We, the ZIEGERT Group Holding GmbH, appreciate your interest in our company and our website. We take the protection of your personal data seriously. Therefore, we would like to inform you about when we store which personal data and how we use them. Your personal data is processed in strict compliance with the relevant legal provisions; the data is deleted as soon as it is no longer needed for the purpose for which it was collected.

Personal data is any information relating to an identified or identifiable natural person (Art. 4 No. 1 DSGVO). This includes information such as your name, your e-mail address, your postal address or your telephone number. Information that cannot be linked to your identity, such as the number of users of a website, is not included.

Our online offer may contain links to websites of other providers. We are not responsible for the offers of these third parties and their data processing.

1. Processing of personal data a) Processing of personal data for informational use

When using the website for information purposes only, i.e. when you do not log in to use the website, register, use the contact form or otherwise provide us with information, we do not collect any personal data, with the exception of the data that your browser transmits to enable you to visit the website (for example, IP address, date and time of the request, browser type and pages viewed). We also use cookies (see point 2.a)) to enable you to visit the website.

No personal exploitation takes place except in the cases described in this privacy policy. The statistical evaluation of anonymised data records is reserved.

The legal basis for the processing of personal data is Art. 6 (1) sentence 1 lit. b DSGVO, insofar as the data processing is necessary for the provision of our offer. Any data processing beyond this is based on Art. 6 para. 1 p. 1 lit. f DSGVO. We have a legitimate interest in ensuring the security and effective use of our website and in verifying it by means of the creation of anonymised data records.

The personal data collected will be stored for as long as is necessary for the aforementioned purposes and then deleted immediately, unless legal retention periods require longer storage.

2. Cookies Cookie settings

The website uses so-called cookies in several places. They serve to make our offer more user-friendly and effective. Cookies are small text files that are stored on your computer and saved by your browser. Most of the cookies we use are so-called "session cookies", which we set for a limited period of time during your visit to our website. For certain offers, we use persistent cookies, which are used to recognise visitors and are stored on your computer for future sessions. Persistent cookies are automatically deleted after a specified period of time, which may differ depending on the cookie.

Cookies can be "first party cookies", i.e. those set by ZIEGERT Group Holding GmbH, or "third party cookies", i.e. cookies set by third parties. We work in strict compliance with the legal regulations with such external companies that provide services such as web tracking or range measurement for us. We have ensured that these companies comply with the requirements of this privacy policy. Additional individual information on cookies and data protection with regard to the individual services can be found in the following sections.

Cookies do not cause any damage to your computer and do not contain viruses. In your browser settings you can determine whether cookies may be set or not.

a) Essential cookies

Cookies that are required to carry out the electronic communication process or to provide certain functions of our website and to operate it (so-called necessary cookies) are stored on the basis of Art. 6 para. 1 p. 1 lit. b DSGVO. They cannot be deactivated, as the cookies are necessary to provide you with the corresponding services. These are, for example, cookies with which your language and data protection settings are stored. With the help of necessary cookies, we regularly process your IP address, the time of your request, device data (e.g. operating system, browser version) and settings that you make when visiting our website (e.g. language). The collected data is stored for a period of 7 days and then deleted.

b) Non-essential cookies

All other non-essential cookies are only set if you have given your prior consent. The legal basis is Art. 6 para. 1 p. 1 lit. a DSGVO. We use a cookie banner for this purpose, in the context of which you can give your consent to the various cookies. The consent is voluntary and can be revoked at any time without giving reasons with effect for the future. To do this and adjust your cookie preferences, you can follow this link and select or deselect certain cookie categories. By clicking on "Save selection", the current setting will be saved and applied immediately. You may also refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of this website.

1. Performance cookies

We use performance cookies to evaluate the use of our website. These cookies collect data about how visitors use our services in order to improve the performance of our services. If you do not allow these cookies, we will not be able to analyse the performance of our services and tailor them to the needs of our users. We currently use the following performance cookies:

a) Google Analytics

This website uses functions of the web analysis service Google Analytics of Google Inc. (Google), 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (https://www.google.com/). The information generated by the cookie about your use of this website will usually contain personal data (e.g. IP address, online and device identifiers, information about user behaviour) and will be transmitted to and stored by Google on servers in the United States. In the event that IP anonymisation is activated on this website, however, your IP address will be truncated beforehand by Google within member states of the European Union or in other contracting states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. On behalf of the operator of this website, Google will process this information for the purpose of evaluating your use of the website, compiling reports on website activity and providing other services relating to website activity and internet usage to the website operator. Die im Rahmen von Google Analytics von Ihrem Browser übermittelte IP-Adresse wird nicht mit anderen Daten von Google zusammengeführt.

The data processing is based on your consent, Art. 6 para. 1 p. 1 lit. a DSGVO. The transfer of data to Google is based on Art. 28 DSGVO in conjunction with the order processing agreement. For the transfer of your personal data to the third country, we have concluded the standard contractual clauses (https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc/standard-contractual-clauses-international-transfers_de) with Google and take additional security measures to the extent necessary to compensate for the lower level of data protection in the USA compared to the level of data protection in the EU.

Google Analytics cookies are stored for a period of 24 hours (to distinguish daily visits), or 2 years. Personal data is deleted after a period of 26 months.

You can also prevent the collection of data generated by the cookie and related to your use of the website (incl. your IP address) by Google and the processing of this data by Google by downloading and installing the browser plugin available at the following link: https://tools.google.com/dlpage/gaoptout?hl=de. You can also prevent the collection by Google Analytics by clicking on the following link: Deactivate Google Analytics. An opt-out cookie will be set to prevent future collection of your data when visiting this website. For more information on the terms of use and data protection of Google Analytics, please visit http://www.google.com/analytics/terms/de.html or https://www.google.de/intl/de/policies/.

b) Google Tag Manager

This website uses the Google Tag Manager from Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (https://www.google.de/). Google Tag Manager is a solution that allows marketers to manage website tags through one interface. The Google Tag Manager service itself (which implements the tags) is a cookie-less domain, but helps us load and manage third-party website tags and connect this website to those services where you have consented to the use of appropriate cookies or other technologies. The Google Tag Manager service provides for the triggering of other tags, which in turn may collect data. Google Tag Manager does not access this data. If consent has not been given at the domain or cookie level, this will remain the case for all tracking tags implemented with Google Tag Manager.

The data processing is based on your consent pursuant to Art. 6 para. 1 p. 1 lit. a DSGVO. The data transfer to Google is based on Art. 28 DSGVO in conjunction with the order processing agreement.

The Google Tag Manager is stored for a period of 2 years. The personal data will be deleted after a period of 26 months. Google may process personal data outside the EU / EEA. For the transfer of your personal data to third countries for which there is no adequacy decision, we have concluded the standard contractual clauses (https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc/standard-contractual-clauses-international-transfers_de) with Google and take additional security measures to the extent necessary to compensate for the lower level of data protection in the respective recipient country (e.g. in the USA) compared to the level of data protection in the EU.

c) Hotjar

This website uses Hotjar, an analysis software from Hotjar Ltd ("Hotjar"), Level 2 St Julians Business Centre, 3, Elia Zammit Street, St Julians STJ 1000, Malta, Europe. Hotjar enables us to analyze usage behavior on our website in order to better understand the needs of our users and to optimize our website. To this end, Hotjar processes the following data on our behalf:

• Shortened IP address
• User interactions
• Mouse events (movement, position and clicks)
• Keystrokes
• Language settings
• Screen sizes
• Browser settings
• Time and date of visit to the website/li>

Hotjar sets a cookie that assigns you a unique user ID to recognize you when you return to our website and that expires after 365 days. Hotjar also places session cookies to recognize you across different pages of our website, to identify new users and/or changes in user attributes, and to collect information about your viewport (size and dimension). In addition, Hotjar places cookies that expire after 30 minutes to recognize when you first visit a page on our website and to recognize if you are included in data collection based on our website's page view limit. The personal data will be deleted after a period of 12 months.

The data processing is based on your consent in accordance with Article 6 Paragraph 1 Clause 1 Letter a GDPR. The data is transmitted to Hotjar on the basis of Art. 28 GDPR in conjunction with the order processing contract. Hotjar may process personal data outside of the EU/EEA. For the transfer of your personal data to third countries for which there is no adequacy decision, we have the EU standard contractual clauses with Hotjar (https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension- data-protection/standard-contractual-clauses-scc/standard-contractual-clauses-international-transfers_de) and take additional security measures insofar as this is necessary to compensate for the lower level of data protection in the respective recipient country compared to the level of data protection in the EU.

If you do not want Hotjar to process the data, you can also object to the processing at any time with effect for the future on the page https://www.hotjar.com/legal/compliance/opt-out. Please note that this will set a cookie on your end device, which prevents Hotjar from collecting data for web analysis purposes. The objection applies until you delete the cookie.

3. Career

You can also apply to ZIEGERT Group Holding GmbH electronically. This is done via Personio GmbH, Rundfunkplatz 4, 80335 Munich, Germany, which provides the electronic applicant management platform. The following data is collected in this process: Name, date of birth, address, e-mail and your application documents. We will, of course, only use your details to process your application and will not pass them on to third parties. Please note that unencrypted e-mails will not be transmitted without access protection.

Please refrain from including sensitive data in your application. Sensitive data means personal data revealing your ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, as well as genetic data, biometric data for unique identification, health data or data concerning your sex life or sexual orientation.

The data processing is based on § 26 para. 1 p. 1 BDSG. The data transfer to Personio GmbH is based on Art. 28 DSGVO in conjunction with the order processing agreement. The data will be deleted within 6 months after completion of the application process. If you conclude an employment contract with ZIEGERT Group Holding GmbH, the data required for the implementation of the employment relationship will be stored beyond this and deleted in accordance with the legal requirements.

4. Communicate with us

You can contact us by email, telephone or also by post. If you do so, we will process the information in your request as well as the date of your request together with the contact details you provided or used in order to process your request and communicate with you. Legal basis The data processing is based on Art. 6 (1) p. 1 lit. b DSGVO, as it is necessary to process your request. The data will be stored for as long as is necessary to process your enquiry and to clarify any follow-up questions and will then be deleted, unless legal retention periods require longer storage.

5. Disclosure of data to third parties

As a matter of principle, we do not pass on any data to third parties - except in the cases specified in this data protection information - unless you have expressly consented or this is provided for by law. In particular, data is only exchanged with other companies of the ZIEGERT Group if the exchange is necessary in the context of the execution or initiation of the contract.

Furthermore, data is shared under strict contractual and legal requirements as follows:

To external service providers for data processing: If service providers come into contact with personal data of our customers (e.g. for the purpose of sending requested information brochures, web tracking or reach measurement), this takes place within the framework of so-called commissioned data processing under the conclusion of a so-called commissioned processing agreement. This is expressly provided for by law (Art. 28 DSGVO). ZIEGERT Group Holding GmbH remains responsible for the protection of your data even in this case. The service provider works exclusively in accordance with our instructions, which we ensure through strict contractual regulations, through technical and organisational measures and through supplementary controls.

Because of legal obligation: In certain cases, we are legally obliged to transmit data to a requesting government agency (e.g. public authorities, law enforcement agencies) or courts. The legal basis in these cases is Art. 6 para. 1 p. 1 lit. c DSGVO. In some cases, there may also be corresponding obligations to transfer data to other companies or persons.

Because of our legitimate interests: Unless we are required by law to disclose personal data, we may nevertheless have a legitimate interest in disclosing personal data to government agencies, courts, other companies (including lawyers) or individuals. The legal basis in these cases is Art. 6 para. 1 p. 1 lit. f DSGVO, as we have a legitimate interest in protecting our rights, interests and the safety of us as well as our employees, customers or other partners.

6. Retention periods

Unless otherwise explained in this privacy policy, personal data will be stored for as long as necessary for the relevant processing purpose. Subsequently, the data will be deleted unless further data storage is required or justified by law.

7. Transfer of personal data to recipients in countries outside the EU / EEA

For some of the purposes described above, we transfer your personal data to recipients who are based outside the EU or the EEA or who process data in corresponding countries. These countries may not have the same level of data protection as the EU or EEA. Furthermore, these recipients may be subject to national laws and your personal data may be accessible to local governments, courts, law enforcement and regulatory authorities. However, when transferring your personal data to such third countries, we will take appropriate measures to adequately secure your data.

If there is no EU Commission adequacy decision for the recipient country, the transfer of your data to a third country is protected by the fact that EU standard contractual clauses (https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en) have been concluded with the recipient or binding internal data protection guidelines exist. Otherwise, a transfer will only take place if an exception according to Art. 49 DSGVO is fulfilled. In addition, we take further security measures to the extent necessary to compensate for a lower level of data protection in the respective recipient country compared to the level of data protection in the EU or the EEA.

Please contact us (see section 12) if you would like more information about the specific security measures applied by the recipients of your personal data.

8. Automated decision making

A decision based exclusively on automated processing, including profiling, which produces legal effects vis-à-vis you or similarly significantly affects you, does not take place.

9. Your data protection rights

You have the following data protection rights, depending on the circumstances of the specific case:

• Request information about your personal data and/or copies of this data. This includes information about the purpose of the use, the category of data used, its recipients and authorised persons and, if possible, the planned duration of data storage or, if this is not possible, the criteria for determining this duration;
• To request the rectification, erasure or restriction of the processing of your personal data where its use is unlawful under data protection law, in particular because (i) the data is incomplete or inaccurate, (ii) it is no longer necessary for the purposes for which it was collected, (iii) the consent on which the processing was based has been withdrawn, or (iv) you have successfully exercised a right to object to data processing; in cases where the data is processed by third parties, we will forward your requests for rectification, erasure or restriction of processing to those third parties, unless this proves impossible or involves a disproportionate effort;
• Refuse consent or - without affecting the lawfulness of the data processing carried out before the revocation - revoke your consent to the processing of your personal data at any time;
• To request the personal data concerning you that you have provided to us in a structured, common and machine-readable format and to transfer this data to another person responsible without hindrance from us;
• You may also have the right to request that we transfer the personal data directly to another controller, where this is technically feasible;
• Take legal action or contact the competent supervisory authorities if you believe that your rights have been infringed as a result of processing of your personal data that does not comply with data protection law.

In addition, you have the right to object to the processing of your personal data at any time:

• Where we process your personal data for direct marketing purposes; or
• Provided that we process your personal data in pursuit of our legitimate interests and there are grounds arising from your particular situation.

To exercise your data protection rights, you can contact us at any time using the contact details provided in section 12.

10. Data security

We use the widespread SSL procedure (Secure Socket Layer) in connection with the highest encryption level supported by your browser when visiting the website. As a rule, this is 256-bit encryption. If your browser does not support 256-bit encryption, we use 128-bit v3 technology instead. You can tell whether an individual page of our website is transmitted in encrypted form by the closed display of the key or lock symbol in the lower status bar of your browser.

11. Adaptation and amendment of the privacy policy

We reserve the right to adapt this data protection declaration if technical circumstances or legal requirements change.

12. Contact

Your trust is important to us. If you have any questions regarding the processing of your personal data, please do not hesitate to contact us:

Ziegert Group Holding GmbH Zimmerstraße 16, 10969 Berlin

Datum der letzten Änderung: 02.05.2022