1) Information on the Collection of Personal Data and Contact Details of the Controller

Below we inform you about the handling of your personal data. Personal data is any data that can be used to personally identify you. Please carefully consider what personal data you share with us via Facebook. As long as you are logged into your Facebook account and visit our Facebook profile, Facebook can associate this with your Facebook profile. We expressly point out that Meta, as the operator of Facebook, stores data from its users (e.g. personal information, IP address, etc.) and may also use it for business purposes. More information about Facebook's data processing can be found in Facebook's privacy policy at https://de-de.facebook.com/policy.php.

We have no influence on the data collection and further processing by Facebook. Furthermore, we cannot determine the extent, location, or duration of data storage by Facebook, whether Facebook complies with existing deletion obligations, what analyses and links are made with the data by Facebook, or to whom the data is passed on by Facebook. If you wish to prevent Facebook from processing personal data you have sent to us, please contact us by other means. Our full contact details can be found in our imprint on Facebook.

The controller for data processing within the meaning of the General Data Protection Regulation (GDPR) is Simon Habenicht, Penny Bricks, Lentruper Ring 19, 48231 Warendorf, Germany, Tel.: +49 15255716761, Email: [email protected], insofar as we exclusively process the data you have sent us via Facebook ourselves. Insofar as the data you have sent us via Facebook is also or exclusively processed by Meta as the operator of Facebook (Insights data), Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland is also a controller within the meaning of the GDPR. The data processing is based on an agreement between joint controllers pursuant to Art. 26 GDPR, which you can view here: https://www.facebook.com/legal/terms/page_controller_addendum Furthermore, for the use of certain Facebook products, such as "Facebook Business Tools", and for data processing carried out thereby, a supplementary agreement between us and Meta Platforms Ireland Ltd. as joint controllers pursuant to Art. 26 GDPR applies, which can be viewed here: https://www.facebook.com/legal/controller_addendum The controller for the processing of personal data is the natural or legal person who alone or jointly with others determines the purposes and means of processing personal data.

2) Data Protection Officer

You can contact Meta's data protection officer, as the operator of Facebook, via the online contact form at https://www.facebook.com/help/contact/540977946302970.

3) Data Processing When Contacting Us

We collect personal data when you contact us, e.g. via a contact form or messenger. The data we collect when you contact us via a contact form can be seen from the respective contact form. This data is stored and used exclusively for the purpose of responding to your enquiry or for contacting you and the associated technical administration. The legal basis for processing the data is our legitimate interest in responding to your enquiry pursuant to Art. 6(1)(f) GDPR. If your contact is aimed at concluding a contract, the additional legal basis for processing is Art. 6(1)(b) GDPR. Your data will be deleted after your enquiry has been conclusively processed, unless statutory retention obligations apply. We assume conclusive processing when the circumstances indicate that the matter in question has been conclusively resolved.

4) Data Processing for Contract Fulfilment

If your contact via Facebook serves as the basis for a contract for the delivery of goods and/or the provision of services with us, we process the data you have sent us in this context additionally as follows in the event of a contract being concluded: We pass your payment data on to the commissioned bank as part of payment processing, insofar as this is necessary for payment processing. The legal basis for the transfer of data is Art. 6(1)(b) GDPR.

For contracts for the delivery of goods, we pass on the personal data we have collected to the transport company commissioned with the delivery as part of the contract fulfilment, insofar as this is necessary for the delivery of the goods. Insofar as we owe you updates for goods with digital elements or for digital products on the basis of a corresponding contract, we process the contact data (name, address, email address) you provided when ordering in order to inform you personally about upcoming updates within the legally prescribed period via a suitable communication channel (e.g. by post or email) within the framework of our statutory information obligations pursuant to Art. 6(1)(c) GDPR. Your contact data is used strictly for notifications about updates we owe and is only processed to the extent necessary for the respective information.

5) Data Processing for Direct Marketing

Based on our legitimate interest in personalised direct marketing, we reserve the right to store your first and last name, your postal address and — insofar as we have received these additional details from you within the contractual relationship — your title, academic degree, year of birth and professional, industry or business designation pursuant to Art. 6(1)(f) GDPR and to use them for sending interesting offers and information about our products by post. You can object to the storage and use of your data for this purpose at any time by sending a corresponding message to the controller.

6) Data Processing for Statistics and Marketing Purposes

Page Insights: Facebook provides us with so-called Page Insights for our Facebook page: https://www.facebook.com/business/a/page/page-insights. These are aggregated data that allow us to gain insight into how people interact with our page. Page Insights may be based on personal data collected in connection with a visit to or interaction with our page and its content. This serves pursuant to Art. 6(1)(f) GDPR to safeguard our overriding legitimate interests in an optimised presentation of our offer and effective communication with customers and interested parties. You can object to the processing of your data for the aforementioned purposes at any time by changing your advertising settings in your Facebook user account at https://www.facebook.com/settings?tab=ads.

Facebook Lead Ads: We use the "Lead Ads" function of Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland ("Facebook") to collect and process certain personal data from interested parties — so-called leads — via a contact form ("Instant Form") displayed on Facebook websites. The content and scope of the data requested in this form depends on the orientation of the respective lead campaign. The processing of data is strictly bound to the purposes pursued by the respective Lead Ad campaign. These purposes are clearly named within the Lead Ad or on the form provided before the specified data is transmitted. Depending on the orientation of the Lead Ad campaign, the legal basis for data processing is either your express consent pursuant to Art. 6(1)(a) GDPR (e.g. for direct marketing measures such as registration for email newsletter delivery) or our legitimate interest in optimal marketing of our offer pursuant to Art. 6(1)(f) GDPR. Data is not passed on to third parties. Within the framework of the aforementioned services, data transmitted via Instant Forms may be stored on servers of Meta Platforms, Inc., 1601 Willow Rd, Menlo Park, CA 94025, USA. For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European data protection level based on an adequacy decision of the European Commission. Further information on data processing via Facebook Lead Ads can be found in Facebook's data policy at https://de-de.facebook.com/privacy/explanation

7) Rights of the Data Subject

Applicable data protection law grants you comprehensive data subject rights (rights of access and intervention) vis-à-vis the controller with regard to the processing of your personal data, about which we inform you below: Right of access pursuant to Art. 15 GDPR; Right to rectification pursuant to Art. 16 GDPR; Right to erasure pursuant to Art. 17 GDPR; Right to restriction of processing pursuant to Art. 18 GDPR; Right to notification pursuant to Art. 19 GDPR; Right to data portability pursuant to Art. 20 GDPR; Right to withdraw consent pursuant to Art. 7(3) GDPR; Right to lodge a complaint pursuant to Art. 77 GDPR.

RIGHT TO OBJECT: IF WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTEREST IN THE CONTEXT OF A BALANCING OF INTERESTS, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THIS PROCESSING WITH EFFECT FOR THE FUTURE ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION. IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE DATA CONCERNED. HOWEVER, FURTHER PROCESSING REMAINS RESERVED IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR PROCESSING WHICH OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FREEDOMS, OR IF THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS. IF YOUR PERSONAL DATA IS PROCESSED BY US FOR THE PURPOSE OF DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH MARKETING. YOU MAY EXERCISE YOUR OBJECTION AS DESCRIBED ABOVE. IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE DATA CONCERNED FOR DIRECT MARKETING PURPOSES.

8) Duration of Storage of Personal Data

The duration of storage of personal data is determined by the respective legal basis, the processing purpose and — where applicable — additionally by the respective statutory retention period (e.g. commercial and tax law retention periods). When processing personal data on the basis of express consent pursuant to Art. 6(1)(a) GDPR, the data concerned is stored until you revoke your consent. Where statutory retention periods exist for data processed on the basis of Art. 6(1)(b) GDPR within the framework of legal or quasi-legal obligations, this data is routinely deleted after expiry of the retention periods, provided it is no longer required for the performance or initiation of a contract and/or there is no legitimate interest on our part in continued storage. When processing personal data on the basis of Art. 6(1)(f) GDPR, this data is stored until you exercise your right to object pursuant to Art. 21(1) GDPR, unless we can demonstrate compelling legitimate grounds for processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. When processing personal data for the purpose of direct marketing on the basis of Art. 6(1)(f) GDPR, this data is stored until you exercise your right to object pursuant to Art. 21(2) GDPR. Unless otherwise stated in the other information in this declaration regarding specific processing situations, stored personal data will be deleted when they are no longer necessary for the purposes for which they were collected or otherwise processed.