DATA PROTECTION

Thank you for visiting our website. Data protection is a high priority for us and we want you to feel safe while visiting our website. You can therefore visit our website without providing your personal data. However, as soon as you make use of individual functions, services or offers on our website, personal data may be processed. We only collect, process and use personal data if you have consented to the collection, processing and use or if there is a corresponding legal basis. We reserve the right to change the data protection declaration at any time with effect for the future. The current version of the data protection declaration can be accessed, saved and printed out at any time on our website. Below, we inform you in detail about the type, scope and purpose of the personal data we collect, use and process and inform you about your rights as a data subject.

1. Name and address of the person responsible

The responsible person within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws of the member states as well as other data protection regulations is:

Jobversal GbR,

Im Mediapark,

50670, Köln/Germany

datenschutz@jobversal.de

2. Name and address of the data protection officer The data protection officer of the data controller is:

Kurtul Demir

Im Mediapark,

50670, Köln/Germany

datenschutz@jobversal.de

3. Access data in server log files

Each time our website is accessed, we automatically store access data in so-called server log files. This includes the date and time of the access, the amount of data transferred and, if applicable, the name of the requested file, the browser used and its version, the operating system used, the IP address, the requested URL including subpages, the referrer URL (URL that you visited immediately before) and the requesting provider. The temporary storage of the IP address by the system is necessary to enable delivery of the website to your end device. For this purpose, your IP address must remain stored for the duration of the session. The legal basis for the temporary storage of your data and the log files is Sect. 6 para. 1 cl. f GDPR. This data is evaluated exclusively to ensure the permanent and trouble-free operation of the website and to improve the content of our website, as well as for transmission to law enforcement authorities in the event of a cyber attack and to ensure the security of our information technology systems. These purposes are also our legitimate interest in data processing according to Sect. 6 Para. 1 cl. f GDPR. An evaluation of your data for marketing purposes does not take place in this context. The data of the server log files are stored separately from all other personal data provided by you. The collection of data for the provision of the website and the storage of the data in log files is absolutely necessary for the operation of our website. Consequently, there is no possibility to object.

4. Use of cookies

In order to make visiting our website more attractive and to enable the use of certain functions, we use so-called "cookies" on our website. These are small text files that are stored on your end device via a browser. Many cookies contain a so-called cookie ID. After the end of the browser session, most of the cookies we use are deleted again ("session cookies"). The permanent cookies ("persistent cookies"), on the other hand, remain on your end device. The following data is stored and transmitted in the cookies: Language settings, log-in information, search terms entered, frequency of page views, use of website functions. Your data collected on our website is pseudonymised by technical precautions. Therefore, it is no longer possible to assign the data to you. The data is not stored together with other personal data. The legal basis for the processing of personal data using cookies is Sect. 6 (1) cl. f GDPR. The purpose of using technically necessary cookies is to simplify the use of our websites for you (e.g. your login is stored). Some functions of our website cannot be offered without the use of cookies. For these, it is necessary that your browser is recognised even after a page change. If cookies are not accepted or deactivated, the functionality of our website may be limited. Analysis cookies are used to improve the quality of our website and its content. Through the analysis cookies, we learn how the website is used by you and can thus continuously optimise our offer. These purposes are also our legitimate interest in processing the personal data according to Sect. 6 (1) cl. f GDPR. Some third-party services integrated by us may use cookies. Please refer to the websites of the respective providers for information on the respective mode of operation and data processing. The services we use can be found in this data protection declaration. Cookies are stored on your terminal device and transmitted to our website. You therefore have control over the use of cookies. You can set your browser in such a way that you are informed about the setting of cookies and decide individually about their acceptance or exclude the acceptance of cookies for certain cases or generally or set it in such a way that the setting of cookies is prevented and thus permanently object to the setting of cookies. In addition, you can delete cookies that have already been set at any time via your browser. The transmission of Flash cookies cannot be prevented via the settings of your browser, but by changing the settings of the Flash Player. This also applies to all third-party cookies listed below.

5. Data collection and use during registration

You have the option of registering on our website and creating an application. In this case, we collect the personal data that you voluntarily provide to us as part of your registration and the creation of the application, which data is collected can be seen from the respective input forms. The legal basis for the processing of your data is accordingly Sect. 6 para. 1 cl. b GDPR. We use the data you provide only for the purpose of processing the contract and providing our services to be rendered under the contract. We may also pass on your data to one or more order processors (e.g. payment service providers), who will also use your data exclusively for internal use on our behalf. We also store your IP address and the date and time of registration in order to prevent misuse of our website and the services offered on it and to clarify any criminal offences that may have been committed. The storage of this data is therefore necessary for our own protection. The legal basis for the processing of personal data is Sect. 6 para. 1 cl. f GDPR. The aforementioned purposes are also our legitimate interest in data processing according to Sect. 6 para. 1 cl. f GDPR. As a matter of principle, this data is not passed on to third parties unless there is a legal obligation to pass it on or the passing on serves law enforcement purposes. After complete processing of the contract or deletion of your account, your data will initially be blocked for further use and deleted after expiry of the statutory retention periods, unless you have expressly consented to further use of your data or we reserve the right to use data beyond this, which is permitted by law and about which we inform you below.

6. Data collection and use when using our application tool

If you use our tool, you are the controller in relation to the respective applicant within the meaning of Article 4(7) of the GDPR and must, among other things, fulfil your information obligations under Articles 13 and 14 of the GDPR on your own responsibility. In this case, we are the processor.

7. Web analysis with Matomo (Piwik)

We use the open source software tool Matomo (https://matomo.org/) from the company InnoCraft Ltd, 150 Willis St, 6011 Wellington, New Zealand, ("Mataomo") on our website. Data is collected and stored on the basis of our legitimate interest in the statistical analysis of user behaviour for optimisation and marketing purposes in accordance with Sect. 6 para. 1 cl. f GDPR. Pseudonymised user profiles can be created and evaluated from this data for the same purpose. Cookies can be used for this purpose. Cookies are small text files that are stored locally in the cache of the site visitor's internet browser. Among other things, the cookies enable the recognition of the internet browser. The data collected with Matomo technology (including your pseudonymised IP address) is processed on our server. If individual pages of our website are called up, the following data is stored:

• Two bytes of the IP address of the user's calling system.
• The web page accessed.
• The website from which the user accessed the website (so-called referrer).
• The subpages that are accessed from the accessed website.
• The time spent on the website.
• The frequency with which the website is accessed. The software runs exclusively on the server of our website. Personal data of the users is only stored there. The data is not passed on to third parties.

8. Integration of Youtube

This website uses the Youtube embedding function to display and play videos from the provider "Youtube", which belongs to Google LLC., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google"). Google LLC, based in the USA, is certified for the USEuropean data protection agreement "Privacy Shield", which ensures compliance with the level of data protection applicable in the EU. The legal basis is Sect. 6 para. 1 cl. f GDPR (legitimate interest). We use the extended data protection mode, which, according to the provider, only triggers the storage of user information when the video(s) is/are played. If the playback of embedded Youtube videos is started, the provider "Youtube" uses cookies to collect information about user behaviour. According to information from "Youtube", these are used, among other things, to collect video statistics, to improve user-friendliness and to prevent abusive behaviour. If you are logged in to Google, your data will be directly assigned to your account when you click on a video. You can find more information here: https://www.google.com/policies/privacy We use YouTube to make our service more userfriendly. This is also our legitimate interest, which outweighs the rights and freedoms of the user. If you do not wish to be associated with your YouTube profile, you must log out before activating the button. You have the right to object to the creation of these user profiles, whereby you must contact YouTube to exercise this right. You can also use the following optout: https://adssettings.google.com/authenticated.

9. Integration of Google reCaptcha

To protect your orders via internet forms, we use the reCAPTCHA service of the company Google Inc (Google). Google LLC, based in the USA, is certified for the us-European data protection agreement "Privacy Shield", which guarantees compliance with the level of data protection applicable in the EU. The query serves to distinguish whether the input is made by a human being or improperly by automated, machine processing. The query includes the sending of the IP address and, if applicable, further data required by Google for the reCAPTCHA service to Google. For this purpose, your input is transmitted to Google and further used there. By using reCaptcha, you agree that the recognition you provide may be used for the digitisation of old works. However, in the event that IP anonymisation is activated on this website, your IP address will be truncated beforehand by Google within member states of the European Union or in other contracting states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. On behalf of the operator of this website, Google will use this information to evaluate your use of this service. The IP address transmitted by your browser as part of reCaptcha will not be merged with other Google data. The deviating data protection regulations of the Google company apply to this data. Further information on Google's data protection guidelines can be found at: https://www.google.com/intl/de/policies/privacy. The legal basis is Sect. 6 para. 1 cl. f GDPR. We use Google's service to distinguish whether an entry is made by a natural person or is misused by machine and automated processing. This is also our legitimate interest, which outweighs your interests as a user. Further information on Google reCAPTCHA and Google's privacy policy can be found at: https://www.google.com/intl/de/policies/privacy.

10. Integration of third party content

We sometimes include third-party content on our website, such as maps from Google Maps and Apple Maps, RSS feeds or graphics from other websites/providers. To display this content, the transmission of your IP address to the third-party provider is necessary. When you call up our website, a direct connection is therefore established via your browser with the servers of the respective third-party provider. Your browser is automatically prompted by the respective content embedded on our website to download a representation of the corresponding component of the third-party provider. As part of this technical process, the third-party provider receives information about which specific sub-page of our website you are visiting. Unfortunately, we have no influence on whether the third-party provider collects or stores the IP address for other purposes beyond the mere display of the content. If we become aware of such use, we will inform you about it in this privacy policy.

11. Email and contact form

Due to legal regulations, we provide information on our website that enables a quick electronic contact to us as well as direct communication with us. This includes our email address as well as our contact form. If you contact us by email or via our contact form, the personal data you provide will be automatically stored. The other personal data processed during contact serve to prevent misuse of the contact form and to ensure the security of our information technology systems. The legal basis for the processing of data transmitted in the course of sending an e-mail is Sect. 6 (1) cl. f GDPR. If the purpose of contacting you is to conclude a contract, the additional legal basis for processing is Sect. 6 (1) cl. b GDPR. We use the personal data you provide exclusively for processing your specific enquiry. The data provided will always be treated confidentially. The data will be deleted as soon as they are no longer required to achieve the purpose for which they were collected. For the personal data from the input mask of the contact form and those sent by e-mail, this is the case when the respective conversation with you has ended. The conversation is ended when the circumstances indicate that the matter in question has been conclusively clarified. You have the option to revoke your consent to the processing of your personal data at any time. If you contact us, you can object to the storage of your personal data at any time. In such a case, the conversation cannot be continued.

12. Payment service provider

Stripe We offer the option of processing the payment transaction via the payment service provider Stripe, Legal Process, 510,Townsend St., San Francisco, CA 94103 (Stripe). This is in line with our legitimate interest in offering an efficient and secure payment method (Sect. 6 para. 1 cl. f GDPR). In this context, we share the following data with Stripe to the extent necessary for the performance of the contract (Sect. 6 para. 1 lit b. GDPR).

• Name of the cardholder
• E-mail address
• Customer number
• Order number
• Bank details
• Credit card details
• Period of validity of credit card
• Credit card verification number (CVC)
• Date and time of transaction
• Transaction amount
• Name of the provider
• Place

The processing of the data provided under this section is not required by law or contract. We cannot process a payment via Stripe without you submitting your personal data.

Stripe has a dual role as controller and processor in data processing activities. As a controller, Stripe uses your submitted data to comply with regulatory obligations. This corresponds to Stripe's legitimate interest (pursuant to Sect. 6 para. 1 cl. f GDPR) and serves the performance of the contract (pursuant to Sect. 6 para. 1 cl. b GDPR). We have no influence on this process.

Stripe acts as a processor in order to be able to complete transactions within the payment networks. Within the scope of the order processing relationship, Stripe acts exclusively according to our instructions and has been contractually obligated within the meaning of Sect. 28 GDPR to comply with the provisions of data protection law.

Stripe has implemented compliance measures for international data transfers. These apply to all global activities where Stripe processes personal data of individuals in the EU. These measures are based on the EU Standard Contractual Clauses (SCCs).

For more information on opting out and opting in from Stripe, please visit: https://stripe.com/privacy-center/legal.

Your data will be stored by us until payment processing is complete. This includes the period required for processing refunds, claims management and fraud prevention.

13. Data security

We secure our website and other systems through numerous technical and organisational measures against loss, destruction, access, modification or distribution of your data by unauthorised persons. However, despite regular checks, complete protection against all risks is not possible and cannot be guaranteed by us.

14. Legal basis of the processing of personal data

Insofar as we obtain your consent for processing operations of personal data, Sect. 6 (1) cl. a GDPR serves as the legal basis for the processing of personal data. When processing personal data that is necessary for the performance of a contract to which you are a party, Sect. 6 (1) (b) GDPR serves as the legal basis. This also applies to processing operations that are necessary for the performance of pre-contractual measures. Insofar as processing of personal data is necessary for compliance with a legal obligation to which our company is subject, Sect. 6 (1) c GDPR serves as the legal basis. In the event that your vital interests or the vital interests of another natural person make processing of personal data necessary, Sect. 6 (1) cl. d GDPR serves as the legal basis. If the processing is necessary to protect a legitimate interest of our company or a third party and your interests, fundamental rights and freedoms do not outweigh the first-mentioned interest, Sect. 6 (1) f GDPR serves as the legal basis for the processing.

15. Legitimate interests in the processing

If the processing of your personal data is based on Article 6 I cl. f GDPR, our legitimate interest, unless otherwise stated, is the performance of our business activities. Otherwise, we have indicated our purposes and interests in each case in the context of the above list of processing.

16. Data deletion and storage period

Your personal data will be deleted or blocked as soon as the purpose of the storage no longer applies or you revoke your consent. In addition, storage may take place if this has been provided for by the European or national legislator in Union regulations, laws or other provisions to which the person responsible is subject. If the purpose of storage no longer applies, if you revoke your consent or if a storage period prescribed by the European Directive and Regulation Maker or another competent legislator expires, the personal data will be routinely blocked or deleted in accordance with the statutory provisions, unless there is a necessity for the further storage of the data for the conclusion or fulfilment of a contract.

17 Right to information

You also have the right to receive from us at any time, free of charge, information about the personal data stored about you and a copy of this information. You also have a right of access to the following information:

• The purposes of processing,
• The categories of personal data that are processed,
• The recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular in the case of recipients in third parties or international organisations,
• If possible, the planned duration for which the personal data will be stored or, if this is not possible, the criteria for determining this duration,
• The existence of a right to obtain the rectification or erasure of personal data concerning them or to obtain the restriction of processing by the controller or a right to object to such processing,
• The existence of a right of appeal to a supervisory authority,
• If the personal data are not collected from the data subject: any available information on the origin of the data; and,
• The existence of automated decision-making, including profiling, pursuant to Article 22(1) and (4) of the GDPR and, at least in these cases, meaningful information about the logic involved and the scope and intended effects of such processing for the data subject.

You also have the right to know whether personal data has been transferred to a third country or to an international organisation. If this is the case, you also have the right to obtain information about the appropriate safeguards in connection with the transfer.

18 Right of rectification

You have the right to request the immediate correction and/or completion of any inaccurate or incomplete personal data concerning you. We shall carry out the correction without delay.

19. Right to restriction of processing

You have the right to request us to restrict processing if one of the following conditions is met:

• The accuracy of the personal data is contested by the data subject for a period enabling the controller to verify the accuracy of the personal data.
• The processing is unlawful, the data subject objects to the erasure of the personal data and requests instead the restriction of the use of the personal data.
• The controller no longer needs the personal data for the purposes of processing, but the data subject needs it for the establishment, exercise or defence of legal claims.
• The data subject has objected to the processing pursuant to Article 21(1) of the GDPR and it is not yet clear whether the legitimate grounds of the controller override those of the data subject.

Where the processing of personal data relating to you has been restricted, such data may be processed, with the exception of storage, only with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of substantial public interest of the Union or a Member State. If the restriction of processing has been restricted in accordance with the above conditions, you will be informed by us before the restriction is lifted.

20. Right to erasure

You have the right to request that we delete the personal data concerning you without delay, provided that one of the following reasons applies and insofar as the processing is not necessary:

• The personal data were collected or otherwise processed for purposes for which they are no longer necessary.
• The data subject revokes the consent on which the processing was based pursuant to Article 6(1)(a) of the GDPR or Article 9(2)(a) of the GDPR and there is no other legal basis for the processing.
• The data subject objects to the processing pursuant to Article 21(1) of the GDPR and there are no overriding legitimate grounds for the processing or the data subject objects to the processing pursuant to Article 21(2) of the GDPR.
• The personal data have been processed unlawfully.
• The deletion of the personal data is necessary for compliance with a legal obligation under Union or Member State law to which the controller is subject.
• The personal data was collected in relation to information society services offered pursuant to Sect. 8(1) GDPR.

If the personal data have been made public by us and we as a controller are obliged to erase the personal data pursuant to Article 17(1) of the GDPR, we shall, taking into account the available technology and the cost of implementation, implement reasonable measures, including those of a technical nature, to inform other data controllers which process the published personal data, that the data subject has requested from those other data controllers the erasure of all links to such personal data, or to copies or replications of such personal data, unless the processing is necessary. The right to erasure does not exist insofar as the processing is necessary:

• To exercise the right to freedom of expression and information,
• For compliance with a legal obligation which requires processing under Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller,
• For reasons of public interest in the area of public health pursuant to Sect. 9 (2) (h) and (i) and Sect. 9 (3) GDPR,
• For archiving purposes in the public interest, scientific or historical research purposes or statistical purposes pursuant to Article 89(1) of the GDPR, where the right referred to in Section a) is likely to render impossible or seriously prejudice the achievement of the purposes of such processing, or
• For the assertion, exercise or defence of legal claims.

21 Right to information

If you have asserted the right to rectification, erasure or restriction of processing against us, we are obliged to notify all recipients to whom the personal data relating to you has been disclosed of this rectification or erasure of the data or restriction of processing, unless this proves impossible or involves a disproportionate effort. You have the right to be informed about these recipients.

22. Right to data portability

You have the right to receive the personal data concerning you that you have provided to us in a structured, common and machine-readable format. You also have the right to transfer this data to another controller without hindrance from us, provided that the processing is based on consent pursuant to Sect. 6(1)(a) GDPR or Sect. 9(2)(a) GDPR or on a contract pursuant to Sect. 6(1)(b) GDPR and the processing is carried out with the aid of automated procedures, unless the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us. Furthermore, when exercising your right to data portability pursuant to Article 20(1) of the GDPR, you have the right to have the personal data transferred directly from us to another controller, insofar as this is technically feasible and insofar as this does not adversely affect the rights and freedoms of other persons. The right to data portability does not apply to processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

23. Right to object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Article 6(1)(e) or (f) GDPR. This also applies to profiling based on these provisions. We shall no longer process the personal data in the event of the objection, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims. If we process your personal data for the purpose of direct marketing, you have the right to object at any time to the processing of your personal data for the purpose of such marketing. This also applies to profiling insofar as it is associated with such direct advertising. If you object to us processing your personal data for direct marketing purposes, we will no longer process it for these purposes. You also have the right to object, on grounds relating to your particular situation, to processing of your personal data which is carried out by us for scientific or historical research purposes or for statistical purposes pursuant to Article 89(1) GDPR, unless such processing is necessary for the performance of a task carried out in the public interest. You may contact us at any time to exercise your right to object. You are also free to exercise your right to object in connection with the use of information society services, notwithstanding Directive 2002/58/EC, by means of automated procedures using technical specifications.

24. Right to revoke consent under data protection law

You have the right to revoke your consent to the processing of personal data at any time. The revocation of consent does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation.

25. Right to automated decisions in individual cases, including profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, unless the decision is necessary for the conclusion or performance of a contract between you and us or is authorised by Union or Member State law to which we are subject and that law contains adequate measures to safeguard your rights and freedoms and legitimate interests, or is based on your explicit consent.

If the decision is necessary for the conclusion or performance of a contract between you and us, or if it is made with your express consent, we will take reasonable steps to safeguard your rights and freedoms and your legitimate interests, including at least the right to have a person's views heard by us and to challenge the decision.

26. Existence of automated decision making

We do not carry out any automatic decision-making or profiling.

27. Right to complain to a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your residence, place of work or the place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR. The supervisory authority to which the complaint has been lodged shall inform the complainant of the status and outcome of the complaint, including the possibility of a judicial remedy under Article 78 GDPR.

Status: October 2022