Data protection information according to Art. 13 and 14 DSGVO

Valid for customers, interested parties, suppliers and sales and cooperation partners of ARTEBENE GmbH (hereinafter referred to as "ARTEBENE GmbH").

The following information provides you with an overview of the processing of your personal data by us and your rights under the EU General Data Protection Regulation (DSGVO) and the German Federal Data Protection Act (BDSG). Which data is processed in detail and how it is used depends largely on the products and services requested or commissioned in each case.

1. person responsible for data processing

ARTEBENE GmbH
Werner-von-Siemens-Str. 1
59348 Lüdinghausen
Germany

Phone: +49 (0) 2591 / 792390
Fax : +49 (0) 2591 / 7424
E-Mail: info@artebene.com

2. data protection officer of the responsible person

GINDAT GmbH
Mr Arndt Halbach
Wetterauer Str. 6
42897 Remscheid
Germany

Phone: 49 (0) 2191 909 / 430
E-Mail : datenschutz@artebene.de

3. data and services

a) sources

We process personal data that we receive from you in the course of our business relationship. In addition, we process (to the extent necessary for the provision of our products and services) personal data that we have permissibly received from other organisations of ARTEBENE GmbH or from other third parties (e.g. for the execution of orders, for the fulfilment of contracts or on the basis of consent given by you). On the other hand, we process personal data that we have permissibly obtained from publicly accessible sources (e.g. trade and association registers, press, media, Internet) and are allowed to process.

b) categories of personal data

When initiating a business relationship or creating master data, the following personal data may be collected, processed and stored:

Address and communication data (name, address, telephone, e-mail address, other contact data), personal master data (date/place of birth, gender, nationality, marital status, business capacity, occupational group key, identification data (e.g. ID card data), authentication data (e.g. sample signature), tax ID).

When products and services are used within the scope of contracts concluded with us, the following additional personal data may be collected, processed and stored in addition to the aforementioned data:

Contract master data (order data, data from the fulfilment of our contractual obligations, details of any third-party beneficiaries), billing, performance and payment data (direct debit data, tax information, other personal master data (profession, employer), documentation data (e.g. logs), product data (e.g. requested or booked services and products) as well as the following business creditworthiness documents: income/surplus statements, balance sheets, business evaluation, type and duration of self-employment.

c) customer contact information

In the course of the business initiation phase and during the business relationship, in particular through personal, telephone or written contacts, initiated by you or by ARTEBENE GmbH, further personal data is created. This includes, for example, information about the contact channel, date, occasion and result, (electronic) copies of correspondence and information about participation in direct marketing measures.

d) services of the information society

When processing data in the context of information society services, you will receive further information on data protection in connection with the particular service.

4. purpose and legal basis of the processing

We process the personal data mentioned under 3. in accordance with the provisions of the EU General Data Protection Regulation (DSGVO) and the Federal Data Protection Act (BDSG):

a) for the fulfilment of contractual obligations (Article 6 para. 1 lit. b DSGVO)

Personal data is processed for the establishment, execution and termination of a contract for the provision of products or services as well as for the execution of pre-contractual measures for the preparation of offers, contracts or other requests directed towards the conclusion of a contract, which are made in response to your request.

The purposes of data processing primarily depend on the specific products and services and may include, among other things, needs analyses, consultations and support. Further details on the purpose of data processing can be found in the respective (also pre-contractual) contractual documents of our cooperation. Interested parties may be contacted, taking into account any restrictions expressed, during the contract initiation phase, and customers, suppliers and sales and cooperation partners may be contacted during the business relationship, using the data they have provided.

b) based on your consent (Article 6 para. 1 lit. a DSGVO)

Insofar as you have given us consent to process personal data for certain purposes (e.g. transfer of data within the corporate group), the lawfulness of this processing is based on your consent. Consent given can be revoked at any time. This also applies to the revocation of declarations of consent given to us before the EU General Data Protection Regulation came into force, i.e. before 25 May 2018. Please note that the revocation only takes effect for the future. Processing that took place before the revocation is not affected. You can request an overview of the status of the consent you have given us at any time.

c) due to legal requirements (Article 6 para. 1 lit. c DSGVO) or in the public interest (Article 6 para. 1 lit. e DSGVO)

We are subject to various legal obligations and statutory requirements and process data for the following purposes, among others: Identity and age verification, the fulfilment of tax control and reporting obligations as well as the assessment and management of risks in the organisation group.

d) within the framework of the balancing of interests (Article 6 para. 1 lit. f DSGVO)

Where necessary, we process your data beyond the actual fulfilment of the contract to protect the legitimate interests of us or third parties. Examples:

• Testing and optimisation of procedures for needs analysis and direct customer approach; incl. segmentations and calculation of closing probabilities,
• Advertising or market and opinion research, insofar as you have not objected to the use of your data
• Assertion of legal claims and defence in legal disputes
• Ensuring IT security and IT operations
• Consultation of and data exchange with credit agencies to determine creditworthiness or default risks
• Prevention of criminal offences
• Video surveillance for the preservation of domiciliary rights, for the collection of evidence in the case of criminal offences
• Building and office security measures (e.g. access controls)
• Measures to ensure domiciliary rights
• Measures for business management and further development of services and products
• Risk management in the organisational group

5. recipients of the data

Within the ARTEBENE GmbH, access to your data is granted to those departments that require it in order to fulfil our contractual and legal obligations. Service providers used by us may also receive data for these purposes if they comply with our written data protection instructions.

With regard to the transfer of data to recipients outside the ARTEBENE GmbH, it should first be noted that we are obliged to maintain confidentiality about all customer-related information of which we become aware. We may only pass on information about you if this is required by law, if you have given your consent and/or if processors commissioned by us guarantee that the requirements of the EU General Data Protection Regulation and the Federal Data Protection Act are met in the same way.

Under these conditions, recipients of personal data may be, for example:

• Public bodies and institutions in the event of a statutory or regulatory obligation
• Processors to whom we transfer personal data in order to carry out the business relationship with you. In detail: Support/maintenance of EDP/lT applications, archiving, document processing, call centre services, compliance services, controlling, data destruction, purchasing/procurement, space management, recovery, customer administration, lettershops, marketing, media technology, reporting, research, risk controlling, expense reporting, telephony, video legitimation, website management, auditing services, payment transactions.

Further data recipients may be those parties for whom you have given your consent to the transfer of data.

6. data transfer to third countries or to an international organisation

Data is only transferred to countries outside the EU or the EEA (so-called third countries) if this is necessary for the execution of your orders, is required by law (e.g. reporting obligations under tax law), you have given us your consent or within the scope of commissioned processing. If service providers in third countries are used, they are obliged to comply with the level of data protection in Europe by agreeing to the EU standard contractual clauses in addition to written instructions.

7. duration of the data storage

We process and store your personal data as long as it is necessary for the fulfilment of our contractual and legal obligations. If the data is no longer required for the fulfilment of contractual or legal obligations, it is regularly deleted, unless its (temporary) further processing is necessary for the following purposes:

• Fulfilment of retention periods under commercial and tax law in accordance with §257 of the German Commercial Code (HGB) and the German Fiscal Code (Abgabenordnung) with the retention or documentation periods of two to ten years specified therein.
• preservation of evidence within the framework of the statute of limitations. According to sections 195 et seq. of the German Civil Code (BGB), these limitation periods can be up to 30 years, with the regular limitation period being three years.

8. obligation to provide data

Lorem ipsum dolor sit amet, consectetur adipisici elit, sed eiusmod tempor incidunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquid ex ea commodi consequat. Quis aute iure reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint obcaecat cupiditat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.

9. automated decision-making (including profiling)

As a matter of principle, we do not use fully automated decision-making (including profiling) in accordance with Article 22 of the DSGVO to establish and implement the business relationship. Should we use these procedures in individual cases, we will inform you about this separately if this is required by law.

10. Profiling

We process your data partly automatically with the aim of evaluating certain personal aspects (profiling). We use profiling, for example, to be able to inform and advise you about products in a targeted manner with the help of evaluation tools. These enable needs-based communication and advertising, including market and opinion research.

11. your rights

Pursuant to Articles 15-21 of the DSGVO, you may exercise the following rights in relation to the personal data we process, provided the conditions described therein are met.

You may request information pursuant to Article 15 of the DSGVO about your personal data processed by us.

If inaccurate personal data is processed, you have a right to rectification pursuant to Art. 16 DSGVO.

If the legal requirements are met, you may request the deletion or restriction of processing (Art. 17, 18 DSGVO).

You have the right to revoke your declaration of consent under data protection law at any time. The revocation of consent does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation.

Right of objection pursuant to Art. 21 DSGVO
The data subject shall have the right to object at any time, on grounds relating to his or her particular situation, to the processing of personal data concerning him or her which is carried out on the basis of Article 6(1)(e) or (f) of the DSGVO; this shall also apply to any profiling based on those provisions.

12. right of complaint to a supervisory authority

According to Art 77 of the DSGVO, every data subject has the right to lodge a complaint with a supervisory authority if he or she is of the opinion that the processing of personal data concerning him or her violates the DSGVO. The responsible supervisory authority for data protection issues is the State Data Protection Commissioner of the federal state in which our organisation is based.