Data Protection Policy

1. Scope

1.1 This data protection policy and general information on data protection apply to all data processing activities carried out by Richard Wolf GmbH, Pforzheimer Straße 32, 75438 Knittlingen, Germany, email: info@richard-wolf.com as the Controller as defined in Art. 4 of the EU General Data Protection Regulation ("GDPR"). Our data protection officer can be contacted at datenschutz@richard-wolf.com or by mail to our address, marked for the attention of the data protection officer.

1.2 The protection of your personal data – and particularly your personal rights when we process and use your information – is important to us. This document sets out how we collect personal data when you use our website. Personal data is all data that relates specifically to you as an individual, such as your name, address, email addresses, and user behaviors.

2. Automated data collection and processing by your browser

2.1 Like all websites, our server automatically collects data provided by your browser and stores it temporarily in server log files, if you have not deactivated this function. If you wish to use our website, we will collect the following data from you to enable us to display our site to you and to guarantee the stability and security of our site (legal basis Art. 6 (1) f GDPR):

• IP address of the requesting computer
• File request of the client
• http status code
• Website you are visiting from (referrer URL)
• Time of server request
• Browser type and version
• Operating system installed on the requesting computer

The server log files are not analyzed in a way that would make you personally identifiable. The provider cannot identify specific individuals from this data at any point. This data is not merged with data from other sources.

2.2 Google Analytics

This website uses Google Analytics, a web analytics service provided by Google Inc. ("Google") to enable us to analyze the use of and implement regular improvements to our website. The statistics generated via this service enable us to improve our offering and make our website more appealing for our users. Google Analytics uses "cookies", which are text files stored on your computer to enable your use of the website to be analyzed. According to Google, cookies remain active for up to two years. After this point, they are automatically deactivated. The information generated by the cookie on your use of this website is generally transmitted to a Google server in the USA and stored there. We use Google Analytics with the "_anonymizeIp()" extension. This means that IP addresses are processed in a shortened form so that they cannot be traced back to specific individuals. If the data collected could be used to personally identify you, the extension excludes this information and the personal data is immediately deleted. On our behalf, Google uses the information to analyze the use of the website, to compile reports on website activity, and to provide other services in connection with website and internet use.

According to Google, the IP address provided by your browser as part of the Google Analytics service will not be merged with other data held by Google. For exceptional cases in which personal data is transmitted to the USA, Google has signed up to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework.

The legal basis for the use of Google Analytics is your consent in accordance with Art. 6 (1) a GDPR. On your first visit to our website, you will be asked whether you consent to the use of cookies to collect your data for various purposes. You can choose to grant your consent for all categories of services ("Select all" button) or check individual boxes to configure your own settings. Google Analytics is assigned to the "Statistics" category. This means that you can decide whether or not to grant consent for your data to be processed. Consent is voluntary and you can revoke your consent for future processing at any time by clicking on "Cookie settings" in the footer of our website and unchecking the relevant box.

You can also configure your browser software to block the storage of cookies; however, please note that if you do this, you may not be able to use all of the features of our website, or the functionality of some features may be limited. You can also prevent the data generated by the cookie on your use of the website (incl. your IP address) from being recorded or processed by Google by downloading and installing the browser plug-in available at the following link: http://tools.google.com/dlpage/gaoptout?hl=de.

You can prevent data from being recorded by Google Analytics by clicking on the following link. This action places an opt-out cookie on your computer, which will prevent your data from being recorded on future visits to this website: Deactivate Google Analytics.

Information on third-party provider: Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001. User terms: http://www.google.com/analytics/terms/de.html, privacy overview: http://www.google.com/intl/de/analytics/learn/privacy.html, and privacy policy: http://www.google.de/intl/de/policies/privacy. Information on the use of cookies by Google Analytics is available at https://developers.google.com/analytics/devguides/collection/analyticsjs/cookie-usage?hl=de.

3. Collection and processing of data provided on a voluntary basis

3.1 General contact

When you share personal data with us by email or via our website (surname, name, email address, mail address), this is generally done on a voluntary basis. This data is used in the performance of your contract, to process your queries and orders, and to conduct our own market/opinion research and marketing by mail and email. We will not use this data for any other purposes; in particular, your data will not be transferred to third parties for advertising or market/opinion research. Data collected in this way will be deleted when it is no longer required; if a statutory retention period applies, we will restrict the processing of the data until it can be deleted. The legal basis for this is Art. 6 (1) b GDPR or Art. 6 (1) f GDPR.

3.2 Newsletter

With your consent, you can subscribe to our newsletter, which provides the latest news on offers that may be of interest to you. The goods and services advertised are specified in the declaration of consent.

We use a double opt-in procedure for users wishing to register for our newsletter. This means that, after you have registered, we send an email to the address you specify asking you to confirm that you wish to receive our newsletter. If you do not confirm your registration within 24 hours, your information will be locked and automatically deleted after one month. We also store the IP addresses you use and the times of your registration and confirmation. The aim of this process is to be able to prove your registration and investigate any possible misuse of your personal data that may occur in the future.

The only mandatory information you must provide to receive our newsletter is your email address. The provision of any additional, separately marked information is voluntary and is used by us to address you personally. Following your confirmation, we will store the data you have provided for the purpose of sending you our newsletter (the legal basis for this is Art. 6 (1) a GDPR).

You may revoke your consent to receive the newsletter and cancel your subscription at any time. You can revoke your consent by clicking on the link provided in each newsletter email or by sending an email to presse@richard-wolf.com.

3.3 Data processing for performance of the contract

Personal data of our customers, clients, interested parties, and other contractual partners (referred to collectively as "Contractual partners") is processed in accordance with Art. 6 (1) b GDPR. This takes place within the framework of our contractual or pre-contractual services towards our Contractual partners. The data processed, and the type, scope, purpose, and the necessity of their processing, are determined by the underlying contractual relationship.

The processed data includes the master data of our Contractual partners (e.g., names and addresses), contact data (e.g., email addresses and telephone numbers), as well as contract data (e.g., services used, contract contents, contractual communication, names of contact persons), and payment data (e.g., bank details, payment history). We only process special categories of personal data if these are components of commissioned or contractual processing. This data will not be passed on to third parties, unless this is required to pursue our claims in accordance with Art. 6 (1) f GDPR or where there is a legal obligation in accordance with Art. 6 (1) c GDPR.

The data will be deleted when it is no longer required for the fulfillment of a contractual or legal duty of care or in connection with any warranty or other obligations. The need to retain the data will be checked every three years; in all other cases, the statutory retention periods apply.

3.4 Electronic applications

On our careers page, you can submit a speculative application or apply for a specific role by email. Your data (name, email address, contact information, application documents) will be processed only in connection with the relevant job advertisement (Art. 6 (1) b GDPR, § 26 German Federal Data Protection Act) or for other job advertisements where you have granted consent for us to do so (Art. 6 (1) a GDPR). If you grant your consent for us to process your application data, you may revoke this consent at any time.

Note on sensitive data: Application documents, including résumés, references, and other documents you provide to us, may contain sensitive information relating to your physical and mental health, race or ethnic origin, political opinion, religious or philosophical beliefs, trade union or political party memberships, or your sex life.

If you provide such information in your online application, you consent to us processing this data for the purposes of your application. This data will be processed in accordance with this data protection policy and other applicable legal regulations.

If your application is unsuccessful, the data provided will be deleted at the earliest three months after the end of the application process. This does not apply if we are not permitted to delete the data by law or if we are required to retain the data for evidence purposes or if you have agreed to a longer retention period.

4. Transfer to third parties

4.1 If you have provided us with personal data, this data will not generally be transferred to third parties. The data will only be transferred:

• If you have provided your consent for us to do so (see clause 3.2). When we collect your data, you will be informed of the recipients or categories of recipients.
• To process your queries and orders and, in connection with the use of our services, to authorized subcontractors who will only receive the data required to provide their contracted service and will only use it for this purpose.
• To an external service provider contracted to provide data processing services in accordance with art. 28 GDPR. Such external providers are carefully selected by us and are required to follow our instructions and comply with the provisions of the GDPR; they are regularly audited by us.
• To fulfill legal obligations to bodies authorized to request information.

4.2 This website uses social plug-ins. Social plug-ins are web applications that connect this website to selected social networks. The social plug-ins are not directly integrated, but must be activated with a separate click. A connection to the social network is only established after the user activates the plug-in, regardless of whether or not you actually click on the social plug-ins. Through this connection, your IP address and user data for the social network in question will be transmitted to the social network. Further information on the social plug-ins used is provided in clause 6.

5. Cookies

5.1 This website uses cookies. Cookies are small text files that are stored locally in the cache of your browser. The following types of cookies (the scope and function of which are explained below) are used on this website:

• Transient cookies (see 5.2)
• Persistent cookies (see 5.3).

5.2 Transient cookies are automatically deleted when you close your browser. Session cookies are one of the most common types of transient cookie. These cookies store a session ID, which is used to assign various requests from your browser to the same session. This enables us to recognize your computer when you return to our website. Session cookies are deleted when you log out or close your browser.

5.3 Persistent cookies are automatically deleted after a set period of time, which differs depending on the cookie. You can delete cookies at any time in your browser security settings.

5.4 You can configure your browser settings to suit your preferences, for example to accept third-party cookies or reject all cookies. Please note that you may not be able to use all of the features of this website if you reject all cookies.

6. Social networks

Our website contains links to the social network YouTube. The following data protection information applies to these links:

To present our videos, we use the video service provided by YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA ("YouTube"). The legal basis for this is Art. 6 (1) f GDPR.

Where YouTube videos are directly integrated into our website, the contents of the embedded videos are sent directly to your browser by email. At the same time, certain data from your browser is sent to YouTube. This occurs regardless of whether or not you click on the video. We have no influence on the scope of the data that YouTube collects in this way. According to the latest information we have received, YouTube collects the following data, in particular to display embedded YouTube videos:

1. the page you visited on our website that contains the video,
2. the data generally transmitted by your browser (IP address, browser type and version, operating system, time),
3. for registered and logged in YouTube and Google users, your Google username.

Embedded YouTube videos can also be hidden by browser add-ons, which prevents YouTube from collecting any data. If you are logged into Google, your data will be directly linked to your account. If you do not want your data to be linked to your YouTube profile, you will need to log out before activating the button. YouTube stores your data as a usage profile and uses it for advertising, market research, and/or to optimize the design of its website. In particular, this kind of analysis takes place (even if you are not logged in) for the purpose of delivering targeted advertising and to inform other users of the social network of your activities on our website. You can object to the creation of this user profile by contacting YouTube.

Further information on the purpose and scope of data collection and processing by YouTube is provided in its privacy policy. This policy also contains further information on your rights and how you can configure your settings to protect your privacy: www.google.de/intl/de/policies/privacy. Google also processes your personal data in the USA and has signed up to the EU-US Privacy Shield, www.privacyshield.gov/EU-US-Framework.

7. Retention period

Your data will only be used as long as necessary for the existing customer relationship, unless you have given us your consent or we have a legitimate interest in further processing. In such cases, we process your data until you revoke your consent or until you object to our legitimate interests. Regardless of this, we are obliged by regulatory, commercial, and tax law requirements to store your address, payment, and order data for a period of ten years.