Privacy Policy

1. Name and Contact Details of the Controller

2. Name and Contact Details of the Data Protection Officer

The Company's Data Protection Officer can be reached at dsb@kwery.co.

The Company is the controller within the meaning of the GDPR for the processing of your personal data. We process certain personal data about you in connection with the initiation or execution of contracts for products and services acquired through us, as well as in connection with the provision of service, support, maintenance and other services such as procurement of consumables (hereinafter "Services") for the purposes stated in this privacy policy.

1. "Personal data" means any information relating to an identified or identifiable natural person (hereinafter "data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g., cookie) or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
2. "Processing" means any operation or set of operations which is performed on personal data, whether or not by automated means. The term is broad and covers virtually any handling of data.
3. "Controller" means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

Personal data is information relating to an identified or identifiable natural person. In the context of our Services, we process data about you to the extent legally permissible, always in accordance with the principle of data minimization. This particularly concerns the following information:

• Data you provide to us: When using our Services, you provide us with various information about yourself. The different categories of your data depend on your specific contractual relationship with us — typically names, contact details including address, email address and telephone number(s), and account information.
• Data collected from third parties: In the context of contract initiation or fulfillment, we may also process personal data that third parties provide to us (for example, data sets from contractual or cooperation partners) to the extent necessary for the performance of our Services.
• Special categories of personal data: In principle, we do not collect or process special categories of personal data. If required in individual cases, we will always process them in accordance with the GDPR and BDSG.

We only process your personal data when a legal provision permits this. The legal bases are primarily Art. 6, and where applicable Art. 9 of the GDPR, as well as your consent pursuant to Art. 7 GDPR:

• Consent (Art. 6(1)(a), Art. 7 GDPR): We process certain personal data only on the basis of your prior express and voluntary consent. You may withdraw your consent at any time with effect for the future.
• Contract / pre-contractual measures (Art. 6(1)(b) GDPR): For the initiation or performance of your contractual relationship with the Company.
• Legitimate interests (Art. 6(1)(f) GDPR): To protect your interests or the interests of third parties, provided your interests do not prevail.

We only share your personal data with third parties if:

• You have given your express consent pursuant to Art. 6(1)(a) GDPR;
• Disclosure is necessary pursuant to Art. 6(1)(f) GDPR for the establishment, exercise or defense of legal claims and your interests do not prevail;
• There is a legal obligation for disclosure pursuant to Art. 6(1)(c) GDPR; or
• It is legally permissible and necessary pursuant to Art. 6(1)(b) GDPR for the performance of contractual relationships with you.

We will only process your personal data for purposes that are permissible under data protection law:

• Purposes for which you have given us prior consent;
• Processing to fulfill our contract with you;
• Fulfillment of legal obligations to which we are subject;
• Protection of our legitimate interests or those of third parties;
• Establishment, exercise or defense of legal claims;
• Marketing and advertising.

1. Contract-related processing

• Contract initiation: To initiate a (further) contractual relationship, we send you product information and process personal data for this purpose.
• Contract execution: Contract management organizes the administration and execution of contracts between you and us.
• Customer support: We process personal data to advise you and provide support.
• Receivables management: We process your personal data (e.g., payment transactions) to manage claims arising from our contracts, particularly outstanding receivables.
• Contract termination: When our contractual relationship ends, we process your personal data accordingly.
• Cooperation with partners: The Company may work with service and cooperation partners in connection with contract conclusion, management and your support.

2. Consent-based processing

In individual cases, we process your personal data on the basis of consent you have given (e.g., for information about and implementation of events).

3. Processing based on legitimate interests

• Advertising and marketing: Where consent exists, we process your personal data to inform you about our offers.
• Service provision: Certain services may be provided by partner companies; we may transfer your personal data to the extent necessary.
• Receivables management: We will give you sufficient opportunity to settle outstanding receivables as part of our dunning process.

4. Further processing for other purposes

If we intend to process personal data for a purpose other than the one for which it was obtained, we will inform you about this other purpose and all other relevant information in accordance with this privacy policy prior to such further processing.

We retain your personal data in accordance with Art. 17 GDPR only for as long as is necessary for the respective purposes for which we process your personal data. If we process personal data for multiple purposes, it will be automatically deleted or stored in a format that does not allow direct conclusions about your person once the last specific purpose has been fulfilled. A company deletion concept ensures that all your personal data is deleted in accordance with the principle of data minimization and Art. 17 GDPR.

We process your personal data in accordance with the security requirements of Art. 32 GDPR. We have implemented appropriate technical and organizational security measures that comply with recognized IT standards and are continuously reviewed. This ensures that your data is adequately protected against misuse or any other unauthorized data processing at all times.

We will share your personal data with third parties outside the Company in certain cases for the purposes set out in this privacy policy for contract performance. When transferring your personal data, we ensure that your data is processed, protected and transferred lawfully.

1. Transfer to cooperation partners

We may send your personal data to cooperation partners who process your data entirely on our behalf and according to our instructions.

2. Transfer to suppliers

For the purpose of carrying out deliveries and services, we may transfer your personal data to our suppliers.

3. Transfer to other third parties

We transfer your personal data for the purposes set out in Section IV and in the context of statutory information and reporting obligations to other third parties (e.g., external service or IT providers, external consultants, transport and insurance companies), unless already mentioned above. We will ensure that these third parties guarantee the confidentiality of your personal data.

4. Transfer to non-EU member states

Insofar as data is processed in countries outside the EU or the EEA in individual cases, the Company will ensure that your personal data is processed in accordance with European data protection standards. Where necessary, we will use data transfer agreements based on the EU Standard Contractual Clauses ("SCC") or other safeguards.

1. Server log files

When you access our website, data is automatically stored in server statistics (so-called server log files) that your browser transmits to us:

• IP address of the requesting computer
• Date and time of access
• Name and URL of the retrieved file
• Referrer URL
• Browser used and, if applicable, the operating system and the name of your access provider

For data protection reasons, the hostname or IP address of the client is anonymized in the log files. The legal basis is Art. 6(1)(f) GDPR. Log file information is stored anonymously for 6 weeks for security reasons and then deleted.

2. Website registration

Where registration is offered, the following data is collected: first name, last name, username, email address, IP address, and date and time of registration.

3. Contact form and email contact

When you contact us, we collect: first and last name, email address, IP address, and date and time of submission.

4. Cookies

Our website uses cookies — small text files your browser stores on your device. Cookies do not cause any damage to your device and do not contain viruses, trojans or other malware. The data stored in cookies typically includes language settings, login information, and session variables. Processing is based on Art. 6(1)(f) GDPR.

5. Third-party providers

We may integrate content or services from third-party providers. Integration generally requires that the third-party provider receives the IP address of users. Relevant providers include Google Analytics, Google Maps, Google Web Fonts, and social media plugins (Facebook, Instagram, Pinterest, LinkedIn, Xing, Twitter, YouTube). For more information, please refer to the respective privacy policies of those providers. You can prevent the collection of data generated by Google Analytics cookies by installing the browser plugin available at tools.google.com/dlpage/gaoptout.

As a person affected by the processing of your personal data, you have the following rights under the GDPR and other relevant data protection provisions:

• Right of access (Art. 15 GDPR): Request information about the personal data we hold about you at any time.
• Right to rectification (Art. 16 GDPR): Request the immediate rectification of inaccurate data or completion of incomplete data.
• Right to erasure (Art. 17 GDPR): Request erasure of your personal data if the legal requirements are met.
• Right to restriction of processing (Art. 18 GDPR).
• Right to data portability (Art. 20 GDPR): Receive your data in a structured, commonly used, machine-readable format.
• Right to withdraw consent (Art. 7(3) GDPR).
• Right to object (Art. 21 GDPR): Where processing is based on legitimate interests.

To exercise your right of withdrawal or objection, an email to info@kwery.co is sufficient. You also have the right to lodge a complaint with a supervisory authority pursuant to Art. 77 GDPR.

The text of the GDPR and BDSG can be accessed at gdpr-info.eu.

Please direct written inquiries to us via the contact channels listed below: