Privacy policy for OIY Solutions GmbH in accordance with the requirements of the DSGVO

OIY Solutions GmbH (hereinafter referred to as the "responsible party"), is pleased that you are visiting our website. Data protection and data security when using our website are very important to us. We would therefore like to inform you at this point which of your personal data we collect when you visit our website and for what purposes it is used.

Since changes in the law or changes in our internal company processes may make it necessary to adapt this data protection declaration, we ask you to read it regularly. The data protection declaration can be called up, saved and printed out at any time under Data protection declaration.

§ 1 Responsible party and scope of application

The responsible party within the meaning of the EU General Data Protection Regulation (hereinafter: DSGVO) and other national data protection laws of the member states as well as other data protection regulations is:

OIY Solutions GmbH

Weyertal 109

50931 Köln

Germany

Tel.: +49 (0)221 6700 4044

E-Mail: info@oater.de

Website: www.oater.de

Further information can be found in the imprint of our website. This data protection declaration applies to the internet offer of OIY Solutions GmbH, which can be accessed under the domain www.oater.de as well as the various subdomains (hereinafter referred to as "our website").

§ 2 Principles of data processing

We process personal data of our users only insofar as this is necessary for the provision of a functional website and our content and services. The processing of personal data of our users is regularly only carried out with the consent of the user. An exception applies in those cases where it is not possible to obtain prior consent for factual reasons and the processing of the data is permitted by legal regulations.

§ 3 Legal basis

DThe legal bases for the processing of personal data result in principle from:

• 6 para. 1 lit. a DSGVO, insofar as we obtain the consent of the data subject for processing operations of personal data.
• 6 para. 1 lit. b DSGVO for the processing of personal data which is necessary for the performance of a contract to which - the data subject is a party. This also applies to processing operations that are necessary for the performance of pre-contractual measures.
• 6 para. 1 lit. c DSGVO, insofar as processing of personal data is necessary for compliance with a legal obligation to which our company is subject.
• 6 para. 1 lit. f DSGVO, insofar as processing is necessary to protect a legitimate interest of our company or a third party and the interests, fundamental rights and freedoms of the data subject do not override the former interest.

For the processing operations carried out by us, we indicate the specific applicable legal basis in each case.

§ 4 Data deletion and storage period

The personal data of the data subject will be deleted or blocked as soon as the purpose of storage ceases to apply. Storage may take place beyond this if this has been provided for by the European or national legislator in Union regulations, laws or other provisions to which the controller is subject. Data will also be blocked or deleted if a storage period prescribed by the aforementioned standards expires, unless there is a need for further storage of the data for the conclusion or performance of a contract.

§ 5 Passing on of data

We will only pass on your personal data to third parties if:

• you have given your express consent to this in accordance with Art. 6 Para. 1 lit. a DSGVO
• this is legally permissible and necessary for the fulfillment of a contractual relationship with you according to Art. 6 para. 1 lit. b DSGVO there is a legal obligation for the transfer according
• to Art. 6 Par. 1 lit. c DSGVO the disclosure is necessary in accordance with Art.
• there is a legal obligation to disclose the data the disclosure is necessary in accordance with Art. 6 Para. 1 lit. f DSGVO for the protection of legitimate business interests, as well as for the assertion, exercise or defense of legal claims and there is no reason to assume that you have an overriding interest worthy of protection in the non-disclosure of your data.

Recipients of the data are:

1. Hubspot

On this website, we use the service HubSpot for various purposes. HubSpot is a software company from the USA with a branch in Ireland. Contact: HubSpot, 2nd Floor 30 North Wall Quay, Dublin 1, Ireland, phone: +353 1 5187500.

Hubspot is an integrated software solution that we use to cover various aspects of our online marketing. These include:

Email Marketing, Social Media Publishing & Reporting, Reporting, Contact Management (e.g. user segmentation & CRM), Landing Pages and Contact Forms.

Our sign-up service allows visitors to our website to learn more about our company, download content, and provide their contact information and other demographic information. This information, as well as our website content, is stored on servers operated by our software partner HubSpot.

It may be used by us to contact visitors to our website and to determine which of our company's services are of interest to them. All information we collect is subject to this privacy policy. We use all collected information exclusively to optimize our marketing measures.

As part of the optimization of our marketing measures, the following data may be collected and processed via Hubspot:

• Geographic location
• Browser type
• Navigation information
• Referral URL
• Performance data
• Information about how often the application is used
• Mobile apps data
• HubSpot subscription service credentials
• Files that are displayed on site
• Domain names
• Pages viewed
• Aggregated usage
• Operating system version
• Internet service provider
• IP address
• Device identifier
• Duration of visit
• Where the application was downloaded from
• Operating system
• Events that occur within the application
• Access times
• Clickstream data
• Device model and version

In addition, we also use Hubspot to provide contact forms. For more information in this regard, please refer to subsection 4 of this Privacy Policy.

The legal basis for the processing is your consent pursuant to Art. 6 para. 1 lit. a DSGVO. If you do not want the aforementioned data to be collected and processed via Hubspot, you can refuse your consent or revoke it at any time with effect for the future.

The personal data will be kept for as long as it is necessary to fulfill the purpose of processing. The data will be deleted as soon as they are no longer required to achieve the purpose. In the context of processing via HubSpot, data may be transferred to the USA. The security of the transfer is secured via so-called standard contractual clauses, which ensure that the processing of personal data is subject to a level of security that corresponds to that of the GDPR. If the standard contractual clauses are not sufficient to establish an adequate level of security, your consent pursuant to Art. 49 (1) lit. a DSGVO may serve as the legal basis for the transfer to third countries.

§ 6 Conditions for the transfer of personal data to third countries

In the course of our business relationships, your personal data may be transferred or disclosed to third party companies. These may also be located outside the European Economic Area (EEA), i.e. in third countries. When transferring your personal data in third countries, we ensure compliance with the special requirements of Art. 44 et seq. GDPR.

Some third countries are certified by the European Commission through so-called adequacy decisions to have a level of data protection that is comparable to the EEA standard. However, in other third countries to which personal data may be transferred, there may not be a consistently high level of data protection due to a lack of legal provisions. If this is the case, we ensure that data protection is adequately guaranteed. This is possible via binding company regulations, standard contractual clauses of the European Commission for the protection of personal data pursuant to Art. 46 (1), (2) 46 Abs. 1, 2 lit. c DSGVO in conjunction with appropriate security guarantees, certificates or recognized codes of conduct.

§ 7 Individual processing operations

1. Provision and use of the website
2. Type and scope of data processing

When you call up and use our website, we collect the personal data that your browser automatically transmits to our server. When you use our website, we collect the following data, which is technically necessary for us to display our website to you and to ensure stability and security:

• IP address of the requesting computer
• Date and time of access
• Name and URL of the file accessed
• WWebsite from which the access is made (referrer URL)
• browser used and, if applicable, the operating system of your computer, as well as the name of your access provider.

This information is temporarily stored in a so-called log file. This data is not stored together with other personal data of the user.

1. Purpose and legal basis

The temporary storage of the IP address by the system is necessary to enable delivery of the website to the user's computer. For this purpose, the IP address of the user must remain stored for the duration of the session. The storage in log files is done to ensure the functionality of the website. In addition, we use the data to optimize the website and to ensure the security of our information technology systems. An evaluation of the data for marketing purposes does not take place in this context.

Art. 6 para. 1 lit. f DSGVO serves as the legal basis for the temporary storage of the data and the log files. The collection of data for the provision of the website and the storage of the data in log files is mandatory for the operation of the website. Consequently, there is no possibility of objection on the part of the user.

1. Storage period

As soon as the aforementioned data is no longer required to display the website, it is deleted. In the case of the collection of data for the provision of the website, this is the case when the respective session has ended. Further storage may take place in individual cases if this is required by law.

In the case of storage of data in log files, this is the case after seven days at the latest. Storage beyond this period is possible. In this case, the IP addresses of the users are deleted or alienated, so that an assignment of the calling client is no longer possible.

1. Registration / Waiting list
2. Type and scope of data processing

On our website, we offer you the opportunity to be placed on our waiting list by providing personal data. The data is entered into an input mask, transmitted to us and stored.

The following overview shows you in detail which personal data we collect from you when you register:

• Name
• E-mail address
• Address
• Date of birth
• Interests, if applicable

The following data is also stored at the time of registration:

• IP-adress
• Date and time of registration
• Duration of the user's stay on the website
• Purpose and legal basis

The registration is necessary for the fulfillment of a contract with us or for the implementation of pre-contractual measures for the following reasons: we check your data in order to be able to offer you relevant services and content.

The legal basis for the processing of the data is Art. 6 para. 1 lit. a DSGVO if the user has given his consent. The processing of the personal data presented serves the fulfillment of a contract between you and us or the implementation of pre-contractual measures, so that in addition Art. 6 para. 1 lit. b DSGVO serves as the legal basis.

1. End of registration or change of data

As a user, you have the option to terminate your registration at any time. You can also have the data stored about you changed at any time. To do so, proceed as follows: You can either write us an email to the above address so that we delete your data, or change your data in your account.

However, if the processed data is still required for the fulfillment of a contract or for the implementation of pre-contractual measures, early deletion of the data is only possible insofar as this does not conflict with contractual or legal obligations.

1. Newsletter
2. Type and scope of data processing

On our website, you have the option of subscribing to a free newsletter. In order to send you the newsletter on a regular basis, we need the following information from you:

• E-Mail adress
• Name

ZIn addition, the following data is collected during registration:

• IP address of the calling computer
• Date and time of registration

For the processing of data, your consent is obtained during the registration process and reference is made to this privacy policy.

In connection with the data processing for the newsletter dispatch, your data will not be passed on to third parties. The data is used exclusively for sending the newsletter.

or the newsletter dispatch, we use the so-called double opt-in procedure, i.e. we will only send you the newsletter if you first confirm your registration via a confirmation e-mail sent to you for this purpose by means of a link contained therein. In this way, we want to ensure that only you, as the owner of the e-mail address provided, can register for the newsletter. Your confirmation must be made promptly after receipt of the confirmation e-mail, otherwise your newsletter registration will be automatically deleted from our database.

We reserve the right to send you advertising without your consent if you have purchased goods or services from us and the advertising is related to the goods or services. This will only be done if you have not previously objected to the advertising. Each time we send you advertising, we will also inform you of the possibility of objecting.

1. Purpose and legal basis

The collection of the user's e-mail address serves to deliver the newsletter. The collection of other personal data during the registration process serves to prevent misuse of the services or the e-mail address used.

The legal basis for the processing of data after the user has registered for the newsletter is Art. 6 para. 1 lit. a DSGVO if the user has given his consent. The legal basis for sending the newsletter as a result of the sale of goods or services is Section 7 (3) UWG.

1. Storage period

The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. Accordingly, the user's e-mail address is stored for as long as the subscription to the newsletter is active. The other personal data collected during the registration process is usually deleted after a period of seven days.

Declaration of consent::

By entering my data and pressing the button "Send", I declare my consent to the processing of my e-mail address, name for a regular newsletter mailing. I can unsubscribe from the newsletter service at any time by clicking the corresponding link at the end of the newsletter.

I can revoke my consent to the collection of personal data collected during the registration process at any time.

1. Storage period

Your e-mail address, name will be stored as long as you have subscribed to the newsletter. After unsubscribing from the newsletter mailing, your e-mail address will be deleted. Further storage may take place in individual cases if required by law.

1. Contact form
2. Type and scope of data processing

On our website, we offer you the opportunity to contact us via a provided form. In the context of sending your request via the contact form, reference is made to this data protection declaration in order to obtain your consent. If a user takes advantage of this option, the data entered in the input mask will be transmitted to us and stored.

These data are:

• E-mail address
• Name
• Company, if applicable
• Contact person, if applicable
• If applicable, further personal data that you wish to communicate to us as part of the message

The following data is also stored at the time the message is sent:

• IP address
• Date and time

When using the contact form, your personal data will not be passed on to third parties.

1. Legal basis

The purpose of providing your e-mail address is to be able to assign your inquiry and respond to you.

The legal basis for the processing of the data is Art. 6 Para. 1 lit. a DSGVO if the user has given his consent.

1. Storage period

Declaration of consent:

By entering my data and pressing the "Send" button, I declare my consent to the processing of my e-mail address, name, company (if applicable) and any other personal data that I provide as part of my message for the purpose of responding to my contact request.

I can revoke my consent to the collection of personal data collected during the use of the contact form at any time.

The data will be deleted as soon as they are no longer required to achieve the purpose for which they were collected. For the personal data from the input mask of the contact form, this is the case when the respective conversation with the user has ended. The conversation is ended when it is clear from the circumstances that the matter in question

has been conclusively clarified. The additional personal data collected during the sending process will be deleted after a period of seven days at the latest.

§ 8 Use of cookies

1. Type and scope of data processing

We use cookies on our website. Cookies are small text files that are sent by us to the browser of your end device during your visit to our website and stored there. Some functions of our website cannot be offered without the use of technically necessary cookies. Other cookies, on the other hand, enable us to perform various analyses. Cookies are, for example, able to recognize the browser you are using when you visit our website again and to transmit various information to us. With the help of cookies, we can, among other things, make our website more user-friendly and effective for you, for example by tracking your use of our website and determining your preferred settings (e.g. country and language settings). If third parties process information via cookies, they collect the information directly from your browser. Cookies do not cause any damage to your end device. They cannot execute programs or contain viruses.

ADifferent types of cookies are used on our website:

| Type 1: Transient cookies | Our website uses transient cookies, which are automatically deleted as soon as you close your browser. This type of cookie makes it possible to record your session ID. This makes it possible to assign various requests from your browser to a common session and enables us to recognize your terminal device during subsequent website visits within a session. | | --- | | Type 2: Persistent cookies | Persistent cookies are used on our website. Persistent cookies are cookies that are stored in your browser for a longer period of time and transmit information to us. The respective storage period differs depending on the cookie. You can delete persistent cookies independently via your browser settings. | | | | Type 3: Third-party cookies | In some cases, cookies from third-party companies may also be stored on your terminal device when you enter our site. These enable us or you to use certain services of the third-party company (e.g. cookies for processing payment services). | |

1. Purpose and legal basis

The purpose of using technically necessary cookies is to simplify the use of websites for users. Some functions of our website cannot be offered without the use of cookies. This refers, for example, to the following applications: Consent Manager. In addition, these cookies contribute to a safe and compliant use of the website.

The analysis cookies are used for the purpose of improving the quality of our website and its content. Through the analysis cookies, we learn how the website is used and can thus constantly optimize our offer. For example, information is collected about how our website is used by visitors, which pages are called up most frequently, or whether error messages are displayed on certain pages.

The legal basis for the storage of cookies, device identifiers and similar tracking technologies, or for the storage of information in the end user's terminal equipment and access to this information, as well as any subsequent use of the personal data, is their consent in accordance with Section 25 (1) of the Telecommunications and Telemedia Data Protection Act (TTDSG). If the cookies are not stored on the end user's terminal device, consent is required pursuant to Art. 6 (1) lit. a DSGVO.

The legal basis for the processing of personal data using technically necessary cookies is Art. 6 para. 1 lit. f DSGVO.

1. Storage period

Cookies are stored on the user's computer and transmitted from it to our site. Therefore, you as a user also have full control over the use of cookies. By changing the settings in your internet browser, you can disable or restrict the transmission of cookies. Cookies that have already been stored can be deleted at any time. This can also be done automatically. If cookies are deactivated for our website, it may no longer be possible to use all the functions of the website in full.

§ 9 Hyperlinks

On our website there are so-called hyperlinks to websites of other providers. When activating these hyperlinks, you will be redirected from our website directly to the website of the other provider. You will recognize this, among other things, by the change of URL. We cannot accept any responsibility for the confidential handling of your data on these third-party websites, as we have no influence on whether these companies comply with data protection regulations.

A button of the network "LinkedIn" is used on our website. When you click this button, you will be redirected to our LinkedIn page. In doing so, a connection to servers of LinkedIn Corp. (hereinafter "LinkedIn") is established via your browser. LinkedIn stores personal data of you about the call of this website. We have no influence on the processing of your personal data by LinkedIn. You can access the current data protection information of LinkedIn and supplementary information on this website:

https://de.linkedin.com/legal/privacy-policy.

A button of the network "Instagram" is used on our website. When you click this button, you will be redirected to our LinkedIn page. In doing so, a connection to servers of Instagram Corp. (hereinafter "Instagram") is established via your browser. Instagram stores personal data of you about the call of this website. We have no influence on the processing of your personal data by Instagram. You can access the current privacy information of Instagram and supplementary information on this website:

https://privacycenter.instagram.com/policy/?entry_point=ig_help_center_data_policy_redirect.

§ 10 Data subject rights

The DSGVO gives you the following rights as a data subject of a processing of personal data:

• Information:In accordance with Art. 15 DSGVO, you can request information about your personal data processed by us. In particular, you can request information about the processing purposes, the categories of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned storage period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right of complaint, the origin of your data if it has not been collected by us, about a transfer to third countries or international organizations, and about the existence of automated decision-making, including profiling, and, if applicable, meaningful information about its details.
• Correction: In accordance with Art. 16 DSGVO, you can immediately request the correction of incorrect or the completion of your personal data stored by us.
• Erasure: Pursuant to Art. 17 DSGVO, you may request the erasure of your personal data stored by us, unless the processing is necessary for the exercise of the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defense of legal claims.
• Restriction: Pursuant to Article 18 of the GDPR, you may request the restriction of the processing of your personal data if you dispute the accuracy of the data, the processing is unlawful, we no longer need the data and you object to their deletion because you need them for the assertion, exercise or defense of legal claims. You also have the right under Art. 18 DSGVO if you have objected to the processing in accordance with Art. 21 DSGVO.
• Data portability:Pursuant to Art. 20 DSGVO, you may request to receive your personal data that you have provided to us in a structured, commonly used and machine-readable format or you may request the transfer to another controller.
• Revocation:In accordance with Art. 7 (3) DSGVO, you may revoke your consent at any time. This has the consequence that we may no longer continue the data processing based on this consent for the future.
• Objection: Art. 21 DSGVO you have the right to object to the processing of your personal data on the basis of legitimate interests pursuant to Art. 6 (1) lit. f DSGVO, insofar as there are grounds for doing so that arise from your particular situation or the objection is directed against direct advertising. In the case of direct advertising, you have a general right of objection, which is implemented by us without specifying a particular situation.
• Complaint: Pursuant to Art. 77 DSGVO, you have the right to complain to a supervisory authority. As a rule, you can contact the supervisory authority of your usual place of residence, your place of work or our company headquarters for this purpose. The supervisory authority responsible for us is:

DThe State Commissioner for Data Protection and Freedom of Information.
Kavalleriestr. 2-4
40213 Düsseldorf poststelle@ldi.nrw.de
0211 – 38424-0