Privacy policy of the MPDV Group

1 MPDV as responsible party

MPDV Mikrolab GmbH
Römerring 1
74821 Mosbach
E-mail: info@mpdv.com

MPDV Mikrolab GmbH is the Controller for the processing activities on this website, provided that you are currently on the URL https://www.mpdv.com/ and its subpages.

MPDV Mikrolab GmbH is the Controller for the processing activities on this website, provided that you are currently on the URL https://smartfactory.blog/de_de/ and its subpages.

2 Name and address of the data protection officer

ENSECUR GmbH
Personal liability: Thorsten Jordan
Kaiserstraße 86
76133 Karlsruhe
datenschutz@mpdv.com or dsb-mpdv@ensecur.de

3 Web server logging [applies to all MPDV company websites]

When our web server is visited and the content provided is retrieved, our web servers store each access in a log file for statistical and system-related purposes. The logs contain the following information:

• IP address, timestamp (date and time of access) of the requesting computer
• Web pages/file names accessed
• Web browser and operating system of the requesting computer
• Amount of data transferred and notification of successful retrieval

This data is stored for security reasons, e.g. to defend against attempted attacks on our web servers. The stored IP address is only analyzed in the event of an attack on our systems (Art. 6(1) sentence 1 lit. f) GDPR). No association is made between a natural person and this stored usage data.

The data is deleted after 12 days. Server log files are not stored in complete form. The visitor's IP is communicated during the transmission of a page request, anonymized directly after transmission and processed without reference to a person. The data anonymized in this way is stored for up to 3 years or until the contract is terminated, if this occurs earlier.

4 Error logs [applies to all MPDV company websites]

So-called error logs are created for the purpose of error identification and correction. This is essential in order to be able to react to possible problems in the presentation and implementation of content as promptly as possible (legitimate interest). This data is usually pseudonymous and therefore does not allow any conclusions to be drawn about a natural person. The legal basis for this can be found in Art. 6(1) sentence 1 lit. f) GDPR. When an error message occurs, general data is recorded such as the domain name of the website, the web browser and web browser version, the operating system, the IP address and the timestamp when the corresponding error message/specification occurred.

See Section 2 above for information about the storage period of error logs.

5 Cookies [applies to all MPDV company websites]

We use so-called "cookies". Cookies are small text files stored by the browser of an Internet user on his or her hard drive when a website is visited. Most cookies are so-called "session cookies". These are necessary so that you can use certain functions of our website. The cookies are automatically deleted from your hard drive after your browser session ends. The temporary storage takes place on the basis of Art. 6(1) sentence 1 lit. b) GDPR.

When you use our website, you can agree to the use and storage of cookies on your hard drive or refuse it. Most browsers accept cookies automatically. You can also specify in your browser settings whether cookies are allowed or not. To delete cookies, please also refer to your browser's help function. The following links may be helpful in understanding your browser settings, otherwise you should use the 'Help' option in your browser to get more information.

• Cookie settings in Edge
• Cookie settings in Firefox
• Cookie settings in Chrome
• Cookie settings in Safari

You can also view our Internet pages without cookies. However, we point out that this may lead to restrictions on the functionality of our website.

We use cookies to personalize content and ads, to offer social media features, and to analyze traffic to our website. We also share information about your use of our website with our social media, advertising and analytics partners. Our partners may combine this information with other data you have provided to them or that they have collected during your use of the Services.

This site uses different types of cookies. Some cookies are placed by third parties that appear on our pages.

• Essential cookies are necessary to ensure the core functionality of the website.
• Statistical cookies are cookies used to record user behavior on our website so the functionality of the website can be improved.
• We use marketing cookies to provide advertising that is related to your interests.

The legal basis for the use of essential cookies is Art. 6(1) sentence 1 lit. f) GDPR – a legitimate interest. Our legitimate interest in the use of essential cookies is to be able to provide a functioning website. The legal basis for the other cookies is Art. 6(1) sentence 1 lit. a) GDPR – your consent.

At any time, you can change or revoke your consent to the use of cookies, with future effect, from the cookie declaration on our website: Change consent.

5.1 Cookie declaration

Cookie declaration MPDV Mikrolab GmbH.

Cookie declaration MPDV Mikrolab GmbH Smart Factory Blog.

5.2 Consent Manager

Here you can access the Consent Manager at any time and revoke any consents you have given.

5.2.1 Cookiebot by Usercentrics [Relates exclusively to the website mpdv.com]

We use a so-called "consent manager" that ensures that processing based on your consent actually only takes place if you have given us your consent. For this purpose, we use the Cookiebot service provided by Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark (Usercentrics). The consent manager enables us to obtain and manage your consent as a website user to data processing. The processing is necessary for compliance with a legal obligation (Art. 6(1) sentence 1 lit. c GDPR). The following data is processed with the help of cookies:

• Your pseudonymized IP address (the last digits are removed)
• Date and time of consent
• Browser information
• URL from which the consent was sent
• An anonymous, random, and encrypted key
• End-user consent status, as proof of consent

This information and the status of your consent are stored as a cookie ("CookieConsent") in the browser for one year. This ensures that your decision is retained for subsequent visits to our website.

If you use the "bulk consent" service feature to enable consent for multiple websites through a single end-user consent, the service additionally stores a separate, random, unique ID. If all of the following criteria are met, this key is stored in encrypted form in the third-party cookie "CookieConsentBulkTicket" in your browser. This is done if:

• you enable the bulk consent feature,
• your web browser accepts third-party cookies,
• you do not use your web browser's "Do Not Track" feature,
• you accept all or at least certain types of cookies when you give your consent.

The website cannot function in compliance with the law without the use of a consent manager. Usercentrics is the recipient of your personal data and acts as a data processor on our behalf.

Processing takes place within the European Union. For more information on your rights to object and request deletion from Usercentrics, please refer to: https://www.cookiebot.com/de/privacy-policy/

Your personal data will be deleted on an ongoing basis after 12 months or immediately upon termination of the contract between us and Usercentrics.

Please note our general information regarding cookies.

5.2.2 Consentmanager – Borlabs [Relates to the Smart Factory Blog websites]

We use a so-called "consent manager" to ensure that processing based on your consent actually only takes place if you have given us your consent. For this purpose, we use the Borlabs service provided by Borlabs GmbH, Hamburger Straße 11, 22083 Hamburg, Germany. The consent manager enables us to obtain and manage website users' consent to data processing. Processing is necessary to comply with a legal obligation (Art. 6(1) sentence 1 lit. c GDPR). The following data is processed with the help of cookies:

• Your pseudonymized IP address (the last digits are removed)
• Date and time of consent
• Browser information
• URL from which the consent was sent
• An anonymous, random, and encrypted key
• End-user consent status, as proof of consent

This information and the status of your consent are stored as a cookie in your browser for one year. This ensures that your decision remains in effect for subsequent visits to our website.

The website cannot function in compliance with legal requirements without the use of a consent manager.

The Borlabs Consent Manager is integrated into our website as a local WordPress plugin. Processing therefore takes place on our servers in the European Union. Your personal data is automatically deleted after 12 months.

Please note our general information regarding cookies.

6 Integration of third-party services and content [applies to all MPDV company websites]

Among other things, web analyses are also used on this website with your consent for the purpose of reach measurement in accordance with Art. 6(1) sentence 1 lit. a) GDPR in order to effectively design advertising and public relations initiatives. In this, personal data collection is reduced to a minimum through IP anonymization which occurs in all cases when your IP address is received on the respective web server. The controller does not merge this data with other data, in particular in any way that would make it possible to identify the user.

6.1 Tools for analysis, advertising, and other purposes [applies to all MPDV company websites]

Unless otherwise stated in this privacy policy, the operator of all Google services mentioned in Section 5.1 is Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland. The legal basis for the processing is your consent in accordance with Art. 6(1) sentence 1 lit. a) GDPR, except for the use of Google Fonts (subsection 5.1.4). You can refuse your consent or revoke it at any time with future effect if you do not want Google to collect and process the aforementioned data for the respective purposes.

Your personal data will only be stored for the period of time for which it is required to fulfill the respective processing purpose. Your data will be deleted as soon as it is no longer required to achieve the purpose.

In addition to Google Ireland Limited, your data may also be transferred to the following recipients for processing:

• Google LLC.
• Alphabet Inc.

If personal data is processed by Google, this data may also be transferred to the USA. By concluding so-called standard contractual clauses, as well as on the basis of the Data Privacy Framework (USA), we ensure that an appropriate level of data protection exists if your data is transferred to third countries.

You can find more information about Google's privacy policy here: https://www.google.com/intl/de/policies/privacy/

6.1.1 Google Analytics [applies to all MPDV company websites]

Our website uses Google Analytics, a web analytics service provided by Google LLC ("Google"). Google Analytics uses cookies that are stored on your computer and enable analysis of your use of the website. The information generated by the cookie about your use of our website (including your IP address) will be transmitted to and stored by Google on servers in the United States.

Using Google Analytics, the following data is collected and processed:

• IP address (anonymized)
• Usage data
• Click path
• App updates
• Browser information
• Device information
• JavaScript support
• Pages visited
• Referrer URL
• Downloads
• Flash version
• Location information
• Purchase activity
• Widget interactions
• Date and time of visit
• Visitor's country and city
• Visitor's language preference
• Files downloaded
• Duration of the visit

We would like to point out that this website uses the "_anonymizeIp()" extension from Google Analytics. This activates IP anonymization on our website and your IP address will be truncated by Google, within member states of the European Union or in other states party to the Agreement on the European Economic Area, before being transmitted to the USA. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there. The truncation excludes the possibility of any direct association with an individual person.

You may refuse the use of cookies by selecting the appropriate settings on your browser; however, please note that if you do this you may not be able to use the full functionality of this website. You can revoke your consent at any time with future effect, i.e. without the data processing that took place prior to the time of your revocation ceasing to be lawful, in one of the following ways:

• By changing the cookie settings on our website: Change consent.
• By downloading and installing the browser plugin available at the following link: http://tools.google.com/dlpage/gaoptout?hl=de
• By clicking on the following link: Deactivate Google Analytics

An opt-out cookie will be set that prevents future collection of your data when visiting this website.

You can find more information on Google's terms of use and data protection at http://www.google.com/analytics/terms/de.html or at https://www.google.de/intl/de/policies/.

Google Analytics also allows us to use a JavaScript to track so-called events on our website, i.e. clicking on certain buttons, downloading information, etc. You cannot object to this separately, only by completely switching off the tracking as described above.

6.1.2 Google Tag Manager [applies to the company websites of MPDV GmbH]

Google Tag Manager is a solution from Google LLC ("Google") that allows us to manage website tags via an interface. Tags are small code elements on our website that are used, among other things, to measure traffic and visitor behavior, to track the impact of online advertising and social channels, to use remarketing and targeting and to test and optimize our website. The Tag Manager tool itself (which implements the tags) is a cookie-less domain and does not collect any personal data. http://www.google.de/tagmanager/use-policy.html

6.1.3 Google Web Fonts [applies to the company websites of MPDV GmbH]

By using Google Web Fonts from Google LLC ("Google"), we are able to load and display external fonts, so-called Google Fonts, on our website. Google Fonts is integrated locally on our site. This means that the fonts are not loaded from Google servers.

The legal basis for this processing is Art. 6(1) sentence 1 lit. f) GDPR – a legitimate interest. Our legitimate interest in processing is to present the website in an attractive and user-friendly manner. Local hosting ensures that no data is transmitted to Google; no corresponding data transfer takes place.

6.1.4 Google reCAPTCHA [applies to all MPDV company websites, with the exception of the websites of the Smart Factory Blog]

In order to ensure appropriate data security when using contact forms, in certain cases we use the reCAPTCHA service of the company Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"). This is primarily used to distinguish whether the input is made by a natural person or abusively by machine and automated processing. For this purpose, reCAPTCHA analyzes the behavior of the website visitor based on the following characteristics:

• IP address
• Referrer URL
• Information about the operating system
• Cookies, if applicable
• Mouse movements and keyboard strokes
• Dwell time
• User device settings

The service includes the transmission of the characteristics to Google. Further information on Google reCAPTCHA can be found at https://www.google.com/recaptcha/intro/android.html.

6.1.5 YouTube [applies to all MPDV company websites]

For the integration of videos we use a YouTube plugin that is operated by Google LLC ("Google"). The videos are stored on http://www.YouTube.com and can be played directly from our website. These are all integrated in "extended data protection mode", which means that no data about you as a user is transmitted to YouTube if you do not play the videos. Only when you play the videos or activate the YouTube cookies in our consent manager will the following data be transferred.

We have no influence on this data transmission:

• IP address
• Referrer URL
• Device information
• Videos viewed

For more information on the purpose and scope of data collection and processing by YouTube, please see the privacy policy there. There you will also find further information on your rights and setting options to help protect your privacy: https://policies.google.com/privacy.

6.1.6 Google DoubleClick Ad [applies to all MPDV company websites]

We use the "DoubleClick Ad" service. The operator of this service is Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google").

The purpose of this service is the display of advertisements for users based on their interests. This requires an analysis of website usage to be carried out using cookies. The cookies store anonymized or pseudonymized data relating to use of the website. If you visit other websites that also use these services, you will be presented with advertisements that correspond to your previous interests.

The following data is collected and processed in this context:

• Pages visited
• IP address
• Duration of visit
• Other information about the use of websites
• Content in which the user is interested

The legal basis for the processing is your consent pursuant to Art. 6(1) sentence 1 lit. a) GDPR.

You can prevent participation in this tracking process in various ways:

• By not activating the Google marketing cookie in our cookie consent manager
• With an appropriate setting in your browser software – suppressing third-party cookies will result in you not receiving third-party ads;
• By deactivating cookies for conversion tracking by setting your browser to block cookies from the domain www.googleadservices.com (https://www.google.de/settings/ads). This setting will be deleted when you delete your cookies;
• By deactivating the interest-based ads of the providers that are part of the "About Ads" self-regulation campaign (via the link http://www.aboutads.info/choices). This setting will be deleted when you delete your cookies;
• By permanently deactivating them in your Firefox, Internet Explorer or Google Chrome browsers (plug-ins available at the link http://www.google.com/settings/ads/plugin). Please note that in this case you may not be able to use the full functionality of this website.

Further information on DoubleClick by Google can be found at https://www.google.de/doubleclick and http://support.google.com/adsense/answer/2839090, and on data protection at Google in general: https://www.google.de/intl/de/policies/privacy

6.2 WiredMinds [applies to the MPDV GmbH company website with the exception of the Smart Factory Blog]

Our website uses the pixel-code technology of WiredMinds GmbH, Lindenspürstraße 32, 70176 Stuttgart (www.wiredminds.de) to analyze visitor behavior. In the process, data can be collected, processed and stored, from which usage profiles are created under a pseudonym. Where possible and reasonable, these usage profiles are completely anonymized. The analysis collects the following data:

• IP address (anonymized)

The data collected, which may also include personal data, is transmitted to WiredMinds or collected directly by WiredMinds. WiredMinds may use information left behind by visits to the websites to create anonymized usage profiles. The data obtained in this way will not be used to personally identify the visitor to this website without the consent of the person concerned being granted separately, and it will not be merged with personal data about the bearer of the pseudonym. Insofar as IP addresses are collected, they are immediately anonymized by deleting the last number block.

Exclude from website tracking

6.3 Calendly [applies to the MPDV GmbH company website]

Our website allows you to arrange appointments with us directly. For this purpose, we use the tool Calendly from the service provider Calendly LLC, BB&T Tower, 271 17th St NW, Atlanta, GA 30363, USA (hereinafter "Calendly"). We have concluded a data processing contract with Calendly.

When making an appointment, it is generally necessary to provide personal data; please refer to the form to be filled out to find out what this data is. When booking an appointment via Calendly, your data entered on the Calendly website will be passed on to us by Calendly and stored and processed by us in order to fulfill the appointment. The legal basis for this is your consent, which you give us before using Calendly in accordance with Art. 6(1) sentence 1 lit. a) GDPR and for further processing carried out to handle your request, it is Art. 6(1) sentence 1 lit. b) and f) GDPR. The information you provide in the Calendly form, including the data you enter there, will be stored by us and Calendly for the purpose of processing your inquiry and dealing with follow-up questions. This data is retained by us and Calendly until you ask us to delete it, revoke your consent to its storage or the purpose for which the data was stored no longer applies (e.g. appointment has taken place). Mandatory legal provisions – in particular retention periods – remain unaffected by this.

With regard to the processing of your data by Calendly itself, we refer you to Calendly's privacy policy, available at: https://calendly.com/pages/privacy. Further information on cookie-based data processing when Calendly is used for our demo booking can be found in Calendly's Consent Manager, which appears before you give your consent to use. Further information can be found here: https://calendly.com/pages/security. The data transfer takes place on the basis of the Data Privacy Framework (USA), under which Calendly is certified.

Our website also uses a cookie from the service provider Stripe Payments Europe Ltd, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland, through the use of the Calendly tool from Calendly LLC. Stripe is Calendly's payment service and is automatically integrated into every use. We do not use Stripe's services ourselves.

6.4 Mic und Max GmbH / Chatbot [applies to all MPDV company websites]

On our website we use the application "ezyaa" of Mic und Max GmbH, Hauptstraße 81, 55743 Idar-Oberstein, Germany, to enable you to communicate directly and efficiently via a chatbot. Users can ask questions about MPDV and our products. These questions do not result in any further action by MPDV: inquiries about support, appointments, contracts, etc. can still be made via the official channel. For your request to be processed, you may not enter any personal data such as name, date of birth or similarly sensitive data. Please enter only the specific question. If you nevertheless enter personal data such as name, date of birth or similar data, you do so at your own risk and responsibility. ezyaa acts as our processor and implements technical, administrative and organizational security measures that meet the requirements of the EU General Data Protection Regulation (GDPR). The provider also uses Large Language Models outside the EU to generate text messages. The data processing is carried out in accordance with the GDPR, to which these LLM providers are obligated by appropriate data processing agreements. Your data will only be processed for as long as is necessary to implement the communication services. The IP addresses of the users are stored pseudonymously so that it is not possible to draw conclusions about a specific user. This data is stored exclusively for the duration of the provision of the communication services and is automatically deleted once the communication ends, unless statutory retention obligations prevent this. However, if personal data is subject to retention obligations, it will be blocked for processing.

Warning and disclaimer: We would like to point out that the chatbot works with artificial intelligence. Its answers may be based on incorrect, outdated or otherwise irrelevant information. Its output should therefore be checked carefully and treated with caution. The chatbot cannot and should not replace advice from an MES expert. MPDV Mikrolab GmbH does not provide any warranty, guarantee or other promises of performance via the answers provided by the chatbot. The information provided by the chatbot does not constitute a legally binding statement, but is for informational purposes only and has no legally binding effect.

6.5 Hubspot [applies to the MPDV GmbH company website]

We use HubSpot's CRM and marketing software on our website. We have commissioned HubSpot to store and process our sales and marketing data. We use various features of this software for this purpose:

• Contact form (e.g., white papers, downloads, demo requests)
• E-mail marketing (e.g., newsletters, automated mailings, provision of downloads)
• Contact management (user segmentation, CRM)
• Interaction and conversion reporting (e.g., call-to-action analysis)

The legal basis for processing in the context of marketing activities is Art. 6(1) lit. a GDPR, provided you have given us your consent for this. If, based on the afore-mentioned processing, individual contact is initiated that is clearly aimed at concluding a contract, the further processing of personal data takes place outside the scope of marketing activities and is based on Art. 6(1) lit. b GDPR (implementation of pre-contractual measures).

The recipient of the data is HubSpot Inc. as a data processor. A data processing agreement in accordance with Article 28 of the GDPR has been concluded with HubSpot.

Personal data is transferred to a third country (the United States). This transfer is carried out using the Standard Contractual Clauses (SCCs) approved by the European Commission. Additionally, HubSpot is certified under the EU-US Data Privacy Framework, which imposes further data protection obligations.

Data is stored only for as long as necessary for the stated purposes. Data from marketing processes is deleted or anonymized as soon as consent is revoked or the purpose no longer applies. Data related to pre-contractual measures is processed in accordance with statutory retention periods.

6.6 Friendly Captcha (bot/spam protection)

Our website makes use of the service provided by Friendly Captcha GmbH, Am Anger 3-5, 82237 Wörthsee, Germany. Friendly Captcha is an innovative, data protection-friendly protection solution that makes it more difficult for automated programs and scripts (so-called "bots") to use our website.

For this purpose, we have integrated a program code from Friendly Captcha into our website, for example for contact forms, so that the visitor's end device can establish a connection to the Friendly Captcha servers in order to receive a calculation task from Friendly Captcha. The visitor's end device solves the calculation task, which requires certain system resources, and sends the calculation result to our web server. This contacts the Friendly Captcha server via an interface and receives a response indicating whether the puzzle was solved correctly by the end device. Depending on the result, we can apply security rules to requests via our website and, for example, process or reject them.

• The data is used exclusively to protect against spam and bots as described above.
• Friendly Captcha does not set or read any cookies on the visitor's end device.
• IP addresses are only stored in hashed, i.e. one-way encrypted, form and do not allow us or Friendly Captcha to draw any conclusions about an individual person.
• If personal data is stored, this data is deleted within 30 days.

The legal basis for the processing is our legitimate interests in protecting our website from abusive access by bots, i.e. spam protection and protection against attacks such as mass requests) in accordance with Article 6(1) sentence 1 lit. f) GDPR.

Further information on data protection when using Friendly Captcha can be found at https://friendlycaptcha.com/legal/privacy-end-users/

7 Signing up to receive email bulletins from MPDV [applies to all MPDV company websites]

By registering with us to receive information and news from MPDV by email, you consent to us processing the data you provide in the registration form solely for the purpose of sending and personalizing emails with information from MPDV. In order to evaluate and improve the newsletter, we analyze the opening and click-through rates. In addition, we store your IP address in order to be able to prove your consent. After submitting your e-mail address, you will receive a confirmation e-mail containing a link you must click on in order to actually receive these e-mails. This confirmation e-mail is necessary so we can verify you are the owner of the e-mail address entered. Only after clicking on this link will your registration become effective.

The data processing described above is carried out on the basis of Art. 6(1) sentence 1 lit. a) GDPR.

For sending e-mails with information from MPDV, we use a newsletter management tool from CleverReach GmbH & Co KG, Schafjückenweg 2 in 26180 Rastede and the HubSpot software from HubSpot, Inc, 25 First Street, Cambridge, MA 02141 USA. We have carefully selected CleverReach and HubSpot and entered into data protection agreements with them so that we retain control over your data. Hubspot Inc. is certified in accordance with the Data Privacy Framework.

At the end of each e-mail bulletin from MPDV, you will find a link that allows you to unsubscribe from these e-mails at any time. To do this, you can also contact us at the address given below.

If you unsubscribe from the e-mails, the data we store for the purpose of sending these e-mails will be deleted, unless deleting it would infringe our legal retention obligations.

8 Use of the contact form [applies to all MPDV company websites]

If you have any questions, for example about our services, you can use the contact form provided on our website or contact us by e-mail. When you use the contact form, we process the information you provide (mandatory fields of the contact form: first name, last name, e-mail address, telephone number) to process your request and any follow-up questions (Art. 6(1) sentence 1 lit. f) GDPR). We process all information that you provide to us voluntarily on the basis of your consent (Art. 6(1) sentence 1 lit. a) GDPR).

9 Registration customer portal myMPDV [applies to the MPDV GmbH company website]

You can register on the myMPDV customer portal. When you register on the customer portal, we process the information you provide (mandatory information: company, first name, surname, e-mail address, address) to create or assign it to a user profile. As you continue using the customer portal, we use this information to process your inquiries, e.g. in support cases (Art. 6(1) lit. b) GDPR) and to answer any queries, e.g. regarding the quality of our information (Art. 6(1) sentence 1 lit. f) GDPR). If you also provide us with information voluntarily, we process this on the basis of your consent (Art. 6(1) sentence 1 lit. a) GDPR).

10 Webshop

Our website contains a link to our webshop, where companies can purchase tangible and intangible goods, as well as services, from MPDV.

11 Customer survey [applies to all MPDV company websites]

Satisfaction surveys are conducted for continuous further development and quality assurance. Normally, the satisfaction survey is anonymous and cannot be traced back to the individual person.

In the case of satisfaction surveys following training courses, your name and contact details can be provided voluntarily (Art. 6(1) sentence 1 lit. a) GDPR). MPDV uses this information to contact you in the event of follow-up queries or if further information is required. The survey data will be anonymized after the purpose has been fulfilled, at the latest after 180 days. Consent to data processing and contact can be revoked at any time for future effect.

In following up support orders, satisfaction surveys are offered to the client. The data is used for continuous further development and quality assurance on the basis of a legitimate interest of MPDV (Art. 6(1) sentence 1 lit. f) GDPR in conjunction with Section 7(3) UWG [Act Against Unfair Competition]) and deleted after one year.

For the implementation of online satisfaction surveys, MPDV uses the service of Netigate GmbH, which may also have access to personal data as part of its data processing. We have carefully selected this service provider and have made data protection arrangements with them so that we retain sovereignty over your data.

12 Your rights

We will fulfill your rights below to the extent that the legal requirements for asserting the rights are met. To exercise your rights, please contact the controller using the contact details provided above.

12.1 Right to object (Art. 21(1) GDPR)

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on point (e) or (f) of Article 6(1) GDPR. Details can be found in Art. 21 GDPR.

12.2 Right of revocation

If you have consented to the processing of your data, you have the right to revoke this consent at any time for the future in accordance with Art. 7 para. 3 GDPR.

12.3 Right of access, rectification, erasure, restriction of processing, data portability

Pursuant to Art. 15 GDPR, you have the right, upon request and free of charge, to receive information about the personal data that has been stored about you. You also have according to Art. 16, 17 and 18 GDPR the right to correct incorrect data as well as rights regarding the restriction of processing and erasure of your personal data.

You are also entitled, under the conditions set out in Art. 20 GDPR, to receive the stored personal data relating to you in a structured, common and machine-readable format and to transfer this data to another controller without hindrance from us.

To do this, please contact the controller at the contact details provided above.

12.4 Right of complaint

As a data subject, you can contact the Baden-Württemberg state commissioner responsible for data protection and freedom of information at any time if you wish to make a complaint.

12.5 Duration of storage and routine deletion

Unless otherwise stated in this privacy policy for specific data processing, we process and store personal data only for the period of time required to achieve the processing purpose or if this has been provided for in laws or regulations to which we are subject. If the storage purpose ceases to apply or if a legally prescribed storage period expires, the personal data will be routinely blocked or deleted in accordance with the statutory provisions.

12.6 Categories of recipients of data; data transfers to a third country

Service providers and vicarious agents used by us in connection with the website, e.g. hosting providers, agencies and IT service providers as well as the providers mentioned in Section 5 of this privacy policy, may have access to your personal data. However, insofar as these service providers and vicarious agents act on our behalf, they only act in accordance with instructions and are accordingly subjected to contractual obligations by us. This also applies to service providers located in a third country (a state outside the EU or EEA). Transfers of data to a third country only take place as described in this privacy policy.

13 Data protection notices for our social media pages (company pages)

13.1 Xing

We use XING as a social network to connect and communicate with various groups of people, as well as to inform you about our company, our services, and news. New Work SE, Am Strandkai 1, 20457 Hamburg, Germany, is generally responsible for the processing of personal user data on the XING websites.

When you visit our XING page, XING processes certain information about you on its own responsibility, even if you do not have a XING user account or are not logged in. We have no influence over the processing of data by XING, nor do we have access to such data. XING informs you in its privacy policy at https://privacy.xing.com/de/datenschutzerklaerung about how your data is processed. If you wish to exercise your data subject rights with XING, please contact XING directly. You can find more detailed information on this via the link provided above.

As the operator of our XING page, we process your data only to the extent that we can view the data in your public profile on XING. Which information is visible depends on your profile settings. If you contact us via our XING page, we process your name as well as the content of your messages, inquiries, or other posts in order to process them and, if necessary, respond to them. We are solely responsible for such data processing. Depending on the nature of your inquiry, the processing of your personal data is based either on our legitimate interest pursuant to Art. 6(1) sentence 1 lit. f) GDPR or pursuant to Art. 6(1) sentence 1 lit. b) GDPR if your inquiry is aimed at entering into a contract. We store your personal data on our systems only if and as long as it is necessary for processing purposes or if there are legal retention obligations. If you wish to exercise your data subject rights with us, please use the contact options listed in this Privacy Policy.

13.2 LinkedIn

We use LinkedIn as a social network to communicate with various groups of people. The entity responsible for processing personal data on the LinkedIn websites is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland.

When you visit our LinkedIn page, LinkedIn processes personal data even if you do not have a LinkedIn account or are not logged in. You can find information on this in LinkedIn's Privacy Policy at: https://www.linkedin.com/legal/privacy-policy.

As the operator of our LinkedIn page, we can view the content of your publicly accessible profile, provided you have made it available. If you contact us via LinkedIn, we process your name and the content of your message to handle your inquiry. The legal basis is Art. 6(1) lit. f GDPR (legitimate interest in communication and public image) or Art. 6(1) lit. b GDPR, provided your inquiry is aimed at entering into a contract.

LinkedIn provides us with so-called Page Analytics (anonymous statistics) that allow us to evaluate the usage and quality of our site. We do not have access to personal usage data. For this processing, there is joint responsibility in accordance with the agreement at: https://legal.linkedin.com/pages-joint-controller-addendum.

LinkedIn assumes primary responsibility for fulfilling the rights of data subjects. The legal basis is Art. 6(1) lit. f GDPR (legitimate interest in analyzing and optimizing our offering). We store personal data that we process outside of LinkedIn only for as long as is necessary for the respective purposes or as required by statutory retention obligations.

It cannot be ruled out that LinkedIn may transfer data to affiliated companies outside the EU, particularly to the United States. LinkedIn bases such transfers on the European Commission's Standard Contractual Clauses and, according to its own statements, participates in the EU-U.S. Data Privacy Framework.

To exercise your data subject rights regarding data processing by LinkedIn, please contact LinkedIn directly via the privacy policy mentioned above. In all other cases, please contact us using the contact information provided in this privacy policy.

13.3 YouTube

Data processed by YouTube (Google)

We operate a YouTube channel. The provider is Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland.

When you use our YouTube channel, personal data is processed by Google. This applies even if you do not have a Google or YouTube account. Information on the nature, scope, and purposes of data processing can be found in Google's Privacy Policy: https://policies.google.com/privacy?hl=de&gl=de.

In particular, Google processes:

• data you voluntarily provide (e.g., name, username, email address),
• content that you create, upload, or comment on,
• usage data (e.g., content viewed, interactions),
• location data (e.g., IP address, GPS, Wi-Fi information),
• device and log data (e.g., browser type, operating system, pages visited, search terms, cookies).

This data is processed, among other things, to provide the services, analyze usage behavior, and for advertising purposes. In doing so, data may also be transmitted to Google's affiliated companies and processors, as well as transferred to countries outside the EU (in particular the U.S.).

We have no influence over the nature and scope of the data processing carried out by Google, including the possible use of analytics tools (e.g., Google Analytics). The data collected in this process is not made available to us.

Google also receives so-called log data as soon as you access YouTube content – even without having your own account.

You can control the processing of your data via the settings of your Google account as well as via the YouTube-specific privacy settings. For more information, please visit: https://policies.google.com/privacy or https://policies.google.com/technologies/product-privacy

You can submit a request for information via the Google privacy form: https://support.google.com/policies/troubleshooter/7575787

Data processed by us

We also process your data when you communicate with us via YouTube.

This processing is carried out for the purpose of responding to your posts. This constitutes a legitimate interest on our part (Art. 6(1) lit. f GDPR). Otherwise, further processing of visitors' personal data only takes place if it is necessary to handle an inquiry or a comment.

The recipient of the data is initially Google, where it may be passed on to third parties for Google's own purposes and under Google's responsibility. The recipient of posts is also the general public, i.e., potentially anyone. The IP addresses of website visitors are also transmitted to Google via the embedding of YouTube videos on our website (https://www.mpdv.com). We do not collect any data ourselves about your YouTube channel.

However, we process the data you enter on YouTube – in particular your username and the content published under your account – to the extent that we may respond to your posts under "Discussions." The data you freely publish and share on YouTube is thus incorporated into your offer and made available to your followers.

13.4 Meta - Facebook and Instagram

We operate company pages on the Facebook and Instagram platforms, services of Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (hereinafter "Facebook" or "Instagram").

We would like to expressly point out that you use the Facebook or Instagram page and its features at your own risk.

Purpose of processing and legal basis

Our presence on Facebook and Instagram serves to communicate with prospective customers and users of our offerings, as well as to provide information about our company and our services. We process your data based on our legitimate interest pursuant to Art. 6(1) lit. f GDPR in order to communicate with you and improve our visibility. Our overriding legitimate interest lies in effectively and specifically addressing our target groups, as well as in improving our offerings and our visibility on widely used platforms.

Data processing by Meta

When you visit our Facebook or Instagram page, Meta also processes your personal data. This includes:

• your IP address,
• information about your device and browser,
• your interactions with our pages (e.g., likes, comments, messages).

This data may be processed by Meta for its own purposes, e.g., to analyze user behavior and to display personalized advertising. We have no influence over Meta's processing of this data.

Our Facebook and Instagram pages offer you the opportunity to send us messages, react to our posts, or comment on them. Please therefore consider what personal data you wish to share with us on our company pages. If you do not wish to transmit your personal data to Meta, you can contact us at any time through other channels (e.g., via the website, address, etc.).

Data processing by Facebook and Instagram is governed by Meta Platforms' privacy policies (https://www.facebook.com/privacy/policy and https://privacycenter.instagram.com/policy/).

Insight data

When you use our Facebook and Instagram pages, Meta Platforms Ireland Limited provides us with so-called Page Insights. These are anonymized statistical data that Meta generates based on visitors' interactions with our Facebook and Instagram pages. The legal basis for the use of this Insights data is our legitimate interest pursuant to Art. 6(1) lit. f GDPR to analyze the use of our page and improve it for interested visitors to our institution.

We are jointly responsible with Meta Platforms Ireland Limited for the operation of our Facebook and Instagram pages. You can view the agreement on joint responsibility ("Page Controller Addendum") here: https://www.facebook.com/legal/terms/page_controller_addendum.

Data transfer to third countries

Meta Platforms may transfer your data to the United States or other third countries. Please note that these countries may not have a level of data protection comparable to that of the EU. Meta Platforms ensures an adequate level of data protection in accordance with the requirements of the GDPR through certification under the EU-U.S. Data Privacy Framework (DPF) and the use of Standard Contractual Clauses (SCCs) of the European Commission. For more information on data processing and the safeguards in place, please see Meta's Privacy Policy at: https://www.facebook.com/about/privacy or https://privacycenter.instagram.com/policy.

Retention period

The responsible party has only limited influence over the deletion of personal data, as this is largely determined by Meta. Further information on this can be found at https://www.facebook.com/privacy/policy or https://privacycenter.instagram.com/policy.

Insofar as personal data is provided to us in the context of interactions (e.g., messages), we retain it only for as long as necessary for the purposes of communication.

Your rights

You may exercise your rights to access, rectification, objection, portability, and erasure of data both with us and with Meta Platforms. Please note that Meta Platforms bears primary responsibility for the processing of Insight data. You can find more information about your data subject rights on Facebook or Instagram via the following links: https://de-de.facebook.com/privacy/policy or https://privacycenter.instagram.com/policy.

Requirement to provide personal data

You provide the collected data to us or Meta voluntarily. If you do not wish for your data to be processed, you should not visit our Facebook or Instagram pages.

For information on the purpose and scope of data collection, as well as the further processing and use of the data by Facebook or Instagram, and your related rights and settings options for protecting your privacy, please also refer to Meta's privacy policy at: https://www.facebook.com/about/privacy/ or https://privacycenter.instagram.com/policy.

14 Changes to our privacy policy

In order to ensure that our privacy policy always complies with the current legal requirements, we reserve the right to make changes to it at any time. This also applies in the event that the privacy policy has to be adapted due to new or revised services, for example to take account of new service offerings. The new privacy policy will then apply the next time you visit our website.

15 Data protection information for job applicants in accordance with Article 13 GDPR

• a) Name and contact details of the controller (Art. 13(1) lit. a GDPR)
  See Section 1 of the privacy policy.
• b) Name and contact details of the data protection officer (Art. 13(1) lit. b GDPR)
  See Section 2 of the privacy policy.
• c) Purpose and legal basis of data processing (Art. 13(1) lit. c GDPR)
  • Processing of applications (Art. 6(1) b GDPR)
  • Inclusion in an applicant pool for subsequent contact (Art. 6(1) lit. a GDPR)
• d) Interests of the controller in the balancing of interests (Art. 13(1) lit. d GDPR)
  Not applicable.
• e) Recipients or categories of recipients of the personal data (Art. 13(1) lit. e GDPR)
  e.g.: personnel service provider, payroll office, provider of the software-supported applicant portal, waste disposal service provider, affiliated companies.
• f) Transfer to third countries (Art. 13(1) lit. f GDPR)
  If you apply to us for jobs at our subsidiaries, we will send your data to the relevant subsidiary as part of the application process, unless you have applied there directly. These subsidiaries are also located in third countries whose level of protection for personal data differs from that of the EU. We mitigate the effects of this through our Group standard agreement and by implementing suitable technical and organizational measures both at our company and at our subsidiaries.
• g) Storage period in accordance with statutory retention obligations (Art. 13(2) lit. a GDPR)
  The personal data will be deleted six months after the end of the application process, taking into account Section 61b(1) ArbGG [Labor Courts Act] in conjunction with § 15 AGG [General Equal Treatment Act]. In the event of inclusion in the applicant pool, deletion takes place after 2 years if no suitable position can be offered. In the event of employment, the required data will be transferred to the personnel file. Information about the deletion of data can be found in the information obligation on employee data processing.
• h) Your rights
  See Section 12 of the privacy policy.

16 Data protection information for suppliers, service providers and others in accordance with Article 13 GDPR

• a) Name and contact details of the controller
  See Section 1 of the privacy policy.
• b) Name and contact details of the data protection officer
  See Section 2 of the privacy policy.
• c) Purpose and legal basis of data processing (Art. 13(1) lit. c GDPR)
  • Purchase and processing of support services to fulfill business purposes (Art. 6(1) lit. f GDPR)
  • Fulfillment of legal obligations (Art. 6(1) lit. c GDPR)
  • Sending information material (Art. 6(1) lit. f GDPR)
• d) Interests of the controller in the balancing of interests (Art. 13(1) lit. d GDPR)
  • Assertion of legal claims and defense in legal disputes
  • Ensuring IT security and the IT operations of the company
  • Prevention of criminal offenses
  • Measures for business management and further development of services and products
• e) Recipients or categories of recipients of the personal data (Art. 13(1) lit. e GDPR)
  Authorities, banks, auditors, affiliated companies, disposal service providers, credit agencies.
• f) Transfer to third countries (Art. 13(1) lit. f GDPR)
  No data is transferred to third countries.
• g) Storage period in accordance with statutory retention obligations (Art. 13(2) lit. a GDPR)
  As a rule, personal data is deleted within ten years after termination of the employment relationship, unless, in exceptional cases, a longer statutory retention period exists or in the event of revocation by an employee.
• h) Your rights
  See Section 12 of the privacy policy.

17 Data protection information for interested parties and customers in accordance with Article 13 GDPR

• a) Name and contact details of the controller
  See Section 1 of the privacy policy.
• b) Name and contact details of the data protection officer
  See Section 2 of the privacy policy.
• c) Purpose and legal basis of data processing (Art. 13(1) lit. c GDPR)
  • Processing and handling of inquiries from interested parties (Art. 6(1) lit. f GDPR)
  • Sanctions list checks (Art. 6(1) lit. c GDPR in conjunction with Regulation (EC) No. 2580/2001 against other suspected terrorist persons and organizations and Regulation (EC) No. 881/2002 against Osama bin Laden, Al-Qaida and the Taliban)
  • Preparation of offers for interested parties (Art. 6(1) lit. f GDPR)
  • Conclusion of sales contracts (Art. 6(1) lit. f GDPR)
  • Fulfillment of legal obligations (Art. 6(1) lit. c GDPR)
  • Order processing and delivery (Art. 6(1) lit. f GDPR)
  • Processing of complaints (Art. 6(1) lit. f GDPR)
  • Implementation of sales development measures (Art. 6(1) lit. f GDPR)
  • Support of operational processes by service providers (Art. 28 GDPR)
• d) Interests of the controller in the balancing of interests (Art. 13(1) lit. d GDPR)
  Applies to purpose 1, 3 to 8:
  • Design of direct marketing
  • Storage of data of potential customers and partners for acquisition efforts
  • Use of creditworthiness data to safeguard against payment defaults
  • Assertion of legal claims and defense in legal disputes
  • Ensuring IT security and the IT operations of the company
  • Prevention of criminal offenses
  • Measures for business management and further development of services and products
• e) Recipients or categories of recipients of the personal data (Art. 13(1) lit. e GDPR)
  Authorities, banks, auditors, software manufacturers, affiliated companies, disposal service providers, credit agencies.
• f) Transfer to third countries (Art. 13(1) lit. f GDPR)
  Depending on the order placed, our subsidiaries may be involved in fulfillment of the services. These subsidiaries are also located in third countries whose level of protection for personal data differs from that of the EU. We mitigate the effects of this through our Group standard agreement and by implementing suitable technical and organizational measures both at our company and at our subsidiaries.
• g) Storage period in accordance with statutory retention obligations (Art. 13(2) lit. a GDPR)
  Personal data is generally deleted within ten years of the end of the contractual relationship or even earlier if a prospective customer does not become a customer.
• h) Your rights
  See Section 12.