ata protection

introduction

With the following data protection declaration, we would like to inform you about which types of your personal data (hereinafter also referred to as "data") we process for which purposes and to what extent. The data protection declaration applies to all processing of personal data carried out by us, both within the framework the provision of our services and, in particular, on our websites, in mobile applications and within external online presences, such as our social media profiles (hereinafter collectively referred to as "online offer").

The terms used are not gender specific. As of September 15, 2022
Responsible

Robert Taglauer Werkstrasse 10 85614 Kirchseeon

Robin Kunnecke At Bockshorn 37 38173 Sickte

Authorized representatives: Robin Künnecke and Robert Taglauer Imprint:

https://www.r2studio.de/impressum . E-mail address:

hello [at] r2studio [dot] com

Overview of processing

The following overview summarizes the types of data processed and the purposes of their processing and refers to the data subjects.

Types of data processed

• Inventory data (eg names, addresses).
• Content data (eg entries in online forms).
• Contact information (e.g. email, phone numbers).
• Meta/communication data (eg device information, IP addresses).
• Usage data (e.g. websites visited, interest in content, access times).
• Contract data (e.g. subject of the contract, term, customer category).

Categories of data subjects

• Employees (eg employees, applicants, former employees). • Interested persons.
• Communication partner.
• Customers.

• Users (eg website visitors, users of online services).

purposes of processing

• Provision of our online offer and user-friendliness.
• Conversion measurement (measurement of the effectiveness of marketing measures). • Office and organizational procedures.
• Content Delivery Network (CDN).
• Direct marketing (e.g. by e-mail or post).
• Feedback (eg collecting feedback via online form).
• Marketing.
• Contact Requests and Communications.
• Profiles with user-related information (creating user profiles).
• Reach measurement (e.g. access statistics, recognition of returning visitors).

• Provision of contractual services and customer service.

Relevant legal bases

Below you will find an overview of the legal bases of the GDPR, on the basis of which we process personal data. Please note that, in addition to the provisions of the GDPR, national data protection regulations may apply in your or our country of residence or domicile. If more specific legal bases are relevant in individual cases, we will inform you of them in the data protection declaration.

• Consent (Art. 6 Para. 1 S. 1 lit. a. GDPR)-The data subject has given their consent to the processing of their personal data for one or more specific purposes.

• Fulfillment of contract and pre-contractual inquiries (Art. 6 Para. 1 S. 1 lit. b. GDPR)-The processing is necessary for the performance of a contract to which the data subject is party or for the implementation of pre-contractual measures that are taken at the request of the data subject.

• Legitimate interests (Art. 6 Para. 1 S. 1 lit. f. GDPR)-Processing is necessary to protect the legitimate interests of the person responsible or a third party, unless the interests or fundamental rights and freedoms of the data subject, which require the protection of personal data, prevail.

National data protection regulations in Germany: In addition to the data protection regulations of the General Data Protection Regulation, national data protection regulations apply in Germany. This includes in particular the law on the protection against misuse of personal data in data processing

(Federal Data Protection Act – BDSG). In particular, the BDSG contains special regulations on the right to information, the right to erasure, the right to object, the processing of special categories of personal data, processing for other purposes and transmission as well as automated decision-making in individual cases including profiling. Furthermore, it regulates data processing for the purposes of the employment relationship (§ 26 BDSG), in particular with regard to the establishment, implementation or termination of employment relationships and the consent of employees. Furthermore, state data protection laws of the individual federal states may apply.

Safety measures

We take appropriate technical and organizational measures in accordance with the legal requirements, taking into account the state of the art, the implementation costs and the type, scope, circumstances and purposes of the processing as well as the different probabilities of occurrence and the extent of the threat to the rights and freedoms of natural persons to ensure a level of protection appropriate to the risk.

The measures include, in particular, securing the confidentiality, integrity and availability of data by controlling physical and electronic access to the data as well as access, input, disclosure, securing availability and their separation. Furthermore, we have set up procedures that ensure the exercise of data subject rights, the deletion of data and reactions to data threats. Furthermore, we already take the protection of personal data into account during the development or selection of hardware, software and processes in accordance with the principle of data protection, through technology design and through data protection-friendly default settings.

IP address truncation: If IP addresses are processed by us or by the service providers and technologies used and the processing of a complete IP address is not necessary, the IP address will be shortened (also referred to as "IP masking"). The last two digits or the last part of the IP address after a point are removed or replaced by placeholders. The purpose of shortening the IP address is to prevent or make it much more difficult to identify a person based on their IP address.

SSL encryption (https): In order to protect your data transmitted via our online offer, we use SSL encryption. You can recognize such encrypted connections by the prefix https:// in the address line of your browser.

Transmission of personal data

As part of our processing of personal data, it may happen that the data is transmitted to other bodies, companies, legally independent organizational units or persons or that it is disclosed to them. The recipients of this data can include, for example, service providers commissioned with IT tasks or providers of services and content that are integrated into a website. In such a case, we observe the legal requirements and, in particular, conclude appropriate contracts or agreements with the recipients of your data that serve to protect your data.

Data processing in third countries

If we process data in a third country (i.e. outside the European Union (EU), the European Economic Area (EEA)) or the processing within the framework of the use of third-party services or the disclosure or transmission of data to other persons, bodies or companies takes place, this is only done in accordance with the legal requirements.

Subject to express consent or contractually or legally required transmission, we only process or have the data processed in third countries with a recognized level of data protection, contractual obligation through so-called standard protection clauses of the EU Commission, if there are certifications or binding internal data protection regulations (Art. 44 to 49 DSGVO,

Information page of the EU Commission:https://ec.europa.eu/info/law/law-topic/ dataprotection/international-dimension-data-protection_de).

deletion of data

The data processed by us will be deleted in accordance with the legal requirements as soon as your consent to processing is revoked or other permissions are no longer applicable (e.g. if the purpose of processing this data no longer applies or it is not required for the purpose).

If the data is not deleted because it is required for other, legally permissible purposes, its processing will be limited to these purposes. This means that the data will be blocked and not processed for other purposes. This applies, for example, to data that must be stored for commercial or tax reasons or whose storage is necessary to assert, exercise or defend legal claims or to protect the rights of another natural or legal person.

As part of our data protection information, we can provide users with further information on the deletion and storage of data that applies specifically to the respective processing.

Use of cookies

Cookies are text files containing data from visited websites or domains and are stored by a browser on the user's computer. A cookie is primarily used to store information about a user during or after their visit to an online offer. The stored information can include, for example, the language settings on a website, the login status, a shopping cart or the place where a video was viewed. The term cookies also includes other technologies that fulfill the same functions as cookies (e.g. when user information is stored using pseudonymous online identifiers, also known as "user IDs").

The following cookie types and functions are distinguished:

• Temporary cookies (also: session or session cookies):Temporary cookies are deleted at the latest after a user has left an online offer and closed his browser.

• Persistent cookies:Permanent cookies remain stored even after the browser is closed. For example, the login status can be saved or preferred content can be displayed directly when the user visits a website again. Likewise, the interests of users, which are used to measure reach or for marketing purposes, can be stored in such a cookie.

• First party cookies:First-party cookies are set by us.

• Third-party cookies (also: third-party cookies): Third-party cookies are mainly used by advertisers (so-called third parties) to
process user information.

• Necessary (also: essential or strictly necessary) cookies:On the one hand, cookies may be absolutely necessary for the operation of a website (e.g
to save logins or other user input or for security reasons).

• Statistics, marketing and personalization cookies: Cookies are also generally used to measure range and when a user's interests or behavior (e.g. viewing certain content, using functions, etc.) are stored in a user profile on individual websites. Such profiles are used to show users, for example, content that corresponds to their potential interests. This procedure is also referred to as "tracking", ie tracking the potential interests of users. If we use cookies or "tracking" technologies, we will inform you separately in our data protection declaration or when obtaining consent.

Notes on legal bases:The legal basis on which we process your personal data using cookies depends on whether we ask for your consent. If this is the case and you consent to the use of cookies, the legal basis for the processing of your data is the declared consent. Otherwise, the data processed with the help of cookies will be processed on the basis of our legitimate interests (e.g. in the commercial operation of our online offer and its improvement) or if the use of cookies is necessary to fulfill our contractual obligations.

Storage duration:If we do not provide you with any explicit information on the storage period of permanent cookies (e.g. as part of a so-called cookie opt-in), please assume that the storage period can be up to two years.

General information on revocation and objection (opt-out):Depending on whether the processing is based on consent or legal permission, you have the option at any time to revoke any consent you have given or to object to the processing of your data by cookie technologies (collectively referred to as "opt-out"). You can initially declare your objection using the settings in your browser, e.g. by deactivating the use of cookies (which can also limit the functionality of our online offer). An objection to the use of cookies for online marketing purposes can also be raised using a variety of services, especially in the case of tracking, via the websiteshttps://optout.aboutads.infoandhttps://www.youronlinechoices.com/be explained. In addition, you can receive further objection notices as part of the information on the service providers and cookies used.

Processing of cookie data based on consent: We use a procedure for cookie consent management, as part of which the consent of the user to the use of cookies or the processing and providers mentioned in the context of the cookie consent management procedure is obtained and managed by the users and can be revoked. The declaration of consent is stored here so that the query does not have to be repeated and to be able to prove the consent in accordance with the legal obligation. The storage can take place on the server side and/or in a cookie (so-called opt-in cookie, or with the help of comparable technologies) in order to be able to assign the consent to a user or his device. Subject to individual information on the providers of cookie management services, the following notices apply: The duration of the storage of the consent can be up to two years. A pseudonymous user identifier is created and stored with the time of the consent, information on the scope of the consent (e.g. which categories of cookies and/or service providers) and the browser, system and end device used.

• Types of data processed:Usage data (e.g. websites visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses).

• Affected people:Users (e.g. website visitors, users of online services).
• Legal bases:Consent (Art. 6 Para. 1 S. 1 lit. a. GDPR), legitimate interests (Art. 6

Para. 1 S. 1 lit. f. GDPR).

Provision of the online offer and web hosting

In order to be able to provide our online offer securely and efficiently, we use the services of one or more web hosting providers from whose servers (or servers managed by them) the online offer can be accessed. For these purposes, we may use infrastructure and platform services, computing capacity, storage space and database services, as well as security services and technical maintenance services.

The data processed as part of the provision of the hosting offer may include all information relating to the users of our online offer that arises in the context of use and communication. This regularly includes the IP address, which is necessary in order to be able to deliver the content of online offers to browsers, and all entries made within our online offer or on websites.

Collection of access data and log files: We ourselves (or our web hosting provider) collect data for every access to the server (so-called server log files). The address and name of the retrieved websites and files, date and time of retrieval, amounts of data transferred, notification of successful retrieval, browser type and version, the user's operating system, referrer URL (the previously visited page) and, as a rule, IP Addresses and the requesting provider belong.

The server log files can be used on the one hand for security purposes, e.g. to avoid overloading the server (especially in the case of abusive attacks, so-called DDoS attacks) and on the other hand to ensure server utilization and stability.

Content Delivery Network: We use a "Content Delivery Network" (CDN). A CDN is a service with the help of which the content of an online offer, in particular large media files such as graphics or program scripts, can be delivered faster and more securely with the help of regionally distributed servers connected via the Internet.

• Types of data processed:Content data (e.g. entries in online forms), usage data (e.g. websites visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses).

• Affected people:Users (e.g. website visitors, users of online services). • Purposes of processing:Provision of our online offer and user-

friendliness, Content Delivery Network (CDN).
• Legal bases:Legitimate interests (Art. 6 Para. 1 S. 1 lit. f. GDPR).

Services and service providers used:

• Web flow:We host our website at Webflow. The provider is Webflow, Inc., 398 11th Street, 2nd Floor, San Francisco, CA 94103, USA (hereinafter: Webflow). When you visit our website, Webflow collects various log files including your IP addresses.

Webflow is a website building and hosting tool. Webflow stores cookies or other recognition technologies that are required to display the site, to provide certain website functions and to ensure security (necessary cookies).

Details can be found in Webflow's data protection declaration:https:// webflow.com/legal/eu-privacy-policy.

Webflow is used on the basis of Article 6 (1) (f) GDPR. We have a legitimate interest in our website being displayed as reliably as possible. If a corresponding consent was requested, the processing takes place exclusively on the basis of Art. 6 Para. 1 lit. a DSGVO and § 25 Para B. device fingerprinting) within the meaning of the TTDSG. The consent can be revoked at any time.

Data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here:https://webflow.com/legal/eu-privacypolicy.

order processing

We have concluded an order processing contract (AVV) with the above-mentioned provider. This is a contract required by data protection law, which ensures that the personal data of our website visitors is only processed according to our instructions and in compliance with the GDPR.

We use blogs or comparable means of online communication and publication (hereinafter "publication medium"). The data of the readers are processed for the purposes of the publication medium only insofar as it is necessary for its presentation and the communication between authors and readers or for reasons of security. In addition, we refer to the information on the processing of visitors to our publication medium in the context of this data protection notice.

• Types of data processed:Inventory data (e.g. names, addresses), contact data (e.g. e-mail, telephone numbers), content data (e.g. entries in online forms), usage data (e.g. websites visited, interest in content, access times), meta/ communication data (e.g. device information, IP addresses).

• Affected people:Users (e.g. website visitors, users of online services).
• Purposes of processing:Provision of contractual services and customer service,

feedback (e.g. collecting feedback via online form).

• Legal bases:Fulfillment of contract and pre-contractual inquiries (Art. 6 para. 1 p. 1 lit. b. GDPR), legitimate interests (Art. 6 Para. 1 S. 1 lit. f. GDPR).

Contact and request management

When contacting us (e.g. via contact form, e-mail, telephone or via social media), the details of the requesting person will be processed to the extent that this is necessary to answer the contact request and any requested measures.

The answering of contact inquiries within the framework of contractual or pre- contractual relationships takes place to fulfill our contractual obligations or to answer (pre)contractual inquiries and otherwise on the basis of the legitimate interests in answering the inquiries.

• Types of data processed:Inventory data (e.g. names, addresses), contact data (e.g. e-mail, telephone numbers), content data (e.g. entries in online forms).

• Affected people:communication partner.

• Purposes of processing:Contact Requests and Communication.

• Legal bases:Fulfillment of contract and pre-contractual inquiries (Art. 6 para. 1 p. 1 lit. b. GDPR), legitimate interests (Art. 6 Para. 1 S. 1 lit. f. GDPR).

cloud services

We use software services accessible via the Internet and running on the servers of their providers (so-called "cloud services", also referred to as "software as a service") for the following purposes: document storage and management, calendar management, email sending, spreadsheets and presentations, exchanging documents, content and information with designated recipients or posting web pages, forms or other content and information, as well as chatting and participating in audio and video conferences.

In this context, personal data can be processed and stored on the servers of the providers, insofar as these are part of communication processes with us or are otherwise processed by us, as set out in this data protection declaration. This data can include, in particular, master data and contact details of users, data on transactions, contracts, other processes and their content. The providers of the cloud services also process usage data and metadata, which they use for security purposes and to optimize the service.

If we use the cloud services to provide forms or similar documents and content for other users or publicly accessible websites, the providers can store cookies on the users' devices for web analysis purposes or to change user settings (e.g. in the case of media control). remember, save.

Notes on legal bases:If we ask for consent to use the cloud services, the legal basis for processing is consent. Furthermore, their use can be part of our (pre)contractual services, provided that the use of cloud services has been agreed in this context. Otherwise, user data is processed on the basis of our legitimate interests (ie interest in efficient and secure administration and collaboration processes).

• Types of data processed:Inventory data (e.g. names, addresses), contact data (e.g. e-mail, telephone numbers), content data (e.g. entries in online forms), usage data (e.g. websites visited, interest in content, access times), meta/ communication data (e.g. device information, IP addresses).

• Affected people:Customers, employees (e.g. employees, applicants, former employees), interested parties, communication partners.

• Purposes of processing:office and organizational procedures.

• Legal bases:Consent (Art. 6 Para. 1 S. 1 lit. a. GDPR), fulfillment of contract and pre-contractual inquiries (Art. 6 Para. 1 S. 1 lit. b. GDPR), legitimate interests (Art. 6 Para. 1 S. 1 lit. f. GDPR).

Services and service providers used:

• Drop box:cloud storage services; Service Provider: Dropbox, Inc., 333 Brannan Street, San Francisco, California 94107, USA; site:https://www.dropbox.com/ de; Data protection:https://www.dropbox.com/privacy; Standard contractual clauses (ensuring the level of data protection when processing in third countries):https:// www.dropbox.com/terms/business-agreement-2016.

Newsletters and electronic notifications

We send newsletters, e-mails and other electronic notifications (hereinafter "newsletters") only with the consent of the recipient or legal permission. If the content of the newsletter is specifically described when registering for it, it is decisive for the consent of the user. Our newsletter also contains information about our services and us.

In order to register for our newsletters, it is generally sufficient if you enter your e-mail address. However, we may ask you to provide a name so that we can address you personally in the newsletter, or other information if this is necessary for the purposes of the newsletter.

Double opt-in procedure:The registration for our newsletter takes place in a so-called double opt-in procedure. This means that after registration you will receive an e-mail in which you will be asked to confirm your registration. This confirmation is necessary so that nobody can register with someone else's e-mail address. The registrations for the newsletter are logged in order to be able to prove the registration process in accordance with the legal requirements. This includes storing the time of registration and confirmation as well as the IP address. Changes to your data stored by the shipping service provider are also logged.

Deletion and restriction of processing:We can store the unsubscribed e-mail addresses for up to three years on the basis of our legitimate interests before we delete them in order to be able to prove a previously given consent. The processing of this data is limited to the purpose of a possible defense against claims. An individual request for deletion is possible at any time, provided that the previous existence of consent is confirmed at the same time. In the case of obligations to permanently observe contradictions, we reserve the right to store the e-mail address in a blacklist (so-called "blocklist") solely for this purpose.

The registration process is logged on the basis of our legitimate interests for the purpose of proving that it was carried out properly. If we commission a service provider to send emails, this is done on the basis of our legitimate interests in an efficient and secure shipping system.

Notes on legal bases:The newsletter is sent on the basis of the consent of the recipient or, if consent is not required, on the basis of our legitimate interests in direct marketing, if and to the extent that this is permitted by law, e.g. in the case of advertising for existing customers. If we commission a service provider to send emails, this is done on the basis of

our legitimate interests. The registration process is recorded on the basis of our legitimate interests to demonstrate that it has been carried out in accordance with the law.

Content: Information about us, our services, promotions and offers.

Web analysis, monitoring and optimization

The web analysis (also referred to as "reach measurement") serves to evaluate the flow of visitors to our online offer and can include behavior, interests or demographic information about the visitors, such as age or gender, as pseudonymous values. With the help of the range analysis, we can, for example, identify at what time our online offer or its functions or content are used most frequently or invite people to use them again. We can also understand which areas need optimization.

In addition to web analysis, we can also use test procedures, for example to test and optimize different versions of our online offering or its components.

For these purposes, so-called user profiles can be created and stored in a file (so-called "cookie") or similar processes can be used for the same purpose. This information can include, for example, content viewed, websites visited and elements used there and technical information such as the browser used, the computer system used and information on usage times. If users have consented to the collection of their location data, this can also be processed depending on the provider.

The IP addresses of the users are also saved. However, we use an IP masking process (ie pseudonymization by shortening the IP address) to protect users. In general, no clear user data (e.g. e-mail addresses or names) are stored in the context of web analysis, A/B testing and optimization, but pseudonyms. This means that we and the providers of the software used do not know the actual identity of the users, but only the information stored in their profiles for the purposes of the respective process.

Notes on legal bases:If we ask users for their consent to the use of third-party providers, the legal basis for processing data is consent. Otherwise, user data is processed on the basis of our legitimate interests (ie interest in efficient, economical and recipient-friendly services). In this context, we would also like to draw your attention to the information on the use of cookies in this data protection declaration.

Services and service providers used:

• Google Analytics:Reach measurement and web analysis; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company:

Google LLC, 1600 Amphitheater Parkway, Mountain View, CA 94043, USA; site:https://marketingplatform.google.com/intl/de/about/analytics/; Data protection:https://policies.google.com/privacy.

Online marketing

We process personal data for online marketing purposes, which may include the marketing of advertising space or the presentation of advertising and other content (collectively referred to as "content") based on the potential interests of users and the measurement of their effectiveness.

For these purposes, so-called user profiles are created and stored in a file (so-called "cookie") or similar processes are used, by means of which the information about the user relevant to the presentation of the aforementioned content is stored. This information can include, for example, content viewed, websites visited, online networks used, but also communication partners and technical information such as the browser used, the computer system used and information on usage times. If users have consented to the collection of their location data, this can also be processed.

The IP addresses of the users are also saved. However, we use available IP masking procedures (ie pseudonymization by shortening the IP address) to protect users. In general, within the framework of
Online marketing procedures do not store any clear user data (e.g. e-mail addresses or names), but pseudonyms. This means that we and the providers of the online marketing process do not know the actual identity of the users, only the information stored in their profiles.

The information in the profiles is usually stored in the cookies or by means of similar processes. These cookies can later generally also be read on other websites that use the same online marketing process and analyzed for the purpose of displaying content, as well as supplemented with further data and stored on the server of the online marketing process provider.

As an exception, clear data can be assigned to the profiles. This is the case, for example, when the users are members of a social network whose
We use online marketing processes and the network connects the user profiles with
the aforementioned information. We kindly ask you to note that users can make additional agreements with the providers, e.g. by giving their consent during registration.

In principle, we only receive access to summarized information about the success of our advertisements. However, we can use so-called conversion measurements to check which of our online marketing processes have led to a so-called conversion, ie, to a contract with us, for example. The conversion measurement is only used to analyze the success of our marketing measures.

Unless otherwise stated, please assume that cookies used will be stored for a period of two years.

Notes on legal bases:If we ask users for their consent to the use of third-party providers, the legal basis for processing data is consent. Otherwise, user data is processed on the basis of our legitimate interests (ie interest in efficient, economical and recipient-friendly services). In this context, we would also like to draw your attention to the information on the use of cookies in this data protection declaration.

• Types of data processed:Usage data (e.g. websites visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses).

• Affected people:Users (e.g. website visitors, users of online services).

• Purposes of processing:Marketing, profiles with user-related information (creating user profiles), conversion measurement (measuring the effectiveness of marketing measures).

• Safety measures:IP masking (pseudonymization of the IP address).
• Legal bases:Consent (Art. 6 Para. 1 S. 1 lit. a. GDPR), legitimate interests (Art. 6

Para. 1 S. 1 lit. f. GDPR).

• Possibility of objection (opt-out):We refer to the data protection notices of the respective providers and those specified for the providers
Opt-out options (so-called "opt-out"). If no explicit opt-out option has been specified, you can turn off cookies in your browser settings. However, this can limit the functions of our online offer. We therefore also recommend the following opt-out options, which are offered in summary for the respective areas: a) Europe:https://www.youronlinechoices.eu. b) Canada:https:// www.youradchoices.ca/choices. c) United States:https://www.aboutads.info/ choices. d) Inter-territorial:https://optout.aboutads.info.

Services and service providers used:

• Google Analytics:online marketing and web analysis; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheater Parkway, Mountain View, CA 94043, USA; site: https://marketingplatform.google.com/intl/de/about/analytics/; Data protection:https://policies.google.com/privacy; Possibility of objection (opt-out): Opt-out plugin:https://tools.google.com/dlpage/gaoptout?hl=de, Settings for the display of advertisements: https://adssettings.google.com/authenticated.

• Google Ads and conversion measurement:We use the online marketing process "Google Ads" to place ads on the Google advertising network (eg, in search results, in videos, on websites, etc.) so that they are displayed to users who have a presumed interest in the ads. We also measure the conversion of the ads. However, we only find out the anonymous total number of users who clicked on our ad and were forwarded to a page with a so-called "conversion tracking tag". However, we do not receive any information that could be used to identify users. Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheater Parkway, Mountain View, CA 94043, USA; site:https://marketingplatform.google.com; Data protection:https://policies.google.com/privacy.

Presence in social networks (social media)

We maintain online presences within social networks and process user data in this context in order to communicate with the users active there or to offer information about us.

We would like to point out that user data can be processed outside of the European Union. This can result in risks for the user, because it could make it more difficult to enforce the user's rights, for example.

Furthermore, user data is usually processed within social networks for market research and advertising purposes. For example, usage profiles can be created on the basis of usage behavior and the resulting interests of users. The usage profiles can in turn be used, for example, to place advertisements inside and outside the networks that presumably correspond to the interests of the user. For these purposes, cookies are usually stored on the users' computers, in which the usage behavior and the interests of the users are stored. Furthermore, data can also be stored in the usage profiles independently of the devices used by the users (especially if the users are members of the respective platforms and are logged in to them).

For a detailed description of the respective forms of processing and the possibility of objection (opt-out), we refer to the data protection declarations and information provided by the operators of the respective networks.

Also in the case of requests for information and the assertion of data subject rights, we would like to point out that these can be asserted most effectively with the providers. Only the providers have access to the data of the users and can take appropriate measures and provide information directly. If you still need help, you can contact us.

• Types of data processed:Contact data (e.g. e-mail, telephone numbers), content data (e.g. entries in online forms), usage data (e.g. visited

websites, interest in content, access times), meta/communication data (e.g. device information, IP addresses).

• Affected people:Users (e.g. website visitors, users of online services).
• Purposes of processing:Contact requests and communication, feedback (e.g.

collecting feedback via online form), marketing.
• Legal bases:Legitimate interests (Art. 6 Para. 1 S. 1 lit. f. GDPR).

Services and service providers used:

• Instagram:Social network; Service Provider: Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025, USA, Parent Company: Facebook, 1 Hacker Way, Menlo Park, CA 94025; site:https://www.instagram.com; Data protection:https://instagram.com/about/legal/privacy.

• LinkedIn:Social network; Service Provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland; site:https://www.linkedin.com; Data protection: https://www.linkedin.com/legal/privacy-policy; Possibility of objection (opt-out): https://www.linkedin.com/psettings/guestcontrols/retargeting-opt-out.

• Dribble:Social network; Service Provider: Dribbble Holdings Ltd., 524 Yates St, Victoria, British Columbia, V8W 1K8, Canada. site:www.dribbble.com; Data protection:https://dribbble.com/privacy.

Management, organization and support tools

We use services, platforms and software from other providers (hereinafter referred to as “third-party providers”) for the purposes of organisation, management, planning and the provision of our services. When selecting third-party providers and their services, we observe the legal requirements.

In this context, personal data can be processed and stored on the servers of third-party providers. Various data may be affected by this, which we process in accordance with this data protection declaration. This data can include, in particular, master data and contact details of users, data on transactions, contracts, other processes and their content.

If users are referred to the third-party providers or their software or platforms as part of communication, business or other relationships with us, the third-party providers can process usage data and metadata for security purposes, for service optimization or for marketing purposes. We therefore ask you to observe the data protection notices of the respective third-party providers.

Notes on legal bases:If we ask users for their consent to the use of third-party providers, the legal basis for processing data is consent. Furthermore, their use can be part of our (pre)contractual services, provided that the use of third-party providers has been agreed in this context. Otherwise, user data is processed on the basis of our legitimate interests (ie interest in efficient, economical and recipient-friendly services). In this context, we would also like to draw your attention to the information on the use of cookies in this data protection declaration.

• Types of data processed:Inventory data (e.g. names, addresses), contact data (e.g. e-mail, telephone numbers), content data (e.g. entries in online forms), usage data (e.g. websites visited, interest in content, access times), meta/ communication data (e.g. device information, IP addresses).

• Affected people:Communication partners, users (e.g. website visitors, users of online services).

• Legal bases:Consent (Art. 6 Para. 1 S. 1 lit. a. GDPR), fulfillment of contract and pre-contractual inquiries (Art. 6 Para. 1 S. 1 lit. b. GDPR), legitimate interests (Art. 6 Para. 1 S. 1 lit. f. GDPR).

‍