Data protection

The subject of data protection is personal data. Personal data is any information relating to an identified or identifiable natural person (so-called data subject). Your personal data therefore includes all data that allows your person to be identified, such as your name, your address, your telephone number or your e-mail address. Personal data also includes information that is necessarily generated through the use of our website, such as the start, end and scope of use or your IP address.

We will only process your data if this is permitted by an applicable legal provision. We will base the processing of your data on the following legal bases, among others:

• Consent (Art. 6 para. 1 sentence 1 letter a GDPR): We will only process certain data on the basis of your previously given express and voluntary consent. You have the right to withdraw your consent at any time with effect for the future.
• Fulfillment of a contract or implementation of pre-contractual measures (Art. 6 para. 1 sentence 1 letter b GDPR): We require certain data from you in particular to initiate or execute your contractual relationship with Lampert Nachhaltigkeits GmbH.
• Fulfillment of a legal obligation (Art. 6 para. 1 sentence 1 letter c GDPR): In addition, we process your personal data to fulfill legal obligations such as regulatory requirements or retention obligations under commercial and tax law.
• Protection of legitimate interests (Art. 6 para. 1 sentence 1 letter f GDPR): Lampert Nachhaltigkeits GmbH will process certain data to protect its interests or those of third parties. However, this only applies if your interests do not prevail in individual cases.

Please note that this is not a complete or exhaustive list of the possible legal bases, but merely examples intended to make the legal bases under data protection law more transparent. For more detailed information on the legal bases of the individual data processing operations on our website, please refer to the explanations in the following sections.

You can visit the public part of our website, which is accessible without prior registration, without providing any personal details. When you visit our website, the following information about your visit may be stored:

• IP address
• Date and time of the request
• Time zone difference to Greenwich Mean Time (GMT)
• Content of the request (page visited)
• Access status/HTTP status code
• Amount of data transferred in each case
• Previously visited page
• Browser
• Operating system
• Language and version of the browser software

We process this data on the basis of Art. 6 para. 1 sentence 1 letter f GDPR to provide the website and to ensure the technical operation and security of our information technology systems. In doing so, we pursue the interest of enabling and permanently maintaining the use of our website and its technical functionality. This data is processed automatically when you visit our website. Without this provision, you cannot use our website. We do not use this data for the purpose of drawing conclusions about your identity.

The automatically collected data is generally deleted after 14 days, unless we exceptionally need it for longer for the above-mentioned purposes. In such a case, we delete the data immediately after the purpose no longer applies.

You cannot object to the collection and storage of your server log data, as this data is absolutely necessary for the smooth operation of the website.

If you communicate with us by e-mail or via a contact form, the collection, processing and use of your voluntarily provided contact data (e.g. name, e-mail address) will only take place for a specific purpose, either to record and, if necessary, answer your inquiry(s) or for technical administration.

The processing of data transmitted in the context of communication by e-mail or via a contact form is based on Art. 6 para. 1 sentence 1 letter b GDPR, if it concerns the initiation of a contractual relationship, or on Art. 6 para. 1 sentence 1 letter f GDPR. In the latter case, we have a legitimate interest in processing contact requests voluntarily sent to us.

We delete the data you provide as soon as the purpose for which it was collected no longer applies, subject to the fulfillment of continuing statutory retention obligations.

If your data is processed on the basis of legitimate interests, you can object to the storage of your personal data at any time. For details, please refer to section 14.

You can make public comments on our website, where we publish various articles on topics relating to our activities. Your comment will be published with your specified user name next to the post. We recommend that you use a pseudonym instead of your real name. Your username and e-mail address are required, all other information is voluntary. We need your e-mail address in order to contact you if a third party objects to your comment as unlawful. The legal basis is Art. 6 para. 1 sentence 1 letters c and f GDPR. Comments are not checked before publication. We reserve the right to delete comments if they are objected to as unlawful by third parties.

The website uses cookies and similar technologies to optimize the design of the website. Among other things, this facilitates navigation and a high degree of user-friendliness.

Cookies are small identifiers that our web server sends to your browser and that your device stores if the default settings are set accordingly. These can be used to determine whether your device has already communicated with us. In this way, they serve the purpose of making use more convenient for you and optimizing our offer. We differentiate according to whether the cookie is technically necessary, whether it was set by our website itself or by third parties. For detailed information on the type, function, purposes, legal basis and revocation options for data processing in the case of cookies, please refer to the following provisions:

If you give us your consent to the use and storage of cookies that are not absolutely necessary (see Section 5(b) below), you can revoke this consent at any time with effect for the future via our Consent Manager. You can also technically prevent the storage of strictly necessary cookies at any time by selecting "Do not accept cookies" in your browser settings. The procedure for managing and deleting cookies in your browser settings can be found in the help function of your browser. You can also block all cookies using free browser add-ons, such as "Adblock Plus" (adblockplus.org/en) in combination with the "EasyPrivacy" list (easylist.to), can be deactivated. However, if you do not accept cookies, this can lead to functional restrictions on the website.

a) Strictly necessary cookies

We use the following cookies on our website, which are absolutely necessary for the functioning of our website and in whose storage we have a legitimate interest, as otherwise we would not be able to offer our website with certain basic functionalities (e.g. you would have to log in again each time you change pages). The easiest way to find out details about the strictly necessary cookies we use is via our Consent Manager.

Data processing is carried out to protect our legitimate interests on the basis of Art. 6 para. 1 sentence 1 letter f GDPR. In this respect, our legitimate interest arises from the purposes of use described.

You can only deactivate essential cookies technically via your browser settings or browser add-ons. For further details, please refer to the above passage. This can lead to functional restrictions on the website.

b) Additional own cookies

Additional own cookies that are not absolutely necessary in order to use the website (e.g. functional cookies, also known collectively as "first party cookies") fulfill important tasks. They enable comfortable surfing on our website. They also enable us to respond to you with customized offers. The easiest way to find out details about the additional own cookies we use is via our Consent Manager.

The storage and use of additional own cookies takes place, insofar as you have given us your consent, on the basis of Art. 6 para. 1 sentence 1 letter a GDPR. For further details, please refer to the above passages under point 5. You can revoke this consent at any time with effect for the future via our Consent Manager.

We will only pass on your personal data to external recipients if this is necessary to process your request, if we have your consent to do so or if another legal permission exists.

External recipients can be, in particular

• Processors: These are service providers that we use to provide services, for example in the areas of technical infrastructure and maintenance of our website. Such processors are carefully selected and regularly reviewed by us to ensure that your privacy is protected. These service providers may only use the data for the purposes specified by us and in accordance with our instructions. We are authorized to use such processors in compliance with the legal requirements of Art. 28 GDPR.
• Public bodies: These are authorities, state institutions and other public bodies, e.g. supervisory authorities, courts, public prosecutors or tax authorities. Personal data will only be transferred to such public bodies for compelling legal reasons. The legal basis for such a transfer may be Art. 6 para. 1 sentence 1 letter c and/or f GDPR.
• Non-public bodies: Service providers and auxiliary persons to whom data is transmitted on the basis of a legal obligation or to safeguard legitimate interests, for example tax consultants or auditors. The transfer then takes place on the basis of Art. 6 para. 1 sentence 1 letter b, c and/or f GDPR.

You can subscribe to our newsletter, with which we inform you about our current interesting offers, by giving your consent. The advertised goods and services are named in the declaration of consent.

We use the so-called double opt-in procedure to subscribe to our newsletter. This means that after you have registered, we will send you an e-mail to the e-mail address you have provided in which we ask you to confirm that you are the owner of the e-mail address provided and that you wish to receive the notifications. In addition, we store the IP addresses you use and the times of registration and confirmation. The purpose of this procedure is to be able to prove your registration and, if necessary, to clarify any possible misuse of your personal data.

The only mandatory information for sending the newsletter is your e-mail address. The provision of further, separately marked data is voluntary and is used to address you personally. After your confirmation, we will save your e-mail address for the purpose of sending you the newsletter. The legal basis is Art. 6 para. 1 sentence 1 letter a GDPR.

Our e-mail newsletters are sent via the technical service provider CleverReach GmbH & Co. KG, //CRASH Building, Schafjückenweg 2, 26180 Rastede ("CleverReach"), to whom we pass on the data provided by the user when registering for the newsletter. The data entered by users for the purpose of subscribing to the newsletter (e.g. email address) is stored on CleverReach's servers in Germany or Ireland.

CleverReach uses this information to send and statistically analyze the newsletter on our behalf. For evaluation purposes, the emails sent contain so-called web beacons or tracking pixels, which are one-pixel image files stored on our website. This makes it possible to determine whether a newsletter message has been opened and which links have been clicked on. Conversion tracking can also be used to analyze whether a predefined action has taken place after clicking on the link in the newsletter. Technical information is also collected (e.g. time of access, IP address, browser type and operating system). The data is collected exclusively in pseudonymized form and is not linked to any other personal data of the user; any direct personal reference is excluded. This data is used exclusively for the statistical analysis of newsletter campaigns. The results of these analyses can be used to better tailor future newsletters to the interests of recipients. Further information on data analysis by CleverReach newsletters can be found at: https://www.cleverreach.com/de/funktionen/reporting-und-tracking/.

You can revoke your consent to the sending of the newsletter at any time and unsubscribe from the newsletter. You can declare your revocation by clicking on the link provided in every newsletter e-mail, by e-mail to info@pruefnach.at or by sending a message to the contact details given in the imprint.

For more information on data processing by CleverReach, please refer to CleverReach's privacy policy at: https://www.cleverreach.com/de/datenschutz/.

This website uses Google Analytics, a web tracking service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). The purpose of our use of the tool is to enable us to analyze your user interactions on websites and in apps and to use the statistics and reports obtained to improve our offering and make it more interesting for you as a user.

We primarily record the interactions between you as a user of the website and our website using cookies, device/browser data, IP addresses and website or app activities. In Google Analytics, your IP addresses are also recorded to ensure the security of the service and to provide us as the website operator with information about the country, region or location from which the respective user originates (so-called "IP location determination"). For your protection, however, we naturally use the anonymization function ("IP masking"), i.e. Google truncates the IP addresses by the last octet within the EU/EEA.

Google acts as a processor and we have concluded a corresponding contract with Google. The information generated by the cookie and the (usually shortened) IP addresses about your use of this website are usually transferred to a Google server in the USA and processed there. For these cases, Google has, according to its own information, imposed a standard that corresponds to the former EU-US Privacy Shield and has promised to comply with applicable data protection laws when transferring data internationally. We have also agreed so-called standard contractual clauses with Google, the purpose of which is to maintain an appropriate level of data protection in the third country.

The legal basis for the collection and further processing of the information (which takes place for a maximum of 14 months) is your consent (Art. 6 para. 1 sentence 1 letter a GDPR). You can withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal. In apps, you can reset the advertising ID in the Android or iOS settings. The easiest way to revoke your consent is via our Consent Manager or by installing the Google browser add-on, which can be accessed via the following link: tools.google.com/dlpage/gaoptout?hl=en/.

You can find more information on the scope of services provided by Google Analytics at marketingplatform.google.com/about/analytics/terms/en/. Google provides information on data processing when using Google Analytics at the following link: support.google.com/analytics/answer/6004245?hl=en/. General information on data processing, which according to Google should also apply to Google Analytics, can be found in Google's privacy policy at www.google.de/intl/de/policies/privacy/.

We maintain publicly accessible profiles in social networks and process user data in this context in order to communicate with the users active there or to offer information about us, currently at:

• "Facebook"; Service provider: Facebook Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, parent company: Facebook, 1 Hacker Way, Menlo Park, CA 94025, USA; Website: https://www.facebook.com; Privacy Policy: https://www.facebook.com/about/privacy; Settings for advertisements: https://www.facebook.com/settings?tab=ads
• "LinkedIn"; Service provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland; Website: https://www.linkedin.com; Privacy Policy: https://www.linkedin.com/legal/privacy-policy; Opt-Out: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out
• "Twitter": Social network; Service provider: Twitter Inc, 1355 Market Street, Suite 900, San Francisco, CA 94103, USA; Website: https://twitter.com/; Privacy Policy: https://twitter.com/de/privacy

With our various social media channels, we would like to offer you a wide range of social media services, present our products and services to you comprehensively and exchange ideas and inquiries with you on topics that are important to you. Data processing serves the following purposes in particular:

• Presentation of our company and the corporate culture including existing career and further training opportunities at Lampert Nachhaltigkeits GmbH;
• Answering customer and prospective customer inquiries about our services;
• Communication with and information for social media channel visitor(s); presentation of current events including online seminars;
• Collecting statistical information about the reach of social media channels;
• Conducting customer surveys, marketing campaigns, market analyses, competitions, contests or similar activities or events;
• Resolution of disputes and litigation, establishment, exercise or defense against legal claims or litigation, enforcement of existing contracts.

Unless expressly stated otherwise, the legal basis for processing is Article 6(1)(f) GDPR. Our legitimate interest lies in being able to present our company and the offers you have requested on the channels you prefer and to respond quickly to your messages or inquiries. We also have a legitimate interest in analysing the reach and use of our social media channels in order to achieve an appropriate design and continuous optimization. If you wish to enter into a contractual relationship with us with your request, the legal basis for this processing is Art. 6 para. 1 letter b GDPR.

If we intend to process your personal data for a purpose other than those mentioned above, we will inform you accordingly before processing.

We would like to point out that user data may be processed outside the European Union. This may result in risks for users because, for example, it could make it more difficult to enforce users' rights.

We process the following personal data in particular through our social media presences:

• Your social network username and comments posted on our social presences and messages you have sent via our social networks.
• Your activity on our social networks via the respective service of the providers (in particular Facebook Insights, Twitter Analytics, statistical information at LinkedIn), e.g. the visits to the social presence, the scope of interactions, visits and the average duration of video playbacks, information about which countries and cities our visitors come from and statistics about the general relationships of our visitors.
• Other information necessary to respond to requests from our visitors or to uniquely identify our visitors in our systems.

When you visit one of our social media presences, the operators of the social media portals can also create user profiles in which your preferences and interests are stored. In this way, interest-based advertising can be displayed to you inside and outside the respective social media presence. If you have an account with the respective social network, the interest-based advertising can be displayed on all devices on which you are logged in or were logged in.

Please note that we cannot track all processing operations on the social media portals. Depending on the provider, further processing operations may therefore be carried out by the operators of the social media portals. For details, please refer to the terms of use and data protection provisions of the respective social media portals (see above).

If you visit one of our social media sites, we may be jointly responsible with the operator of the social media platform for the data processing operations triggered during this visit. Joint responsibility within the meaning of the GDPR arises in particular for

• the use of statistical information on Facebook ("Facebook Insights"), whereby Facebook provides us with data in anonymized form and conclusions about individual users and access to individual user profiles by us are not possible. Further information can be found here: https://www.facebook.com/legal/terms/information_about_page_insights_data. Lampert Nachhaltigkeits GmbH and Facebook have concluded a so-called joint responsibility agreement: https://www.facebook.com/legal/terms/page_controller_addendum.
• the use of statistical information at LinkedIn ("LinkedIn Analytics"), whereby LinkedIn only provides us with data in anonymized form via this service and conclusions about individual users and access to individual user profiles by Lampert Nachhaltigkeits GmbH are not possible. Lampert Nachhaltigkeits GmbH and LinkedIn have therefore concluded a so-called joint responsibility agreement: https://legal.linkedin.com/pages-joint-controller-addendum.

In principle, you can assert your rights (information, correction, deletion, restriction of processing, data portability and complaint) both against us and against the operator of the respective social media portal (e.g. against Facebook or LinkedIn), although we would like to point out that these can be asserted most effectively with the providers. Only the providers have access to the users' data and can take appropriate measures and provide information directly. If you still need help, you can contact us.

The data collected directly by us via the social media presence will be deleted from our systems as soon as the purpose for its storage no longer applies, you request us to delete it, revoke your consent to storage or the purpose for data storage no longer applies. Stored cookies remain on your end device until you delete them. Mandatory statutory provisions - in particular retention periods - remain unaffected.

We have no influence on the storage period of your data that is stored by the operators of the social networks for their own purposes. For details, please contact the operators of the social networks directly. Finally, the website contains links to our accounts on social networks such as Twitter or Facebook. After clicking on the embedded graphic, you will be redirected to the page of the respective provider, i.e. only then will user information be transmitted to the respective provider. If you are logged into the corresponding social network with your user profile, an association with your visit to our website will take place once the button has been activated. If you do not want data about the website to be collected by the social networks, you should log out of them before visiting the website.

We have included YouTube videos on our website that are hosted by YouTube but can be played directly from our website. YouTube is a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("YouTube"). These are all integrated in "extended data protection mode", i.e. no data about you as a user is transferred to YouTube if you do not play the videos. Only when you play the videos will the data mentioned below be transmitted. We have no influence on this data transfer. The legal basis for the display of the videos is Art. 6 para. 1 sentence 1 letter a GDPR, i.e. the integration only takes place with your consent.

When you visit the website, YouTube receives the information that you have accessed the corresponding subpage of our website. In addition, the above-mentioned basic data such as IP address and timestamp are transmitted. This occurs regardless of whether YouTube provides a user account through which you are logged in or whether no user account exists. If you are logged in to Google, your data will be assigned directly to your account. If you do not wish your data to be associated with your YouTube profile, you must log out before activating the button. YouTube stores your data as usage profiles and uses them for the purposes of advertising, market research and/or the needs-based design of its website. Such an evaluation is carried out in particular (even for users who are not logged in) to provide needs-based advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles, whereby you must contact YouTube to exercise this right.

The information collected is stored on Google servers, including in the USA. In these cases, the provider has, according to its own information, imposed a standard that corresponds to the former EU-US Privacy Shield and has promised to comply with applicable data protection laws when transferring data internationally. We have also agreed so-called standard data protection clauses with Google, the purpose of which is to maintain an appropriate level of data protection in the third country.

Further information on the purpose and scope of data collection and its processing by YouTube can be found in the privacy policy. There you will also find further information on your rights and setting options to protect your privacy: www.google.de/intl/de/policies/privacy.

We also include videos from the video portal Vimeo on our website. The provider is Vimeo Inc, 555 West 18th Street, New York, New York 10011, USA ("Vimeo").

For technical reasons, the integration of the videos causes the servers of the Vimeo providers to be called up. For the associated use of data from your browser or end device, we refer you to the respective data protection notices of the providers, as they are responsible for the corresponding data processing. You can find Vimeo's privacy policy here: https://vimeo.com/privacy

The use of Vimeo is in the interest of an appealing presentation of our online offers. The legal basis for the integration of Vimeo videos and the associated transmission of the technically required data to Vimeo is Art. 6 (1) (f) GDPR.

If a corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6 para. 1 letter a GDPR; the consent can be revoked at any time.

In order to ensure an adequate level of data protection when transferring data to the USA, we have concluded the EU standard contractual clauses with Vimeo in the so-called "Controller to Controller" variant. As a further protective measure, we always integrate videos from Vimeo in the "Do Not Track" variant, so that personal data is only transmitted to Vimeo in a minimal way.

Further information on the handling of user data can be found in Vimeo's privacy policy at: https://vimeo.com/privacy.

As a rule, we process your data in Germany or other countries of the European Union (EU) or the European Economic Area (EEA). However, if we transfer your data to third countries outside the EU or the EEA in individual cases (e.g. to process an inquiry relating to a third country), we will ensure before the transfer that there is either a legally permitted exception, that the recipient has an adequate level of data protection or that you consent to the data transfer. An adequate level of data protection is guaranteed, for example, by the conclusion of EU standard contractual clauses or the existence of binding corporate rules (BCR). Please contact us at datenschutz@pruefnach.at to obtain a copy of the specific guarantees for the transfer of your data to third countries.

We only store your personal data for as long as this is necessary for the fulfillment of the purposes or - in the case of consent - as long as you do not revoke your consent. In the event of an objection, we will no longer process your personal data unless further processing is permitted or even mandatory under the relevant statutory provisions (e.g. in the context of retention obligations under commercial and tax law). We will also delete your personal data if we are obliged to do so for legal reasons.

For further details on the storage period of your personal data, please refer to the respective explanations in the sections listed above.

As a person affected by data processing, you have numerous rights. In detail, these are

Right to information (Art. 15 GDPR, § 34 BDSG): You have the right to receive information about the personal data we have stored about you.

Right to rectification and erasure (Art. 16 and Art. 17 GDPR, Section 35 BDSG): You can demand that we rectify incorrect data and - if the legal requirements are met - erase your data.

Right to restriction of processing (Art. 18 GDPR): You can demand that we restrict the processing of your data, provided that the legal requirements are met.

Right to data portability (Art. 20 GDPR): If you have provided us with data on the basis of a contract or consent, you may, if the legal requirements are met, request that you receive the data you have provided in a structured and commonly used format or that we transmit it to another controller.

Right to object to data processing based on legitimate interests (Art. 21 GDPR): You have the right to object to data processing by us at any time for reasons arising from your particular situation, insofar as this is based on legitimate interests within the meaning of Art. 6 para. 1 sentence 1 letter f GDPR. If you exercise your right to object, we will stop processing your data unless we can demonstrate compelling legitimate grounds for further processing that outweigh your rights, or the processing serves to assert, exercise or defend legal claims.

Withdrawal of consent (Art. 7 GDPR): If you have given us your consent to process your data, you can withdraw this at any time with effect for the future. This does not affect the lawfulness of the processing of your data until you withdraw your consent.

Right to lodge a complaint with the supervisory authority (Art. 77 GDPR): You can also lodge a complaint with the competent supervisory authority if you believe that the processing of your data violates applicable law. To do so, you can either contact the data protection authority responsible for your place of residence, your workplace or the location of the suspected infringement, or the data protection authority responsible for us. The data protection supervisory authority responsible for us is the Bavarian State Office for Data Protection Supervision, Postfach 1349, 91504 Ansbach, telephone: +49 (0) 981 180093-0, fax: +49 (0) 981 180093-800, e-mail: poststelle@lda.bayern.de.

If you have any questions about the processing of your personal data, your rights as a data subject and any consent you may have given, please contact us using the communication channels listed under point 1 or at datenschutz@pruefnach.at. Please also contact us directly to exercise your rights as a data subject.

We take technical and organizational security measures to protect your personal data against accidental or intentional manipulation, loss, destruction or access by unauthorized persons. These security measures are always adapted to the current state of the art.

Your personal data transmitted when you use our website is transmitted securely using encryption. We use the Transport Layer Security (TLS) encryption protocol, more commonly known by its predecessor Secure Sockets Layer (SSL).

Our employees are obliged to maintain confidentiality.

From time to time it may be necessary to adapt the content of this data protection notice. We therefore reserve the right to change it at any time. If your consent is required for a change, we will obtain this from you. We will also publish the amended version of the data protection information here. If you visit our website again, you should therefore read the data protection information again.