want to ‘share’ the information, you must be logged in. If you are not logged in, you will land on the login page of the social network you clicked on and you will no longer be on the pages of https://www.falkentyre.com/de. If you are logged in, the information that you would like to recommend the respective article will be transmitted.

Once clicked, the button corresponds to a so-called share plug-in. The social network is provided with information about the page you have visited, which you can share with your contacts in your social network. If you want to ‘share’ the information, you must be logged in. If you are not logged in, you will land on the login page of the social network you clicked on and you will no longer be on the pages of https://www.falkentyre.com/de. If you are logged in, the information that you would like to recommend the respective article will be transmitted.

By activating the button, the social networks also receive the information that and when you have accessed the corresponding page of our website, as well as, for example, your IP address, details of the browser used and the language settings. If you click on the button, your click will be transmitted to the social network and used in accordance with its data usage guidelines.

When the button is activated, we have no influence on the data collected and data processing operations and are not responsible for this data processing and are not the controller in this respect within the meaning of the GDPR. We are also not aware of the full extent of the data collection, its legal basis, the purposes and the storage periods. Therefore, the information provided here is not necessarily complete.

The data is transmitted regardless of whether you actually have an account with the provider or are logged in there. If you are logged in with the provider, your data will be assigned directly to your account. The providers may also use cookies on your computer to track you.

To our knowledge, the provider stores this data in user profiles, which it uses for the purposes of advertising, market research and/or customising its website. Such an evaluation is carried out in particular (even for users who are not logged in) to display customised advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles. To exercise this right of objection, please contact the respective provider.

The purpose and scope of the data collection and the further processing and use of the data by the respective social network as well as your rights in this regard and setting options to protect your privacy can be found in the information

• for Facebook: http://www.facebook.com/about/privacy

• for Instagram https://privacycenter.instagram.com/

• for Google: http://www.google.com/intl/de/policies/privacy

• for X: http://twitter.com/privacy

• on Xing: https://www.xing.com/privacy

• on youtube: http://www.youtube.com/t/privacy_at_youtube

• on LinkedIn: https://www.linkedin.com/legal/privacy-policy

If you do not want the social network to receive data about you, you must not click on the button.

3. Online Presence in Social Media

Falken Tyre maintains several online presences within social networks and platforms, such as Facebook, X, YouTube, Xing and LinkedIn, in order to have the opportunity to communicate with active users there and to inform them about our service portfolio. Falken uses the technical platforms and services offered by the operators for this purpose. Both Falken Tyre Europe GmbH and the respective operators of the platforms process your personal data on the platforms. Falken Tyre and the respective operators of the platforms are joint controllers for data processing in accordance with Art. 26 GDPR.

We would like to expressly point out that the operators process your personal data in a way that is outside Falken Tyre's area of responsibility.

As a result, we inform you independently about the data processing in each case, so that the respective operators' own data protection provisions apply in the social networks and on other external platforms, even if we disseminate information and maintain a presence there. The way in which the operators of the social networks use the data from visits to the respective pages for their own purposes, the extent to which activities on the pages are assigned to individual users, how long this data is stored and whether data from a visit to the respective page is passed on to third parties is not conclusively and clearly stated by the operators and is not known to us.

What information the operators receive and how it is used is described in general terms in the respective privacy policies. On the individual platforms, you will also find information on how to contact the operators and on the setting options for adverts:

• for Facebook: www.facebook.com/about/privacy

• for Instagram https://privacycenter.instagram.com/

• for Google: www.google.com/intl/de/policies/privacy

• for X: twitter.com/privacy

• at Xing: www.xing.com/privacy

• on youtube: www.youtube.com/t/privacy_at_youtube

• for LinkedIn: www.linkedin.com/static

We would also like to point out that only the operators of the respective platforms have full access to the user data and recommend that you contact the operators directly regarding requests for information or other questions about the rights of data subjects as users (e.g. right to cancellation):

• Facebook/ Instagram, Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland

• Google/ YouTube, Google Ireland Limited Gordon House, Barrow Street, Dublin 4, Ireland

• X, X Corp, 1355 Market St, Suite 900, San Francisco, CA 94103, USA

• Xing, New Work SE, Am Strandkai 1, 20354 Hamburg, Germany

• LinkedIn, LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland

If you no longer wish the data processing described here to take place in the future, you can disconnect your user profile from our website using the ‘I no longer like this page’ function.

We will inform you about Falken Tyre's data processing on the respective platforms in this privacy policy.

3.1 Facebook

Our online presence on Facebook is used to publish news, increase the visibility of the company and raise brand awareness. In this context, users' personal data may be processed:

• Publication of news: In our posts, we also publish text, including photos and videos of cooperation partners, possibly with their names mentioned. In such cases, processing is based on the consent of the data subjects.

• Answering message enquiries: We may answer or comment on questions from other users about our posts. In the case of enquiries in the form of private messages (direct message), we process the user name for this purpose.

• Statistical analyses: The Facebook Insights tool is used for statistical purposes to record visitor numbers, impressions, engagement and followers and to evaluate their development. The statistical data is only processed in aggregated, anonymised form.

3.2 Instagram

Our online presence on Instagram is used to publish news, increase the visibility of the company and raise brand awareness. In this context, personal data of users may be processed:

• Publication of news: In our posts, we also publish photos and videos of cooperation partners, including their names, if applicable. In such cases, processing is based on the consent of the data subjects.

• Answering message enquiries: We may answer or comment on questions from other users about our posts. In the case of enquiries in the form of private messages (direct message), we process the user name for this purpose.

• Statistical analyses: The Facebook Insights tool is used for statistical purposes to record visitor numbers, impressions, engagement and followers and to evaluate their development. The statistical data is only processed in aggregated, anonymised form.

3.3 Xing

Our online presence on Xing is used to publish news, increase the visibility of the company and raise brand awareness. In this context, personal data of users may be processed:

• Publication of news: In our posts, we also publish text, including photos and videos (embedded) from cooperation partners, possibly with their names mentioned. In such cases, processing is based on the consent of the data subjects.

3.4 LinkedIn

Our online presence on LinkedIn is used to publish company-related news. In this context, personal data of users may be processed:

• Publication of news: In our posts, we also publish text, including photos and videos of cooperation partners, possibly with their names mentioned. In such cases, processing is based on the consent of the data subjects.

3.5 X

Our online presence on X serves to publish news, increase the visibility of the company and raise brand awareness. In this context, users' personal data may be processed:

• Publication of news: In our posts, we also publish text, including photos and videos (embedded) from cooperation partners, possibly with their names mentioned. In such cases, processing is based on the consent of the data subjects.

• Answering message enquiries: We may answer or comment on questions from other users about our posts. In the case of enquiries in the form of private messages (direct message), we process the user name for this purpose.

• Statistical analyses: On X, statistical data provided by the platform is used to record visitor numbers, impressions, engagement and followers and to evaluate their development. The statistical data is only processed in aggregated, anonymised form.

3.6 youtube

Our online presence on YouTube is used to publish videos, increase the visibility of the company and raise brand awareness. In this context, personal data of users may be processed:

• Publication of videos: Data subjects may be depicted in our video contributions, possibly with their names mentioned. In such cases, processing takes place with the consent of the data subjects.

• Statistical analyses: On YouTube, we use the statistics provided by the platform about visitors and viewers of our videos. The statistical data on origin (how the video was found) and user characteristics (gender, age, subscriber status) are only summarised and presented to us in anonymised form. We have no influence on the data collected by YouTube and the duration of storage. We do not process the data outside the platform.

4. Making Contact on our website

4.1 E-mail, telephone, post

You have the option of contacting us by e-mail using the addresses provided, by telephone using the telephone numbers provided or by post. When you contact us, the personal data you provide (your e-mail address, your name and telephone number if applicable) will be stored and processed by us in order to respond to your enquiry. The exact purpose depends on the content of your enquiry (e.g. provision of product information, information on campaigns or events). We process your personal data on the basis of Art. 6 para. 1 lit. b GDPR for pre-contractual measures. Further information is provided on a voluntary basis. We delete the data arising in this context after storage is no longer necessary, or restrict processing if there are statutory retention obligations.

4.2 Tyre approval certificates / tyre pressure recommendation - form

We also offer you the option of having your tyre approval certificates/tyre pressure recommendation validated via the contact form on our website. We process the personal data you provide (name, contact details, tyre data) for the purpose of confirming the suitability/permissibility of tyre/rim combinations. We process your personal data on the basis of your consent in accordance with Art. 6 Para. 1 lit. a GDPR. We delete the data arising in this context after storage is no longer necessary, or restrict processing if there are statutory retention obligations.

5. Newsletter

With our newsletter we inform you about current offers and services, products and partners. If you would like to receive the newsletter, we require a valid e-mail address from you. The data entered in the input mask during registration will be collected. In order to be able to address you personally, we ask you to state your title and name. This data is only used for sending the newsletter. In addition to this data, we also store the date of registration. This logging serves solely as proof in the event that a third party misuses your e-mail address and subscribes to the newsletter using your e-mail address without your knowledge. We process your personal data for the purpose of sending the newsletter for product advertising and on the basis of your consent in accordance with Art. 6 para. 1 lit. a GDPR.

Cancellation / revocation: You can revoke your consent to the storage of your personal data and its use for sending the newsletter at any time. At the same time, your consent to the sending of the newsletter and the statistical analyses will expire. You will find a link to unsubscribe in every newsletter.

6. B2B Webshop

In our B2B webshop, our business customers have the option of ordering tyres online.

The data (customer master data, user account data, order data) is processed to fulfil our contractual obligations in the context of the business relationship, Art. 6 para. 1 lit b GDPR. If the account is deactivated, the processing of the data is restricted, the data is deleted in accordance with statutory retention periods.

7. Claims

Our customers can submit technical complaints about tyres sold by Falken Tyre Europe GmbH via PDF/paper forms or via the online portal (B2B webshop). The data entered in the form (dealer and dealer address, name of the dealer or employee, tyre data, vehicle data, type of complaint, date, damage if applicable) will be processed by us to check and process the complaint.

While the paper form is signed, the identity of the sender is determined in the online portal via the user ID. The processing is based on the fulfilment of warranty obligations within the framework of the contractual relationship, Art. 6 para. 1 lit b GDPR.

Personal data of other persons may be transmitted to us as part of the complaint, e.g. if the dealer provides invoices or vehicle registration certificates of tyre buyers as proof, from which the name, vehicle data and date of purchase can be seen. In these cases, the personal data will only be stored by us in the document and will not be used for other purposes outside the processing of the complaint. The processing takes place within the framework of the fulfilment of our statutory warranty obligation, Art. 6 para. 1 lit c GDPR.

8. Organisation of events

For the organisation of events for our customers (e.g. incentive trips, invitations to motorsport events, workshops, dealer conferences, etc.), we process the personal data of participants and guests required for the booking and organisation, such as name, address, email, telephone numbers, dates of birth, allergies and dietary preferences, if applicable. The processing takes place on the basis of the consent given at the time of registration in accordance with Art. 6 para. 1 lit. a GDPR and Art. 9 para. 2 lit. a GDPR.

9. Image and sound recordings at events

Image and sound recordings are made at events (such as motorsport events at the Nürburgring, trade fairs, promotional events) to be used for advertising and promotional purposes and for public relations work. The recordings may be published on the website and on social media sites or used in printed materials (flyers, brochures, posters). The photographs are always taken in accordance with the specifications of the respective event. The commissioned photographers and videographers are instructed to ensure that people are not recorded against their will, e.g. if they expressly signal that they do not wish to be recorded by stepping away. The legal basis is consent in accordance with Art. 6 para. 1 lit. a GDPR, otherwise legitimate interest in accordance with Art. 6 para. 1 lit. f GDPR. Our legitimate interest in processing the recordings lies in documenting the events for public relations and advertising purposes. The recordings will be deleted after fulfilment of the purpose or after revocation of consent.

10. Online applications

On our careers page you have the opportunity to apply online for advertised positions or to submit a speculative application. An application form provided by HRworks GmbH is embedded in the website.

We store your applicant data for the duration of the review of your application. If your application is unsuccessful, your application data will be deleted no later than 6 months after the end of the selection process. If you withdraw your application yourself, the documents will be deleted immediately.

The processing is carried out on the basis of Art. 6 para. 1 lit. b GDPR for the initiation of a possible employment.

You also have the option of making your application data available to the talent pool. In this case, we will retain the data so that we can get back to you if necessary. The data in the talent pool is routinely deleted after 2 years at the latest. However, you have the option of withdrawing your consent to storage in the talent pool at any time, whereupon your data will be deleted immediately.

If you do not provide us with the required personal data, this will not have any negative consequences for you. However, incomplete or incorrectly completed applications may not be considered. Unfortunately, the application cannot be submitted without providing your personal data and will therefore be deleted.

11. Competitions and promotional campaign (for example fuel voucher campaign)

If you take part in one of our competitions or promotional campaigns (e.g. fuel voucher campaigns), we will process the personal data you provide for participation in the respective sales promotion campaign.

We use the personal data collected in the participation form exclusively for the proper implementation of the campaign (see conditions of participation). Consent is obtained in accordance with Art. 6 para. 1 lit. a GDPR.

The personal data will be routinely deleted after the end of the campaign/promotion, but no later than 6 months after the prizes have been sent. The retention of the data for the period after the prizes have been sent serves to process latecomers and complaints in connection with the respective campaign or promotion.

In particular, the data will not be used for subsequent advertising purposes unless separate consent has been given for subscribing to the newsletter. There is no automated decision-making or profiling. If you have consented to the processing of personal data (see Art. 6 para. 1 lit. a GDPR), you can withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

12. Disclosure to third parties

We use service providers who process data on our behalf (e.g. email marketing, IT service providers, telecommunications providers). In the cases described here, the information is passed on to these third parties to enable further processing. The external service providers are carefully selected and regularly checked by us to ensure that your privacy is protected.

The service providers are service providers / processors bound by our instructions and are accordingly obliged by us, among other things, to treat your data exclusively in accordance with our instructions and the applicable data protection laws. In particular, they are obliged to treat your data as strictly confidential. They are also prohibited from processing the data for purposes other than those agreed.

The circumstances authorising data processing are derived from the above statements and the lawfulness pursuant to Art. 6 GDPR. The transfer of data to processors takes place in accordance with Art. 28 para. 1 GDPR.

We also do not sell your data to third parties, nor do we market it in any other way.

In addition, your personal data will be forwarded to the law enforcement authorities and, if necessary, to injured third parties without your express consent if this is necessary to clarify any unlawful use of our services or for legal prosecution. However, this only happens if there are concrete indications of unlawful or abusive behaviour. Disclosure may also take place if this serves to enforce terms of use or other agreements. We are also legally obliged to provide information to certain public authorities on request. These are law enforcement authorities, authorities that prosecute administrative offences subject to fines and the tax authorities. If a legal obligation exists, the processing is based on Art. 6 para. 1 lit. c GDPR.

This data is passed on on the basis of our legitimate interest in combating misuse, prosecuting criminal offences and securing, asserting and enforcing claims, provided that your rights and interests in the protection of your personal data do not prevail, Art. 6 para. 1 lit. f GDPR.

13. Transfer to third countries

A transfer of personal data to third countries only takes place to the extent described here and with the appropriate legal basis.

14. Deletion of data

Your personal data will be stored for as long as this is necessary to fulfil the respective purpose. Once the purpose no longer applies, the data will be routinely deleted. If the processing is based on consent, the data will be deleted at the latest after the consent has been withdrawn. Data is only stored beyond this point if it is subject to statutory retention obligations. In this case, the data will be stored until the expiry of the respective period.

Furthermore, data may be retained if this is necessary for the assertion of claims.

15. Other uses of data

In the event of further processing for purposes other than those for which the data was originally collected, we will inform you of these other purposes prior to further processing and provide you with further relevant information.

16. Misuse detection and tracking

We store information for misuse detection and tracking, in particular your IP address, for a maximum of 7 days. The legal basis in this respect is Art. 6 para. 1 lit. f GDPR. Our legitimate interest in retaining data for 7 days is to ensure the proper functioning of our website and the transactions carried out via it and to be able to ward off cyber attacks and the like. We may use anonymous usage information to customise the design of our website.

17. Rights regarding the processing of personal data

17.1 Right to information

You have the right to request information from us at any time about the personal data concerning you that we process within the scope of Art. 15 GDPR. You can submit a request by post or email to the addresses below.

17.2 Right to rectification of inaccurate data

You have the right to demand that we rectify your personal data without undue delay if it is incorrect (Art. 16 GDPR). To do so, please use the contact addresses given above.

17.3 Right to erasure

You have the right to immediate erasure (‘right to be forgotten’) of the personal data concerning you if the legal grounds pursuant to Art. 17 GDPR apply. These exist, for example, if the personal data are no longer necessary for the purposes for which they were originally processed or if you have withdrawn your consent and there is no other legal basis for the processing; the data subject objects to the processing (and there are no overriding grounds for processing - this does not apply to objections to direct marketing).

17.4 Right to restriction of processing

You have a right to restriction of processing if the conditions are met and in accordance with Art. 18 GDPR. According to this, the restriction of processing may be necessary in particular if the processing is unlawful and the data subject refuses the erasure of the personal data and instead requests the restriction of the use of the personal data or the data subject has objected to the processing pursuant to Art. 21 (1) GDPR pending the verification whether our legitimate grounds override theirs.

17.5 Right to data portability

You have a right to data portability in accordance with Art. 20 GDPR. You have the right to receive the data concerning you, which you have provided to us, in a commonly used, structured and machine-readable format and to transmit those data to another controller, such as another service provider. The prerequisite for this is that the processing is based on consent or on a contract and is carried out using automated procedures.

17.6 Right to object

YOU HAVE THE RIGHT TO OBJECT, ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION, AT ANY TIME TO PROCESSING OF PERSONAL DATA CONCERNING YOU WHICH IS BASED, INTER ALIA, ON ART. 6 ABS. 1 LIT. E OR F GDPR, OBJECTION PURSUANT TO ART. 21 GDPR. WE WILL STOP PROCESSING YOUR PERSONAL DATA UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING IS FOR THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS.

17.7 Right to lodge a complaint with a supervisory authority

If you believe that the processing of personal data concerning you by us is unauthorised, you have the right to lodge a complaint with the supervisory authority responsible for us, which you can contact as follows

The Hessian Commissioner for Data Protection and Freedom of Information P.O. Box 31 63 65021 Wiesbaden

Telephone: +49 611 1408-0

E-mail: poststelle@datenschutz-hessen.de-mail.de

---

Version September 2024