DSGVO Privacy Policy

General - Information according to Art. 13 + 14 DSGVO

Innus GmbH appreciates your visit to our website and your interest in our company. We take the protection and security of your personal data entrusted to us seriously and want you to feel safe and comfortable when visiting our website and using our services. It is important to us that you know what personal data is collected when you make use of our offers and services and how we use it afterwards.

Purpose of the data processing

Insofar as Innus GmbH processes personal data, this is done for the purposes stated in this privacy policy.

Personal data, in particular address data, contact data or payment data, are used to implement a contractual relationship or to initiate such a relationship. The processing of your personal data therefore takes place on the legal basis of Art. 6 para. 1 lit. b GDPR. For this purpose, it is usually necessary to transfer the collected data to our partner companies or other data processors.

In the case of specific services (in the sovereign or recognized area), personal data and also special categories of personal data are processed on a legal basis in accordance with

Art. 6 para. 1 lit. c, d, e GDPR.

Depending on the type of contractual service, these contractual partners may also be located in countries outside the EU.

We also process your data for internal customer analyses.

Data processing is carried out on the basis of Art. 6 para. 1 lit. f GDPR and in our legitimate interest in providing you with optimal offers as part of our marketing.

Contact details of the responsible person:

Innus GmbH Untermainanlage 7 60329 Frankfurt am Main Phone +49 6151 600-0 E-mail: info@innus.de

Data Privacy Representative

If you have any further questions regarding the processing of your personal data, you can contact our data protection officer directly, who is also available in the event of requests for information, applications or complaints: Data Protection Officer of Innus GmbH, Untermainanlage 7, 60329 Frankfurt am Main E-Mail: dataprotection@innus.de

Rights regarding the processing of personal data

Right to information You have the right to receive information from us at any time upon request about the personal data processed by us concerning you within the scope of Art. 15 GDPR. To do so, you can send a request by post or email to the addresses given above.

Right to rectification of inaccurate data You have the right to obtain from us without undue delay the rectification of inaccurate personal data concerning you (Art. 16 GDPR). To do so, please use the contact addresses given above.

Right to erasure You have the right to the immediate erasure ("right to be forgotten") of personal data concerning you if the legal grounds pursuant to Art. 17 GDPR apply. These exist, for example, if the personal data are no longer necessary for the purposes for which they were originally processed or if you have withdrawn your consent and if there is no other legal basis for the processing; the data subject objects to the processing (and there are no overriding reasons for processing - this does not apply to objections to direct marketing). To exercise your above right, please contact us at the addresses given above.

Right to restriction of processing You have a right to restriction of processing if the conditions are met and in accordance with Art. 18 GDPR. According to this, the restriction of processing may be required in particular if the processing is unlawful and the data subject refuses to delete the personal data and instead requests the restriction of the use of the personal data or the data subject has objected to the processing pursuant to Art. 21 para. 1 GDPR, as long as it is not yet clear whether our legitimate reasons outweigh theirs. To assert your aforementioned right, please contact us at the contact addresses given above.

Right to data portability You have a right to data portability in accordance with Art. 20 GDPR. You have the right to receive the data concerning you, which you have provided to us, in a commonly used, structured and machine-readable format and to transmit those data to another controller, such as another service provider. The prerequisite for this is that the processing is based on consent or on a contract and is carried out using automated procedures. To assert your above right, please contact us at the addresses given above.

Right to lodge a complaint with a supervisory authority If you believe that the processing of personal data concerning you by us is unlawful, you have the right to lodge a complaint with the supervisory authority responsible for us, which you can contact as follows: The Hessian Commissioner for Data Protection and Freedom of Information, P.O. Box 31 63, 65021 Wiesbaden, telephone: +49 611 1408-0, e-mail: poststelle@datenschutz.hessen.de

Planned data transfer to non-EU countries

A transfer to non-EU countries is currently not planned, otherwise the corresponding legal requirements will be created. In particular, you will be informed about the respective recipients or categories of recipients in accordance with the legal requirements.

Security

Innus GmbH uses technical and organizational security measures to protect the data you have provided against accidental or intentional manipulation, loss, destruction or against access by unauthorized persons. This also applies when external services are obtained. The effectiveness of our security measures is reviewed and the measures are continuously improved according to technological developments.

Standard periods for the deletion of data

The legislator has enacted a variety of retention periods and obligations. After these periods have expired, the corresponding data is routinely deleted. If data is not affected by this, it will be deleted or made anonymous if the purposes stated in this data protection declaration cease to apply. Unless this data protection declaration contains other, deviating provisions regarding the storage of data, the data collected by us will be stored for as long as it is required for the aforementioned purposes for which it was collected.

Other data use and data deletion

Further processing or use of your personal data will generally only take place if permitted by law or if you have consented to the data processing or use. In the event of further processing for purposes other than those for which the data was originally collected, we will inform you of these other purposes prior to further processing and provide you with any other relevant information.

Applications

You can send us an unsolicited application via our e-mail address info@innus.de.

We store your applicant data, i.e. all personal data that you provide to us as part of your unsolicited application, for the duration of the review of your application. If your application is unsuccessful or if you withdraw your application, your application data will be deleted after a maximum of 6 months, unless you have expressly consented to a longer storage period (see Art. 6 para. 1 lit. a GDPR).

If your application is successful, the data you have provided to us will be processed in relation to your future employment with our company. The legal basis is Art. 6 para. 1 a, b and f GDPR and § 26 BDSG.

If you do not provide us with the required personal data, this will not have any negative consequences for you. However, incomplete or incorrectly completed applications will not be considered. Unfortunately, the application cannot be submitted without providing your personal data and will therefore be deleted.

Website information

Calling up our website

We collect and store the IP address assigned to your computer in order to transmit the content you have retrieved from our website to your computer (e.g. texts, images and files made available for download, etc.) (cf. Art. 6 para. 1 lit. a GDPR) and to enable the technical provision of our website. We also process this data to detect and track misuse. In this respect, the legal basis is Art. 6 para. 1 lit. f GDPR. Our legitimate interest in data processing lies in ensuring the proper functioning of our website and the transactions conducted via it.

When you visit our website, we process your personal data as described above for the purpose of providing the functions of the website. By integrating the cookie banner and linking to this privacy policy, you can gain knowledge of the data processing that takes place.

Other purposes

Personal data is also processed if you provide it to us voluntarily, for example as part of an inquiry. The legal basis in this respect is Art. 6 para. 1 lit. b GDPR. The data processed by us in this respect includes customer data, employee data and data from suppliers, insofar as this is necessary for the purposes stated in this privacy policy.

Insofar as we process your data for the purposes of receiving and processing your respective inquiry, as described above, you are obliged to provide us with this data. Without this data, we will not be able to process your request accordingly.

If you have consented to the processing of personal data (cf.

Art. 6 para. 1 lit. a GDPR), you can withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

Contact us

If you have a more detailed question for us, you can make an inquiry by telephone, post or email using the contact details on our website. When you contact us, the data you provide will be stored by us. The processing is carried out for the purpose of processing the inquiries on the basis of Art. 6 para. 1 lit. b GDPR, provided that your inquiry is related to the fulfillment of a contract or is necessary for the implementation of pre-contractual measures.

In all other cases, the processing is based on our legitimate interest in the effective processing of the inquiries addressed to us (Art. 6 para. 1 lit. f GDPR).

The data collected when you contact us will be deleted as soon as it is no longer required to process your request.

Forwarding to third parties

The permissions for data processing are derived from the statements made in this privacy policy and the lawfulness pursuant to Art. 6 GDPR. The transfer of data to processors takes place on the basis of Art. 28 para. 1 GDPR.

We do not sell your data to third parties, nor do we market it in any other way.

In addition, your personal data will be forwarded to the law enforcement authorities and, if necessary, to injured third parties without your express consent if this is necessary to clarify any unlawful use of our services or for legal prosecution. However, this only happens if there are concrete indications of unlawful or abusive behavior. Disclosure may also take place if this serves to enforce terms of use or other agreements. We are also legally obliged to provide information to certain public authorities on request. These are law enforcement authorities, authorities that prosecute administrative offenses subject to fines and the tax authorities.

This data is passed on on the basis of our legitimate interest in combating misuse, prosecuting criminal offenses and securing, asserting and enforcing claims, provided that your rights and interests in the protection of your personal data do not prevail,
Art. 6 para. 1 lit. f GDPR.

Links to websites of other providers

Our website may contain links to websites of other providers. We would like to point out that this data protection declaration applies exclusively to this website. We have no influence on and cannot control the fact that other providers comply with the applicable data protection regulations.

Cookies

We use cookies in some areas to make our website more user-friendly for you and to tailor it optimally to your needs. A cookie is a small file that is stored locally on your computer as soon as you visit a website. If you visit the website again with the same end device, the cookie indicates, for example, that it is a repeat visit. Cookies also enable us to analyze the use of our website. Basically, the browser has been configured so that you can use the website anonymously, i.e. without tracking. The information in the cookies is not personally identifiable and cannot be used to identify you on third-party websites, including the websites of analytics providers. Your personal data may only be processed in cases where you give your consent.

We use the following types of cookies:

• Essential cookies: These cookies are of fundamental importance for the functioning of our website. This is, for example, the assignment of anonymous session IDs for bundling several queries to a web server or the error-free functioning of logins and orders.
• Functional cookies: These cookies help us to save settings you have selected or support other functions when you navigate our website. For example, we can remember your preferred settings for your next visit or save your login details for certain areas of our website.
• Statistics cookies: These cookies collect information about how you use our website (e.g. Internet browser used, number of visits, pages viewed or time spent on the website). We receive the information collected with the help of these cookies in aggregated form so that we cannot personally identify the visitor.

You can declare your consent or rejection of cookies - also for web tracking - via the settings of your web browser. You can configure your browser to refuse acceptance of cookies in general or to inform you in advance when a cookie is stored. In this case, however, the functionality of the website may be impaired (e.g. when placing orders). Your browser also provides a function to delete cookies (e.g. via Delete browser data). You can find more information about this in the operating instructions or, as a rule, in the settings of your Internet browser.

---

Cookie Consent Settings

We use the consent tool "Real Cookie Banner" to manage the cookies and similar technologies used (tracking pixels, web beacons, etc.) and related consents as well as to document these in compliance with data protection regulations.
The provider of this technology is devowl.io GmbH, Tannet 12, 94539 Grafling, Germany.
Details on how "Real Cookie Banner" works can be found at https://devowl.io/de/datenschutzerklaerung/.

The cookie banner records and stores the consent to the use of cookies for the respective user of our website. Our cookie banner ensures that statistical and marketing cookies are only set if the user has given their express consent to their use.

For this purpose, we store information on the extent to which the user has confirmed the use of cookies. The user's decision can be revoked at any time by accessing the cookie settings and managing the declaration of consent:

> Change privacy settings > History of privacy settings > Revoke consent

Existing cookies are deleted after consent is withdrawn.

A cookie is also set to store information about the status of the user's consent, which is referred to in the cookie details. Furthermore, the IP address of the respective user is transmitted to devowl.io servers when this service is accessed. The IP address is neither stored nor associated with any other data of the user, it is only used for the correct execution of the service.

The legal basis for the processing of personal data in this context is Art. 6 para. 1 lit. c GDPR and Art. 6 para. 1 lit. f GDPR. Our legitimate interest is the management of the cookies and similar technologies used and the related consents.

---

Matomo Analytics

Our website uses the web analysis tool "Matomo". Matomo is an open source software that enables detailed statistics on visitor access. It is a service provided by InnoCraft Ltd, 150 Willis St, 6011 Wellington, New Zealand, NZBN 6106769, ("Matomo"). The protection of your data is important to us, which is why we have also configured Matomo so that your IP address is only recorded in abbreviated form. We therefore process your personal usage data anonymously. It is not possible for us to identify you personally. The Matomo installation does not use cookies, tracking pixels or browser fingerprinting. Only the log files of the web server, which are generated anyway, are anonymously evaluated and statistically processed. Matomo does not request, process or store any additional data from your browser. Furthermore, no Matomo cookies are stored in your browser. You do not need an opt-out cookie on this website, as no personal data is stored or processed without prior anonymization. The processing is based on the legal basis of legitimate interest, Art. 6 lit. f GDPR. Further information on Matomo's terms of use and data protection regulations can be found at: https://matomo.org/privacy/

Google Analytics

We use Google Analytics to analyze website usage. The data obtained from this is used to optimize our website and advertising measures. Google Analytics is provided to us by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), a company incorporated and operated under Irish law (registration number: 368047). Google Analytics uses "cookies". The information generated by the cookie about your use of our website (including your IP address) will be transmitted to and stored by Google on servers in Ireland. The following data is recorded during your visit to the website:

• Pages accessed
• The achievement of "website goals"
• Your behavior on the pages
• Your approximate location (country and city)
• Your IP address (in abbreviated form, so that no clear assignment is possible)
• Technical information such as browser, internet provider, end device and screen resolution
• Source of origin of your visit (i.e. via which website or advertising medium you came to us)
• Personal data such as name, address or contact details are never transmitted to Google Analytics.

If you consent to the use of cookies (see Art. 6 para. 1 lit. a GDPR), Google will anonymize the information obtained from the cookies. The anonymization represents a processing of your data, which, however, only takes place on the basis of your consent. It cannot be ruled out that the data processing takes place outside the scope of application of EU law.

Google Analytics stores cookies in your web browser for a period of two years since your last visit. These cookies contain a randomly generated user ID with which you can be recognized on future visits to the website. Google Analytics uses technologies that enable the recognition of the user for the purpose of analyzing user behavior (e.g. cookies or device fingerprinting).

The recorded data is stored together with the randomly generated user ID, which enables the evaluation of pseudonymous user profiles. Other data remains stored indefinitely in aggregated form.

The use of this service is based on your consent in accordance with
Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TDDDG. Consent can be revoked at any time.

Data transfer to the USA is based on the standard contractual clauses of the EU Commission and the EU-U.S. Data Privacy Framework.

Details can be found here:

https://policies.google.com/privacy/frameworks, https://privacy.google.com/businesses/controllerterms/mccs/ https://www.dataprivacyframework.gov/s/

If you do not agree to the collection of data, you can prevent this by installing the browser add-on to deactivate Google Analytics or by rejecting cookies via our cookie settings dialog.

Further information on terms of use and data protection can be found at http://www.google.com/analytics/terms/de.html or at https://www.google.de/intl/de/policies/.

Google Tag Manager

This website uses Google Tag Manager. Google Tag Manager is a solution that allows Innus to manage website tags via an interface. The Tag Manager tool itself (which implements the tags) is a cookie-less domain and does not collect any personal data. The tool triggers other tags, which in turn may collect data. Google Tag Manager does not access this data. If a deactivation has been made at domain or cookie level, this remains in place for all tracking tags that are implemented with Google Tag Manager.

The Google Tag Manager is used on the basis of
Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in the fast and uncomplicated integration and management of various tools on its website. If a corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR and
§ 25 para. 1 TDDDG, insofar as the consent includes the storage of cookies or access to information in the user's terminal device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent can be revoked at any time.

Google Consent Mode

Due to our use and integration of the Google service "Google Analytics" on our website, we are obliged to obtain your consent and document it in a legally secure manner in accordance with the legal requirements and Google's "EU User Consent Policy".

In accordance with the Digital Markets Act, Google is obliged to request consent for the processing of your personal data, in particular in the context of use for personalized advertising. For this purpose, we have integrated the Google consent mode ("Google Consent Mode V2") into our website. The service provider of the consent mode is Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), a company incorporated and operated under Irish law (registration number: 368047).

As part of the consent mode described, we share the status of your consent with Google on the basis of a legal obligation pursuant to Art. 6 para. 1 lit. c GDPR or on the basis of your consent granted pursuant to Art. 6 para. 1 lit. a GDPR in conjunction with. § 25 para. 1 TDDDG.

We have integrated the simple implementation of the consent mode, according to which no transmission of a Google code that allows conclusions to be drawn about your personal data is carried out without your consent.

A possible data transfer from Google to the USA is based on the standard contractual clauses of the EU Commission and the EU-U.S. Data Privacy Framework.

Details can be found here:

https://policies.google.com/privacy/frameworks, https://privacy.google.com/businesses/controllerterms/mccs/, https://www.dataprivacyframework.gov/s/

You can find more information on the use of your data by Google and in Google services as well as on data protection at https://business.safety.google/privacy/ or at https://policies.google.com/privacy

Information about our online presences

Innus GmbH maintains online presences within social networks and platforms in order to have the opportunity to communicate with active users there and to inform them about our service portfolio. For this purpose, we use the technical platforms and services offered by the operators. Your personal data is processed on the platforms both by us and by the respective platform operators. Innus GmbH and the respective platform operators are jointly responsible for data processing in accordance with Art. 26 GDPR.
We would like to expressly point out that the operators process your personal data outside our area of responsibility. As a result, we will inform you independently about the data processing, so that the respective operators' own data protection provisions apply in the social networks and on other external platforms, even if we disseminate information and maintain a presence there. The way in which the operators of the social networks use the data from visits to the respective pages for their own purposes, the extent to which activities on the pages are assigned to individual users, how long this data is stored and whether data from a visit to the respective page is passed on to third parties is not conclusively and clearly stated by the operators and is not known to us.
The respective privacy policies describe in general terms what information the operators receive and how this is used. On the individual platforms, you will also find information on how to contact the operators and on the setting options for advertisements:
- for Xing: www.xing.com/privacy
- for LinkedIn: www.linkedin.com/legal

We would also like to point out that only the operators of the respective platforms have full access to the user data and recommend that you contact the operators directly with regard to requests for information or other questions about the rights of data subjects as users (e.g. right to deletion). right to erasure) directly to the operators:
- Xing, New Work SE, Am Strandkai 1, 20354 Hamburg, Germany
- LinkedIn, LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland
If you no longer wish the data processing described here to take place in the future, you can disconnect your user profile from our site by clicking on "I no longer like this page".
We will inform you about Innus GmbH's data processing on the respective platforms in this privacy policy.

In which way the operators of the social networks use the data from the visit of the respective pages for their own purposes, to which extent activities on the pages are assigned to individual users, how long this data is stored and whether data from a visit of the respective page is passed on to third parties, is not conclusively and clearly stated by the operators and is not known to us.

I. Xing

Our Xing presence is used to maintain contact and make contact. Various personal data may be collected and processed in the process:

• Publicly available information: We use publicly visible data such as profile name, profile picture, professional background, interests and posts to get in touch with you or follow relevant topics.
• Messages and communication: When using the message function, personal data is processed. This communication is confidential and will not be passed on to third parties.
• Posts, comments and interactions: We review and moderate posts or comments that relate to our activities. In doing so, we take care to protect your privacy.
• Forwarding of data: In principle, data generated via Xing is not forwarded to third parties unless there is express consent or a legal obligation to do so.
• Statistical analyses: Anonymized statistical analyses are used to improve our Xing presence and to measure the success of our activities.

II. LinkedIn

Innus uses LinkedIn to generate leads, among other things. We collect and process personal data as follows:

• Public information: We use publicly available information from LinkedIn profiles, especially when users interact with us or comment on our posts. This includes data such as name, profile picture, professional background, interests and location.
• Communication via messages: We use the LinkedIn messaging function to contact users or reply to their messages. This communication is processed by our employees.
• Posts and comments: We review and moderate posts and comments that users post on LinkedIn and that relate to us. In the event of inappropriate content, we point out rules of conduct or remove such content.
• Forwarding of data: We only pass on personal data with express consent. We will only pass on contact inquiries or requests to the relevant departments with your explicit consent.
• Suspicion of misuse: If we suspect misuse or unauthorized activities, we take appropriate measures, such as personal feedback, blocking or reporting to LinkedIn.
• Statistical analyses: We use anonymized statistical analyses from LinkedIn to optimize our content. This includes data such as age, gender, location and total number of page views and interactions.

Changes to this privacy policy

The further development of the Internet and our website may also affect our privacy policy. We reserve the right to change this privacy policy in the future. If we use your personal information in a manner different from that stated here at the time of collection, we will attempt to notify you via email using the most recent information known to us. If notification is not possible, we will not use your personal information in any new way. In any event, a notice to this effect will be made available through a prominent notice on the Websites. As of May 2024.