Data Privacy of the Company Website and Portals of genua

For technical reasons, genua processes a limited amount of data (so-called connection data) each time the website is accessed. This data is technically necessary to establish and carry out a connection between your terminal device and our servers. The processing is based on Art. 6 para. 1 p. 1 lit. f) GDPR. The following data or data categories may be collected in the process:

• Name of the website that is accessed

• Time and date of access

• Browser type and version

• The user operating system

• Referrer URL (the previously visited page)

• IP address

• possibly Username

This log data is only processed for statistical evaluations for the purpose of operation, security and optimization of the offer. However, we reserve the right to subsequently review the log data if there is a justified suspicion of unlawful use based on specific indications.

This data is deleted or anonymized after the end of the connection and is therefore not used to create user profiles.

We would like to send you regular offers, news and other interesting information by e-mail. If you are interested, you can register for our newsletter. All you have to do is fill in the mandatory information marked with an asterisk and confirm that you want to subscribe to genuletter by checking the box. Subsequently, you will receive an activation link to the specified e-mail address, which you can confirm with one click. Alternatively, you can copy the link and access it via the address bar of your web browser. In this way you complete the registration and agree to receive the newsletter. (Double opt-in procedure)

Your data will be processed exclusively for sending the newsletter. The processing is based on Art. 6 para. 1 p. 1 lit. a) GDPR. The following personal data is processed during registration and when receiving and using the newsletter:

• E-mail address

• Title

• Last name

• First name (optional)

• Company (optional)

You can revoke your consent at any time and without giving reasons. For this purpose, you have two options to choose from:

1. You can unsubscribe from our newsletter by clicking on the "unsubscribe" link found in every newsletter.

2. You can send an informal e-mail with your unsubscribe request to datenschutz@genua.de.

3. You can visit our unsubscribe page to unsubscribe from the mailing list.

Upon receipt of your revocation, genua will no longer send you newsletters in the future and, if necessary, delete your data collected during registration.

Cookies are text files that allow device-specific information to be stored on the end device used.

Cookies that are necessary to carry out the electronic communication process (necessary cookies) are stored on the basis of Art. 6 para. 1 p. 1 lit. f) GDPR. genua has a legitimate interest in storing cookies for the technically error-free and optimized provision of its services. The legal basis for storing information in the end user's terminal equipment is Section 25 para. 2 (2) TTDSG (German Telecommunications and Telemedia Data Protection Act). The use of session cookies is absolutely necessary so that we, as the provider of the genua websites (telemedia service), can provide this expressly requested telemedia service. If consent to the storage of cookies has been requested, the storage of the cookies in question will be based exclusively on this consent (Art. 6 para. 1 p. 1lit. a) GDPR and Section 25 para. 1 TTDSG); consent can be revoked at any time.

genua uses the privacy-friendly web analytics tool Matomo to learn more about user behavior on the website and to use this knowledge to continuously improve the website. Matomo uses cookies for this purpose in which device-specific information (IP address, browser type, operating system, country of origin) and information on user behavior are stored anonymously. As Matomo is operated directly on genua's servers, this process does not transmit personal data to third parties. The processing is based on your consent pursuant to Art. 6 para. 1 p. 1 lit. a) GDPR and Section 25 para. 1 TTDSG. The user can revoke his consent at any time via the cookie settings. Matomo is disabled when you visit our website. Only if you actively consent, your usage behavior will be recorded.

genua provides you with the option to make general contact within the framework of the company website. If you wish to use these offers, you will be asked to enter personal data that is required to process your request. In this context, genua collects your last name and e-mail address (mandatory information) and, if applicable, your title, first name, telephone number, company, postal address (optional information). It is your free decision whether you use these offers and enter your data. genua collects this data in order to be able to use a personal approach when communicating with you. The legal basis for data processing is Art. 6 para 1 p. 1 lit. f) GDPR. This results from the economic, conceptual and technical interest in the provision and use of a contemporary information medium as well as to answer your inquiry.

We offer you the possibility to download genua whitepapers. If you are interested in this, you can enter your data and download the whitepaper. All you have to do is fill in the mandatory information and confirm that you want to download the whitepaper by checking the box. Your data will then be stored in our systems so that we can contact you about similar goods or services.
You can also voluntarily agree to receive news and other interesting information by e-mail. You will then receive an activation link to the e-mail address you provided, which you can confirm by clicking on it. Alternatively, you could copy the link and call it from the address bar of your web browser. In this way, you complete the registration and consent to receiving marketing measures (double opt-in procedure).

Your data will be processed exclusively for the respective contact described above.
The processing of your data is based on our legitimate interest in being able to present you with similar goods and services, Art. 6 para. 1 p. 1 lit. f) GDPR. In the case of active consent to receive general marketing measures, the legal basis is your consent pursuant to Art. 6 para. 1 p. 1 lit. a) GDPR.

The following personal data is processed during registration:
- Salutation
- First name
- Surname
- Company name
- Branch
- E-mail address

With regard to the processing of your personal data during the whitepaper download and the subsequent contacting of similar goods and services, you can exercise your right to object at any time without incurring any costs other than the transmission costs according to the prime rates. Please feel free to contact datenschutz@genua.de for this purpose.

With regard to your consent to general marketing measures, you can revoke your consent at any time and without giving reasons. For this purpose, please send an e-mail to datenschutz@genua.de.

Upon receipt of your revocation or objection, genua will no longer contact you for marketing measures in the future and, if necessary, delete your data collected during registration.

The personal data collected when ordering goods or services will be used by genua to manage your customer account and to fulfill and process your order, and if applicable will only be passed on to third parties (e.g. to a transport company commissioned with shipping) for this purpose. In addition, this data will be further used within the scope of legal regulations. genua will inform you by phone, by e-mail or via post about interesting offers concerning the same or similar goods or services as well as a little gesture for special occasions. In addition, genua conducts customer customer feedback surveys from time to time to make the products even better for you. If you do not (or no longer) wish to receive such information or promotions, you can informally object to this at any time with effect for the future to genua (e.g. e-mail: datenschutz@genua.de). Such an objection will not incur any costs beyond the transmission costs according to the prime rates.

The processing of your data is based on our legitimate interest in being able to present similar goods and services to you as well as to strengthen our business relationship in various manners, Art. 6 para. 1 p. 1 lit. f) GDPR.

You also have the option of contacting genua by telephone. You may be asked to provide personal data that is required to process your request. In this context, genua regularly collects your name and the reason for the call. The legal basis for data processing is genua's legitimate interest pursuant to Art. 6 para. 1 sentence 1 lit. f) GDPR. This results from the economic, idealistic and technical interest in answering your inquiry and communicating with you.
genua regularly uses the services of MWC - Mobile World Communications GmbH for this purpose. This service provider acts as a processor for genua; a corresponding data processing agreement has been concluded in accordance with Art. 28 GDPR.

To ensure that we reach our potential future colleagues in the best possible way, we maintain a company page on popular business networks. The following data privacy information therefore applies to the processing of personal data within the portals.

Social networks are only integrated on our website as a link to the corresponding services. After clicking on the embedded text/image link, you will be redirected to the page of the respective provider. User information is only transmitted to the respective provider after forwarding. For information on the handling of your personal data when using these websites, please refer to the respective data privacy policies of the providers you use.

a) LinkedIn

When you visit our LinkedIn company page, follow our page or engage with the page, LinkedIn processes personal data about this interaction, which enables us to evaluate user behavior by means of statistics. This involves the so-called "Page Insights" function. For these statistical analyses, LinkedIn primarily processes data that you have provided to the platform via information within your profile. In addition, LinkedIn processes information about how you interact with our LinkedIn company page, such as whether you are a follower of our LinkedIn company page. When we organize so-called "polls", i.e. release topic-related surveys on our company website, we see evaluations of the voting behavior for this purpose.

LinkedIn does not provide us with any personal data via Page Insights. We only have access to summarized Page Insights that do not allow us to draw conclusions about individual members.

The processing of personal data in the context of Page Insights is carried out by LinkedIn and us. The evaluation of the actions on our LinkedIn company page supports the constant efforts to align our public relations with the needs of our users. The legal basis for this processing is Art. 6 para 1 lit. f) GDPR.

In principle, the company is solely responsible under data privacy law for the processing of personal data within the LinkedIn platform. You can obtain further information about the processing of personal data by LinkedIn here. Please note that LinkedIn processes personal data in the USA or other third countries. LinkedIn transfers personal data only to countries for which an adequacy decision has been issued by the European Commission in accordance with Art. 45 GDPR or on the basis of appropriate safeguards pursuant to Art. 46 GDPR.

b) Twitter

We make use of the option for corporate presence in the Twitter network (Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2, Ireland).

On our company page, we provide information and offer Twitter users the opportunity to communicate. If you perform an action on our Twitter corporate presence (e.g. comments, posts, likes, etc.), you may thereby make public personal data such as the plain name or photo of your user profile. However, since we generally or to a large extent have no influence on the processing of your personal data by the companies jointly responsible for the Twitter corporate presence, we cannot provide any binding information on the purpose and scope of the processing of your data.

Our company presence in social networks is used for communication and information exchange with (potential) customers. In this context, publications about the corporate presence may include the following content:

• Information about products

• Information about services

• Competitions

• Advertising

• Customer contact

Every user is free to publish personal data through activities. The legal basis for data processing is Art. 6 para. 1 p. 1 lit. a) GDPR.

The data generated by the corporate presence is not stored in our own systems. You can object at any time to the processing of your personal data that we collect in the course of your use of our Twitter corporate presence and exercise your data subject rights set out in Section 8 of this privacy policy. To do so, send us an informal e-mail to datenschutz@genua.de.

You can find more information on the processing of your personal data by Twitter and the corresponding objection options here:  https://twitter.com/en/privacy

c) XING and kununu

Our XING company page is provided on the platform of the company New Work SE, Dammtorstraße 30, 20354 Hamburg. If you visit our site and are logged into your XING account at the same time, XING can associate your visit to our website with your XING account. If you log out beforehand, such a link cannot be created by XING. The way in which XING collects and processes your data and the purposes for which this is done can be found in XING's privacy policy, which you can find here.

When you visit the service, cookies and similar technologies such as pixels may be used to collect information about your use of the service and to provide you with features. In addition, advertisers or other XING partners may provide cookies or similar technologies on your device. You have the option to restrict the processing of your data in the privacy settings of your profile. Information on the privacy settings can be found here.

Depending on the mobile device, you can restrict the service's access to contact and calendar data, photos, location data, etc. in the settings options. However, this depends on the operating system used.

We process data entered by you on XING via our company page on the XING platform, in particular your (user) name. We process the content published under your account by sharing your posts or when we respond to them. We could also write posts that link to your profile and your content, thereby drawing the attention of our "followers".

The legal basis for this data processing is Art. 6 para 1 lit. f) GDPR. Our legitimate interest is the interaction with potential employees and the presentation of genua within the network. You can object to this data processing at any time. For more information, see the heading "Data subject rights" below.

Kununu is also a brand operated by New Work SE. As a user of kununu, you can request the data that is stored about you in this application via the following link: https://www.kununu.com/user/inquiry. Further information on data processing within the scope of the entire XING service and its applications (such as kununu, among others) can be found in the XING Privacy Policy.

d) YouTube account

We make use of the option for corporate presence on YouTube (Google Ireland Limited, Gordon House, Barrow Street, D04 E5W5, Dublin, Ireland). Google LLC, headquartered in Montain View, California in the U.S., is certified under the Data Privacy Framework and thus the adequacy decision between the EU and the U.S. applies.

On our company page, we provide information and offer YouTube users the opportunity to communicate. If you perform an action on our YouTube corporate presence (e.g. comments, posts, likes, etc.), you may thereby make public personal data such as the plain name or photo of your user profile.

Our company presence in social networks is used for communication and information exchange with (potential) customers. In particular, we use the corporate presence to provide information about products and services.

If you are logged into your YouTube account during your visit, Google can associate your website visit with this account. This information is transmitted directly to Google and stored there.

The legal basis for this processing of personal data is Art. 6 para 1 p.1 lit. f) GDPR.

You can object at any time to the processing of your personal data that we collect in the course of your use of our YouTube corporate presence and exercise your data subject rights set out in Section 8 of this privacy policy. You can find more information on the processing of your personal data by YouTube and the corresponding objection options here: https://policies.google.com/privacy?gl=DE&hl=en

Our website links to YouTube videos. The provider of the video platform is Google Ireland Limited, Gordon House, 4 Barrow Street, Dublin, Ireland. The video will only be opened and played externally on YouTube when you click on the corresponding preview image. YouTube is independently responsible for data processing. We do not share any personal data with YouTube.

When using YouTube, personal data is usually transferred to a Google server in the USA and stored there. We therefore wish to point out that it cannot be ensured that the data processing will be carried out with the same level of protection as within the EU. In this respect, to our knowledge, there is in any case a risk that you will only be able to enforce your rights as a data subject with difficulty and that state security authorities will access data disproportionately. In addition, there is a lack of data privacy supervision. We expressly point this out. For more information on the handling of user data, please refer to the Google Privacy Policy.

a) Purpose and legal basis of data processing

Through our whistleblower tool, genua ensures greater protection for whistleblowers who want to report violations of EU or German law. Through this tool, genua has established a secure channel for whistleblowing. The purpose of processing personal data is to manage genua's whistleblower system, including the detection of serious violations or potential violations of German or EU law or other serious matters.

The processing of personal data is necessary for compliance with a legal obligation to which genua is subject, cf. Art. 6 para. 1 p. 1 lit. c) DSGVO. This is the German Law for Better Protection of Whistleblowers and for the Implementation of the Directive on the Protection of Persons Reporting Breaches of Union Law, which transposes the EU Directive "Directive on the Protection of Persons Reporting Breaches of Union Law" (2018/0106 COD) into national law.

In addition, the processing is necessary to protect genua's legitimate interest in detecting serious violations or potential violations of German or EU law or other serious matters that override the interests or fundamental rights and freedoms of the data subject, cf. Art. 6 para. 1 p. 1 it. ) GDPR.

As far as the processing of special categories of personal data is concerned, the processing is necessary for reasons of substantial public interest on the basis of the Law for Better Protection of Whistleblowers and for the Implementation of the Directive on the Protection of Persons Reporting Breaches of Union Law, cf. Art. 9 para. 2 lit. g)GDPR. In addition, the processing of special categories of personal data is necessary for the establishment, exercise or defense of legal claims, see Art. 9 para. 2 lit. f) GDPR in conjunction with Art. 6 para. 1 p. 1 lit. f) GDPR.

The processing is also necessary for the performance of a task carried out in the public interest, cf. Art. 6 para. 1 p 1 lit. e) GDPR.

The data subjects are primarily the persons to whom the reporting relates, including employees, partners or other persons professionally associated with genua, depending on who is mentioned in the notification. Moreover, genua processes personal data about the reporting person if the reporting person submits his or her contact information or other information from which the reporting person can be directly or indirectly identified. As the reporting person, you must therefore be aware that genua may process personal data about you in connection with the processing of the reported case.

Reporting can be done 100% anonymously. In this case, no personal data of the reporting person will be processed.

The categories of personal data that are processed depend on the information reported. If the reporting person reports personal data about another person, including the reported person or persons, genua also processes this personal data. Which personal data are processed in this case depends on which personal data are included in the report. The following categories of personal data may be processed:

• General personal data (name, address, e-mail address, telephone number, position, etc.)

• Personal data on criminal convictions or the suspicion of such activity

• Special categories of personal data (information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, data concerning health, and data concerning a person's sex life or sexual orientation)

genua advises the reporting person to report only information that is of specific relevance to the reported case and, in particular, not to report information about criminal offenses and special categories of personal data unless this is of central importance to the processing of the reported case.

b) Obligation to provide personal data

There is no obligation to provide the personal data listed under Section 3, as reports can also be made anonymously. However, it may not be possible for genua to process the report without providing the personal data.

c) Recipients of personal data

The reports are created in the Internal Audit department of Bundesdruckerei Gruppe GmbH as a ticket in the WhistleB system, made available as a system message to genua's management and evaluated by them. After the assessment, the system messages are passed on internally to genua's Compliance Officer, who processes them. The reason for this being forwarded is that only the respective management can decide on any follow-up measures, not the Internal Audit department of Bundesdruckerei Gruppe GmbH. In this context, personal data is only passed on for a specific purpose and in accordance with the principle of data minimization, i.e. only the personal data that is absolutely necessary to process the report is passed on.

genua discloses personal data about the reporting person to public authorities if this is necessary to deal with serious violations or serious matters or to ensure the right of defense of the data subjects. In other cases, genua discloses personal data about the reporting person only with the consent of the reporting person. genua will only disclose personal data about persons other than the reporting person as part of the follow-up of a reported case or to deal with serious violations or serious matters.

genua uses the tool from Bundesdruckerei Gruppe GmbH, which in turn cooperates with the Swedish software manufacturer WhistleB, Whistleblowing Centre AB. As this involves order processing within the meaning of Art. 28 GDPR by Bundesdruckerei Gruppe GmbH, we have concluded an order processing agreement in accordance with the statutory provisions. For more information on WhistleB, Whistleblowing Centre AB, please visit: report.whistleb.com/content/documents/whistleb_terms_of_use.pdf

d) Storage period

Personal data that proves to be irrelevant to genua's processing of a reported case, as well as reports that genua deems to be unfounded or that do not fall within the scope of the whistleblower regu

relevant" and any existing personal reference (unless it is already an anonymous report) is removed. In order to ensure the legally required documentation obligation or legal deletion period from Section 11 para. 1, para. 5 HinSchG (the German Whistleblower Protection Act), this report is then initially archived (without personal reference), but not yet deleted. Archived cases are used exclusively to fulfill documentation obligations and can therefore no longer be called up by the system for processing.

Reports and personal data that genua collects in the course of processing a report that forms the basis for further processing will be anonymized as soon as possible. However, should the need arise for follow-up measures within the meaning of Section 3 (8), 18 HinSchG, it is possible that the anonymization must be deviated from, for example, due to an official order or to secure legal claims. In this case, pseudonymization is generally aimed for and implemented, unless otherwise specified (e.g., by a court order). Once the processing of the information is complete, either anonymization or pseudonymization is performed and the reports are archived and deleted two years after the case is closed, i.e., on the date genua made a decision in the case, unless special circumstances or legal as well as regulatory requirements require a shorter or longer period.

genua organizes webinars, during which the name and, if applicable, the profile picture and chat of the participants are transmitted to all other participants. genua works with the service provider Microsoft Corporation in this regard. genua has concluded a data processing agreement with Microsoft in accordance with Art. 28 GDPR.

To participate in a webinar, you can register on the webinar website (specific URL that provides information about the webinar, such as date, time, and content). When registering, the following information will be requested:

• First name
• Last name
• Email address
• Consent to Microsoft's terms and conditions

Additional information, such as address, industry, and position, may also be required for registration and will be requested on a case-by-case basis.

a) Processing of Data in the Context of Webinars

To participate in webinars, we need to process various types of data. The following personal data are therefore subject to processing for the purpose of conducting the webinar:

• User information: e.g., display name, online status (optional), profile picture (optional), email address
• Meeting metadata: e.g., date, time, duration, meeting ID, participation status, and location

The camera and microphone functions are generally deactivated by genua. Exceptions are possible, but in such cases, the participant is responsible for using these functions and making the data available.

A recording of the webinar will generally be made.

During the webinar, you have the option to use the chat function. In this case, the text inputs, links, or content shared, as well as social interactions (such as emojis, pictograms, like buttons for comments, or sending GIFs), will be processed to display them to the participants. These keyboard inputs (hereinafter referred to as "chats") will be stored to send valuable information, such as URLs to helpful documents, to all participants by email after the event. The chat logs will be deleted after sending the information.

b) Legal Basis for Data Processing

As a participant in our webinar, we process your data based on your consent to participate in the webinar in accordance with Art. 6 Para. 1 S. 1 lit. a) GDPR. Additionally, Art. 6 Para. 1 S. 1 lit. f) GDPR serves as the legal basis for data processing during the webinar with regard to meeting metadata.

You can revoke your consent at any time without giving reasons by canceling your participation. Please note that the recording cannot be adjusted retrospectively.

c) Storage of Data

A recording of the webinar will generally be made. genua will transparently communicate this in advance and obtain the consent of all participants if necessary.

The recordings will be made available to all participants for 60 days via a link.

No automated decision-making within the meaning of Art. 22 GDPR is used.

d) Recipients of Data

Personal data processed in connection with participation in webinars will generally only be transmitted to our processor, Microsoft, i.e., the service provider that supports us in conducting the webinars.

Data will only be transmitted to third parties if genua is legally obligated to do so (e.g., by court order) or if the data subjects have explicitly consented to the transmission of their data.

Within genua, only the organizers and co-organizers have the authorization to view the list of participants.

During the webinar, other participants have access to the following data of the other participants:

• Display name (usually first and last name)
• Chat inputs (optional, if the participant enters something)
• Profile picture (optional, if the participant has set a profile picture)

The recording contains your display name and, if applicable, your profile picture. Chat contributions are not recorded. You can also deactivate your camera and microphone, if activated by genua, before the start of the recording in the registration window. The recording can be published on the genua partner portal, genua online campus, the genua website, or the genua YouTube channel. The storage duration is based on the topicality of the topic.

e) Data Processing outside the European Union

To the extent possible, genua has restricted storage locations to data centers in Germany or within the European Union. Therefore, data processing generally does not take place outside the European Union (EU).

Since we use the Microsoft Teams video conferencing software, please note the following information:

• When accessing the Microsoft Teams website, Microsoft is responsible for data processing. Accessing this website (https://teams.microsoft.com/) is only required for downloading the necessary software if use is not possible directly and without downloading via an internet browser.
   
• Microsoft provides an extensive video tutorial at the following link: https://cloudblogs.microsoft.com/industry-blog/de-de/uncategorized/2020/05/14/microsoft-teams-video-tutorials-nutzliche-tipps-und-tricks/ 
   
• We recommend that you familiarize yourself with the software before an upcoming webinar to minimize technical delays during the sessions.
   
• Microsoft Teams is a service provided by Microsoft Corporation:
  Microsoft Corporation
  One Microsoft Way
  Redmond, WA 98052-6399
  USA
  (https://teams.microsoft.com/)

You can find more information on the use of Microsoft Teams at https://www.genua.de/fileadmin/rechtliches/Datenschutz_InformatonspflichtStandFebruar2023_EN.pdf