Privacy Statement

When you use our website, we process your personal data for various purposes, e.g. so that you can contact us or purchase a product in our online shop. In doing so, we comply with the statutory data protection regulations, in particular the General Data Protection Regulation (hereinafter "GDPR") and the Federal Data Protection Act (Bundesdatenschutzgesetz, hereinafter "BDSG").

I. Controller & Data Protection Officer

The controller for the processing of your personal data on our website (https://www.vitakraft.de and www.shop.vitakraft.de) is:

Vitakraft pet care GmbH & Co. KG
Mahndorfer Heerstraße 9
28307 Bremen, Germany

You can also contact us by telephone at +49(0)421 / 4896 - 0 or by e-mail at datenschutz@vitakraft.de.

You can also contact our Data Protection Officer by telephone at +49(0)421 / 4896 - 0 or by e-mail at datenschutz@vitakraft.de.

II. Processing of your personal data

Personal data is data with which you can be personally identified. The term processing encompasses various actions in which personal data is, for example, collected, recorded, organised, ordered, stored, changed, deleted, disclosed or transmitted.

In this section, we will explain to you what personal data we process, for what purposes and on what legal basis this takes place and how long we store your data for.

1. Server log files

When you visit our website, information about your visit is automatically stored in so-called server log files, which your Internet browser automatically transmits to us. This information is as follows:

• Browser type and browser version
• Operating system used
• URL visited
• Time of server request
• IP address
• Size of data retrieval

This data is not combined with other data sources.

Your IP address must be stored in our system so that we can correctly display the website you have visited. The legal basis for temporarily storing this data in log files is Article 6(1)(f) GDPR. Our legitimate interest is to ensure the functionality and optimisation of our website.

We store the log files for as long as necessary to achieve this purpose. If the provision is required to display the website, the purpose is achieved when you have ended your session. This is usually the case when you leave the website. The log files are then deleted: on the general Vitakraft website no later than after 7 days, within the online shop after 26 days.

2. Contact options

a. Contact forms

On our website, we offer you the opportunity to send us your questions or comments using contact forms. The following table shows you how our contact forms differ:

You can use the contact form to ask questions about the products presented and other business topics.

Insofar as the request concerns an existing or future contractual relationship with us, Article 6(1)(b) GDPR is the basis of authorisation to process your data.

For all other enquiries (e.g. regarding the products presented), we process your personal data on the basis of Article 6(1)(f) GDPR.

We process personal data from the contact forms exclusively for the processing of your request. The data will therefore not be passed on to third parties. However, if you have specific enquiries about products, personal data will be transferred within our group of companies for the purpose of responding.

The data you enter in the contact form will be deleted as soon as the purpose for the processing ceases to apply and no contradictory legal or contractual obligations oblige us to continue storing it. Generally speaking, the purpose ceases to apply once we have completed the processing of your request.

b. E-mail, fax, post, telephone

We have also published our contact address, including telephone number, fax number and e-mail address, on our website. If you wish to contact us via these contact channels, the information you provide and possibly your name and contact address will be processed (depending on the contact channel, the e-mail or fax/telephone number or postal address). We process this data for the purpose of processing your message.

Depending on your request, we process this data either on the basis of Article 6(1)(b) GDPR, in the case of pre-contractual measures or a contract concluded with us, or on the basis of Article 6(1)(f) GDPR. In this case, our legitimate interest in processing your data is to be able to respond to your message as quickly or directly as possible.

This data will be deleted insofar as it is no longer necessary for the achievement of the respective purpose, i.e. as soon as the correspondence with you has ended. Mandatory contractual or statutory provisions – in particular retention periods – remain unaffected by this.

3. E-mail newsletter

We also offer you an e-mail newsletter service.

a. Subscribing to and sending of the e-mail newsletter

You can subscribe to our e-mail newsletter on our website by entering your data in the registration input screen and clicking on "Subscribe". We will need to collect your e-mail address in order to send you the newsletter. You can also enter or mark other voluntary information, such as your name or certain animals of interest to you.

Registration takes place according to the so-called "double opt-in procedure". After submitting your subscription request, you will receive an e-mail asking you to confirm your registration by clicking on a link in the e-mail text. This is used to verify that you really want to receive the e-mail newsletter. If you click on the confirmation link, your e-mail will be included in the newsletter mailing list and stored for the purpose of sending e-mails. If you do not click on the confirmation link within 48 hours, your login data will be blocked and automatically deleted after 30 days.

In addition, we log your IP address used for registration as well as the date and time of consent (registration and confirmation). The purpose of this storage is to comply with legal requirements regarding proof of your registration and to prevent misuse of your e-mail. As part of your declaration of consent, the content (e.g. advertised products/services, offers, advertising and topics) of the newsletter will be described in concrete terms.

The processing of your data for the purpose of sending the newsletter is based on your explicit consent in accordance with Article 6(1)(a), Article 7 GDPR. Processing for the purpose of logging consent is based on Article 6(1)(f) GDPR, as this serves our legitimate interest. The legitimate interest here lies in the proof of your consent, insofar as this is contested. In addition, in accordance with Article 5(2) GDPR, we are legally obliged to document why Article 6(1)(c) GDPR is also relevant here as the legal basis.

You can revoke your consent to receive the e-mail newsletter at any time with future effect by unsubscribing from receiving the newsletter. You can do this by clicking on the unsubscribe link at the end of each newsletter e-mail.

For sending e-mails, we use a delivery service provider with whom we have concluded an agreement on order processing in accordance with Article 28 GDPR. They use your data to send the e-mail newsletter.

We store your data for the period during which you have subscribed to the e-mail newsletter or for the period during which we are legally or contractually obliged to do so (in particular until the limitation period of any claims has expired). As a rule, once you have unsubscribed, we only store your data anonymously for statistical purposes.

b. Evaluation of the use of the e-mail newsletter

When sending out the e-mail newsletter, we evaluate your user behaviour via a service provider (CleverReach GmbH & Co. KG, Mühlenstraße 43, 26180 Rastede), provided you give us your consent. For this purpose, the e-mail newsletters contain so-called "web beacons" or "tracking pixels" that are called up when the newsletter is opened. For the analyses, we link these web beacons with your e-mail address and an individual ID. Links contained in the e-mail newsletter also contain this ID. The data is collected exclusively in pseudonymised form, meaning that the IDs are not linked to your other personal data, and direct personal relevance for us is excluded. We can use this data to determine whether and when you opened the newsletter and which links have been clicked on in the newsletter. This is for the purpose of optimising and statistically evaluating our newsletter.

In addition, we use the data obtained to create a user profile in order to analyse the reading habits and interests of our users and thus to be able to customise the e-mail newsletter. If you have also taken further actions on our website, we will also link this data together in order to adapt the content of the e-mail newsletter to your interests.

The processing of your data for the purpose of measuring success is based on your explicit consent in accordance with Article 6(1)(a), Article 7 GDPR.

You can revoke your consent to the evaluation of your usage behaviour at any time with future effect by unsubscribing from the newsletter by clicking on the unsubscribe link at the end of each e-mail newsletter or by sending an e-mail or message to our contact details above. In this case, however, you would no longer receive the e-mail newsletter. In addition, you can deactivate the display of images in your e-mail software, which also stops the evaluation of your usage behaviour. However, this may limit the functionality of the newsletter. For example, images contained will no longer be displayed.

We store your data for the period during which you subscribe to the e-mail newsletter. Once you have unsubscribed, your data will only be stored anonymously for statistical purposes.

4. User account

a. Vitakraft online shop

You can create a user account in our Vitakraft online shop to purchase products at a later date or to subscribe to an e-mail newsletter.

aa. Registration ("New customer?" or "Create user account")

You can register as a user by entering the following data in the corresponding input screen:

• Form of address
• First name
• Surname
• E-mail address
• Password
• Confirm password

Once registration is complete, the data will be sent to us. The registration confirmation will be sent to you by e-mail and contains a link to the confirmation. If you click on the link, you will be finally registered.

Upon completion of the registration, a contractual usage relationship arises between you and us, so that the legal basis for the processing of personal data can be seen in Article 6(1)(b) GDPR.

The data is stored for as long as necessary for the purpose for which it was collected. This is usually the case as long as you are registered with us as a user. Mandatory statutory provisions – in particular retention periods – remain unaffected.

bb. Login process

You can log in to your user account with your login data (e-mail address and password you chose). We process this data to enable you to log in.

The processing of your data is based on Article 6(1)(b) GDPR, as you are contractually entitled to use the user account. The data is required for authentication reasons.

The data is stored for as long as necessary for the purpose for which it was collected. This is usually the case as long as you are registered with us as a user. Mandatory statutory provisions – in particular retention periods – remain unaffected.

cc. "Forgotten password"

If you have forgotten your password, you can request a new password by sending us information via this input screen. For authentication, you must enter your e-mail address and a combination of numbers and letters shown so that we can send you the new password.

The processing of your data is based on Article 6(1)(b) GDPR, as you have been granted a contractual right of access to your user account.

The data is stored for as long as necessary for the purpose for which it was collected. This is usually the case as long as you are registered with us as a user. Mandatory statutory provisions – in particular retention periods – remain unaffected.

dd. "Address book" feature or add "New address"

You can update or supplement your data in your user account. This is done on a purely voluntary basis. In this case, we save the data and store it for your user account.

We process your data in this case because you have voluntarily transmitted it to us. The legal basis for processing is Article 6(1)(f) GDPR. Our legitimate interest is to be able to process any purchases via the online shop more quickly or to be able to contact you more quickly. In addition, it is also our legal obligation in accordance with Article 6(1)(c) GDPR to update incorrect data from you, as you are entitled to have incorrect data from you rectified in accordance with Article 16 GDPR in conjunction with Section 35 GDPR.

The data is stored for as long as necessary for the purpose for which it was collected. This is usually the case as long as you are registered with us as a user or until you change or delete this data in the respective input screen. Mandatory statutory provisions – in particular retention periods – remain unaffected.

ee. Unsubscribe from your user account

You can also close your user account by sending an e-mail to info@vitakraft.de. In this case, we will close your user account. Please note that in this case you will also be unsubscribed from the Vitakraft newsletter if you have subscribed to the newsletter via your account.

We process your data on the basis of Article 6(1)(b) GDPR, as you are contractually entitled to close your user account.

The data is stored for as long as necessary for the purpose for which it was collected. The deletion usually follows immediately after the closing of the user account, unless we are otherwise required by law or contractual provisions to store it further. Such storage is possible if you have purchased products in our online shop.

b. Virtual trade fair stand

To visit our virtual trade fair stand, you must log in to the relevant page with the login details provided by Vitakraft (username and password). This is general login data for which no personal data is processed and no assignment to a specific or identifiable person is possible.

5. Ordering products in our online shop

If you order products from our online shop, processing of your personal data is necessary for the execution of the contract with you. We also process your data to provide you with further information about similar products and promotions.

a. Processes in connection with the execution of the purchase contract

You can order our products via our online shop. We will send them to you after conclusion of the contract. For the execution of the contract it is necessary to collect and process the following data from you:

• Form of address
• Surname and first name
• Address (street, house number, post code, town/city, country)
• Telephone (optional)
• Fax (optional)
• Shipping information
• Shipping method
• Payment information (PayPal Express, direct debit including bank country and IBAN and BIC or credit card with credit card number)
• SEPA direct debit mandate (if you select direct debit)

We process this data in order to execute the purchase contract. The legal basis is therefore Article 6(1)(b) GDPR. In order to process, fulfil and handle your order, we need to transfer your personal data to logistics and shipping companies, banks, financial service providers and, where applicable, credit card companies.

If you voluntarily enter your telephone number, we will forward it to the commissioned shipping company. The telephone number is used by the latter to contact you if they have any questions about the delivery. Your telephone number is processed with your explicit consent in accordance with Article 6(1)(a) GDPR.

These external service providers are contractually obliged to process your personal data in accordance with data protection provisions.

Otherwise, we will not pass on personal data to third parties without your instigation. However, we reserve the right to disclose information about you if we are legally obliged to do so or if the disclosure is requested by lawful authorities or law enforcement agencies.

Once the contract has been fully processed and the purchase price has been paid in full, your data will be blocked for further use and deleted after expiry of the retention periods under tax and commercial law, unless you have expressly consented to the continued use of your data.

aa. Payment service providers

Payment in the online shop requires the transmission of data to payment service providers. Card and payment data as well as name and address are transmitted on the basis of Article 6(1)(b) GDPR.

We have commissioned BS PAYONE GmbH, Fraunhoferstraße 2-4, 24118 Kiel ("Payone"), to process the payments (for the payment methods PayPal, SEPA direct debit and credit card payment). For this purpose, Payone requires, among other things, your name and address, account number and sort code or credit card number (including period of validity), invoice amount and currency as well as the transaction number. Payone uses this data for the purpose of payment processing and transmits information in this regard to us. The legal basis for the processing of your personal data is Article 6(1)(b) GDPR.

If you would like to order goods in the online shop, we may ask Payone for credit information about you. For this purpose, we transfer your personal data to Payone.

The purpose of the transfer and processing of your personal data is to avoid a payment default. A so-called scoring is carried out based on methods defined by Payone. If the result of the scoring is positive, payment for the respective product is possible. If the result is negative, payment by "direct debit" is not possible. We use the scoring exclusively to prepare and execute the contract with you and to protect ourselves against possible payment defaults.

This personal data is required for the execution of your contract with us on the basis of Article 6(1)(1)(b) GDPR as well as on the basis of Article 6(1)(1)(f) GDPR due to our legitimate interest in avoiding a payment default on your part (creditor risk).

The scoring data will be deleted as soon as it is no longer required for the purpose for which it was collected and there are no legal or contractual obligations requiring us to store it further. This is usually the case as soon as Payone has communicated the positive or negative result to us.

We also offer PayPal payment via Payone. The provider of this payment service is PayPal (Europe) S.à.r.l. et Cie., S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg ("PayPal"). If you select PayPal payment, your payment data will be transferred to PayPal. The transfer of data to PayPal takes place on the basis of Article 6(1)(b) GDPR. You can find out how PayPal processes your personal data (in particular whether and how a credit check is carried out) at https://www.paypal.com/de/webapps/mpp/ua/privacy-full?locale.x = de_DE.

If you have selected credit card payment as your payment method, the data mentioned above will be forwarded to the credit card company from which your credit card originates. If your credit card is a Mastercard, the data is transmitted to MasterCard Europe SA, Chaussée de Tervuren 198A, 1410 Waterloo, Belgium, https://www.mastercard.de/de-de/datenschutz.html. If it is a Visa card, the data is transferred to Visa Europe Services LLC, registered in Delaware USA, acting through the London branch, 1 Sheldon Square, London W2 6TT, UK, https://www.visa.de/nutzungsbedingungen/visa-privacy-center.html. This takes place on the basis of Article 6(1)(b) GDPR.

If you select SEPA direct debit, you must issue us a SEPA direct debit mandate. We store both the issue and the information we need to collect the amount. We will send these to your bank so that we can receive the required amount. This is also based on Article 6(1)(b) GDPR.

bb. Logistics and shipping companies

We also commission logistics and shipping companies to ship our products. The legal basis for the transmission and processing of this personal data is Article 6(1)(b) GDPR. In the case of orders for products that we are to send you outside Germany, data is transmitted to postal and parcel service providers abroad, insofar as this is necessary for the respective shipment.

cc. Fraud prevention and suspicion of fraud

If further orders or attempts to place orders take place despite payment defaults, we reserve the right to press charges ourselves.

Processing is based on Article 6(1)(f) GDPR in conjunction with Recital 47 GDPR. Our legitimate interest is the prevention of payment defaults or the reporting of fraud attempts. Your data may be passed on to the police or public prosecutor in the event of suspicion.

If a third party is harmed, e.g. by the use of their account in the electronic direct debit procedure, and presses criminal charges, we will pass on data on request by the police and/or public prosecutor. This could be, for example: name, address and telephone number of the ordering party and – if different – of the goods recipient, as well as the time of the order and IP address of the computer or mobile device used for the order, the bank details available, as well as the data provided by the logistics company to us: delivery location and time as well as the name and signature of the receiving party. We process your personal data on the basis of a legal obligation (Article 6(1)(1)(c) GDPR).

We delete the data as soon as it is no longer required for the purpose for which it was collected or insofar as we are no longer legally or contractually obliged to collect it further.

dd. Reminders or debt collection and enforcement of legal claims

If you do not settle outstanding receivables within the set deadline, we will remind you by post or e-mail. If a payment is still not made after a reminder, we initiate a debt collection procedure and pass on your personal data to debt collection companies and, if applicable, to law firms. We process your personal data for the purpose of executing and processing the contract with you on the basis of Article 6(1)(1)(b) GDPR and on the basis of our legitimate interests to prevent misuse of our services and to enforce our legal claims, including debt collection, on the basis of Article 6(1)(1)(f) GDPR.

If there is a legal dispute with you, we process your personal data for the enforcement or defence of our rights or claims. We process your personal data on the basis of a legal obligation (Article 6(1)(1)(c) GDPR) and on the basis of our legitimate interest in enforcing or defending our legal interests (Article 6(1)(1)(f) GDPR).

This data will be deleted as soon as it is no longer required for the purpose for which it was collected and there are no legal or contractual obligations requiring us to store it further.

b. Sending product recommendations by e-mail

If you were logged in with your user account during the purchase process and have not objected, you will regularly receive information material and product recommendations for similar goods or services by e-mail. For example, if you order cat food or snacks, we will send you information about products in the same category, such as cat food discounts.

Your e-mail address, form of address, first name and surname will be processed.

The sending of product recommendations is based on Article 6(1)(f) GDPR in conjunction with Recital 47(7) GDPR in conjunction with Section 7(3) Law Against Unfair Competition (UWG). Our legitimate interest is to send you more information about our products that interest you based on our contractual relationship with you as an existing customer.

You can object to the sending of product recommendations or information material at any time without incurring costs other than transmission costs at the basic rate. For this purpose, use the unsubscribe link at the end of the respective information e-mail, for example. Alternatively, you can also send us an e-mail at the e-mail address given above. After you have unsubscribed or objected, we only store anonymised data for statistical purposes.

The data is stored for as long as necessary for the purpose for which it was collected. This is usually the case as long as you have not objected to receiving e-mail product recommendations. Mandatory statutory provisions – in particular retention periods – remain unaffected.

6. Links to other websites

On our website you will find links to other websites, e.g. social bookmarks on Twitter or Instagram. These websites are not operated by us. The privacy policies of the respective operator apply to the processing of your personal data on these websites.

7. Cookies

Our website uses cookies, which are stored on your computer. Cookies are small text files that can be stored locally by a website in the memory of your Internet browser on the computer you use. Cookies enable the recognition of the Internet browser in particular.

You can also set your Internet browser so that you are informed about the setting of cookies or so that they are generally rejected. You can then decide individually on their acceptance or exclude the acceptance of cookies for certain cases or in general. However, if you do not accept cookies the display and offering of our website may no longer function or may only function to a limited extent. Cookies are used to make our website more user-friendly, effective and secure.

Most of the cookies we use are so-called "session cookies". These will be deleted automatically at the end of your visit. Other cookies remain stored on your end device until you delete them. These cookies allow us to recognise your browser the next time you visit. Once cookies have been set, you can delete them yourself at any time by calling up the corresponding menu item in your Internet browser or deleting the cookies on your hard drive. Please refer to the Help menu of your Internet browser for details.

A cookie notice layer informs you about the setting of cookies on our website so that you can make decisions about the setting of the individual cookie types.

There are different types of cookies. A rough distinction is made between technically necessary cookies (mostly session cookies), analysis cookies and advertising cookies (usually persistent cookies that are stored beyond a mere one-time visit to a website).

a. Technically necessary cookies

These cookies are required to carry out the electronic communication process or to provide certain functions you require (e.g. shopping cart function). The session ID is stored and transmitted in the login cookie as well as further information, e.g. about your shopping cart content.

The legal basis for processing is Article 6(1)(f) GDPR, since we have a legitimate interest in error-free operation of the website and would like to optimise our services for you.

If you object to the use or configure your Internet browser accordingly, content may no longer be displayed correctly or the website may not be accessible.

Below you will find all technically necessary cookies placed on our website:

b. Analytic and advertising cookies

We also use analytic and advertising cookies. These cookies enable us to analyse the use of our website and to display targeted, individual or personalised advertising on the website for you. These include, for example, the frequency of page visits or the use of features or advertisements on the website. The use of analytic cookies is intended to improve the quality of our website and its content. Advertising cookies are used based on our marketing interest.

We only use these types of cookies if you have given your consent in accordance with Article 6(1)(a) GDPR. You can give us your consent by setting the cookie notice layer that you will see on our website the first time you visit it accordingly. You can change these settings at any time and thereby withdraw your consent. Please note that the withdrawal of your consent will only take effect in the future. The previous processing on the basis of consent remains unaffected.

Websites are also operated which enable preference management by online behavioural advertising companies for users, which are then stored in the browser. You can reach this website at http://www.youronlinechoices.com/ch-de/praferenzmanagement.

Below you will find the analytic and advertising cookies we use:

aa. Google Analytics with anonymisation function

This website uses Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street 4, Ireland ("Google Analytics"). On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity and to provide the website operator with further services associated with website and Internet use.

We only use Google Analytics with the activated configuration for IP anonymisation ("gat._anonymizeIp();") to ensure anonymised collection of IP addresses (so-called IP masking). This means that your IP address will be anonymised by Google within the member states of the European Union or in other signatory states to the Agreement on the European Economic Area. Only in exceptional cases will the complete IP address be transmitted to a Google server in the USA and truncated there. The IP address transmitted by your browser is not merged with other Google data.

You can prevent the storage of cookies by setting your browser software accordingly. However, please note that in this case you may not be able to make full use of all the features of this website.

You can also prevent the data generated by the cookie and related to your use of the website (including your IP address) from being passed on to Google and the processing of this data by Google by downloading and installing the browser plugin available at the following link: http://tools.google.com/dlpage/gaoptout?hl=de

As an alternative to the browser plugin, you can click on this link to prevent Google Analytics from collecting data on this website in the future. An opt-out cookie is stored on your device. If you delete your cookies, you must click on the link again.

In addition, a corresponding agreement has been concluded with Google concerning data processing in accordance with Article 28 GDPR. The conditions for this can be found at https://privacy.google.com/businesses/processorterms/?. Google may also process your personal data in the USA and is subject to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework.

bb. Google Ads

We also use the Google Ads advertising tool from Google Ireland Limited, Gordon House, Barrow Street 4, Ireland ("Google Ads") on our website. In this context, we use the Google Ads Conversion analysis service on our website.

If you have accessed our website via a Google advertisement, a cookie is stored on your computer. These cookies lose their validity after 90 days and are not for your personal identification.

If you visit certain pages of our website and the cookie has not yet expired, we and Google can recognise that you, as a user, have clicked on one of our advertisements placed on Google and have been forwarded to our website. The information gathered with the help of these cookies is used by Google to create visiting statistics for our website. These statistics tell us the total number of users who clicked on our advertisement and which pages of our website were subsequently accessed by the respective user. We or other advertisers via Google Ads do not receive any information that personally identifies users. If you are registered with a Google service, Google can assign the visit to your account. Even if you are not registered with Google or have not logged in, the provider may find out and store your IP address.

You can prevent the setting of the cookie by setting your browser accordingly, for example to deactivate the automatic setting of cookies in general or to only block cookies from the domain googleadservices.com. Google's privacy policy in this regard can be found at the following link: https://policies.google.com/privacy?gl=de

In addition, a corresponding agreement has been concluded with Google concerning data processing in accordance with Article 28 GDPR. The conditions for this can be found at https://privacy.google.com/businesses/processorterms/?. Google may also process your personal data in the USA and is subject to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework.

cc. Adform tracking

This website also uses technology from Adform A/S, Wildersgade 10B, 1. Sal. 1408 København, Denmark. This system uses cookies for tracking and managing digital advertising campaigns, i.e. we learn how many users come to our website via an online advertisement. The information obtained in this way is used to generate statistics about our online advertising measures. Furthermore, this system is used for retargeting, i.e. the visitor to a website is marked and subsequently addressed again on other websites with targeted advertising.

Adform does not store any personal data such as name, e-mail addresses or other personal information by setting cookies. All information is purely anonymised and contains technical information such as the display frequency and the advertisement date, the browser used or the installed operating system. It is not possible to draw any conclusions about you. Since IP addresses are considered personal data in the European Union, Adform never stores complete IP addresses on our website, but truncates the last octet to comply with data protection.

The legal basis for the corresponding data processing is Article 6(1)(a) GDPR. The cookies used by Adform lose their validity after 90 days, unless you delete them manually beforehand using the corresponding feature of your browser.

For more information on Adform tracking, visit https://site.adform.com/de/privacy-center/platform/datenschutzrichtlinie-fuer-produkte-und-services/

c. Cookies overview

8. Other website tools that use tracking mechanisms

In addition to this, we also use various website tools on our website to offer you various features on our website. We will only use these website tools if you have expressly consented to this. The basis of authorisation for the processing of your personal data is Article 6(1)(a) GDPR, unless another basis of authorisation arises from the following subsections.

These are, for example, social media widgets. These are symbols or buttons from social media providers such as Twitter that enable interaction with these services for you.

The respective data processing purposes, data categories and legal bases can be found in the corresponding sections.

a. Google Web Fonts

Our website uses web fonts provided by Google Ireland Limited, Gordon House, Barrow Street 4, Ireland ("Google Web Fonts") for the uniform display of fonts. When you visit a page, your Internet browser loads the required web fonts into your browser cache in order to display texts and fonts correctly. For this purpose, the Internet browser you use must connect to Google servers. As a result, Google becomes aware that our website has been accessed via your IP address.

Google Web Fonts are used in the interest of a uniform and appealing presentation of our website. This represents a legitimate interest within the meaning of Article 6(1)(f) GDPR.

If your browser does not support Web Fonts, a default font is used by your computer.

Further information on Google Web Fonts can be found at https://developers.google.com/fonts/faq and in Google's privacy policy: https://www.google.com/policies/privacy/. Google also processes your personal data in the USA and is subject to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework.

b. Google Maps

We also use the Google Maps service to better present our locations to you. Google Maps is a service of Google Ireland Limited, Gordon House, Barrow Street 4, Ireland ("Google Maps"). An interactive map is displayed. As soon as you click on the map and thus activate the content, your IP address is saved and transmitted to Google. This information is usually transmitted to a Google server in the USA. Google is solely responsible for this form of processing.

You can find the terms of use for Google Maps and further information here:

• https://www.google.com/intl/de_de/help/terms_maps.html
• https://www.google.com/policies/privacy/

In this regard, we have concluded an agreement with Google on joint responsibility. Below are the relevant conditions: https://privacy.google.com/intl/de/businesses/mapscontrollerterms/. Google may also process your personal data in the USA and is subject to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework.

c. Twitter widget

We use features of the service provider Twitter Inc., 1355 Market St, Suite 900, San Francisco, CA 94103, USA. Vitakraft's Twitter timeline is integrated directly into our website (Twitter widget). Twitter offers the so-called Tweet feature.

The data transfer takes place as soon as you have activated the content of the Twitter widget on our website. This is done by clicking on the button. Regardless of whether you have an account with Twitter and are logged into it, data is transferred to Twitter.

If you are logged into your Twitter account and you use the Twitter feature on our website, this information will be linked to your Twitter account. Data is also transmitted to Twitter, for example name and user name, e-mail address as well as the IP address or GPS data. This information can be used, for example, to send you advertising or other content. Through the integrated Twitter widget and the use of cookies, Twitter is able to record your visits to our website and assign them to your Twitter profile if you are logged in during your visit to our website.

Since Twitter Inc. is a non-European provider, your data may be transferred to third countries. You can restrict the processing of your data in the general settings of your Twitter account as well as under "Safety and Security". In addition, you can restrict Twitter's access to contact and calendar data, photos, location data, etc., in the settings on your mobile devices (smartphones, tablet computers). However, this depends on the operating system used.

We are not aware of the content of the transmitted data and its use by Twitter. However, in order to be able to recommend the latest news and communications about our products, we use this service.

You can find further information on this in Twitter's privacy policy at http://twitter.com/privacy as well as at https://help.twitter.com/de/search?q=datenschutz. Twitter gives you the option of setting your privacy settings yourself via the following link: http://twitter.com/account/settings. You can find information on the personalisation and data protection setting options that exist here (with further links): https://twitter.com/personalization

d. YouTube

We use YouTube components (videos) on our website. YouTube is provided by Google Ireland Limited, Gordon House, Barrow Street 4, Ireland. We use the "extended data protection mode" option provided by YouTube. If you visit a page that has an embedded video and activate the content by clicking on the button, a connection to the YouTube servers is established and the YouTube server is informed of which of our web pages you visit.

According to YouTube, only limited data is transmitted to the YouTube server in "extended data protection mode", in particular which of our web pages you visited when watching the video.

If you are logged into YouTube at the same time, this information will be assigned to your YouTube member account. You can prevent this by logging out of your member account before visiting our website.

Further information on YouTube's privacy policy is provided by Google at the following link: https://www.google.de/intl/de/policies/privacy/.

Google also processes your personal data in the USA and is subject to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework.

e. Google Tag Manager

Our website uses the Google Tag Manager of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). By using the Google Tag Manager, website tags can be managed via an interface. The service only implements tags, not cookies on your computer. Consequently, no personal data is collected. The Google Tool Manager triggers other tags, which in turn may collect data. However, the Google Tag Manager does not access this data. You can find more information at http://www.google.de/tagmanager/use-policy.html.

9. Career portal

When you apply for a position via our career portal, we collect and process the following personal data:

• Name
• Address
• E-mail address
• Telephone number
• Personal details from the CV

We will only use the data you provide to us via your application documents or the input screen for the selection process for the position advertised. In doing so, we check whether you are suitable for the position and whether we can take you into account for the further application process.

The legal basis for the processing of your personal data is Section 26(1) BDSG, as this is necessary in order to make a decision about whether or not to establish an employment relationship and to contact you.

Insofar as you voluntarily provide us with special categories of data (such as health data or data on your ethnic origin), for example by attaching them to your CV, we will only process them if this is required in accordance with Section 26(3) BDSG.

If, after completion of the application process, the data is necessary for legal proceedings, data may be processed on the basis of the requirements of Article 6 GDPR, in particular for the exercise of legitimate interests in accordance with Article 6(1)(f) GDPR. The legitimate interest is, for example, that we can fulfil our duty of proof in proceedings in accordance with the General Equal Treatment Act (AGG). Our interest then lies in asserting or defending against claims.

Your data will not be transferred to other parties.

We only store your personal data for as long as necessary for the execution of the application process. Applicant data will be deleted after 4 months in the event of a rejection. This time period starts with the notice of rejection and a corresponding status change in the applicant management system. Should you get the job as part of the application process and take up the role, the data from the applicant management system will be transferred to our personnel information system in accordance with Section 26(1) BDSG and will be irrevocably deleted from the applicant management system.

III. Security on our website

For security reasons and to protect the transmission of confidential content, such as orders or enquiries you send us, our website uses SSL or TLS encryption.

You can recognise an encrypted connection by the fact that the address line of the browser changes from "http://" to "https://" and the lock symbol appears in your browser line. If SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

We also protect our website and other systems against the loss, destruction, access, alteration or distribution of your data by unauthorised persons by appropriate technical and organisational measures. Despite regular checks, we would like to point out that complete protection against all risks is not possible.

IV. Your rights as a data subject

If you would like to exercise your rights as a data subject as explained below, you are welcome to let us know at datenschutz@vitakraft.de.

1. Right of withdrawal (Article 7(3) GDPR)

You have the right to withdraw your consent to the processing for which you have given your consent at any time. Withdrawal shall not affect the lawfulness of the processing carried out on the basis of consent until withdrawal. This means that the withdrawal only applies to the future. You will be informed of this prior to giving your consent.

2. Right of access (Article 15 GDPR, Section 34 BDSG)

You have the right to request confirmation as to whether we process personal data about you. If this is the case, you have the right to access this personal data and the following information:

• Purposes of processing;
• Categories of personal data;
• Recipients of the personal data, in particular where the recipients are in third countries or are international organisations;
• Where possible, the envisaged duration for which the personal data will be stored, or at least the criteria for determining the retention period;
• The existence of a right to rectification or erasure of your personal data or restriction of processing or the right to object;
• The existence of a right to lodge a complaint with a supervisory authority;
• The origin of the personal data (insofar as we do not collect the data from you);
• Whether automated decision-making, including profiling, takes place in accordance with Article 22(1) and (4) GDPR and, if so, meaningful information about the logic involved and the scope and intended effects of such processing on you.

If personal data is transferred to a third country or an international organisation, you have the right to be informed of which appropriate safeguards are in place to ensure that the provisions of the GDPR are complied with by these recipients.

3. Right to rectification (Article 16 GDPR, Section 35 BDSG)

You may request that we rectify inaccurate data immediately. Taking into account the purposes of the processing, you also have the right to request the completion of incomplete personal data – also by means of a supplementary declaration. You can also use our "Change address" or add "New address" feature in the user account if this concerns your address, name or contact details.

4. Right to erasure (Article 17 GDPR, Section 35 BDSG)

You have the right to ask us to erase your personal data immediately if one of the following reasons applies:

• The data is no longer necessary for the purposes for which it was collected or otherwise processed;
• You withdraw your consent on which the processing was based and there is no other legal basis for the processing;
• For reasons arising from your particular situation, you object to processing in accordance with Article 21(1) GDPR and there are no overriding legitimate grounds for processing by us;
• In accordance with Article 21(2) GDPR, you object to processing for direct marketing (no justification is required here);
• In the event of unlawful processing;
• Erasure of the data is necessary for the fulfilment of a legal obligation under European or German law;
• The data was collected in relation to information society services offered in accordance with Article 8(1) GDPR.

If we have made your data public and are obliged to erase it, we shall take appropriate measures, taking into account the available technology and the implementation costs, to inform the data controllers that you have requested erasure.

5. Right to restriction of processing (Article 18 GDPR)

In the following cases, we may only process your personal data to a limited extent if

• You dispute the accuracy of your data until we are able to verify the accuracy;
• The processing is unlawful and you object to the erasure of your data and instead request the restriction of the use of the personal data;
• We no longer need the data for the purposes of processing, but you need it to assert, exercise or defend legal claims, or
• You object to processing in accordance with Article 21(1) GDPR for reasons arising from your particular situation, for as long as it has not yet been determined whether the legitimate grounds for processing by us outweigh your interests.

If processing has been restricted, we may store this data but may not process it any further. This does not include processing that is permitted with your consent or for the assertion, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or a Member State. You can revoke your consent given in this context at any time. We will notify you as soon as the restriction is lifted.

6. Notification obligation (Article 19 GDPR)

We are obliged to inform all recipients to whom your data has been disclosed of any rectification or erasure of your data or restriction of processing. This shall not apply only if this proves impossible or involves disproportionate effort.

7. Right to data portability (Article 20 GDPR)

You have the right to receive the personal data that you have provided to us in a structured, commonly used and machine-readable format. If

• the processing of the data is based on your consent or on a contract, and
• processing is carried out using automated procedures

you may request that we transfer the data directly to a third party, insofar as this is technically feasible. This right must not affect the rights and freedoms of other persons.

8. Automated individual decision-making, including profiling (Article 22 GDPR)

As part of the processing of your data for the execution of the contract, your data is not subject to decisions based solely on automated processing, with the exception of the credit check. A so-called scoring is carried out by our contractual partner Payone. Please contact Payone for more information.

9. Right to object (Article 21 GDPR)

If we process your data on the basis of an overriding legitimate interest, you have the right to object to this if the reasons for this arise from your particular situation. This also applies to profiling based on these provisions.

In this case, we will no longer process your data, unless we can prove compelling legitimate grounds for processing. These must override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

If we process your data for direct marketing purposes, you can object to the processing of the data without providing reasons. This also applies to profiling insofar as this is related to direct marketing.

The objection means that we no longer process your data for these purposes. You can send an objection informally to the contact address above.

10. Right to lodge a complaint with a supervisory authority (Article 77 GDPR)

You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your place of residence, your place of work or the place of the alleged violation, if you believe that the processing of your personal data violates the GDPR. This shall not affect any other administrative or judicial remedies you may have.

V. Changes to this Privacy Policy

We reserve the right to amend this Privacy Policy if necessary, e.g. in the event of legal changes. You can view the current version of the Privacy Policy at any time on our website.

Version 1.5 / 05/11/2020