1. Definitions

In our Privacy Policy, we use specific terms from various data protection laws. We want our statement to be easily understandable, and therefore we explain these terms in advance.

The following definitions may be interpreted or expanded based on the case law of the Court of the European Union (CJEU), the European Court of Justice (ECJ), the Swiss Federal Court (BGE), the Supreme Court of the United Kingdom (UKSC), or based on national data protection laws or national case law of a state or federal state, including but not limited to California, including case law, also under Common Law, if this is necessary for the application of the law in the individual case.

In this Privacy Policy, we use among others the following terms:

a) personal data

Personal data is any information relating to an identified or identifiable natural person (hereinafter referred to as the "data subject"). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more specific characteristics that express the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person, or who must be regarded as such under national data protection laws or the national jurisprudence of a state or federal state, including case law, also under common law.

b) data subject

A data subject is any identified or identifiable natural person whose personal data is processed by the controller, a processor, an international organization, or another data recipient, and persons who must be regarded as such under national data protection laws or the national jurisprudence of a state or federal state, including case law, also under common law.

c) processing

Processing is any operation or set of operations performed on personal data, whether or not by automated means, such as the collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

d) Restriction of processing

Restriction of processing is the marking of stored personal data with the aim of limiting its future processing.

e) Profiling

Profiling is any type of automated processing of personal data that consists of using personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning work performance, economic situation, health, personal preferences, interests, reliability, behavior, location, or changes of location of the natural person.

f) Pseudonymization

Pseudonymization is the processing of personal data in such a way that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures that ensure that the personal data is not attributed to an identified or identifiable natural person.

g) Controller

Controller is the natural or legal person, authority, agency, or other body that alone or jointly with others determines the purposes and means of the processing of personal data. Where the purposes and means of processing are determined by Union law or the law of the Member States, the controller or the specific criteria for its designation may be provided for by Union law or the law of the Member States.

h) Processor

The processor is a natural or legal person, authority, institution, or other entity that processes personal data on behalf of the controller.

i) Recipient

The recipient is a natural or legal person, authority, institution, or other entity to whom personal data is disclosed, regardless of whether it is a third party or not. Authorities that may receive personal data in the context of a specific investigation under Union law or the law of the Member States are not considered recipients.

j) Third party

A third party is a natural or legal person, authority, institution, or other entity other than the data subject, the controller, the processor, and the persons who are authorized to process the personal data under the direct responsibility of the controller or the processor.

k) Consent

Consent is any freely given, specific, informed, and unambiguous indication of the data subject's wishes, by which they signify agreement to the processing of personal data concerning them, in the form of a statement or a clear affirmative action.

2. Name and address of the provider

The responsible party in the sense of the General Data Protection Regulation, other applicable data protection laws in the member states of the European Union and the European Economic Area, the British data protection laws, the Swiss data protection laws (DSG, DSV), the California data protection laws (CCPA/CPRA), Chinese data protection law (PIPL), as well as international laws and other provisions with data protection character is:

Lina Maria Valdés Cano

Lichtenbergstr. 65

64289 Darmstadt

Tel.: 017622002380

E-Mail: post@vollmutig.de

Website: www.vollmutig.de

3. Collection of general data and information

Our websites collect a range of general data and information with each access to the websites by an affected person or an automated system. This general data and information is stored in the log files of the respective server. The following can be collected, among other things: (1) the types and versions of browsers used, (2) the operating system used by the accessing system, (3) the website from which an accessing system reaches our websites (so-called referrer), (4) the sub-websites that are accessed via an accessing system on our websites, (5) the date and time of access to the website, (6) an Internet Protocol address (IP address), (7) the Internet service provider of the accessing system, and (8) other similar data and information that serve to prevent danger in the event of attacks on our information technology systems.

When using this general data and information, we do not draw conclusions about the affected person. This information is rather needed to (1) deliver the content of our websites correctly, (2) optimize the content of our websites as well as the advertising for them, (3) ensure the permanent functionality of our information technology systems and the technology of our websites, and (4) provide law enforcement authorities with the necessary information for prosecution in the event of a cyber attack. The anonymized data and information collected by us are therefore evaluated on the one hand statistically and further with the aim of increasing data protection and data security in our company, ultimately to ensure an optimal level of protection for the personal data we process. The data from the server log files are stored separately from all personal data provided by an affected person.

The purpose of processing is the prevention of dangers and the assurance of IT security, as well as the aforementioned purposes. The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest is particularly the protection of our information technology systems. The deletion of the log files occurs after the specified purposes have been achieved.

4. Contact option via the website and other data transmissions and your consent

Our websites contain information that enables quick electronic contact with our company as well as direct communication with us, which also includes a general address of the so-called electronic mail (email address) and possibly a telephone number. If a data subject contacts us via email, through a contact form, through an input form, or otherwise, the personal data transmitted by the data subject will be automatically stored. Such personal data voluntarily provided to us by a data subject will be processed for the purposes of processing or contacting the data subject.

For the transmission, storage, and processing of your contact details and inquiries and for contacting you, we obtain your consent in accordance with Art. 6 (1) (a) GDPR and Art. 49 (1) (1) (a) GDPR as follows:

By submitting your personal data, you voluntarily consent to the processing of your entered or transmitted personal data for the purpose of processing the request and for contacting you. By transmitting your data to us, you also voluntarily give explicit consent in accordance with Art. 49 (1) (1) (a) GDPR for data transfers to third countries to and through the companies mentioned in this privacy policy and for the stated purposes, particularly for such transfers to third countries for which there is or is not an adequacy decision of the EU/EEA, as well as to companies or other entities that do not fall under an existing adequacy decision due to self-certification or other accession criteria, and in which or for which significant risks and no suitable guarantees for the protection of your personal data exist (e.g., due to § 702 FISA, Executive Order EO12333, and the Cloud Act in the USA). When you give your voluntary and explicit consent, you are aware that in third countries there may not be an adequate level of data protection and that your rights as a data subject may not be enforceable. You can revoke your data protection consent at any time with effect for the future. The legality of the processing carried out based on the consent until the revocation is not affected by the revocation of the consent. With a single action (the input and transmission), you give multiple consents. These include consents under EU/EEA data protection law as well as those of the CCPA/CPRA, ePrivacy, and Telemedia law, and other international legal provisions that are required, among other things, as a legal basis for planned further processing of your personal data. With your action, you also confirm that you have read and acknowledged this privacy policy.

5. Routine deletion and restriction of personal data

We process and store personal data for the period necessary to achieve the purpose of processing or as provided by the European legislator or another legislator in laws or regulations to which we are subject, or as long as a legal basis for processing exists.

If the purpose of processing ceases or if a storage period prescribed by the European legislator or another competent legislator expires, or if the legal basis for processing ceases, personal data will be routinely restricted or deleted in accordance with legal regulations.

6. Rights of the data subject under the GDPR

a) Right to confirmation

Every data subject has the right to request confirmation from the controller as to whether personal data concerning them is being processed.

If a data subject wishes to exercise this right, they can contact us at any time.

b) Right to access

Every data subject has the right to obtain from the controller, free of charge, information about the personal data stored concerning them and a copy of this data at any time. Furthermore, the European legislator has granted the data subject access to the following information:

• the purposes of processing,

• the categories of personal data being processed,

• the recipients or categories of recipients to whom the personal data have been disclosed or will be disclosed, particularly in the case of recipients in third countries or international organizations,

• if possible, the planned duration for which the personal data will be stored, or, if this is not possible, the criteria for determining this duration,

• the existence of a right to rectification or erasure of the personal data concerning them or to restriction of processing by the controller or a right to object to such processing,

• the existence of a right to lodge a complaint with a supervisory authority,

• if the personal data are not collected from the data subject: all available information about the source of the data,

• the existence of automated decision-making including profiling pursuant to Art. 22 (1) and (4) GDPR and — at least in these cases — meaningful information about the logic involved as well as the significance and the intended consequences of such processing for the data subject.

Furthermore, the data subject has the right to know whether personal data have been transferred to a third country or to an international organization. If this is the case, the data subject also has the right to obtain information about the appropriate safeguards in connection with the transfer.

If a data subject wishes to exercise this right, they can contact us at any time.

c) Right to rectification

Every data subject has the right to request the immediate correction of inaccurate personal data concerning them. Furthermore, the data subject has the right, taking into account the purposes of processing, to request the completion of incomplete personal data — also by means of a supplementary statement.

If a data subject wishes to exercise this right, they can contact us at any time.

d) Right to deletion (Right to be forgotten)

Every data subject has the right to request the controller to delete personal data concerning them without delay, provided that one of the following reasons applies and as long as the processing is not necessary:

• The personal data were collected or otherwise processed for purposes for which they are no longer necessary.

• The data subject withdraws their consent on which the processing was based according to Art. 6 (1) (a) GDPR or Art. 9 (2) (a) GDPR, and there is no other legal basis for the processing.

• The data subject objects to the processing pursuant to Art. 21 (1) GDPR, and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Art. 21 (2) GDPR.

• The personal data have been processed unlawfully.

• The deletion of personal data is necessary to comply with a legal obligation under Union law or the law of the Member States to which the controller is subject.

• The personal data were collected in relation to services offered by the information society in accordance with Art. 8 (1) GDPR.

If one of the above reasons applies and a data subject wishes to request the deletion of personal data stored with us, they can contact us at any time.

If the personal data has been made public by us and our organization is obligated as the controller under Art. 17 (1) GDPR to delete the personal data, we will take appropriate measures, taking into account the available technology and the implementation costs, including technical measures, to inform other controllers processing the published personal data that the data subject has requested the deletion of all links to this personal data or copies or replications of this personal data from those other controllers, as long as the processing is not necessary.

e) Right to restriction of processing

Every data subject has the right to request the restriction of processing from the controller if one of the following conditions is met:

• The accuracy of the personal data is contested by the data subject, for a duration that allows the controller to verify the accuracy of the personal data.

• The processing is unlawful, the data subject opposes the deletion of the personal data and instead requests the restriction of the use of the personal data.

• The controller no longer needs the personal data for the purposes of processing, but the data subject needs it for the establishment, exercise, or defense of legal claims.

• The data subject has lodged an objection to the processing pursuant to Art. 21 (1) GDPR, and it is not yet clear whether the legitimate grounds of the controller outweigh those of the data subject.

If one of the above-mentioned conditions is met and a data subject wishes to request the restriction of personal data stored with us, they can contact us at any time.

f) Right to data portability

Every data subject has the right to receive the personal data concerning them, which has been provided by the data subject to a controller, in a structured, commonly used, and machine-readable format. They also have the right to transmit these data to another controller without hindrance from the controller to whom the personal data has been provided, provided that the processing is based on consent according to Art. 6 (1) (a) GDPR or Art. 9 (2) (a) GDPR or on a contract according to Art. 6 (1) (b) GDPR and the processing is carried out by automated means, unless the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Furthermore, the data subject, in exercising their right to data portability according to Art. 20 (1) GDPR, has the right to obtain that the personal data be transmitted directly from one controller to another, where technically feasible and provided that the rights and freedoms of other persons are not adversely affected.

If a data subject wishes to exercise this right, they can contact us at any time.

g) Right to object

Every affected person has the right to object at any time to the processing of personal data concerning them, which is carried out based on Art. 6 (1) (e) or (f) GDPR, for reasons arising from their particular situation. This also applies to profiling based on these provisions.

We will no longer process the personal data in the event of an objection, unless we can demonstrate compelling legitimate grounds for the processing that override the interests, rights, and freedoms of the affected person, or the processing is necessary for the establishment, exercise, or defense of legal claims.

If we process personal data for the purpose of direct marketing, the affected person has the right to object at any time to the processing of personal data for such marketing purposes. This also applies to profiling insofar as it is related to such direct marketing. If the affected person objects to us regarding the processing for direct marketing purposes, we will no longer process the personal data for these purposes.

Furthermore, the affected person has the right to object for reasons arising from their particular situation to the processing of personal data concerning them that is carried out by us for scientific or historical research purposes or for statistical purposes in accordance with Art. 89 (1) GDPR, unless such processing is necessary for the performance of a task carried out in the public interest.

If a data subject wishes to exercise this right, they can contact us at any time. The data subject is also free to exercise their right to object in connection with the use of information society services, regardless of Directive 2002/58/EC, using automated procedures that involve technical specifications.

h) Automated decisions in individual cases including profiling

Every data subject has the right not to be subject to a decision based solely on automated processing — including profiling — that has legal effects concerning them or similarly significantly affects them, provided that the decision (1) is not necessary for the conclusion or performance of a contract between the data subject and the controller, or (2) is permissible under Union or Member State law to which the controller is subject and such law provides for suitable measures to safeguard the rights and freedoms as well as the legitimate interests of the data subject, or (3) is based on the explicit consent of the data subject.

If the decision (1) is necessary for the conclusion or performance of a contract between the data subject and the controller or (2) is based on the explicit consent of the data subject, we take appropriate measures to safeguard the rights and freedoms as well as the legitimate interests of the data subject, which include at least the right to obtain intervention from a person on the part of the controller, to express their point of view, and to contest the decision.

If a data subject wishes to exercise this right, they can contact us at any time.

i) Right to withdraw consent to data processing

Every affected person has the right to withdraw consent for the processing of personal data at any time.

If a data subject wishes to exercise this right, they can contact us at any time.

7. General purpose of processing, categories of processed data, and categories of recipients

The general purpose of processing personal data is to carry out all transactions that concern the controller, customers, prospects, business partners, or other contractual or pre-contractual relationships between the mentioned groups (in the broadest sense) or legal obligations of the controller. This general purpose applies when no more specific purposes for a particular processing are specified.

The categories of personal data that we process are customer data, prospect data, employee data (including applicant data), and supplier data. The categories of recipients of the personal data are public authorities, external parties, internal processing, group internal processing, and other parties.

A list of our processors and the data recipients in third countries as well as, if applicable, international organizations is either published on our website or can be requested from us free of charge.

8. Legal bases for processing

Art. 6 (1) (a) GDPR serves as the legal basis for processing operations where we obtain consent for a specific processing purpose. If the processing of personal data is necessary for the fulfillment of a contract to which the data subject is a party, as is the case, for example, with processing operations necessary for the delivery of goods or the provision of other services or considerations, then the processing is based on Art. 6 (1) (b) GDPR. The same applies to such processing operations that are necessary for the performance of pre-contractual measures, such as in cases of inquiries about our products or services. If we are subject to a legal obligation that requires the processing of personal data, such as for the fulfillment of tax obligations, then the processing is based on Art. 6 (1) (c) GDPR.

In rare cases, the processing of personal data may be necessary to protect vital interests of the data subject or another natural person. This would be the case, for example, if a visitor were to be injured in our establishment and subsequently their name, age, health insurance data, or other vital information had to be disclosed to a doctor, a hospital, or other third parties. Then the processing would be based on Art. 6 (1) (d) GDPR.

If the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, the legal basis is Art. 6 (1) (e) GDPR.

Ultimately, processing operations could be based on Art. 6 (1) (f) GDPR. Processing operations that are not covered by any of the aforementioned legal bases are based on this legal basis if the processing is necessary to safeguard a legitimate interest of our company or a third party, provided that the interests, fundamental rights, and freedoms of the data subject do not outweigh this interest. Such processing operations are particularly permitted to us because they were specifically mentioned by the European legislator. He held the view that a legitimate interest could be assumed, for example, if the data subject is a customer of the controller (Recital 47 Sentence 2 GDPR).

9. Legitimate interests in processing pursued by the controller or a third party and direct marketing

If the processing of personal data is based on Art. 6 (1) (f) GDPR, and no more specific legitimate interests are stated, our legitimate interest is the conduct of our business activities for the benefit of the well-being of our staff and our shareholders.

We may send you direct marketing about our own goods or services that are similar to the goods or services you have requested, commissioned, or purchased. You may object to direct marketing at any time (e.g., by email). You will incur no costs other than the transmission costs according to the basic rates. The processing of personal data for the purposes of direct marketing is based on Art. 6 (1) (f) GDPR. The legitimate interest is direct marketing.

Our messages and newsletters may also involve communication for direct marketing purposes within the meaning of Art. 13 para. 2 of the EU Directive 2002/58 (Data Protection Directive for Electronic Communications) and the national law resulting from the directive, provided that we have received your electronic and other contact information in connection with the sale of a service or product, which includes the creation of a free user account through which you are allowed to access free content on our websites and publications (newsletters, etc.), provided that we promote similar products or services with direct marketing, so that direct marketing is also permissible without consent (cf. ECJ, judgment of 13.11.2025, case C 654/23). You can refuse the use of the contact information in such cases at any time free of charge.

10. Duration for which personal data will be stored

The criterion for the duration of storage of personal data is the respective statutory retention period. If there is no statutory retention period, the criterion is the contractual or internal retention period. After the expiration of the period, the corresponding data will be routinely deleted, provided they are no longer necessary for the fulfillment of the contract or the initiation of a contract. This applies in particular to all processing where no more specific criteria have been established.

11. Legal or contractual provisions for the provision of personal data; necessity for the conclusion of the contract; obligation of the data subject to provide personal data; possible consequences of non-provision

We inform you that the provision of personal data is partly legally required (e.g., tax regulations) or may also arise from contractual agreements (e.g., information about the contracting party). Sometimes, it may be necessary for a data subject to provide us with personal data in order to conclude a contract, which must then be processed by us. The data subject is, for example, obligated to provide us with personal data when our organization enters into a contract with them. A failure to provide the personal data would result in the contract with the data subject not being concluded. Before providing personal data, the data subject must contact us. We inform the data subject on a case-by-case basis whether the provision of personal data is legally or contractually required or necessary for the conclusion of the contract, whether there is an obligation to provide the personal data, and what consequences the failure to provide the personal data would have.

12. Existence of automated decision-making

As a responsible company, we usually refrain from automated decision-making or profiling. If we carry out automated decision-making or profiling in exceptional cases, we will inform the data subject either separately or through a subsection in our privacy policy (here on our website). In this case, the following applies:

Automated decision-making, including profiling, may occur if (1) it is necessary for the conclusion or performance of a contract between the data subject and us, or (2) it is permissible under Union or Member State legislation to which we are subject, and such legislation provides for appropriate measures to safeguard the rights and freedoms as well as the legitimate interests of the data subject, or (3) it is carried out with the explicit consent of the data subject.

In the cases mentioned in Art. 22 (2) (a) and (c) of the GDPR, we take appropriate measures to safeguard the rights and freedoms as well as the legitimate interests of the data subject. In these cases, you have the right to obtain the intervention of a person on the part of the controller, to present your own viewpoint, and to contest the decision.

Meaningful information about the logic involved as well as the scope and intended effects of such processing for the data subject will be provided in this privacy policy if applicable.

13. Recipients in a third country and appropriate or suitable safeguards and the possibility of how to obtain a copy of them, or where they are available.

According to Art. 46 (1) of the GDPR, the controller or a processor may only transfer personal data to a third country if the controller or the processor has provided appropriate safeguards and if enforceable rights and effective legal remedies are available to the data subjects. Appropriate safeguards may be provided by standard contractual clauses without the need for specific authorization from a supervisory authority, Art. 46 (2) (c) of the GDPR.

With all recipients from third countries, the EU standard contractual clauses or other appropriate safeguards are agreed upon before the first transfer of personal data, or the transfers are based on adequacy decisions. Consequently, it is ensured that appropriate safeguards, enforceable rights, and effective legal remedies are guaranteed for all processing of personal data. Any affected person can obtain a copy of the standard contractual clauses or adequacy decisions from us. Furthermore, the standard contractual clauses and adequacy decisions are available in the Official Journal of the European Union.

Art. 45 (3) GDPR empowers the European Commission to decide, by means of an implementing act, that a non-EU country ensures an adequate level of protection. This means a level of protection for personal data that is essentially equivalent to the level of protection within the EU. Adequacy decisions result in personal data being able to flow to a third country from the EU (as well as from Norway, Liechtenstein, and Iceland) without further obstacles. Similar regulations apply to the United Kingdom, Switzerland, and some other countries.

In all cases where the European Commission, or a government or competent authority of another state, has decided that a third country ensures an adequate level of protection and/or a valid framework exists (e.g. EU-U.S. Data Privacy Framework, Swiss-U.S. Data Privacy Framework, UK Extension to the EU-U.S. Data Privacy Framework), all transfers from us to the members of such frameworks (e.g. self-certified entities) are based solely on the membership of that entity in the respective framework or on the respective adequacy decisions. If we or one of our group companies is a member of such a framework, all transfers to us or our group company are based solely on the membership of the respective company in that framework. If we or one of our group companies is located in a third country with an adequate level of protection, all transfers to us or our group company are based solely on the respective adequacy decisions.

Any affected person can obtain a copy of the frameworks from us. In addition, the frameworks are also available in the Official Journal of the European Union or in the published legislative materials or on the websites of data protection supervisory authorities or other authorities or institutions.

14. Right to lodge a complaint with a data protection supervisory authority

As the responsible party, we are obliged to inform the data subject of the existence of a right to lodge a complaint with a supervisory authority. The right to complain is regulated in Art. 77 (1) GDPR. According to this provision, every data subject has the right to lodge a complaint with a supervisory authority, in particular in the member state of their residence, their workplace, or the place of the alleged infringement, regardless of any other administrative or judicial remedy, if the data subject believes that the processing of their personal data violates the General Data Protection Regulation. The right to complain has been limited by the EU legislator solely in that it can only be exercised against a single supervisory authority (Recital 141 Sentence 1 GDPR). This regulation is intended to avoid duplicate complaints on the same matter by the same data subject. Therefore, if a data subject wishes to complain about us, they are requested to contact only a single supervisory authority.

15. Data protection provisions regarding the use and application of Odoo

We use Odoo in our company to efficiently manage central business processes such as CRM, accounting, purchasing, inventory management, project management, e-commerce, point of sale, or human resources without media disruptions. Odoo serves as an integrated ERP system and can be operated both as a cloud solution and independently (on-premise). In the course of use, we process personal data – in particular first name and last name, email address, phone number, address, user data such as login events, IP address, timestamps, transaction data, CRM information, and structured business data – provided that these are stored and processed in the Odoo system. The processing takes place – depending on the mode of operation – either via Odoo's infrastructure (cloud platform) or through our own IT infrastructure (self-hosting). In both cases, the system is used to handle business processes.

The operating company of the service and thus the recipient of the personal data is: Odoo SA, Chaussée de Namur 40, 1367 Grand Rosière, Belgium.

Purposes for which the personal data is to be processed, as well as the legal basis for the processing: The purpose of processing lies in the efficient, integrated, and secure handling of cross-functional business processes such as CRM, ERP, project management, human resource management, and financial management. The processing is based on Art. 6 (1) (b) GDPR for the fulfillment of a contract to which the data subject is a party or for the implementation of pre-contractual measures, as well as on the basis of Art. 6 (1) (f) GDPR. The legitimate interest lies in business management, organizational efficiency, as well as data security and system integrity.

The criteria for determining the duration for which personal data is processed are the contractual relationship with the operating company or legal or contractual retention periods (e.g., commercial and tax law). The provision of personal data is not legally or contractually required. If not provided, our services or the functions provided by Odoo may not be used or may only be used to a limited extent.

Further information and the applicable data protection regulations of Odoo can be accessed at https://www.odoo.com/.

16. Data protection regulations regarding the use and application of Zoom

Zoom is a provider of video conferencing software that enables businesses and individuals to host and participate in virtual meetings, webinars, live chats, and collaborative workspaces. With features that include video and audio conferencing, screen sharing, and encryption, Zoom has established itself as an essential tool for remote work, distance learning, and virtual social gatherings.

When using Zoom services, personal data such as names, email addresses, phone numbers, profile pictures, and device information are processed. During meetings, content data such as video and audio streams, chat logs, and shared content may be processed. This information is necessary to provide communication services, manage user accounts, operate the platform securely and efficiently, and offer users personalized experiences.

The operating company of the service and thus the recipient of the personal data is: Zoom Video Communications, Inc., 55 Almaden Boulevard, 6th Floor, San Jose, CA 95113, USA. For affected individuals in the EU and the EEA, Lionheart Squared (Europe) Limited, 2 Pembroke House, Upper Pembroke Street 28-32, Dublin, DO2 EK84, Ireland, acts as the contact person and representative in accordance with Art. 27 GDPR. The representative under national law in the United Kingdom is: Lionheart Squared Limited, 17 Glasshouse Studios, Fryern Court Road, Fordingbridge, Hampshire, SP6 1QX, United Kingdom.

Purposes for which the personal data is to be processed, as well as the legal basis for the processing: The purpose of data processing lies in the use of video communication services. The processing is based on the fulfillment of a contract in accordance with Art. 6 (1) (b) GDPR, of which the affected person is a party, as well as on legitimate interests in accordance with Art. 6 (1) (f) GDPR, such as the use of an efficient platform, the improvement of our services, and the assurance of IT security.

The operating company of the service is located in a third country, namely the USA. Transfers to third countries may be based on the conclusion of standard contractual clauses or on other suitable or appropriate guarantees mentioned in Art. 46 (2) GDPR. The operating company of the service is, if applicable, a certified member of one or more of the Data Privacy Frameworks. Further details can be found at https://www.dataprivacyframework.gov/list. A copy of the suitable or appropriate guarantees can be requested from us.

The criteria for determining the duration for which personal data is processed are the contractual relationship between us and the operating company of the service or legal or contractual retention periods. The provision of personal data is neither legally nor contractually required nor necessary for the conclusion of a contract. You are not obliged to provide us or the operating company of the service with personal data. However, if you do not provide it, our services or those of the operating company of the service may not be available.

Further information and the applicable privacy policies of Zoom can be viewed at https://zoom.us.

The creation of this privacy policy was done with the help of a generator that was developed in cooperation with specialized lawyers for copyright, external data protection consulting and the accredited certification body.

Status: Nov. 2026