A. General information

Thank you for visiting our website and for your interest in it. The protection of your personal data ("data" for short) is very important to us and is therefore of the utmost importance. In the following, we would therefore like to inform you about the collection, processing and use of your personal data when you visit our website.

1 Validity and changes

This privacy policy is currently valid and has the status 04.05.2022

We reserve the right to amend this privacy policy if the legal situation or this online offer or the type of data collection changes. However, this only applies to declarations on data processing. Of course, we will always take your reasonable interests into account when making any changes. If the user's consent is required for data processing or components of the privacy policy contain a regulation of the contractual relationship with users, the privacy policy will only be amended with the user's consent.

2 Controller, contact, data protection officer

The controller pursuant to Art. 4 No. 7 of the EU General Data Protection Regulation ("GDPR") is SpaceNet AG, Joseph-Dollinger-Bogen 14, D-80807 Munich, Germany, represented by the Management Board, whose members are Sebastian v. Bomhard, Michael Emmer.

If you have any questions or comments about this privacy policy or about data protection in general, please contact our external data protection officer:

DSB SpaceNet AG

c/o Rickert Rechtsanwaltsgesellschaft mbH

Colmantstr. 15

53113 Bonn

E-mail address: datenschutz@space.net

3 Legal basis for the processing of personal data

• If the legal basis is not stated in the privacy policy, the following applies
• Insofar as we obtain the consent of the data subject for the processing of personal data, Art. 6 para. 1 sentence 1 lit. a EU General Data Protection Regulation (GDPR) serves as the legal basis.
• When processing personal data that is necessary for the fulfilment of a contract to which the data subject is a party, Art. 6 para. 1 sentence 1 lit. b GDPR serves as the legal basis. This also applies to processing operations that are necessary for the performance of pre-contractual measures.
• Insofar as the processing of personal data is necessary to fulfil a legal obligation to which our company is subject, Art. 6 para. 1 sentence 1 lit. c GDPR serves as the legal basis.
• In the event that vital interests of the data subject or another natural person require the processing of personal data, Art. 6 para. 1 sentence 1 lit. d GDPR serves as the legal basis.
• If the processing is necessary to safeguard a legitimate interest of our company or a third party and if the interests, fundamental rights and freedoms of the data subject do not outweigh the first-mentioned interest, Art. 6 para. 1 sentence 1 lit. f GDPR serves as the legal basis for the processing.
• Applications via online form
  You are welcome to use our online form to apply for jobs advertised here. The purpose of processing personal data is to select a suitable applicant in connection with the respective advertised positions. For this purpose, it is necessary for the applicant to provide us with the types of data that we have labelled accordingly. By transmitting personal data via an attached file, the applicant also agrees to the processing of personal data in this context. In the event of a successful application, the data collected may be further processed by us for the purposes of the employment relationship. The legal basis for the processing of personal data in the context of an online application is Art. 6 para. 1 sentence 1 lit. b GDPR in conjunction with Section 26 BDSG. Beyond the original purpose (selection of a suitable applicant), SpaceNet will retain your application data for the defence of legal claims for a period of 6 months from the rejection of your application. The basis for processing is Art. 17 para. 3 lit. e, Art. 6 para. 1 sentence 1 lit. f GDPR.

If, as an applicant, you also wish your application data to be stored in our applicant pool in order to be considered at a later date when filling vacant positions, your consent is required. The legal basis for this is Art. 6 para. 1 sentence 1 lit. a, Art. 7 GDPR. This consent also applies to special categories of data in accordance with Art. 9 GDPR (e.g. photos, information on severely disabled status, etc.), insofar as these have been transmitted by me to SpaceNet. You can revoke your consent at any time. In this case, your data will be deleted immediately. We will delete your data after 3 years.
Please note that for organisational reasons this is only possible for applicants who are over 16 years old. Application data of applicants under the age of 16 will be destroyed after the above-mentioned deadlines have expired.

4 General information on the storage period

The data processed by us will be deleted or restricted in their processing in compliance with the statutory provisions, in particular in accordance with Art. 17 and 18 GDPR. Unless expressly stated in this privacy policy, we delete data stored by us as soon as it is no longer required for its intended purpose. Data will only be deleted beyond the point in time at which the purpose ceases to apply if it is required for other and legally permissible purposes or if the data must continue to be stored due to statutory retention obligations. In these cases, processing is restricted, i.e. blocked and not processed for other purposes.

B. Collection of personal data when visiting our website

The scope and type of collection and use of your data differs depending on whether you visit our website only to access information, e.g. to view our offers or to make use of services offered by us or to contact us or request information.

1. informational use

For the informational use of our website, it is not necessary for you to actively provide personal data. Rather, in this case we only collect and use the data that your Internet browser automatically transmits to us. This includes

• IP address
• Date and time of accessing our website
• Time zone difference to Greenwich Mean Time (GMT)
• Content of the request (specific page)
• Access status/HTTP status code
• Amount of data transferred in each case
• Website from which the request originates and last page visited
• Browser type
• Language and version of the browser software
• Operating system used and its interface.

This data is processed in order to enable you to use the web pages you have accessed, for statistical purposes and to improve our website. Personal data processed in this context is automatically deleted from our servers after six months.

The processing of the aforementioned data is technically necessary for the provision of a website in accordance with Art. 6 Para. 1 S. 1 S.1 lit. b GDPR in order to display our website correctly. We store log files to ensure the stability and security of our website. In particular, the purpose of creating log files is to be able to detect attacks on our systems. The legal basis for this is Art. 6 para. 1 sentence 1, lit. c, lit. f GDPR.

2. use of the customer area

The use and registration of our customer area is reserved for existing customers.

To use the customer area, it is necessary for you to register. The data entered in the mandatory fields during registration is processed on the basis of Art. 6 para. 1 sentence 1 lit. b GDPR. The processing of voluntarily provided information is based on Art. 6 para. 1 sentence 1 lit. a GDPR.

The data collected during registration will be stored by us for as long as you are registered on our website and beyond that for the duration of statutory retention periods.

Subject to the deletion of your account or the revocation of consent, we are obliged, for example, to store your address, payment and order data for a period of ten years due to commercial and tax law requirements. However, we will restrict processing after the relevant guarantee and warranty periods have expired. The legal basis for this is Art. 6 para. 1 sentence 1 lit. b, lit. c GDPR.

Mandatory information required for the processing of contracts and the creation of a user ID is marked accordingly in the registration form; further information is voluntary. The following is collected

• e-mail address*
• user name*
• password*
• Payment and billing data (form of address*, title, first name*, surname*, customer number*, company name, company address, telephone number)

Information marked with * must be provided upon registration.

We use the so-called double opt-in procedure for registration. After your registration, an e-mail will be sent to the e-mail address you have provided in which we ask you to confirm that you wish to create a customer account. This is done by clicking on a hyperlink contained in the e-mail. In addition, we are authorised to retain the IP addresses you use and the times of registration and confirmation in order to prove your registration and, if necessary, to be able to clarify any possible misuse of your personal data. The legal basis for this is Art. 6 para. 1 sentence 1 lit. c and f GDPR.

The following data is also stored at the time of registration

• Date and time of registration, including the IP address used

We process the data you provide for identification and allocation.

3. enquiries via contact form and email

We want to give you the opportunity to get in touch with us by e-mail and via our contact forms.

You can use the forms to request a quotation or for general enquiries. To process your enquiry, we need your name, your e-mail address and, if applicable, the name of your company. When using the forms to request a quotation, mandatory fields are also used to request data that is absolutely necessary to prepare a quotation. The processing of the personal data from the input mask serves us solely to process the contact.

Depending on the content of the enquiry, your data will be processed when you contact us via contact form, email or telephone for purely informational enquiries on the basis of your (presumed) consent in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR, or in accordance with Art. 6 para. 1 sentence 1 lit. b GDPR, insofar as the contact is made in connection with contractual fulfilment obligations. To contact you via our form, we only need your e-mail address, your name and the company name in order to be able to reply to you. You can also voluntarily provide your name so that we can address you personally. Your details may be stored in a customer relationship management system ("CRM system"). The legal basis for this is Art. 6 para. 1 sentence 1 lit. f GDPR.

You have the option to withdraw your consent to the processing of personal data at any time without affecting the lawfulness of processing based on consent before its withdrawal. If you contact us by email for informational purposes, you can object to the storage of your personal data at any time. In such a case, the conversation cannot be continued. You also have the right to object to the storage of your personal data in a CRM system.

We will delete your contact enquiries from our active systems immediately after final processing, unless legal authorisation or retention obligations permit or require further storage.

4 Your rights

In accordance with the statutory provisions, you have the following rights with regard to the personal data concerning you

• Right of access (Art. 15 GDPR),
• Right to rectification or erasure (Art. 16 and Art. 17 GDPR),
• Right to restriction of processing (Art. 18 GDPR),
• Right to data portability (Art. 20 GDPR),
• Right to object to processing (Art. 21 GDPR).

To assert your rights, please direct your enquiry to the contact details listed under point A2.

Without prejudice to any other administrative or judicial remedy, you have the right to

lodge a complaint with a supervisory authority,

in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes the GDPR. The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Art. 78 GDPR.

5 Order processing and recipients of data

In some cases, we use external service providers who are bound by our instructions to process your data. These have been carefully selected and commissioned by us and are regularly monitored. The commissions are based on agreements on order processing, in accordance with Art. 28 GDPR.

We operate this website in our own high-security data centres in Munich.

6 Newsletter and advertising use

Your data will only be used for advertising and information purposes with your express prior consent. In this respect, the data is used to present you with new products and events from our company that are tailored to your interests. This includes information on the current or future product range as well as events in which we are involved.

We use the so-called double opt-in procedure to register for our e-mail newsletter. After you have registered, an e-mail will be sent to the e-mail address you have provided in which we ask you to confirm that you wish to receive the newsletter. This is done by clicking on a hyperlink contained in the e-mail. If the hyperlink confirmation is not received within 24 hours, your information will be blocked and deleted after one month. In addition, we are authorised to retain your IP addresses and the times of registration and confirmation in order to be able to prove your registration and, if necessary, to clarify any possible misuse of your personal data. The legal basis for this is Art. 6 para. 1 sentence 1 lit. a and lit. c GDPR.

The only mandatory information for registration is your email address. Any additional personal data can be provided voluntarily and is used to address you personally.

You can revoke your consent to advertising use and newsletter dispatch at any time by sending an email to newsletter-info@space.net or by using the unsubscribe link at the end of the email.

We would like to point out that we evaluate your user behaviour pseudonymously when sending the newsletter. In this context, we record and evaluate when you open and read our newsletter and which personalised links you click on. We use the data obtained in this way to create a user profile in order to tailor our newsletter to your individual interests. If you have consented to analysis by Mautic on our website in the cookie settings (see "Use of cookies/Mautic" below), your website usage behaviour may also be included in the analysis.

The information is stored for as long as you are subscribed to the newsletter. After you unsubscribe, we store the data purely statistically and anonymously.

The newsletter is sent and analysed using the open source software Mautic. The data you enter for the purpose of receiving the newsletter is stored on our web server.

The legal basis for the processing is your consent, which can be revoked at any time, Art. 6 para. 1 sentence 1 lit. a, Art. 7 GDPR. We would like to point out that for technical reasons it is not possible to revoke the analysis functions in isolation. If you withdraw your consent, you will no longer be able to receive the newsletter.

7 Data security

This site uses SSL encryption for secure data transmission, in particular for communication data from the contact form.

We use the widespread SSL (Secure Socket Layer) method in conjunction with the highest level of encryption supported by your browser when you visit the website. As a rule, this is 256-bit encryption. If your browser does not support 256-bit encryption, we use 128-bit v3 technology instead. You can recognise whether encrypted transmission is taking place by the closed display of the locked key or lock symbol in the lower status bar of your browser.

We also use suitable technical and organisational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction or unauthorised access by third parties. Our security measures are continuously improved in line with technological developments.

8 Use of cookies

General information

We use the technology of cookies for our website. Cookies are small text files that are sent from our web server to your browser when you visit our website and are stored on your computer for later retrieval. You can determine yourself whether cookies can be set and retrieved by changing the settings in your browser. For example, you can completely deactivate the storage of cookies in your browser, restrict it to certain websites or configure your browser so that it automatically notifies you as soon as a cookie is to be set and asks you for feedback. Cookies cannot execute programmes or transmit viruses to your computer.

We only use so-called session cookies (also known as temporary cookies), i.e. cookies that are only stored temporarily for the duration of your use of one of our websites. For the full functionality of our website (currently only in the customer area), it is necessary for technical reasons to allow the aforementioned session cookies. The purpose of these cookies is to continue to identify your computer during a visit to our website when you switch from one of our websites to another and to be able to determine the end of your visit.

Persistent cookies are automatically deleted after a specified period, which may vary depending on the cookie. You can delete cookies at any time in your browser's security settings.

The legal basis for the use of cookies is Art. 6 para. 1 sentence 1 lit. f GDPR, unless otherwise stated.

Matomo/Piwik

We use the open source software tool Matomo (formerly PIWIK) on our website to analyse the surfing behaviour of our users. This serves to analyse visitor flows on our website. This enables us to recognise which subpages are used most frequently. By analysing the data obtained, we are able to compile information about the use of our website. This helps us to constantly improve our website and its user-friendliness.

For this purpose, pseudonymised user profiles are created which can be assigned to the browser you use by means of a cookie stored on your computer. If individual pages of our website are accessed, the following data is stored:

• The website accessed
• The website from which the user accessed the website (referrer)
• The subpages that are accessed from the website accessed
• The time spent on the website
• The frequency with which the website is accessed

The software runs exclusively on the servers of our website. The user's personal data is only stored there. The data is not passed on to third parties. When using Matomo, we deliberately refrain from processing your full IP address.

The legal basis for the processing of user data is your consent, revocable at any time, in accordance with Art. 6 para. 1 sentence 1 lit. a, Art. 7 para. 3 GDPR. To revoke your consent, please use the settings banner at the end of this privacy policy. In this way, a cookie is set on your system that signals to our system not to store the user's data.

The data will be deleted after 60 days. You can find further information at https://matomo.org/privacy/

We offer our users the option of opting out of the analysis process on our website. To do this, you must follow the corresponding link. In this way, another cookie is set on your system, which signals to our system that the user's data will not be saved. If the user deletes the corresponding cookie from their own system in the meantime, they must set the opt-out cookie again.

Mautic

We use the open source marketing tool Mautic on our website, which is hosted on our server. It is not passed on to third parties or processors. Mautic uses both cookies and tracking pixels. When individual pages of our website are accessed, the following data is stored, recording the time and approximate location (based on your IP address):

• Your abbreviated IP address
• Browser type/version, language setting, resolution of the browser window, screen resolution
• The operating system used, input method
• Referrer URL (the website from which you came to our website)
• Activities on our website including number of page views, time spent on the site and click paths
• The frequency of visits to the website
• Downloads of files provided on our website
• Opening of emails and clicking on links from newsletter campaigns

Processing this data enables us to analyse how our website is used. The purpose of this is to better tailor and/or individualise our marketing measures (website design, email marketing, tracking pixels) to your interests. The tool also helps us to better analyse the success of individual marketing measures and to automate marketing measures based on the interests of our users.

If you register for our newsletter, we can link the information listed above with your newsletter registration.

The legal basis for the processing of user data is your consent pursuant to Art. 6 para. 1 sentence 1 lit. a, Art. 7 para. 3 GDPR, which you can revoke at any time. To revoke your consent, please use the settings banner at the end of this privacy policy. The data will be deleted as soon as it is no longer required for our recording purposes. Cookies are deleted after 7 days at the latest.

Your IP address in the user profile and in the associated database will be anonymised.

Advertising based on tracking and retargeting

As we only want to show you adverts on our advertising partners' websites that really interest you, we use tracking and retargeting technologies on our website so that you only see adverts that really interest you. As a rule, cookies are used for this purpose, which are temporarily stored for this purpose and thus enable our retargeting partners to recognise visitors to our website under a pseudonym. This enables our retargeting partners to show you our products that are likely to be of interest to you.

The legal basis for the processing described in this section is your consent in accordance with Art. 6 para. 1 sentence 1 lit. a), Art. 7 GDPR. You can revoke your consent at any time and without giving reasons via the settings of the cookie banner or your browser settings.

We use the data collected for statistical and advertising purposes and in particular

• for targeted advertising, including via advertising networks in cooperation with partners
• to measure the success and billing of advertising measures between advertising partners and us
• to understand which adverts you have already seen in order to prevent you from seeing the same adverts again and
• to assess which parts of our website need to be optimised.

For our interest-based advertising, we use Facebook Pixel, a service provided by Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland as a processor. As a processor, Facebook is contractually obliged to process data only on our behalf.

The service enables us to determine target groups for advertising on Facebook, so-called "Facebook Ads", based on website visits and surfing behaviour. We also use Facebook Pixel to measure the effectiveness of online marketing measures. This allows us to track the actions of users after they have seen and/or clicked on a Facebook advert and then placed an order. When you visit one of our websites, the pixel is integrated directly by Facebook and can store a cookie on your device. If you subsequently log in to Facebook or are already logged in to Facebook, your visit to this website can be logged in your profile. The user data collected in this way is anonymous to us and therefore does not allow any conclusions to be drawn about your identity. However, this data is stored and processed by Facebook so that it is possible to draw conclusions about the respective user profile. Data processing by Facebook is carried out in accordance with Facebook's data usage guidelines. We have concluded a joint responsibility agreement with Facebook for this data processing. You can find more information about Facebook's data processing at: https://www.facebook.com/about/privacy/.