DATA PROTECTION

The protection of your privacy and the security of all business data when processing personal data are important to us, and we prioritise these factors in our processes. Here you can find out all you need to know about how we handle your data.

Controller as defined by Article 4 (7) of the EU General Data Protection Regulation (GDPR)

HINTE Expo & Conference GmbH, Bannwaldallee 60, 76185 Karlsruhe, Germany, tel.: +49 72193133-0, e‑mail: info@hinte-messe.de

Data protection officer for the Controller

You can contact the data protection officer by sending an e-mail to: datenschutz@hinte-messe.de

1. Rights of the data subject (Art. 15 GDPR)

Below, we explain the rights you have as a data subject. You can exercise these rights at any time and contact us directly to do so. If you do contact us to claim these rights, we will inspect them in detail, taking into account the relevant statutory requirements and conditions. We may ask you to provide further information for this purpose. We will provide you with a detailed explanation of the results of our inspection and how we will proceed to carry out your request. It is possible that we may not be able to fully meet your wishes in the way you would like. This should not discourage you from contacting us to claim your rights or inquire about them. We are happy to answer any queries about data protection you may have.

a) Right of access by the data subject (Art. 15 GDPR)

You are entitled to obtain information from us at any time about whether we are processing your personal data and, if so, which data. This also covers information pertaining to the purposes of the processing, any recipients to whom we have disclosed your data, the envisaged duration of storage, and any information about the origin of this data if we have not collected it from you directly. In addition to this, you are entitled to one free copy of the personal data relating to you that we store.

b) Right to rectification (Art. 16 GDPR)

You are entitled to request that we rectify inaccurate personal data that we have stored about you. This also includes the right to have incomplete personal data completed.

c) Right to erasure (Art. 17 GDPR)

You are entitled to request that we erase personal data that we have stored about you. In the context of the “right to be forgotten” as per Article 17 (2) of the GDPR, if we have made your data public, we are likewise obligated, taking into account available technology and the costs of implementation, to forward your request to erase all links to such data as well as copies and/or replications of such data to other controllers responsible for processing such public personal data.

d) Right to restriction of processing (Art. 18 GDPR)

You are entitled to request that we restrict the processing of personal data that we have stored about you. Thereafter, processing such data is only possible with your consent or for limited purposes defined by statute.

e) Right to object to processing (Art. 21 GDPR)

Provided we have based the processing of your personal data on a balance of interests, you are entitled to file an objection to the processing. This is particularly the case if the processing is not necessary to perform a contract with you, which we will always illustrate in the subsequent description of the functions. Should you exercise this right to object, please state the reasons why we should not process your personal data in the way we have been doing so. If your objection is valid, we will review the situation and either terminate/adjust the data processing or demonstrate to you the compelling legitimate reasons why we will continue with the processing. You can, of course, object to your personal data being processed for advertising and data analysis purposes at any time. You can notify us about your objection to advertising by using the contact details given above.

f) Right to withdraw consent as per data protection law (Art. 7 GDPR)

If you have consented to the processing of your data, you can withdraw your consent at any time as per Article 7 (3) of the GDPR. Informing us of your withdrawal of such consent will affect the subsequent admissibility of the processing of your personal data.

g) Right to data portability (Art. 20 GDPR)

You are entitled to receive your personal data that you provided to us from us in a structured, commonly used and machine-readable format for the purpose of transmitting such data to another controller. This also includes, at your request and taking into account the technical possibilities available, the direct transmission from us to the other controller.

h) Right to lodge a complaint with a supervisory authority (Art. 13 GDPR)

You are entitled to lodge a complaint about how we process your personal data with the data protection supervisory authority at any time. The contact details for the responsible supervisory authority are as follows: The State Representative for Data Protection and Freedom of Information in Baden-Wuerttemberg (Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (BfDI)), Königstrasse 10a, 70173 Stuttgart, Germany.

i) Automated decision-making, including profiling (Art. 22 GDPR) You are entitled to receive information about the existence of automated decision-making, including profiling, as per Article 22 (1) and (4) of the GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

2. Legal grounds for the processing of personal data (Art. 6 GDPR)

(1) Insofar as we obtain the data subject’s consent to processing operations involving their personal data, Article 6 (1) (a) of the GDPR shall constitute the legal grounds for this. (2) Article 6 (1) (b) of the GDPR shall constitute the legal grounds for personal data processing that is necessary for the performance of a contract to which the data subject is party. This shall also apply to processing operations that are necessary to take steps prior to entering into a contract. (3) Article 6 (1) (c) of the GDPR shall constitute the legal grounds where processing personal data is necessary to comply with a legal obligation to which our company is subject. (4) Article 6 (1) (d) of the GDPR shall constitute the legal grounds where vital interests of the data subject or of another natural person make processing personal data necessary. (5) Article 6 (1) (f) of the GDPR shall constitute the legal grounds for the processing if the processing is necessary for the purpose of a legitimate interest pursued by our company or by a third party and such interest is not overridden by the interests or fundamental rights and freedoms of the data subject.

3. Information about the collection of personal data

(1) In this section, we provide information about how and what personal data is collected when you use our website. Personal data refers to all information that allows you to be personally identified, e.g. name, address, e-mail addresses, user behaviour. (2) If you contact us by e-mail or via a contact form, we will store the data you submit (your e-mail address and, where applicable, your name and telephone number) in order to answer your questions. We will delete the data that accrues in this context once storing it is no longer necessary or restrict the processing if there is a statutory obligation to retain the data. (3) If we call on appointed service providers for individual functions of our offering or would like to use your data for advertising purposes, we will provide you with detailed information about the respective procedures below. We will also outline the stipulated criteria for the duration of storage. Collection of personal data during visits to our website: If you use our website simply for information, i.e. if you do not register for an account or otherwise transfer information to us, we will only collect the personal data that your browser transfers to our server. If you would like to look at our website, we collect the following types of data, which are necessary for technical reasons to show you our website and ensure stability and security (Article 6 (1) (f) of the GDPR constitutes the legal grounds for this): • IP address • Host name • Date and time of request • Time zone difference to Greenwich Mean Time (GMT) • Content of request (specific page) • Access status / HTTP status code • Volume of data transmitted each time • Website requesting access (referrer) • Which specific pages on our website you access • Browser – type, version and language settings • Operating system – type and version • If JavaScript is activated, also: ▪ Screen resolution ▪ Colour depth ▪ Size of the browser window ▪ Installed browser plug-ins

4. Deleting data and duration of storage

(1) The data subject’s personal data is deleted or blocked as soon as the purpose for storing it is no longer relevant. (2) Data may continue to be stored if this is stipulated by European or national legislators in EU regulations, statutes or other provisions that the Controller is obliged to adhere to. (3) The data is also blocked or deleted if a storage period stipulated by the above-listed EU regulations, statutes or other provisions that the Controller is obliged to adhere to expires, unless there is a necessity to continue storing the data for the purposes of concluding or performing a contract.

5. Use of cookies

Cookies are small files stored on your hard drive and assigned to the browser you are using; these files channel certain information to the site that places the cookie. Cookies are not able to run any programs or transmit viruses to your computer. They serve to make the internet offering as a whole more user-friendly and effective.

Strictly necessary cookies

These cookies are essential for the website to function correctly, so you cannot refuse them.

WSESSIONID

Duration of storage: Session

Strictly necessary standard cookie for use with PHP session data.

hideCookieNotice

Duration of storage: Up to 30 days, depending on selection

Saves information so the cookie and/or privacy notice is not shown again each time the website is accessed.

allowLoadExternRessources

Duration of storage: Up to 30 days, depending on selection

Remembers the user’s decision about whether external components may be loaded automatically.

allowTracking

Duration of storage: Up to 30 days, depending on selection

Remembers the user’s decision about whether their visitor behaviour may be tracked.

Marketing/tracking cookies

These cookies are used for marketing purposes and analyse your visitor behaviour.

_ga

Duration of storage: 2 years

Stores a randomly generated user ID.

_gat

Duration of storage: 1 minute

Used to monitor the number of server requests.

_gid

Duration of storage: 24 hours

Stores a randomly generated user ID.

6. Other functions and services offered on our company’s website

(1) Besides using our website for purely informational purposes, you have the option of using various services that we offer. To do so, you usually need to supply further personal data, which we use to provide the service in question, and to which the aforementioned principles regarding data processing apply. Mandatory fields are labelled with an asterisk. Fields without this marking are entirely optional. (2) When you contact your service provider by e-mail, we will store your e-mail address for the purpose of answering your questions; if you provide your name, telephone number and […], we will also store these for the same purpose. (3) In some instances, we employ external service providers to process your data. We select and appoint these providers with care; they are bound by our instructions and monitored on a regular basis. (4) If our service providers or partners are based in a state outside of the European Economic Area (EEA), we will inform you about the consequences of this fact in the offering description.

a) Inxmail newsletter (1) For the dispatch of our newsletter, we use the “Inxmail” service offered by Inxmail GmbH, Wentzingerstr. 17, 79106 Freiburg, Germany. Data saved during registration is transferred to Inxmail GmbH and stored by Inxmail GmbH. Data entered during registration is not transferred to any other third parties. (2) The only piece of mandatory information for sending the newsletter is your e-mail address. Any other, separately marked information is optional and used in order to address you personally. (3) For the subscription to our newsletter, we follow the double opt-in process. This means that once you have subscribed, Inxmail will send you an e-mail to the e-mail address provided, in which we will ask you to confirm that you would like us to send you the newsletter. Inxmail will store your IP address, the date and time you clicked on the confirmation link, and the recipient’s e-mail address in a log file as proof of valid consent. (4) We would like to point out that Inxmail uses “newsletter tracking” in its newsletters. This involves recording recipients’ reactions (opening a mailshot, clicking text/image links, downloading images with an e-mail program) and storing them in an anonymised format for statistical purposes. It is not possible to use the stored data to identify individual users. If you have previously given your express consent, the aforementioned recipient reactions will be recorded and stored as information specific to you as an individual. This enables Inxmail to align the newsletter content more effectively to the user’s personal interests. (5) You can withdraw your consent to the newsletter being sent and cancel your subscription at any time. You can declare the withdrawal of your consent by clicking the unsubscribe link provided in every newsletter e-mail. This will equally negate any existing consent to the recording of data regarding personal user behaviour in relation to the newsletter. (6) Processing is based on your consent as per Article 6 (1) (a) of the GDPR.

7. Web analysis and third-party supplier services

The legal grounds for the use of locally deployed web analysis tools are formed by Article 6 (1) (f) of the GDPR, i.e. pursuing our legitimate interests while giving consideration to the interests of our website visitors. Our interest in this context is analysing how our website visitors use our website in order to improve our offering based on the statistics gained from this and make it more interesting for you as a user. If the analysis tool used serves any other additional purposes or if we use it for other interests, we will inform you of this directly in the explanations of the respective analysis tool. Article 6 (1) (a) of the GDPR constitutes the legal grounds for using third-party suppliers to conduct web analysis.

a) Google Maps (1) We use Google Maps services on this website; we display interactive maps directly on our website and enable you to use the maps function with ease. Article 6 (1) (a) of the GDPR constitutes the legal grounds for using the plug-in. Google Maps offers you the option of completing and verifying your address details automatically if these details are required during the order or payment process. For example, Google Maps transmits this data to our payment partner VR PAY. You give your consent by making the appropriate selection in the cookie banner. (2) If you visit the website, Google receives information that you have accessed the relevant subpage on our website. This occurs irrespective of whether Google provides a user account that you are logged into or whether there is no user account. If you are logged into Google, your data is assigned to your account directly. If you do not want your data to be assigned to your Google profile, you need to log out before activating the button. Google stores your data as usage profiles, which it uses for the purposes of advertising, market research and/or customising its website to specific needs. Analysis of this kind is particularly carried out (even for users who are not logged in) for the purposes of showing you targeted adverts and informing other users of the social network about your activities on our website. You have a right to object to these user profiles being created; you must get in touch with Google to exercise this right. (3) You can find further information regarding the purpose and scope of the data collected and its processing performed by the plug-in provider in the provider’s privacy policies. These policies also contain further information about the relevant rights and settings for protecting your privacy: Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland; https://policies.google.com/privacy?hl=en-UK.

b) Google Analytics (1) This website uses Google Analytics, a web analysis service of Google Inc. (“Google”). Google Analytics uses cookies – text files that are stored on your computer and enable your use of the website to be analysed. Information generated by the use of cookies about your usage of this website is generally transmitted to and stored on a Google server in the United States. If, however, the Anonymise IP option has been activated on this website, Google will remove the end of your IP address so it only locates you as within the member states of the European Union or in other states that are party to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be sent to a Google server in the United States and shortened there. Google will use this information on behalf of the website operator to evaluate the way you use this website, to compile reports about activity on the website, and to provide the website operator with additional services associated with usage of the website and of the internet. (2) The IP address transferred by your browser through Google Analytics will not be combined with any other Google data. (3) You can prevent these cookies being stored by deselecting the “Analytics & Performance” category in the cookie banner. Please note, however, that if you choose to deactivate these cookies, you may not be able to use all the functions of this website. You can also prohibit Google from recording and processing the data generated by the cookie about your use of the website (including your IP address) by downloading and installing the browser plug-in available via the following link: https://tools.google.com/dlpage/gaoptout?hl=en-GB (4) This website uses Google Analytics with the “_anonymizeIp()” extension. As a result, IP addresses are processed in a shortened form, ruling out direct associations to individuals. If the data collected about you gains a personal reference, this reference will therefore be eliminated immediately, thereby deleting the personal data right away. (5) For data processing in association with Google Analytics by Google, our company has agreed data processing with the service provider on the basis of the EU Standard Contractual Clauses. (6) Information about the third-party supplier: Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, fax: +353 (1) 436 1001, terms of service https://marketingplatform.google.com/about/analytics/terms/gb/, data protection overview: https://marketingplatform.google.com/about, privacy policy: https://policies.google.com/privacy?hl=en.

c) YouTube (1) We have integrated YouTube videos into our online offering that are stored on http://www.YouTube.com and can be played directly on our website. (2) Your consent in accordance with Article 6 (1) (a) of the GDPR constitutes the legal grounds for use of the plug-in. (3) If you visit the website, YouTube receives information that you have accessed the relevant subpage on our website. This occurs irrespective of whether YouTube provides a user account that you are logged into or whether there is no user account. If you are logged into Google, your data is assigned to your account directly. If you do not want your data to be assigned to your YouTube profile, you need to log out before activating the button. YouTube stores your data as usage profiles, which it uses for the purposes of advertising, market research and/or customising its website to specific needs. Analysis of this kind is particularly carried out (even for users who are not logged in) for the purposes of showing you targeted adverts and informing other users of the social network about your activities on our website. You have a right to object to these user profiles being created; you must get in touch with YouTube to exercise this right. (4) You can find further information regarding the purpose and scope of the data collected and its processing performed by YouTube by reading its privacy policy, which also contains further information about your rights and settings for protecting your privacy. YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, United States, represented by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland; https://policies.google.com/privacy. d) Use of the LinkedIn Insight Tag

This website uses the LinkedIn Insight Tag, which is an analysis tool belonging to LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. The LinkedIn Insight Tag enables us to track users’ actions on our website when they have accessed our website via LinkedIn. This gives us a better understanding of user behaviour and enables us to optimise our marketing activities on LinkedIn.

The LinkedIn Insight Tag collects and stores anonymised data about user behaviour on our website, including page views, interactions and other activities. This data is used by LinkedIn for statistical purposes and helps us display relevant, targeted adverts on LinkedIn.

By using this website, you are giving your consent for LinkedIn to process anonymised data about your user behaviour, as described in the LinkedIn privacy policy: https://www.linkedin.com/legal/privacy-policy?.

You can prevent the LinkedIn Insight Tag from collecting your data by changing your LinkedIn account settings or following the instructions provided at the following link: www.linkedin.com/psettings/enhanced-advertising

Please note that disabling the LinkedIn Insight Tag will only affect the collection of your data on our website; it will not have any effect on the adverts displayed on LinkedIn.

e) Use of the Facebook pixel

This website uses the Facebook pixel, which is an analysis tool belonging to Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. The Facebook pixel enables us to track the behaviour of users who have accessed this website by clicking on an advert displayed on Facebook. This enables us to analyse the effectiveness of our advertising campaigns on Facebook and optimise our marketing activities.

The Facebook pixel collects and stores anonymised data about user behaviour on our website, including page views, interactions and other activities. This data is used by Facebook for statistical purposes and helps us display relevant, targeted adverts on Facebook.

By using this website, you are giving your consent for Facebook to process anonymised data about your user behaviour, as described in the Facebook privacy policy: https://www.facebook.com/privacy/policy/.

You can prevent the Facebook pixel from collecting your data by changing your Facebook account settings or following the instructions provided at the following link:

Please note that disabling the Facebook pixel will only affect the collection of your data on our website; it will not have any effect on the adverts displayed on Facebook.

8. Visitor registration and transferring your personal data

For marketing purposes, including for the purpose of contacting you (including by e-mail), and within the bounds of the GDPR, the personal data you provide during registration will be passed on to event exhibitors whose content you have viewed on the website or whose presentations or webinars you have attended. This also applies to the personal data you have voluntarily provided in your profile. The decision about whether and how to use the transferred data set to make contact with the visitor is at the sole discretion and under the sole responsibility of the exhibitor. The personal data supplied will also be collected and processed by HINTE Expo & Conference GmbH itself for these stated purposes. Your consent in accordance with Article 6 (1) (a) of the GDPR, which you gave when you registered, constitutes the legal grounds for transferring the personal data you have supplied.

9. Terminology

a) Personal data Any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

b) Processing Any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

c) Restriction of processing The marking of stored personal data with the aim of limiting its processing in the future.

d) Profiling Any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

e) Pseudonymisation The processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data is not attributed to an identified or identifiable natural person.

f) Controller The natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.

g) Processor A natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

h) Third party A natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data.

i) Consent of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

Opt-out cookies will prevent future collection of your data when you visit this website. You will need to activate this opt-out cookie on every system you use to prevent Universal Analytics from collecting data across different devices. When you click here, the opt-out cookie will be set.

As at: 27 August 2021