Privacy Policy (Effective as of 03/30/2026)

This privacy policy provides an overview of how your personal data (hereinafter also referred to as “data”) is handled by our company and informs you about your data protection rights under the Swiss Federal Act on Data Protection (“FADP”) and the Data Protection Ordinance (“DPO”). Please take a moment to read through this policy and feel free to print or save it for your records.

Personal data includes any information that can be used to identify you personally. Your personal data may be processed for various purposes. In essence, the data processing activities carried out by Mobility Hub Parkservice GmbH and Mobility Hub Parkservice Switzerland GmbH (hereinafter also referred to as “MH Parkservice” or “we”) can be categorized into the following areas:

• General: General information regarding data protection, processing activities, and the rights of data subjects, which applies to all data processing we perform, can be found in Part A.
• Our online presence: In connection with our website www.mh-parkservice.ch (hereinafter: “website”) or related external online platforms, such as our social media profiles, our service portal (https://service.mh-parkservice.ch/) or our post-payment service (https://parken.mh-parkservice.ch/), from which we link to this privacy policy (the website and external online platforms are hereinafter collectively referred to as: “online presence”), we process data from visitors that is exchanged between their internet-enabled devices and our servers, as well as data provided to us while using the website. Details on this can be found in Part B.
• Parking users: For information on how we process data from users of parking facilities we manage—for example, during payment processes via the MHP Online Shop or our post-payment service, the pursuit of parking violations by MH Parkservice, or viewing details of parking violations via our PCN portal—please visit Part C.
• B2B: We process the necessary data of our business customers and prospective clients for the purpose of initiating or executing contracts. Data from our business partners and suppliers is used exclusively for direct order placement, processing, and fulfillment. You can find more information on this in Part D.

Please visit the individual sections if you would like quick, context-specific information regarding certain processing situations.

‍

A. General information on data protection and data subject rights

I. Who is responsible for data processing, and who can you contact with questions?

The controller responsible under the FADP and other data protection regulations is:

Mobility Hub Parkservice Switzerland GmbH

c/o BDO AG

Obere Spichermatt 12

6370 Stans

Switzerland

Phone: +41 21 561 36 30

Email: info@mh-parkservice.ch

If you have any questions regarding data protection, please feel free to use the contact details above or email us at: datenschutz@mh-parkservice.ch

II. What are your rights regarding your personal data?

If your personal data is being processed, you are a “data subject” under the FADP, which means you may have the rights described below. If you wish to exercise your rights against MH Parkservice as the controller, we recommend that you direct your request to the contact details provided above:

1. Right to information

In accordance with Art. 25 FADP, you may request confirmation from us as to whether we are processing your personal data and ask for information regarding the extent to which we are processing it.

2. Right to rectification

If your personal data is incorrect or incomplete, you have the right to have it corrected and/or completed in accordance with Art. 32 FADP.

3. Right to erasure

Subject to the legal requirements of Art. 32 FADP, you may request that we delete your data if we are processing it unlawfully or if the processing disproportionately infringes upon your legitimate interests. Please note that there may be reasons that prevent immediate deletion, such as statutory retention obligations.

Regardless of whether you exercise your right to erasure, we will delete your data completely and promptly once the purpose of processing has been fulfilled, provided there are no legal or contractual retention periods to the contrary.

4. Right to data portability

Under Art. 28 FADP, you have the right to receive the data you provided to us—which we process automatically based on your consent or for the performance of a contract—in a common, machine-readable format, or to have it transferred to a third party. If you request the direct transfer of data to another controller, this will only be done if it is technically feasible. The right to data portability does not apply to the processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

5. Right to withdraw consent under data protection law

Some data processing operations are only possible with your explicit consent as defined in Art. 6 para. 7 FADP. You may withdraw your consent at any time with future effect. The lawfulness of any data processing carried out prior to your withdrawal remains unaffected. Please note that even after you withdraw your consent, we may still be able to process the affected data, in whole or in part, based on other legal grounds.

6. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, particularly in the member state of your habitual residence, place of work, or place of the alleged infringement, if you believe that the processing of your personal data violates applicable law.

If you believe that we have violated applicable data protection law while processing your data, please contact us so that we can clarify any questions.

You also have the right to contact the supervisory authority responsible for our company headquarters:

Federal Data Protection and Information Commissioner

Feldeggweg 1

CH - 3003 Bern

‍

III. Which personal data is processed and what are the sources of this data?

1. Origin of personal data

We primarily process data that we receive directly from the data subjects when they use our website as part of initiating or maintaining a business relationship (see also Part B Section VI).

Through our website and our services, we process data that we receive during your visit or that you actively provide to us when using our services (e.g., when using our online shop). Other data is collected automatically by our IT systems when you visit the website or use one of our services. This primarily involves technical data (e.g., internet browser, operating system, or the time a page was accessed). This data is collected automatically as soon as you enter our website or access one of our services. You can find details on this in Part B.

In individual cases, we also process data that we have lawfully received or acquired from other third parties, such as credit agencies, creditor protection associations, or authorities, or that we have lawfully obtained, received, or acquired from publicly accessible sources (e.g., telephone directories, company registers, the press, the internet, or other media).

2. Categories of personal data

The personal data we regularly process includes master/contact data such as: title, first and last name, form of address, date of birth, address, email address, telephone number, fax, and job title.

In addition, depending on the order, service, or other relationship with you, we process the following other personal data:

• Address data: street, house number, address supplements if applicable, postal code, city, country
• Contact data: telephone number(s), email address(es)
• Vehicle data: license plate number, vehicle owner
• Parking management data: photographs, date and duration of parking space usage, parking permits, bank details, payment information
• Registration data: information about the service you registered for; timestamps and technical information regarding registration, confirmation, and cancellation; data provided by you during registration
• Offer data
• Access data: date and time of your visit to our service; the page from which the accessing system reached our site; pages accessed during use; session identification data (session ID); as well as the following information from the accessing computer system: internet protocol address (IP address) used, browser type and version, device type, operating system, and similar technical information.
• Information about the nature and content of our business relationship, such as contract data, order data, sales and receipt data, customer and supplier history, and consultation documents
• Advertising and sales data,
• Documentation data (e.g., consultation records, data from service calls or support cases)
• other data we have received from you as part of our business relationship (e.g., in customer meetings),
• documentation of consent declarations

‍

IV. For what purposes is the data processed?

We process your data in accordance with the provisions of applicable data protection law, in particular for the following purposes:

Fulfillment of (pre-)contractual obligations

Personal data is processed to fulfill the contractual obligations of MH Parkservice in particular in connection with the sale and distribution of our goods and services (hereinafter also referred to as “parking services”) as well as all activities typically required in the industry for the operation or administration of MH Parkservice (e.g., customer and user management). Data may also be processed at the pre-contractual stage when initiating business with MH Parkservice, or when carrying out other contractual relationships with MH Parkservice .

This applies, for example, in the following cases:

• Creating and maintaining a partner or supplier account in our CRM system
• Creating and maintaining customer/prospect files or our customer/prospect database in our CRM system
• Sending information
• Offering and selling MH Parkservice products
• Offering and performing our services

Details regarding the purpose of these data processing activities can be found in the respective contract documents and terms and conditions.

2. Safeguarding overriding legitimate interests

Beyond the actual fulfillment of a contract, data processing may take place to safeguard the legitimate interests of MH Parkservice or third parties. This is permissible provided that your interests or fundamental rights and freedoms, which require the protection of personal data, do not override them. Data processing to safeguard legitimate interests occurs, for example, in the following cases:

• Providing the online offering, its functions, and content
• Using technically necessary cookies or comparable technologies
• Responding to contact inquiries and communicating with users
• Transmitting data to companies and partners affiliated with us
• Processing payments via external service providers
• Using debt collection agencies and lawyers to collect and/or judicially enforce claims
• Asserting other legal claims and defense in legal disputes
• Advertising or marketing
• Market and opinion polls
• Measures for business management and further development of our services
• Maintaining databases of customers/prospects or service providers to improve our offering
• Conducting risk assessments (due diligence) in the context of potential corporate restructuring or the purchase or sale of a company
• Ensuring the IT security and IT operation of our company and our services
• Measures for building and facility security

3. Fulfillment of legal obligations

Processing your data may be necessary for the purpose of fulfilling various legal obligations and requirements to which we are subject, e.g., under the German Commercial Code (HGB) or the Fiscal Code (AO).

4. Einwilligung

Sofern wir im Geltungsbereich des DSG eine Einwilligung von Ihnen erbitten, erfolgt die auf Grundlage von Art. 6 Nr. 6 und Nr. 7 DSG.

Wenn Sie uns im Einzelfall eine Einwilligung zur Bearbeitung Ihrer Daten erteilt haben, erfolgt eine Bearbeitung gemäss den in der Einwilligungserklärung festgelegten Zwecken und im darin vereinbarten Umfang. Eine erteilte Einwilligung, kann jederzeit mit Wirkung für die Zukunft widerrufen werden. Wenden Sie sich hierzu bitte an den unter Teil A. Ziff. I bzw. Ziff. II genannten Kontaktdaten. Bitte beachten Sie, dass Bearbeitungen, die vor dem Widerruf erfolgt sind, nicht von dem Widerruf betroffen sind und unter Umständen die Datenbearbeitung zumindest teilweise auf Basis einer anderen rechtlichen Grundlage weiterhin möglich sein kann.

V. Wer erhält meine Daten?

Bei MH Parkservice erhalten diejenigen Mitarbeiter bzw. Organisationseinheiten Ihre Daten, die diese zur Erfüllung unserer vertraglichen und gesetzlichen Pflichten oder zur Bearbeitung oder Verfolgung unserer berechtigten Interessen benötigen. 

Ihre Daten werden zur Anbahnung bzw. Abwicklung eines Vertragsverhältnisses (z.B. Verkauf bzw. Erbringung von Parkleistungen) bzw. – je nach Art des konkreten Vertragsverhältnisses –auf Basis unserer berechtigten Interessen insbesondere an Unternehmen weitergeleitet, die wir regelmässig im Zusammenhang mit der Erbringung unserer Dienstleistung oder zur Vertragsabwicklung einsetzen. Das betrifft folgende Empfänger bzw. Empfängerkategorien:

• IT- Dienstleister (z.B. E-Mail-Dienstanbieter, Webhosting-Unternehmen)

• Amazon Web Services, Inc., 410 Terry Avenue North, Seattle WA 98109, USA (Cloud-Storage-Provider) 
• Amplitude Inc., 201 Third Street, Suite 200, San Francisco, CA 94103, USA (Optimierung von App-Funktionen)
• Airparser, Sepapaja tn 6, Tallinn 11415, Estland (Provider Dokumenten-Management-Software)     
• Celonis SE, Theresienstr. 6 80333 München (Integrations-Plattform-Provider)
• Datadog Inc., 620 8th Avenue, 45th Floor, New York, NY 10018, USA (Systemsicherheit, Monitoring)
• Decagon AI, Inc., 2261 Market Street, STE 5378, San Francisco, CA 94114 USA (KI-Plattform-Betreiber und Anbieter einer KI-Chatfunktion)

• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland
• Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Irland (E-Mail-Service-Provider)
• HubSpot Inc. 25 First Street, 2nd Floor, Cambridge, MA 02141 USA (CRM-System-Provider)
• Freshworks Inc., 2950 S. Delaware Street, Suite 201, San Mateo, CA 94403, USA (Ticket-System-Provider)
• LanguageTooler GmbH, Karl-Liebknecht-Str. 37, 14482 Potsdam
• Leaping AI UG (haftungsbeschränkt), Potsdamer Strasse 72, 10785 Berlin (Anbieter von KI-gestützte Call-Center-Software)
• Octa Inc., 100 First Street, Floor 6, San Francisco, CA 94105, USA (Anbieter von Auth0 einer Löschung für Systemsicherheit)

• OpenAI Ireland Ltd, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Irland (KI-Modell-Anbieter)
• Peter Park System GmbH, Balanstr. 71a, 81541 München, Deutschland (Zurverfügungstellung von IT-Systemen als Managed Services sowie von Parkraumbewirtschaftungsystemen)
• Planet Payment Group Holdings Limited, IDA Business Park, Dangan, Galway H91A06C, Irland (Provider Zahlungssystem-Gateway) 
• sevDesk GmbH, Hauptstrasse 115, 77652 Offenburg (Buchhaltungssoftware-Provider)
• Talkdesk Inc. 201 Spear Street, Suite 1100, San Francisco, CA 94105 USA (Contact-Center-Software-Provider)
• Trustpilot A/S, Pilestraede 58, 5. Stock, DK-1112 Kopenhagen, Dänemark (Bewertungsverfahrenanbieter)
• UAB Baltsoft, Kosciuskos 26-17, Vilnius, LT-01100, Litauen (Anbieter von Konvertierungssoftware-Lösungen)
•  Webflow, Inc., 398 11th Street, San Francisco, CA 94103, Vereinigte Staaten (Webhosting-Service-Provider für die Webseite)
• Weglot, SAS, 138, rue Pierre Joigneaux in Bois-Colombes 92270 Frankreich (Übersetzungsdienstanbieter)

• Vertriebspartner 
• Werbepartner
• Versicherungen 
• Banken 
• Kommunikationsanbieter (Telefonanbieter, Faxanbieter) 
• Zahlungsdienstleister 
  
  • Adyen N.V. Simon Carmiggeltstraat 6, 1011 DJ, Amsterdam, Niederlande
  • Datatrans AG, Kreuzbühlstr. 26, CH-8008 Zürich, Schweiz
  • Stripe Deutschland GmbH, Prielmayerstr. 3, 80335 München, Deutschland 
  • secuPay AG, Goethestrasse 6, 01896 Pulsnitz, Deutschland
  • Planet Payment Group Holdings Limited, IDA Business Park, Dangan, Galway H91A06C, Irland
  • Planet Merchant Services SAS, 1 Terrasse Bellini, Puteaux, 92919, Paris La Défense Cedex, Frankreich
• Versand- und Logistikdienstleister 
• Auskunfteien 
• Wirtschaftsprüfer
• Steuer- und Rechtsberater

Wenn wir einen Dienstleister im Sinne einer Auftragsbearbeitung nach Art. 9 DSG einsetzen, bleiben wir dennoch für den Schutz Ihrer Daten verantwortlich. Soweit gesetzlich vorgeschrieben, werden Auftragsbearbeiter mittels einer Vereinbarung zur Auftragsbearbeitung vertraglich dazu verpflichtet, Ihre Daten vertraulich zu behandeln und nur im Rahmen der Leistungserbringung zu bearbeiten. Die von uns beauftragten Auftragsbearbeiter erhalten Ihre Daten, sofern diese die Daten zur Erfüllung ihrer jeweiligen Leistung benötigen. 

Eine Übermittlung Ihrer Daten an staatliche Einrichtungen und Behörden bzw. eine Erhebung solcher Daten für diesen Zweck erfolgen nur im Rahmen zwingender nationaler Rechtsvorschriften oder wenn Sie uns hiermit beauftragen.

VI. Wie lange werden meine Daten gespeichert?

Ihre Personendaten werden nur zu dem Zweck verwendet, für den Sie uns diese zur Verfügung gestellt haben bzw. in dessen Bearbeitung Sie eingewilligt haben und nur solange gespeichert, bis dieser Zweck erfüllt ist. Nach vollständiger Erfüllung des Zwecks bzw. sobald Sie uns zur Löschung Ihrer Daten aufgefordert haben, werden Ihre Daten nur so lange gespeichert, wie dies aufgrund gesetzlicher Verjährungs- oder Aufbewahrungsfristen (insbesondere steuer- und handelsrechtlicher Art) erforderlich ist. Spätestens nach Ablauf dieser Fristen werden die Daten jedoch gelöscht, sofern Sie nicht ausdrücklich in eine weitere oder andere Nutzung eingewilligt haben. Auch während der Aufbewahrungsfristen können Sie Rechte geltend machen, wie z.B. die Sperrung Ihrer Daten. Sehen Sie hierzu Teil A. Ziff. II.

Ihre Daten werden von uns gelöscht oder gesperrt, sobald der Zweck der Speicherung entfällt oder Sie uns zur Löschung auffordern. 

Wir bearbeiten, insbesondere speichern Ihre Daten grundsätzlich längstens nur bis zur Beendigung der Geschäftsbeziehung oder bis zum Ablauf der geltenden Garantie-, Gewährleistungs-, Verjährungsfristen. Darüber hinaus kann es notwendig sein, dass Daten bis zur rechtskräftigen Beendigung von allfälligen Rechtsstreitigkeiten, bei denen die Daten als Beweis benötigt werden, aufbewahrt werden.

Ferner unterliegen wir gesetzlichen Dokumentations- bzw. Aufbewahrungsfristen (etwa handels- oder steuerrechtlicher Natur) aufgrund derer wir Ihre Daten auch nach Beendigung eines Vertrags speichern müssen. 

‍

VII. Werden Daten an ein Drittland bekanntgegeben?

As part of our processing operations, personal data may be transferred to entities in so-called third countries outside of Switzerland that have not yet been certified by the Swiss Federal Council as having an adequate level of data protection. Should such a data transfer be necessary in an individual case, it will only occur if adequate data protection can be guaranteed, for example, on the basis of international treaties, standard data protection clauses, appropriate safeguards for compliance with data protection, or your explicit consent.

‍

B. Using our websites

In principle, you can visit our websites and use them for informational purposes without having to provide any personal details (e.g., registering, placing orders, or submitting other personal information). In this case, we only process our users' personal data to the extent necessary to provide a functional website and our content and services, or to the extent that cookies or similar technologies used on the website transmit personal information to us when you visit. Information on our own cookies or similar technologies can be found in Part B, Section II. Other cookies or similar technologies may allow us, and potentially our partner companies or third parties, to recognize your browser on your next visit. Please refer to Part B, Section III for information on such third-party cookies or similar technologies.

The processing of our users' personal data generally only takes place with the user's consent. An exception applies in cases where obtaining prior consent is not possible for practical reasons and the processing of the data is permitted by legal regulations.

I. Provision of the website and creation of log files

Description of data processing

Every time you access our website, our system automatically collects data and information from the computer system of the accessing device, which your internet browser automatically transmits to us or our web host (so-called log files). These server log files contain IP addresses or other data that allow for identification of a user. This could be the case, for example, if the link to the website from which the user arrives at our site, or the link to the website to which the user navigates, contains personal data. The following information is collected and stored by our hosting provider:

• Browser type and version
• Operating system used
• Referrer URL
• Hostname of the accessing computer and time of the server request
• IP address

The data is stored in our web host's log files. This data is not stored together with other personal data of the user.

We use Webflow, Inc., 398 11th Street, San Francisco, CA 94103, USA (www.webflow.com) (hereinafter: "Webflow") as our web host and software provider for the creation, provision, and operation of our website, online forms, and other web elements. Information on data protection at Webflow can be found at https://webflow.com/legal/eu-privacy-policy. We have entered into a data processing agreement with Webflow ("Data Processing Addendum," see https://webflow.com/legal/dpa). As part of the aforementioned services provided by Webflow, personal data may be transferred to the USA based on standard data protection clauses that Webflow has agreed upon with us in its Data Processing Addendum, or an equivalent data protection guarantee as part of the processing of personal data on our behalf.

Purpose of data processing

The temporary storage of the IP address by the system is necessary to enable the website to be delivered to the user's computer. For this, the user's IP address must remain stored for the duration of the session.

Storage in log files is carried out to ensure the functionality of the website. In addition, the data helps us optimize the website and ensure the security of our information technology systems.

Duration of storage / Right to object and removal

The data will be deleted as soon as it is no longer required for the purpose for which it was collected. In the case of data collected for the provision of the website, this is the case when the respective session has ended.

If the data is stored in log files, this is the case after no more than 7 days.

The collection of data for the provision of the website and the storage of data in log files is absolutely necessary for the operation of the website. Consequently, there is no option for the user to object.

‍

II. Use of cookies and similar technologies

Description of data processing

Our website uses cookies or similar technologies (e.g., web beacons, local storage) to collect, process, and use usage data (e.g., access times, pages visited) or meta and communication data (IP address, device information), including personal data. For the sake of simplicity, we refer to these technical procedures generally as "cookies" throughout this document.

Cookies are text files containing a unique string of characters that are stored on the user's computer system by an internet browser. This allows the browser to be uniquely identified when the website is revisited. When a user accesses a website, a cookie may be stored on the user's operating system. This cookie contains a characteristic string of characters. These cookies are used to make our website more user-friendly, effective, and secure. When you visit a website that uses cookies, the data you enter is stored exclusively in the cookie on your computer. In this case, data is only transmitted to our servers when a page is requested.

Some cookies are deleted after the browser session ends when you close your browser (so-called session cookies). These cookies are technically necessary, for example, to allow you to log in to the application and remain logged in while navigating between pages during your visit.

Other cookies remain on your device for a set period and allow us to recognize your browser on your next visit (so-called persistent or log cookies). The purpose of these cookies is to provide you with an optimal user experience, to "recognize" you, and to present you with a varied website and new content during repeat visits.

Cookies originating from partner companies or third parties may be used, for example, to collect information for advertising, customized content, or statistics ("third-party cookies"). Unless we identify cookies as originating from third-party providers, they originate from our own services ("first-party cookies"). We provide separate information about the third-party cookies or tracking technologies we use in the following sections of our privacy policy.

Flash cookies are stored as data elements on your computer by websites that run on Adobe Flash. Flash cookies have no expiration date.

For more information about the cookies and similar technologies we use to design our website, their purpose, and what data is stored or transmitted to third parties, please refer to our cookie management tool "CookieHub" provided by CookieHub ehf, Hafnargata 18, 230 Reykjanesbær, Iceland. You can use this tool to provide your consent for the use of cookies and similar technologies according to your preferences when visiting our website.

Our cookie management tool collects log file and consent data using JavaScript. This JavaScript allows us to inform the user about specific tags on our website and to obtain, manage, and document their consent. The cookie management tool saves the settings and consent you provided when entering the website and processes the following data:

• Consent data (anonymized log data (Consent ID, Processor ID, Controller ID), consent status, timestamp)
• Device data (including truncated IP addresses (IP v4, IP v6), device information, timestamp)
• User data (including email, ID, browser information, setting IDs, changelog)

For this purpose, the cookie management tool stores a technically necessary cookie. Information on data protection at CookieHub can be found at: https://www.cookiehub.com/legal/privacy-policy

Further information on which cookies we use to design our website, their purpose, and what data is stored in them or transmitted to third parties can be found in the detailed information provided by CookieHub, which you can access under "More options" or "Cookie declaration". CookieHub automatically analyzes which cookies are set on the site. The list of procedures used and the cookie declaration are then updated automatically.

Purpose of data processing

The processing of personal data using cookies and similar technologies is necessary to safeguard our legitimate interests in the best possible functionality and security of the website, as well as a customer-friendly and effective design of your visit, unless we ask for your consent.

We have integrated CookieHub to obtain consent. This makes it easier for users to provide or manage consent for the individual categories of cookies and similar technologies we use. CookieHub blocks all categories of cookies that are not essential for the proper functioning of the website unless you provide your consent for additional tools. When you visit our website, you will see an interface for this purpose:

• By clicking the "Accept all" button, you can either allow all procedures or decide individually via the "More options" button (by activating the individual toggles and clicking the final "Save settings" button) which cookies and/or cookie-based applications and subsequent data processing you consent to.
• Alternatively, you can reject all non-essential cookies by clicking the "Only essential cookies" button and use the website with only the cookies required for its operation.

The purpose of using technically necessary cookies is to simplify or make the use of websites more convenient for users and is therefore required to provide the service. Some features of our website cannot be offered without the use of cookies. In particular, these features require the browser to recognize the user even after navigating to a different page.

Otherwise, the purpose of the cookies we use in the "Analytical cookies," "Marketing cookies," and "Necessary cookies" categories depends on the services used and subsequent data processing, and is explained in more detail in the following sections of the privacy policy and in CookieHub.

As website operators, we have a legitimate interest in the data processed by our cookie management tool to ensure legally compliant, user-specific, and user-friendly cookie consent management, as well as to design our website in a legally compliant manner.

Storage duration / Right to object and removal

For details on how long our cookies are stored, please refer to the information in CookieHub under the "Cookie Declaration" section.

Cookies are stored on your computer and transmitted to our site from there. As a user, you have full control over the use of cookies. You can disable or restrict the transmission of cookies by changing your internet browser settings. Cookies that have already been saved can be deleted at any time. This can also be done automatically.

If cookies are disabled for our website, you may not be able to use all of the website's features to their full extent.

Alternatively, you can use the features of our integrated cookie consent tool and withdraw your consent at any time or change your preferences by clicking the "Cookie Settings" button (located at the bottom left of our website).

‍

III. Statistical analysis of the website / Reach enhancement

1. Google Analytics

Description of data processing

We use features of the web analytics service Google Analytics for our online services. The provider in Europe is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter: "Google"), a subsidiary of Google LLC, Amphitheatre Parkway, Mountain View, CA 94043, USA.

Google Analytics also uses cookies. The information generated by a Google cookie about your use of this website is generally transmitted to a Google server in the USA and stored there. Google processes the data, and we receive reports about your user behavior. These reports may include, among other things:

• Audience reports: Through audience reports, we get to know our users better and learn more precisely who is interested in our service.
• Behavior reports: Here we learn how you interact with our website. We can track the path you take on our site and which links you click.
• Real-time reports: Here we can see immediately what is happening on our website at any given moment. For example, we can see how many users are currently reading this text.

Google Analytics uses a tracking code to create a random, unique ID that is linked to your browser cookie. This allows Google Analytics to recognize you as a new user. The next time you visit our site, you will be recognized as a "returning" user. All collected data is stored together with this user ID. This is the only way to evaluate pseudonymous user profiles.

Your interactions on our website are measured using identifiers such as cookies. Interactions are all types of actions you perform on our website. If you also use other Google systems (such as a Google account), data generated via Google Analytics can be linked to third-party cookies. Google does not share Google Analytics data unless we, as the website operator, authorize it. Exceptions may occur if required by law. You can find the cookies used by Google Analytics in the detailed information of our cookie management tool, CookieHub, which you can access under "Cookie Declarations".

Our website uses Google Analytics exclusively with the "anonymizeIp()" extension. Your IP address is therefore not stored in full; it is truncated by Google within member states of the European Union or other contracting states to the Agreement on the European Economic Area before being transmitted to the USA. Identification of the website visitor is excluded. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there. Below, we provide an overview of the most important data collected by Google Analytics:

• Heatmaps: Google creates so-called heatmaps. Heatmaps show exactly which areas you click on. This gives us information about where you are "moving" on our site.
• Session duration: Google defines session duration as the time you spend on our site without leaving. If you have been inactive for 20 minutes, the session ends automatically.
• Bounce rate: A bounce occurs when you view only one page on our website and then leave it.
• Account creation: If you create an account or make a purchase on our website, Google Analytics collects this data.
• Location: Your country and approximate location can be determined via your IP address. This process is also known as IP geolocation.
• Technical information: Technical information includes, among other things, your browser type, your internet service provider, or your screen resolution.
• Referral source: Google Analytics—and we—are naturally interested in which website or advertisement led you to our site.

This list is not exhaustive and serves only as a general guide to data storage by Google Analytics. For more information about how Google processes data, please read Google's privacy policy: https://policies.google.com/privacy?hl=en

Purpose of data processing

We use Google Analytics to evaluate the use of our website and services, to compile reports on activities on our website and services, and to provide us with other services related to the use of our website, services, and the internet. We also use Google Analytics to evaluate data from AdWords and the DoubleClick cookie for statistical purposes. As a website and service operator, we have a strong interest in this analysis of user behavior in order to optimize both our website and the offers and advertising we place there.

The information generated by the cookie about your use of our website or services is generally transmitted to a Google server in the USA and stored there. If IP anonymization is activated, your IP address will be truncated by Google within member states of the European Union or other contracting states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there. By consenting to the use of cookies by Google Analytics, you also agree that your data may be processed in the USA, provided that the data transfer is not secured on the basis of standard data protection clauses. The USA is considered by the Swiss Federal Council to be a country with an inadequate level of data protection by Swiss standards. In particular, there is a risk that your data may be processed by US authorities for control and surveillance purposes, possibly without the possibility of legal recourse. If you click the "Reject All" button or make a limited selection that excludes Google cookies, the described transmission to Google will not take place. You can withdraw your consent at any time with effect for the future.

Google will use this information to evaluate your use of the website or services, to compile reports on website activity for us, and to provide other services related to website and internet usage. According to Google, they may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google's behalf. Google has contractually guaranteed that it will not associate your IP address with any other data held by Google. To ensure this, as well as the data processing performed on our behalf, we have entered into a data processing agreement with Google.

Storage duration / Right to object and removal

Cookies are stored on your computer and transmitted to our site from there. As a user, you have full control over the use of cookies. You can disable or restrict the transmission of cookies by changing your internet browser settings. Cookies that have already been saved can be deleted at any time. This can also be done automatically. If cookies are disabled for our website, you may not be able to use all of the website's features to their full extent.

You can object to the collection and processing of your data by Google Analytics by installing the browser add-on to deactivate Google Analytics (http://tools.google.com/dlpage/gaoptout?hl=en). This informs Google Analytics that no information about your website visit should be transmitted to them.

Furthermore, especially for mobile browsers, you can install an opt-out cookie on your device via this link https://developers.google.com/analytics/devguides/collection/gajs/?hl=en to prevent future data collection by Google Analytics on our website. Please note that if you delete the cookies on your device, you will need to reinstall the opt-out cookie.

Alternatively, you can also set your cookie preferences using the Cookie Hub consent tool we have integrated.

‍

2. Google Tag Manager

Description of data processing

Google Tag Manager is a solution provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter: "Google"), which allows marketers to manage website tags through a single interface. The Google Tag Manager itself (which implements the tags) is a cookie-free domain and does not collect any personal data. Google Tag Manager helps with the integration and triggering of other tags, code snippets, tracking codes, and conversion pixels on a website, which may in turn collect data. Google Tag Manager does not access this data. Google Tag Manager provides us with an easy-to-use user interface that requires no in-depth programming knowledge or modifications to the website's source code.

We use Google Tag Manager solely to display Google Ads (formerly Google AdWords) for our search engine marketing activities.

For more information on Google Tag Manager, see: https://www.google.com/intl/en/tagmanager/use-policy.html.

‍

3. Google Ads (formerly Google AdWords) & Google Ads Conversion Tracking

Description of data processing

We use Google Ads, a service provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, offered in Europe by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland, to display advertisements within our online services and to draw attention to our attractive offers on external websites using advertising materials.

This allows us to determine how successful individual advertising campaigns are. These advertisements are delivered by Google via "AdServers." Google AdWords uses cookies for this purpose (see the general information above). Setting these cookies enables an analysis of how our website is used. Each time you access one of the individual pages of our website that includes a Google Ads component, your internet browser is automatically prompted by the respective Google Ads component to transmit data to Google for the purpose of online advertising and commission billing. As part of this technical process, Google receives personal data, such as your IP address, which Google uses, among other things, to track the origin of visitors and clicks and subsequently enable commission settlements. The cookies used typically store the following information as analysis values: unique cookie ID, number of ad impressions per placement (frequency), last impression (relevant for post-view conversions), and opt-out information (a flag indicating that the user no longer wishes to be targeted). These cookies allow Google to recognize your web browser. If you do not agree to cookies being stored on your computer, please follow the general instructions for this or the instructions at the end of this explanation.

In addition, Google Ads uses "web beacons" (invisible graphics). These web beacons allow information such as visitor traffic on these pages to be evaluated.

The information generated by cookies and web beacons about your use of our website, including your IP address and the delivery of ad formats, is transmitted to a Google server in the USA and stored there. This information may be passed on by Google to Google's contractual partners (see https://support.google.com/admanager/answer/94149?visit_id=637060482444635472-69980806&rd=1). We have no influence over the data collected by Google, nor are we aware of the full extent of the data collection or the storage duration. To our knowledge, Google will not merge your IP address with other data stored about you. However, if you are logged into a Google account, your data may be directly associated with it. If you do not want this association with your Google profile, please log out before using our online services.

Further information on data protection at Google Ads can be found at https://policies.google.com/privacy?hl=en, as well as https://policies.google.com/technologies/ads?hl=en

Purpose of data processing

We store Google Ads cookies and web beacons based on our legitimate interest as a website operator in analyzing the reach of our services, displaying relevant and interesting ads, improving campaign performance reports, and ensuring fair advertising cost calculations, provided we have not requested your consent.

We have also entered into a data processing agreement with Google.

Right to object and removal

You can prevent the installation of Google Ads cookies in several ways: a) by adjusting your browser settings accordingly; in particular, blocking third-party cookies will prevent you from receiving ads from third-party providers; b) by disabling interest-based ads on Google via the link www.google.de/ads/preferences, though this setting will be deleted if you clear your cookies; c) by disabling interest-based ads from providers participating in the "About Ads" self-regulatory campaign via the link www.aboutads.info/choices, though this setting will be deleted if you clear your cookies; d) by permanently disabling them in your Firefox, Internet Explorer, or Google Chrome browser via the link www.google.com/settings/ads/plugin. Please note that if you do this, you may not be able to use all the features of our website to their full extent.

Alternatively, you can manage your cookie preferences using the CookieHub cookie management tool we have integrated.

‍

4. Amplitude

Description of data processing

To optimize our online shop and mobile payment app, we use the web analytics software Amplitude, a service provided by Amplitude Inc., 201 Third Street, Suite 200, San Francisco, CA 94103, USA ("Amplitude"). This process is used to evaluate and analyze user behavior and to compile reports on activities for us Data is captured in near real-time as soon as a user performs a specific action (e.g., clicking a button, loading a page, or completing a purchase). The following data categories are affected:

• Usage data: clicks, pages visited, time spent, feature usage.
• Device data: operating system, browser type, device type, screen resolution.
• Identifiers: pseudonymized user IDs, internal Amplitude IDs, IP address. A truncated IP address is processed in this context.

Cookies are also stored on your computer for this purpose.

The information generated in this way is transmitted to an Amplitude server in the USA and stored there. We have concluded a Data Processing Addendum with Amplitude, which includes standard data protection clauses as a mechanism for transferring personal data from Switzerland to the USA. Amplitude is certified under the Swiss/EU-US Data Privacy Framework, which mandates minimum standards for the protection of personal data of Swiss citizens whose data is stored or processed in the USA.

Further information on how Amplitude processes data can be found in Amplitude's privacy policy (https://amplitude.com/privacy).

Purpose of data processing

We use Amplitude to evaluate the use of our services, to compile reports on activities within those services, and to better understand how our services are used. This helps us identify areas for improvement and optimize our site performance and features. As a service provider, we have a strong interest in analyzing user behavior for product improvement purposes, so we ask for your consent to use Amplitude and store cookies.

Storage duration / Right to object and removal

If you do not want cookies to be stored, please adjust your internet browser settings to delete cookies, block all or specific cookies, or provide a warning before cookies are saved. You can also set your cookie preferences using the CookieHub cookie management tool we have integrated.

‍

IV. Further information on the procedures, plugins, and tools used for website design

1. SSL or TLS encryption

For security reasons and to protect the transmission of confidential content, such as orders or inquiries you send to us as the site operator, this site uses SSL or TLS encryption. You can recognize an encrypted connection by the fact that the browser's address line changes from "http://" to "https://" and by the lock symbol in your browser bar.

When SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

2. make.com

Description of data processing

To integrate various databases and web tools, we use make, a service provided by Celonis SE, Theresienstr. 6, 80333 Munich. make is a platform where different cloud-based software applications can be connected. Data required or processed in such linked applications is automatically transferred via these connections. The goal is to allow digital processes to run independently, especially standardized, recurring tasks. This creates an automated data flow and efficient workflows.

Further information on data protection at Celonis can be found at https://www.make.com/en/privacy-notice as well as https://www.celonis.com/de/privacy-notice/ 

Purpose of data processing

We use make.com to efficiently automate processes, integrate various services, and handle the associated import and export of personal and contact data.

‍

3. Language versions of the website (translations with Weglot) 

Description of data processing

On our website, we use the translation service Weglot, provided by Weglot SAS, 138, rue Pierre Joigneaux in Bois-Colombes 92270, France. Weglot is loaded when the website is accessed and allows you to set the website language using the corresponding language icons. By integrating the Weglot translation service, a connection is established between your browser and Weglot's servers when you visit our website, and your IP address and device information are transmitted to Weglot. The transmitted data is necessary for Weglot to function.  

Data processed through the use of Weglot is handled by Weglot as a data processor based on a data processing agreement within the European Union. 

Information on how Weglot handles personal data can be viewed at https://www.weglot.com/privacy .

Purpose of data processing

Data processing via Weglot is carried out for the purpose of providing our website in multiple languages, including a corresponding selection option for website visitors.

Right to object and removal

The use of the Weglot service is strictly necessary to provide the website in different language versions. 

You can exercise your right to object and removal as described in the general information in Part A .

4. Integration of YouTube content

Description of data processing

We occasionally use content and services from the video platform YouTube to embed video content on our website via a plugin or to link to videos on our YouTube channel. YouTube is a subsidiary of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States, provided in Europe by Google Ireland Limited
Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter: “Google”).

We may process data you enter on our YouTube channel (specifically your username and any content you publish under your account) if we respond to your posts or messages via our YouTube channel.

Otherwise, we only receive certain non-personal information from Google regarding post activity, such as the number of profile or media clicks and the watch time for a specific video. This data can be viewed via our YouTube account. Beyond this, data processing is carried out by Google under its own responsibility; we have no way to prevent or disable the use of analysis tools and similar features by Google within YouTube.

If you wish to play embedded videos using this plugin (by clicking the play button), your IP address is sent to YouTube, as YouTube cannot send the video content to your browser without it. The IP address is therefore necessary for display. Furthermore, information about which subpage of our website you visited is transmitted to the YouTube server. If you are logged into your YouTube account as a member, you also allow YouTube to associate your usage behavior directly with your personal profile when you play our videos. Further information on data processing by Google when using YouTube can be found in the policies applicable to YouTube: https://policies.google.com/privacy?hl=en&gl=en

Legal basis and purpose of data processing

The use of YouTube is based on our overriding interests in making content available on our website or linking to it, and in processing inquiries or comments.

Storage duration / Right to object and removal

To prevent your activity from being associated with your user account, log out of your YouTube profile before playing our video content. You must inform yourself about ways to restrict the processing of your data by Google via Google or within your YouTube user account. For example, you can do this in the general settings of your Google account under “Privacy and Security.” Additionally, on mobile devices (smartphones, tablets), you can restrict Google’s access to contact and calendar data, photos, location data, etc., in the device settings. However, this depends on the operating system you are using.

‍

5. Auth0

Description of data processing

For registration and login in our online shop, we use the cloud-based identity management platform Auth0, provided by Okta Inc., 10800 NE 8th Street, Suite 700, Bellevue, WA 98004, USA.

When users enter data into a form provided by Auth0, this data is exchanged directly between the user’s browser and Auth0. The following data is processed for identity management, authentication (login/registration), and user account security:

• Master data: Email address, name, and profile picture (if using social login).
• Security data: Password hashes, two-factor authentication (MFA) data, session tokens.
• Metadata: Login IP address, timestamps, browser/device used (for fraud detection).

Data collection occurs exclusively during the login or registration process and whenever a session is refreshed.

Further information on data processing at Auth0 can be found at https://www.okta.com/legal/privacy-policy/.

We have selected Europe as the server location for data storage. In cases where data transfer to the USA may be necessary, we base this on standard contractual clauses, which we have concluded together with a data processing agreement.

Purpose of data processing

Auth0 is integrated to ensure that only authorized and identified individuals gain access when using our services. Auth0 is also strictly necessary for providing the service as part of user account access.

Storage duration / Right to object and removal

If you prefer not to have cookies stored, you can adjust your internet browser settings to delete cookies, block all or specific cookies, or provide a warning before cookies are saved. You can also manage your cookie preferences using our integrated CookieHub tool.

‍

6. Datadog

Description of data processing

We use DataDog, a service provided by DataDog, Inc., 620 8th Avenue, 45th Floor, New York, NY 10018, USA (“DataDog”), as a data processor in accordance with Art. 4 No. 8 and Art. 28 GDPR.

We use DataDog to monitor system stability and analyze errors (such as unexpected deviations, anomalies including latency—i.e., the time delay in transmitting data to our servers—availability, and response times) on our websites and services, as well as for IT security purposes.

For this purpose, DataDog collects the following data on our behalf:

• Log data: Technical logs of server requests (includes user IP addresses).
• Performance data: App response times, error rates, error information, and crash reports (stack traces, i.e., the sequence of application events leading to an error, as well as the time the error occurred).
• Metadata: System configurations (e.g., browser type and version, operating system) and anonymized user IDs to track errors across various microservices.

This data allows DataDog to detect, analyze, and promptly resolve errors. The collected personal data may be transferred to and stored by DataDog in the USA. We have entered into a Data Processing Agreement with DataDog that includes standard contractual clauses. Furthermore, DataDog is certified under the Swiss/EU-US Data Privacy Framework, which serves as the basis for data transfers to certified companies and organizations in the USA.

For more information on how DataDog processes data, please refer to DataDog Inc.’s privacy policy: https://www.datadoghq.com/legal/privacy/

Purpose of data processing

After this period, only aggregated, non-personal data is retained.
This data is processed to ensure the error-free and demand-oriented operation of our websites and services, as well as for error detection and resolution.
DataDog is therefore necessary for providing our websites and services as part of user account access.

Storage duration / Right to object and removal

Data collected via DataDog is deleted or anonymized once the error analysis is complete.

‍

V. Links to third-party websites

Our website may contain links to other websites. We have no control over the content or design of third-party offerings. Therefore, these privacy notices do not apply to external providers whose content or services we merely link to.

If you are redirected to other sites via links on our pages, please inform yourself there about how your data is handled.

‍

VI. Online presence on social networks and platforms

Description of data processing

We maintain additional online presences on social networks and industry networks (such as Facebook, Xing, or LinkedIn) (hereinafter referred to as “SN”) and platforms (e.g., YouTube), which we link to from our website. Clicking on the respective buttons (identifiable by the logos of the social networks or platforms) will take you to the corresponding online presence of the SN. The purpose of these online presences is to communicate with active customers, interested parties, and users, and to provide them with information about our services.

When accessing these networks and platforms, the terms and conditions and data processing policies of their respective operators apply.

Since the use of SN occurs outside of our website and services, we have no influence over it, unless otherwise stated below. However, please be aware that when using the aforementioned platforms and networks we link to, data may also be processed by these SN companies in the USA. These operators may also process data for market research and advertising purposes, including the creation of user profiles. If you are logged into these networks and platforms, they may also store cookies on your device to track your use of our platform or services, as well as other information about your usage behavior.

Unless otherwise stated in our privacy policy, we only process user data when they communicate with us within these social networks and platforms, for example, by posting comments or sending us messages.

To make it easier for you to find information about data processing and your options for opting out, we have provided links to the privacy policies and information of the respective network operators below.

Purpose of data processing

We only process your personal data when you contact us directly via the respective SN or interact with our presence or content there. Unless otherwise stated in our privacy policy, we process user data based on our legitimate interest in effectively informing and communicating with users, provided they interact with us within these social networks and platforms (e.g., when users post on our pages or send us messages). If your contact is aimed at entering into a contract, the processing serves that purpose.

If personal data is processed beyond this in connection with our presence on an SN, and the respective SN alone determines the purposes and means of processing, that SN is the sole controller for such processing. Please carefully consider which personal data you share with us via an SN presence. If you wish to avoid having an SN process personal data you provide to us, please contact us through other means.

Storage duration / Right to object and removal

If you are a member of an SN where we maintain an online presence and do not want the SN to collect data about you via our site and link it to your member data, you must log out of the SN before visiting our site. For a detailed overview of the respective processing activities, information on how long data is stored by the SN, and your options for opting out, please refer to the provider information linked below.

Regarding requests for information or the exercise of user rights, please note that these are most effectively handled directly by the providers. Only the providers have access to user data and can take appropriate action or provide information. Should you still require assistance, you are welcome to contact us.

Facebook

We maintain a Facebook company page (“Fanpage”) on the SN operated by Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

Facebook Ireland and we are joint controllers for the collection of data from visitors to our Fanpage, which is why we have entered into additional data processing agreements:

• “Controller Addendum”: https://www.facebook.com/legal/controller_addendum
• “Data Processing Terms”: https://www.facebook.com/legal/terms/dataprocessing/update

We are responsible for providing data subjects with at least the information above and below. You can find Facebook’s information on the collection of personal data in the Facebook Ireland Data Policy at https://www.facebook.com/about/privacy.

Facebook Inc., Menlo Park, California, USA (hereinafter: Facebook Inc.) also collects and uses so-called Page Insights for analytical purposes. Page Insights are summaries of data that allow both us and Facebook Inc. to gain insights into how users interact with our page. Page Insights may be based on personal data collected in connection with our users' visits or their interactions on our page. For this purpose, we have entered into a “Controller Addendum” with Facebook (see above), which specifically regulates the security measures Facebook takes regarding Page Insights and how Facebook responds to user inquiries. The purposes for which the collection and transmission of personal data—which constitute joint processing—take place are set out in detail in the terms of use referenced by the aforementioned Controller Addendum.

Data collected during visits to our “Fanpage” also includes information about the types of content users view or interact with, or actions they take (see “Things you and others do and provide” in the Facebook Data Policy: https://www.facebook.com/policy), as well as information about the devices used by users (e.g., IP addresses, operating system, browser type, language settings, and cookie data, as described in detail under “Device Information” in the Facebook Data Policy: https://www.facebook.com/policy).

However, by maintaining our Facebook company page, we share responsibility for Page Insights. We have agreed with Facebook Ireland that they are responsible for fulfilling the rights of data subjects regarding the personal data stored by Facebook Ireland after joint processing. Therefore, we are required to notify Facebook if we receive any data protection inquiries regarding Page Insights. Please note that we will forward any inquiries concerning Page Insights to Facebook Ireland. For further details on your rights as a data subject, please refer toPart A. For more information on how Facebook Ireland processes personal data and how you can exercise your rights as a data subject with them, please see Facebook Ireland's Data Policy at https://www.facebook.com/about/privacy.  

Data collected via Page Insights is used to improve our websites and for advertising purposes. We maintain our Facebook fan page to communicate and easily channel contact requests from Facebook users. The collection and further processing of this data is in our legitimate interest as well as that of Facebook Inc.

Please be aware that we cannot enable or disable the Page Insights technology. We must therefore forward most related requests to Facebook Ireland, unless we have collected the data ourselves. If you do not want Facebook Inc. to collect your data, we ask that you do not use our Facebook company page, configure your browser to block cookies, and/or log out of Facebook while using our site.

Privacy Policy:

https://www.facebook.com/about/privacy/, https://www.facebook.com/legal/terms/information_about_page_insights_data

Opt-out options:

https://www.facebook.com/settings?tab=ads and http://www.youronlinechoices.com

LinkedIn

LinkedIn is a service provided by LinkedIn Corporation, 2029 Stierlin Court, Mountain View, CA 94043, USA, and operated in Europe by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. LinkedIn is an internet-based social network that allows users to connect with existing business contacts and build new ones. With over 400 million registered members in more than 200 countries, LinkedIn is currently the largest platform for professional networking and one of the most visited websites in the world.

Every time you visit our website, if it contains a LinkedIn component (plug-in), this component prompts your browser to download a representation of that component from LinkedIn. You can find more information about LinkedIn plug-ins at https://developer.linkedin.com/plugins. Through this technical process, LinkedIn learns which specific subpage of our website you are visiting.

If you are logged into LinkedIn at the same time, LinkedIn recognizes which specific subpage of our website you are visiting every time you access our site and for the entire duration of your visit. This information is collected by the LinkedIn component and associated with your LinkedIn account. If you click on a LinkedIn button integrated into our website, LinkedIn assigns this information to your personal LinkedIn user account and stores this personal data.

The LinkedIn component always informs LinkedIn that you have visited our website if you are logged into LinkedIn at the time you access our site; this happens regardless of whether you click on the LinkedIn component or not. If you do not want this information to be transmitted to LinkedIn, you can prevent it by logging out of your LinkedIn account before visiting our website.

LinkedIn offers the option to unsubscribe from email messages, SMS messages, and targeted ads, as well as to manage ad settings, at https://www.linkedin.com/psettings/guest-controls. LinkedIn also uses partners such as Quantcast, Google Analytics, BlueKai, DoubleClick, Nielsen, Comscore, Eloqua, and Lotame, which may set cookies. You can opt out of such cookies at https://www.linkedin.com/legal/cookie-policy. LinkedIn's current privacy policy is available at https://www.linkedin.com/legal/privacy-policy. LinkedIn's cookie policy is available at https://www.linkedin.com/legal/cookie-policy.

Privacy Policy: https://www.linkedin.com/legal/privacy-policy , 

Opt-out options:

https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out , 

XING

The operating company for Xing is XING AG, Dammtorstrasse 29-32, 20354 Hamburg, Germany ("XING").

Xing is an internet-based social network that allows users to connect with existing business contacts and build new ones. Users can create a personal profile on Xing. Companies can, for example, create company profiles or post job offers on Xing.

Each time you access a page on this website that is operated by the data controller and features an integrated Xing component (Xing plug-in), your internet browser is automatically prompted by the Xing component to download a representation of the corresponding Xing component from Xing. You can find more information about Xing plug-ins at https://dev.xing.com/plugins. Through this technical process, Xing learns which specific subpage of our website you are visiting.

If you are logged into Xing at the same time, Xing recognizes which specific subpage of our website you are visiting each time you access our site and for the entire duration of your visit. This information is collected by the Xing component and assigned to your respective Xing account. If you click on one of the Xing buttons integrated into our website, such as the "Share" button, Xing assigns this information to your personal Xing user account and stores this personal data.

The Xing component always receives information that you have visited our website if you are logged into Xing at the time you access our site; this happens regardless of whether you click on the Xing component or not. If you do not want this information to be transmitted to Xing, you can prevent it by logging out of your Xing account before accessing our website.

The privacy policy published by Xing, which is available at https://www.xing.com/privacy, provides information about the collection, processing, and use of personal data by Xing. Furthermore, Xing has published privacy information for the XING Share button at https://www.xing.com/app/share?op=data_protection .

Privacy Policy / Right to Object:

https://privacy.xing.com/de/datenschutzerklaerung  

‍

VII. Active use of our website

1. Contact forms and email contact

Description of data processing

Our website features a contact form that can be used for electronic communication. If a user takes advantage of this option, the data entered in the input mask is transmitted to us and stored.

• Company/Municipality (required)
• First name (required)
• Last name (required)
• Email (required)
• Phone (optional)
• Message (optional)

At the time your message is sent via one of our contact forms, the following data is also stored:

• The user's IP address
• Date and time of registration

If you contact us via an email address provided by us, the personal data of the user transmitted with the email will be stored.

If you provide a mobile phone number to receive updates on the status of your payment request, we will use the number you provided for this purpose.

We use HubSpot Forms on our website, a service provided by our CRM system HubSpot, to integrate contact forms and process the data entered there (see Part C, Section II). HubSpot Forms offers functionalities for SEO, content creation, lead management, email marketing, and analytics. The user data entered in the forms is stored in our customer relationship management system provided by HubSpot.

We use Google email services, which are provided via Google Workspace by Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland (hereinafter: "Google"). In addition to our CRM software, which serves as our central system for managing and processing inquiries, emails are also stored on Google's servers. We have selected the "Europe" region as our server location and have entered into a data processing agreement with Google. Any further transfer of these emails to third countries, particularly the USA, does not take place, which Google also contractually guarantees.

To channel and sort incoming inquiries, we use an interface to access AI-based services designed to understand and generate natural language and related inputs, analyze information, and make predictions.

• For this purpose, we use the ChatGPT language model from OpenAI Ireland Ltd, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland. We have agreed with OpenAI that our data will not be used for training models or shared with OpenAI. OpenAI's privacy policy can be viewed at https://openai.com/de/policies/eu-privacy-policy . We have entered into a Data Processing Addendum with OpenAI (see https://openai.com/policies/data-processing-addendum). Since data is transferred to the USA when using the OpenAI API, the Data Processing Addendum includes standard contractual clauses to ensure an adequate level of data protection even when data is transferred to a third country.
• In addition, we use the AI-powered system Google Gemini, offered by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Gemini was developed to provide advanced language and image processing capabilities. It uses machine learning to understand and generate natural language and analyze images, offering versatile applications in various fields. We use the Google Gemini model to pre-select emails and incoming documents. As Google Workspace customers, Google ensures that data used with Google Gemini is not used by Google to train its generally available AI models.

For spell-checking responses to incoming emails, we use the LanguageTool application, software from LanguageTooler GmbH,
Karl-Liebknecht-Str. 37, 14482 Potsdam, a subsidiary of Learno Inc., which includes AI features for checking spelling and grammar as well as refining phrasing. You can find the provider's privacy policy for LanguageTool at: https://languagetool.org/de/legal/privacy. LanguageTool stores checked records and the errors found within them on its servers for up to 15 minutes (not on permanent storage media). This storage occurs without an IP address or other information that would allow the data records to be linked to an individual. However, if the text contains personal data, this is also stored temporarily. We have entered into a data processing agreement with Learno Inc. that includes the standard contractual clauses required for data processing in the USA, by which the provider contractually commits to complying with applicable data protection regulations: https://languagetool.org/de/legal/dpa.

To read attached PDF or Word files, we use the software solution Airparser, located at Sepapaja tn 6, Tallinn 11415, Estonia. Airparser uses AI technology to identify and extract structured data. We have entered into a data processing agreement with Airparser, which contractually obligates them to comply with applicable data protection regulations (see https://airparser.com/dpa/). You can view Airparser's privacy policy at https://airparser.com/gdpr/ .

‍

Purpose of data processing

Data submitted via contact forms or email is processed based on our legitimate interests. If the inquiry is aimed at entering into a contract, the data will also be processed for the initiation and fulfillment of that contract.

We process personal data from the input form to handle inquiries and communicate with you. If you contact us via email, this also constitutes the necessary legitimate interest in processing the data. If you provide a mobile number for status updates regarding your payment request, we will use that number for this purpose.

We use AI-based services to improve the efficiency of our technical and operational processes, which is in both our interest and the interest of our users. Due to the high volume of incoming messages, we rely on this type of pre-selection and routing to the appropriate departments to ensure fast and targeted processing, which benefits both us and the individuals contacting us.

User information may also be stored in our Customer Relationship Management (CRM) system or similar inquiry management tools based on our legitimate interests.

Other personal data processed during the submission process helps us prevent misuse of the contact form and ensure the security of our IT systems.

Retention period / Right to object and erasure

Data is deleted as soon as it is no longer needed for the purpose for which it was collected. For personal data from contact forms or emails, this occurs once the conversation with the user has ended. A conversation is considered ended when the circumstances indicate that the matter has been fully resolved and there are no legal requirements for further storage.

Users have the right to withdraw their consent for the processing of their personal data at any time.

If a user contacts us, they may object to the storage of their personal data at any time. In such cases, the conversation cannot be continued unless we have another legal basis for processing or an overriding interest in continuing to process the data.

All personal data stored during the contact process will be deleted in such cases, provided there are no legal requirements for longer retention.

‍

2. Telephone Hotline

Description of data processing

If a user calls us using a number provided on our website, we collect the caller's phone number and other technical information from our phone system (start time and duration of the call), which is either generated there or provided by the telephone company. We also record the essential content of the conversation and any information provided to our staff (name, request, contact details for follow-up, etc.).

To pre-qualify incoming calls, we use an AI-powered software solution from Leaping AI UG (limited liability), Potsdamer Strasse 72, 10785 Berlin. This software is used to collect the data necessary to categorize the call, route it to the correct department, or answer user inquiries (specifically our reference number, ID, and the caller's name), and to automate certain customer requests. We have entered into a data processing agreement with Leaping AI for this purpose.

We will ask for your consent before recording any call. If you agree to have the call recorded, we will store the entire conversation and automatically generate a transcript. We use these recordings and transcripts for staff training, resolving customer complaints, creating anonymized internal reports (classifying calls and generating statistics on call reasons), and for evidentiary purposes in the event of legal claims or defenses.

For this, we use the cloud contact center platform Talkdesk, provided by Talkdesk Inc., 201 Spear Street, Suite 1100, San Francisco, CA 94105, USA ("Talkdesk"). We have entered into a data processing agreement with Talkdesk, including standard contractual clauses for data transfers to third countries, which contractually obligates Talkdesk to comply with applicable data protection regulations. We have also agreed with Talkdesk that our instance will be hosted in a European region, ensuring that our data is processed by default in a regional cloud within the European Union.

Zweck der Datenbearbeitung

Wir erfassen bei Annahme des Gesprächs automatisiert die für die Anrufabwicklung erforderlichen Daten zum Zwecke der Automatisierung und effizienteren Abwicklung von bestimmten Kundenanliegen bzw. Interaktionsbestandteile.

Wir speichern während des Gesprächs das Anliegen des Anrufers manuell in unserem System und speichern diese Gesprächsnotiz mit Gesprächsende ab. Eine Gesprächsaufzeichnung findet dabei nicht statt. 

Gesprächsaufzeichnungen und Transkriptionen werden ausschliesslich auf Basis einer vom Nutzer zuvor abgegebenen Einwilligung angefertigt und weiterbearbeitet.

Die Angaben der Nutzer können ferner auf Basis unserer Berechtigten Interessen in unserem Customer-Relationship-Management-System (CRM-Software) oder vergleichbarer Anfragenorganisation gespeichert werden.

Dauer der Speicherung / Widerspruchs- und Beseitigungsmöglichkeit

Die Daten werden gelöscht, sobald sie für die Erreichung des Zweckes ihrer Erhebung nicht mehr erforderlich sind. Dies dann der Fall, wenn die jeweilige Konversation mit dem Nutzer beendet ist. Beendet ist die Konversation dann, wenn sich aus den Umständen entnehmen lässt, dass der betroffene Sachverhalt abschliessend geklärt ist und keine gesetzlichen Vorgaben eine längere Speicherung bedingen.

Sofern keine gesetzliche Speicherfrist für Aufzeichnungen vorgegeben ist, orientiert sich die Dauer der Speicherung von Gesprächsaufnahmen und Gesprächsnotizen an den gesetzlichen Verjährungsfristen (Ansprüche auf Schadensersatz oder Genugtuung verjähren mit Ablauf von drei Jahren). Transkripte von Gesprächsaufnahmen werden nach 6 Monaten gelöscht.

Der Nutzer hat jederzeit die Möglichkeit, seine Einwilligung zur Bearbeitung der Personendaten zu widerrufen. Willigt ein Anrufer in die Aufnahme des Gesprächs, dessen Transkription und Speicherung dieser Aufnahme und des Transkripts ein, kann er diese Einwilligung jederzeit widerrufen. In einem solchen Fall werden die Aufnahmen bzw. Transkripte umgehend gelöscht, sofern keine gesetzlichen Vorgaben uns zu einer längeren Speicherung zwingen.

‍

3. Ticket-System

Beschreibung der Datenbearbeitung

Wir benutzen als Ticketsystem Freshdesk, eine Software-Lösung der Freshworks, Inc., 2950 S.Delaware Street, Suite 201 in San Mateo, CA 94403 USA. Freshdesk ist eine Kundenservice-Plattform, die die Bearbeitung von Kundenanfragen und -wünschen über verschiedene Kanäle erleichtert. Wir verwenden Freshdesk zur Annahme und Verwaltung von Kontaktanfragen. Stellen Sie über unsere Internetauftritte Kontaktanfragen über ein Kontaktformular oder kontaktieren Sie uns per E-Mail oder per Telefon werden die im Zuge der Kontaktaufnahme gemachten Angaben und Konversationsinhalte sowie von uns erhobenen Daten (siehe vorstehende Ziffern VII. 2 und VII. 3) im Ticketsystem gespeichert und organisiert, um eine chronologische Bearbeitung zu ermöglichen und das Serviceerlebnis zu verbessern.

Die gespeicherten Informationen werden auf Servern von Personendaten nach dem Umfang ihrer Bereitstellung, jedenfalls aber Name, Vorname und E-Mail-Adresse erhoben, an den Freshdesk übermittelt, dort gespeichert und ausgelesen. Wir haben von der Möglichkeit Gebrauch gemacht, die Bearbeitung der Daten auf Servern innerhalb der EU vornehmen zu lassen. Damit sollte technisch sichergestellt sein, dass die Daten innerhalb der Europäischen Union liegen und ein Zugriff durch US-Behörden nicht möglich ist.

Nähere Informationen zum Datenschutz bei Freshdesk finden Sie unter https://www.freshworks.com/privacy/.

Zweck der Datenbearbeitung

Wir bearbeiten die über Freshdesk erfassten Informationen auf Basis unseres berechtigten Interessen an der effizienten Ausgestaltung unseres Kundenservice und an der schnellstmöglichen Beantwortung Ihres Anliegens zum Zwecke der Unterstützung der Betreuung unserer Kundinnen und Kunden bzw. Nutzerinnen und Nutzer. Wir haben mit Freshdesk eine Vereinbarung zur Bearbeitung von Daten im Auftrag geschlossen, die den Schutz der Daten sicherstellen soll und insbesondere eine unberechtigte Weitergabe an Dritte untersagt.

Sofern im Einzelfall eine Datenübertragung in die USA erforderlich sein sollte, wird diese auf die Standarddatenschutzklauseln gestützt.

Dauer der Speicherung/Widerspruchs- und Beseitigungsmöglichkeit

Wir speichern Ihre Daten für die Dauer des Bestehens eines Vertragsverhältnisses zwischen uns und den Betroffenen bzw. bis zur Abwicklung der jeweiligen Konversation.

If you would like your personal data to be deleted, you can exercise your right to object and request erasure as described in the general information in Part A.

4. Chat feature

Description of data processing

The chat feature provided on our website uses an AI-powered chatbot from Decagon AI, Inc., 2261 Market Street, STE 5378, San Francisco, CA 94114, USA ("Decagon"). Decagon operates an AI platform that automates customer service processes using "agents." You can use the chat feature to ask and receive answers to frequently asked or general questions about our parking system or specific parking areas we manage (e.g., opening hours, rates), or to report issues at a parking area we manage so they can be forwarded to our customer support team.

As soon as you enter a question into the chat text field (a "prompt"), Decagon automatically analyzes the question and provides a text-based response from the agent. Generally, we do not need any personal information about you (such as names, email addresses, phone numbers, physical addresses, or license plate numbers) for this. Please refrain from voluntarily entering such personal data about yourself or others into the input field. We only collect and store such data if you provide it to us voluntarily.

For the purpose of displaying and technically operating the chat feature, the following technically necessary data is processed as part of log data when you use it:

• IP address
• Metadata regarding API requests
• Date and time of access

Processing by the chat feature is fully automated and only occurs once you send data into the chat. The agent works independently within clearly defined boundaries and does not make independent decisions that affect your rights or your access to our services. If a request requires human judgment or falls outside the AI agent's scope, it will be forwarded to one of our human support staff via a supervised process and stored outside of Decagon in our CRM or ticketing system for further processing.

Decagon has contractually guaranteed that user data provided via the chat feature will not be used to train other AI models. We have entered into a data processing agreement with Decagon that ensures data protection and prohibits unauthorized disclosure to third parties.

For more information on data protection at Decagon, please visit https://decagon.ai/legal/privacy.

Purpose of data processing

The purpose of processing is to support our customers and users by answering general questions or support requests. We process the information collected via Decagon based on our legitimate interest in providing efficient customer service and answering your requests as quickly as possible.

Furthermore, we have agreed with Decagon that data will be processed exclusively within the EU during the normal operation of the chat feature (EU data residency). If, in individual cases, data transfer to the USA is necessary for technical support of the chat feature and has been authorized by us, it will be based on standard contractual clauses.

Storage duration / Right to object and erasure

Any personal data exchanged during chats is stored for the duration of the legal relationship between us and the affected party, or until the respective conversation has been concluded.

If you would like your personal data to be deleted, you can exercise your right to object and request erasure as described in the general information in Part A.

‍

C. Data processing in connection with the use of MH PARKSERVICE parking lots

1. Use of the MH PARKSERVICE Online Shop

Description of data processing

Through our MH Parkservice online shop (hereinafter: “online shop”), you have the option to book and pay for the parking services described therein for parking areas managed by us, based on our applicable General Terms and Conditions. For example, you can pay your parking fees online.

We use cookies to make our online shop more user-friendly. Some elements of our website require the browser to be identified even after navigating to a different page. These cookies store information such as your language and region.

Cookies also enable us to analyze browsing behavior within the online shop. This allows us to collect data such as search terms entered, frequency of page views, and the use of website features.

To book parking services or pay for your use of a parking area, you must enter your vehicle license plate number into the designated input form, select your desired parking area if applicable, and/or provide a file number or reference. We require your license plate number and other details to assign the correct parking fee to your specific parking session or service.

Data processed during the booking process includes license plate information, the amount to be paid, and other communication, contract, and payment details of our customers, prospective clients, and other business partners. This processing is carried out for the purpose of providing contractual services as part of operating our online shop, as well as for billing, delivery, and customer service. During the booking process, we specifically process the information provided in the respective input forms, such as name, company, address, email, and telephone number. Mandatory fields are generally marked with an asterisk (*) or labeled as “optional,” and include the information necessary to provide and bill for the ordered service, as well as contact details so we can reach you or notify you of important information regarding your order (e.g., mandatory legal information, schedule changes, etc.).

We process and use the data collected here to enable you to select, book, and pay for our parking services. We also process this data to handle and, if necessary, ship your booking. Further details regarding the legal and organizational framework can be found in the underlying General Terms and Conditions. Details regarding the payment service providers we use can be found in Section 2 of this Part C.

Purpose of data processing

The processing of data collected during a booking is necessary for the intended conclusion of a contract, as well as to detect and combat harmful behavior, uncover and prevent other negative experiences, maintain the integrity of the online shop, and promote protection and security. Both we and other users of our services have an interest in preventing, detecting, or investigating illegal activities, fraud, or security breaches.

We process the personal data from the input form to handle your booking and provide the respective parking service.

The processing of data entered in the online shop may also be based on your consent, if we have requested it. You can revoke your consent at any time. The legality of any data processing already carried out remains unaffected by the revocation. Please note that as a result of your revocation, we may not be able to provide the full booking process, and your booking may no longer be able to be completed.

Storage duration / Right to object and erasure

Data will be deleted as soon as it is no longer required for the purpose for which it was collected. For personal data from the booking input form, this is the case once a contract for our parking services has been concluded and the respective service has been fully provided. As a rule, however, we retain contract-related data until the expiration of statutory warranty obligations. In the event of a statutory archiving obligation, the affected data will be deleted after the relevant period has expired.

‍

2. Use of payment providers in order processing (“payment services”)

Description of data processing

If you are required to provide us with your payment details (e.g., account number for direct debit) after concluding a paid contract for parking services, this data is required for payment processing.

To ensure modern, simple, and secure payment processing, we offer our customers various payment options for which we use banks, credit institutions, and other payment service providers (hereinafter collectively: “payment service providers”).

Payment transactions via common payment methods (e.g., Visa/MasterCard) are carried out exclusively via an encrypted SSL or TLS connection. You can recognize an encrypted connection by the fact that the browser's address bar changes from “http://” to “https://” and by the lock icon in your browser bar.
With encrypted communication, your payment data transmitted to us cannot be read by third parties.

If you have chosen the payment services of a specific payment service provider as your payment option, they will provide their services based on a contract concluded between you and the payment service provider, in accordance with their applicable terms and conditions. The data processing carried out by these providers is their responsibility; we have no influence over this. Accordingly, if you wish to assert your rights as a data subject in this context, we must refer you to the respective payment service provider. The payment service provider may ask you for additional consent, e.g., to perform an identity or credit check. Personal data processed by payment service providers generally includes first and last name, address, date of birth, gender, email address, IP address, telephone number, and data necessary for processing the payment related to the order, such as the number of items, item numbers, invoice amount and tax percentages, or bank details required to execute the transaction (e.g., account or credit card numbers, passwords, TANs, and checksums), as well as contract, total, and recipient-related information.

The payment service provider processes this data for the purpose of offering the respective payment method, as well as for any necessary identity and/or credit checks, payment administration, and fraud prevention.

Purpose of data processing

Your data is transmitted to the payment service providers we use to fulfill the contract concluded with us and for the purpose of effective and modern processing of online payment transactions, unless we ask for your consent. You have the option to revoke your consent for data processing by payment providers at any time with effect for the future. A revocation does not affect the validity of data processing operations that took place in the past.

‍

Adyen

For certain payment methods, we use the payment service provider Adyen N.V., Simon Carmiggeltstraat 6, 1011 DJ, Amsterdam, Netherlands (hereinafter: "Adyen"). If a payment via Adyen is selected, personal data is automatically transmitted to Adyen. The personal data transmitted to Adyen generally consists of the card type (e.g., Visa or Mastercard), the cardholder's name, card number, security code, and expiration date. Adyen's role is to request authorization for the transaction from the respective payment system, such as Mastercard or Visa, and to send this authorization to the buyer's bank for approval. If the bank approves, Adyen is notified by the relevant payment system and processes the payment to our bank. Adyen processes your data for payment processing as well as for identity and credit checks. In this case, Adyen processes your personal data as a controller. We therefore have no influence on Adyen's subsequent data processing.

You can find information from Adyen regarding data protection at: https://www.adyen.com/de_DE/privacy-policy, and for transaction processing at https://www.adyen.com/de_DE/privacy-policy/transaction.

‍

Stripe

For the online processing of payments for services we provide, we use Stripe, an online payment service provided by the technical service provider Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland ("Stripe").

If you have chosen Stripe as your payment method, the information provided during the ordering process, along with information about your order and any information required depending on the payment method (name, address, email address, customer number, order number, bank, account number, bank code, credit card number if applicable, credit card expiration date, credit card security code (CVC), invoice amount, currency, transaction number, date and time of the transaction, location, name of the provider), will be passed on to Stripe. The data is passed on exclusively for the purpose of payment processing with Stripe and only to the extent necessary for this purpose. We cannot process a payment via Stripe without the transmission of your personal data.

Stripe acts in a dual role as both a controller and a (sub-)processor for data processing activities. As a controller, Stripe uses your transmitted data based on its applicable terms and conditions to perform the contractual relationship regarding payment processing between you and Stripe and to fulfill regulatory obligations. We have no influence on this process. You can find Stripe's privacy policy with further information here: https://stripe.com/de/privacy

Stripe acts as a processor to complete transactions within payment networks. Within the scope of the data processing agreement, Stripe acts exclusively according to our instructions and has been contractually obligated to comply with data protection regulations in accordance with Art. 9 GDPR.

‍

secuPay

We offer cashless payment methods from secupay AG (Goethestr. 6, 01896 Pulsnitz; "secupay") in our online shop. Secupay is a payment institution within the meaning of the Payment Services Supervision Act (ZAG) and is registered with the Federal Financial Supervisory Authority (Graurheindorfer Str. 108, 53117 Bonn; "BaFin") (registration number: 126737), enabling cashless payment for products and services on the internet. When using secupay as a payment method, the purchase price claim is assigned to secupay. This enables online shop operators to deliver goods, services, or downloads to the customer immediately after the order. If "direct debit," "invoice," or "credit card" is selected as a payment option via secupay during the ordering process, your data is automatically transmitted to secupay. During payment processing via secupay, payment data is transmitted to secupay. secupay then carries out a technical check of the payment default risk. The transaction result is then automatically communicated to us. The personal data exchanged with secupay includes your first name, last name, address, email address, IP address, telephone number, or other data necessary for payment processing.

The personal data exchanged between secupay and us may be transmitted by secupay to credit agencies. The purpose of this transmission is identity and credit verification. secupay may pass on personal data to affiliated companies and service providers or subcontractors if this is necessary to fulfill contractual obligations or if the data is to be processed on our behalf. This data processing is carried out under the sole responsibility of secupay. We have no influence on this. You have the option to revoke any consent given to secupay regarding the handling of personal data at any time. A revocation does not affect personal data that we are mandatorily required to process, use, or transmit for (contractual) payment processing. The applicable data protection provisions of secupay can be accessed at https://www.secupay.com/de/datenschutz .

‍

Planet (Datatrans)

For our online shop, we use the "Datatrans" payment gateway from Planet Payment Group Holdings Limited, IDA Business Park, Dangan, Galway H91A06C, Ireland, as well as the acquiring services provided through it for the processing, handling, and settlement of cashless payments for products and services via our webshop by Planet Merchant Services SAS, 1 Terrasse Bellini, Puteaux, 92919, Paris La Défense Cedex, France, which is registered as a payment institution with the Autorité de Contrôle Prudentiel et de Résolution (registration number: 83991), using the payment categories we accept (Mastercard/Maestro, Visa, Twint). Planet Payment Group Holdings Limited and Planet Merchant Services SAS are hereinafter referred to as "Planet".

Planet acts in a dual role as both a controller and a (sub-)processor for data processing activities.

The gateway processes the technical data required for the real-time transmission of payment transaction data between a payment channel and Planet. We have entered into a data processing agreement with Planet for this purpose.

As the data controller, Planet uses your transmitted data to fulfill regulatory obligations and to process the payment. The transaction is handled exclusively between you and the originating website by charging the payment method stored with Planet. If you choose a payment method offered via Planet, the information provided during the checkout process—along with your order details and any information required by the specific payment method (e.g., name, address, email address, customer number, order number, bank, account number, sort code, credit card number, expiry date, CVC, invoice amount, currency, transaction number, date and time of the transaction, location, and provider name)—will be passed to Planet via the gateway. This data is shared solely for the purpose of processing the payment with Planet and only to the extent necessary. We cannot process payments via Planet without transmitting your personal data. Planet provides its acquiring services based on its own applicable terms and conditions. Planet has full control over these terms.

Processing this personal data is necessary to provide services such as payment processing, credit checks, availability information, fraud prevention, and the handling of complaints and refunds, as well as to comply with regulatory requirements.

You can find information on data protection at Planet here: https://www.weareplanet.com/privacy-policy and https://www.planetpayment.com/en/privacy/

‍

3. Using MHP Online Shop reviews

Description of data processing

We use the review portal "Trustpilot," operated by Trustpilot A/S, Pilestraede 58, 5th Floor, 1112 Copenhagen, Denmark. Trustpilot allows users to rate our products and services.

When a parking service is purchased online via our shop and the receipt is sent by email, we include a Trustpilot button in that email containing a unique link generated by Trustpilot. We maintain an interface ("API") with Trustpilot to create these invitation links. Clicking this link redirects you directly to the Trustpilot review platform. When you click the button with the invitation link, the Trustpilot form is automatically populated with your data, allowing you to submit your review on the portal. The review is verified based on the reference number linked to the generated URL. Submitting a review is entirely voluntary.

We transmit the following data to Trustpilot for this purpose:

• Email address
• First and last name
• Reference number
• Language and country-specific domain of our shop, access data (including IP address)
• Selected parking service

We use Trustpilot as a data processor and have contractually obligated them to handle your data in compliance with data protection laws through a data processing agreement.

Please note that you need a Trustpilot user account to submit a review. Once you submit your review and agree to Trustpilot's terms of use, Trustpilot becomes the data controller for the further processing and publication of your review. You can find details on data protection at Trustpilot here: https://de.corporate.trustpilot.com/legal/for-businesses/privacy-policy.

Purpose of data processing

Data is processed to generate invitation links and to verify the authenticity of shop usage for Trustpilot's review process. This, along with gathering user feedback to improve our services, constitutes a legitimate interest.

Storage duration / Right to object and erasure

Invitation data for Trustpilot is stored for a period of one year.

4. Use of parking areas managed by MH Parkservice

Description of data processing

When using our parking areas, the following data is automatically recorded: vehicle license plate (including front and rear views of the vehicle), entry/exit time, date and location stamp, and the amount and method of payment for the parking fee.

Before leaving the parking area, you must enter your vehicle license plate number at the payment machine, unless you have a permanent parking permit. Once the entered license plate is found in our database, the parking fee will be calculated and paid by the user. For details on data processing for payments made via our online shop, please refer to Part C, sections 1 and 2 and the applicable terms and conditions.

In the event of a breach of the General Terms and Conditions, we will also process all personal data of the vehicle owner and the driver that is relevant for legal enforcement, particularly for the collection of any incurred contractual penalties and/or the assertion of property and ownership rights ("follow-up").

If you receive a demand for payment as the registered owner of a vehicle involved in a parking violation, your license plate was previously transmitted by us to the locally responsible authority for owner inquiries (the road traffic office of the respective canton or the eAutoindex portal provided by the cantons). If you are not the owner of the vehicle, your data was provided to us by the vehicle owner or another third party (e.g., a vehicle rental or leasing company) who confirmed to us that you were the driver at the time of the parking violation. If you no longer reside at the address registered with the authority responsible for owner inquiries, we have obtained your data through the person currently registered at that address, a credit agency, or a collection agency.

To process the collective documents containing owner data received from the responsible authorities and to split data records by owner, we use the ConvertAPI platform provided by UAB Baltsoft, Kosciuskos 26-17, Vilnius, LT-01100, Lithuania. This tool is used to process PDF files and, if necessary, to convert files into other formats (e.g., PDF to DOCX). In this process, the personal data contained in the documents—usually the name and address of the registered owner—is processed on the provider's servers. The data streams exchanged between us and ConvertAPI are fully encrypted. ConvertAPI has committed to us to comply with applicable data protection standards https://www.convertapi.com/static/docs/compliance/PP_DPA.pdf and has been ISO 27001 certified by TÜV Thüringen (https://www.convertapi.com/compliance).

Purpose of data processing / Data recipients

The collected data is processed to safeguard the legitimate interests of the parties in operating the parking area and related industry-standard administrative activities, as well as to fulfill the services provided in accordance with the General Terms and Conditions (e.g., calculating and billing parking fees, verifying parking permits, reconciling payments made via app or online portal, and monitoring compliance with maximum parking durations, free parking periods, or grace periods).

Owner-related data (specifically name and address) is retrieved from the responsible authority or agency by forwarding the license plate number ("owner inquiry"). Driver data may be requested via the identified vehicle owner, vehicle rental, or leasing company and may also be passed on to third parties for the aforementioned purposes (e.g., lawyers, collection agencies). For the technical operation of parking equipment and software, as well as for the follow-up of violations of the General Terms and Conditions, data is processed by MH Parkservice and its contractors (Peter Park System GmbH (operation of parking equipment and software) and Amazon Web Services EMEA SARL (data storage)). This processing is carried out for the performance of the contract or to pursue legitimate interests in protecting the property and ownership rights of MH Parkservice and third parties, their legitimate interest in ensuring the proper operation of the parking areas, and to expedite vehicle processing within the parking area.

Storage duration / Obligation to provide data / Right to object and erasure

The personal data we collect will be deleted after all existing claims arising from and in connection with the use of the parking area have been settled and after all statutory retention or limitation periods have expired. If there is no violation of the General Terms and Conditions of the parking area and the user leaves the parking area within the grace period applicable from entry, the user's data will be automatically deleted 48 hours after exiting the parking area, provided there are no statutory retention obligations to the contrary.

Providing your data when using the parking lots we manage is contractually stipulated under the respective General Terms and Conditions or is strictly necessary for the conclusion of the contract. Without providing your data, it would not be possible to execute the underlying legal relationship and the services provided within the scope of parking space management. However, we do not use your data for automated decision-making, including profiling. Since the collection of data and its further processing is strictly necessary, there is no right for users to object. As license plate recognition occurs upon entry to the parking area, it is generally possible—provided the structural conditions allow—to turn around prematurely to avoid data collection.

‍

5. Activation of parking permits

Description of data processing

For some of the parking areas we manage, parking permits can be requested via terminals or online booking forms (via the MH Parkservice website, online, or, for example, at local retail stores or institutions), such as for designated parking spaces for specific groups (e.g., employees, visitors, or customers) and/or free parking periods, in accordance with the conditions applicable on-site for the respective parking area.

To do this, you must enter the data required in the respective input form. Entering the vehicle license plate number is always mandatory. In some cases, additional information may be required to verify membership in an authorized group, such as employee ID numbers. This information may be transmitted to our clients or their customers to verify eligibility or may be cross-referenced with data provided by them.

‍

Purpose of data processing / Data recipients

The processing of data collected during a booking is necessary for the intended conclusion of a contract, and otherwise for the purpose of effectively managing parking permits and supporting the provision of the respective parking service.

To the extent that a comparison with other data is required to validate eligibility, or for the processing of additional data provided in the form, this may also be based on your consent. You may revoke your consent at any time. The legality of data processing already carried out remains unaffected by the revocation. Please note that as a result of your revocation, we may not be able to provide the full booking process, and the booking made may no longer be able to be carried out.

‍

Storage duration / Obligation to provide data / Right to object and erasure

Data is deleted as soon as it is no longer required for the purpose for which it was collected. For personal data from the input form, this is the case once a contract for our parking services has been concluded and the respective parking service has been fully provided. As a rule, however, we retain contract-related data until the expiry of statutory warranty obligations. In the event of a statutory archiving obligation, the affected data will be deleted after the period has expired.

‍

6. Parking areas with free parking options for people with disabilities

Description of data processing

For some of the parking areas we manage, we offer a special arrangement allowing people with disabilities to park free of charge in designated spaces during their stay. To take advantage of this, eligible users must provide us with proof of a disabled parking permit (e.g., the blue disabled parking card).

In detail, the eligibility for this option must be verified in accordance with the conditions posted at the parking area where such free parking is offered. This can be done, for example, by scanning a QR code on the corresponding sign, visiting our website, and submitting the parking permit via the input form provided there.

‍

Purpose of data processing

Data collected during a booking is processed for the purpose of entering into a contract, and otherwise for the effective management of parking permits and to support the provision of the respective parking service. If we process health data, which is considered sensitive personal data, we will obtain your consent to do so.

‍

Storage duration / Obligation to provide data / Right to object and erasure

The proof of a disabled parking permit is checked exclusively for the purpose of verifying eligibility and is deleted immediately after the parking process has been completed.

‍

7. Using the MH Parkservice portal

Description of data processing

We offer users of the parking lots we manage the opportunity to submit support requests (questions, objections to payment notices, or clarification of other concerns), view information on parking violations including supporting images and payment options, or access other customer-specific information via our service portal (https://service.mh-parkservice.ch/).

The portal can be accessed via our website using a QR code provided to users (e.g., as part of a payment notice). After authentication, you can access the PCN portal. During the authentication process, the user provides the following personal data:

• Reference number
• License plate number

For technical reasons, a limited amount of data (so-called connection data) is collected every time the portal is accessed. This data is technically necessary to establish and maintain a connection between the user's device and our servers. Furthermore, this data is required to maintain the session after login and to prevent unauthorized access to this session. During each login process and while using the customer portal or the portal, we or our hosting service provider store the IP address and the time of the respective user action (timestamp), the internet service provider, the web browser and operating system used (or their respective version information), language settings, the referrer URL, and the name of the page accessed.

Once you log in to the PCN Portal, a cookie is set to maintain and protect your session. You must allow this cookie in your web browser to use the portal.

If a solution to a problem reported via the PCN Portal or an answer to a question requires the involvement of other partners or service providers, we will share the information related to your request or incident with them.

Purpose of data processing

Data processed during your use of the PCN Portal, including inquiries submitted or downloads accessed, is handled as part of our contract with you regarding parking space usage. This also helps us provide an effective way to contact and communicate with our support teams, manage and resolve incoming requests, and ensure a secure connection between your devices and our servers.

Storage duration / Right to object and erasure

Data is deleted as soon as it is no longer needed for the purpose for which it was collected. For personal data entered during login, this is generally once the specific usage session has ended.

Any personal data stored when you contact us will be deleted no later than when legal requirements no longer mandate further storage (such as statutory warranty periods related to support requests).

‍

8. Invoicing

Description of data processing

To create, send, document, and account for invoices, we use the cloud-based accounting software sevDesk, provided by sevDesk GmbH, Hauptstrasse 115, 77652 Offenburg. In this process, the invoice recipient's contact details are processed by sevDesk. You can view the sevDesk privacy policy at https://sevdesk.de/datenschutz/.

Purpose of data processing

We use sevDesk for the aforementioned purposes to fulfill our legal obligations, for contractual purposes, and to support our legitimate interest in efficient accounting. We have entered into a data processing agreement with sevDesk, which obligates them to comply with applicable data protection requirements.

Storage duration / Right to object and erasure

We store your data for the duration of our contractual relationship and until the end of the statutory retention periods for accounting-related documents.

If you would like your personal data to be deleted, you can exercise your right to object and erasure as described in the general information in Part A.

‍

D. Contractual relationships with business customers and partners

‍

I. Am I required to provide data?

When you ask us about our services, enter into contract negotiations, accept one of our offers, or enter into other contractual agreements with us, we process the personal data you provide in this context. The specific data processed depends largely on the relevant products or services you are requesting or purchasing from us. In this context, processing your data is generally essential for preparing, concluding, and executing the contract. If you do not provide this data, we may have to decline to enter into a contract or fulfill an order, or we may be unable to carry out an existing contract.

When we use data as part of initiating or fulfilling a contract with a business client, business partner, or cooperation partner, our interest in handling your data lies in enabling and maintaining our interaction with that client or partner, typically within the scope of a contractual or other relationship. If you are acting as a contact person—typically in your capacity as an employee of these companies—you generally do not have an overriding interest to the contrary, provided that this interaction is part of your job responsibilities, which means a right to object usually does not apply.

However, you are not required to provide consent for the processing of data that is not relevant to the fulfillment of the contract or not required by law.

‍

II. CRM System ("HubSpot")

Description of data processing

We use features of the Customer Relationship Management (CRM) system HubSpot. HubSpot is a software solution provided by HubSpot Inc., 25 First Street, 2nd Floor, Cambridge, MA 02141, USA, and offered in Europe by HubSpot Ireland Limited, 2nd Floor, 30 North Wall Quay, Dublin 1, Ireland. HubSpot is an integrated software solution that we use to cover various aspects of our online marketing. This includes, among other things: email marketing, social media publishing & reporting, analytics, contact management (e.g., user segmentation & CRM), landing pages, and contact forms.

We use HubSpot to manage and implement inbound marketing in connection with various features of our online presence. The stored information is kept on HubSpot's servers. We may use the processed data to gain detailed insights into how our online presence is used, to get in touch with visitors to our website, and to determine which of our company's services are of interest to them.

HubSpot uses "web beacons" (invisible graphics or code) and cookies that are embedded in websites or emails and stored on users' devices. This tracks the IP address, geographic location, browser type, duration of the visit, and the pages accessed.

Furthermore, HubSpot collects data entered by the user when they (a) subscribe to our newsletter or (b) fill out one of our contact forms.

For more information on data protection at HubSpot, please visit https://legal.hubspot.com/de/privacy-policy.

Purpose of data processing

We use the information collected via HubSpot based on our legitimate interest in optimizing our marketing, analyzing the use of our online presence, continuously improving it to make it more user-friendly, and providing our users with more targeted information.

Right to object and removal

Users can prevent the storage of cookies by adjusting their browser settings. If a user wishes for their other personal data to be deleted, they can exercise their right to object and removal as described in the general information under section A.

Alternatively, you can set your cookie preferences using the CookieHub cookie management tool we have integrated.

‍

III. Communication

In principle, we collect the necessary data directly from you during personal contact. However, you are also welcome to contact us by phone, fax, mail, or via our provided email address (see legal notice) or any other email addresses of our employees that you may have. In the latter case, the personal data transmitted with the email will be stored. Please note that communication via email is unencrypted for technical reasons.

Your data will be used to process the conversation and follow up on the respective inquiry or meeting content. If the communication is related to the fulfillment of a contract or is necessary for the implementation of pre-contractual measures, we will process your data for these purposes.

In all other cases, processing is based on our legitimate interest in effectively handling the inquiries we receive.

In this context, data is not shared with third parties unless it is necessary for the performance of a contract, the pursuit of our claims or legitimate interests, or if there is a legal obligation to do so.

‍

IV. Data processing in the context of sales

Personal data is processed to provide the services you request from us, in particular to fulfill our contracts or pre-contractual measures, as well as for all activities necessary for the operation and administration of MH Parkservice .

The resulting purposes of data processing are primarily based on the specific activities and individual services agreed upon with you and may include, among other things, consulting services or activities related to managing sales processes (e.g., compiling documents, sending MH Parkservice product or event information, providing services through MH Parkservice) or supporting sales negotiations and contract conclusions.

Further details regarding the scope, purpose of data processing, and recipients of your data can be found in the respective contract documents and associated terms and conditions.

To the extent necessary for our business operations, we process your data in connection with our services beyond the actual fulfillment of the contract to protect our legitimate interests.

In connection with the offer or provision of our services, we may be subject to specific legal obligations, such as tax law requirements. The purposes of processing your data may therefore include, among other things, compliance with tax-related monitoring and reporting obligations, customs or export regulations, as well as risk assessment and management.

‍

V. Newsletter

Description of data processing

We would like to keep our business clients and interested parties regularly informed via email or other electronic notifications about our services and other products, offerings, webinars, updates, or news from MH Parkservice (hereinafter referred to as the “Newsletter”). For this, we require your email address. Additional information may be requested in the respective newsletter sign-up forms to provide you with personalized content tailored to your interests.

You can sign up for our newsletters by using the corresponding function in a sign-up form or by checking a box (so-called opt-in) during a registration process. We provide various options on our websites or within sign-up and order interfaces for you to register for our (potentially topic-specific) newsletters. Details regarding the specific content of the newsletters are described in the respective sign-up form. This description is authoritative for your consent.

After signing up, you will receive an email from us asking you to confirm your newsletter subscription (the so-called double opt-in procedure). This confirmation is necessary to ensure that no one else has misused your email address to sign up for our newsletter. Your email address will only be activated for newsletter delivery once you click the hyperlink provided in that email.

To manage registrations and send emails related to our newsletter, we use the service MailChimp, provided by the US company Rocket Science Group, LLC, 675 Ponce De Leon Ave NE #5000, Atlanta, GA 30308, USA (hereinafter “MailChimp”), which allows us to easily and conveniently automate the registration process and the necessary email delivery. Since MailChimp’s IT system is located in the USA, the registration data from the input forms is transferred to and processed in the USA. To ensure appropriate handling of the data we transmit, we have entered into a data processing agreement with MailChimp, including standard contractual clauses for data transfers to third countries. Further information on how MailChimp handles personal data can be found at: https://mailchimp.com/legal/privacy/.

For verification purposes, your IP address and the date of registration (“timestamp”) are stored alongside your email address and name for newsletter delivery.

Legal basis and purpose of data processing / Data recipients

The legal basis for sending newsletters is the consent you provide as a recipient in accordance with Art. 3 of the Swiss Federal Act against Unfair Competition (UWG). If consent is not required under applicable law, data processing is based on our legitimate interest in direct marketing measures.

Logging of the registration process is based on our legitimate interest in a secure and targeted newsletter system that meets both our business sales interests and the expectations and needs of the recipients, as well as the ability to provide proof of the consent given.

Storage duration / Right to object and erasure

You can unsubscribe from our newsletter at any time or revoke your consent to receive it, either in full or in part. You will find an unsubscribe link at the bottom of every newsletter. You can also contact us directly using the contact details provided at the beginning of this document.

Unsubscribing from the newsletter does not affect our business communication. Your data will remain stored if it is required for the performance of a contract. Furthermore, we reserve the right to store the necessary evidence to prove that our newsletter distribution complies with legal requirements until the statutory limitation periods have expired.

‍

VI. Data transfer

Depending on the scope of the services provided, your data or documents may be shared with public authorities, private service providers, or individuals with whom we regularly collaborate during the inquiry, quotation, or contract execution phases (see Part A, section V).

‍

E. Other

As we continue to develop our website, services, and other offerings, or due to changes in legal or regulatory requirements, it may become necessary to update this privacy policy. You can access and print the current version of our privacy policy on our website at any time.

‍

Privacy Notes (Valid since 30/03/2026)

These Privacy Notices are intended to provide an overview of what happens to your personal data (hereinafter also: “data”) in our company and to inform you about the data-protection claims and rights to which you are entitled within the meaning of the European General Data Protection Regulation (“GDPR”), the German Federal Data Protection Act (Bundesdatenschutzgesetz – “BDSG”), and the Telecommunications-Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutzgesetz – “TDDDG”). We therefore ask you to take note of these Privacy Notices and, if necessary, to print them out or save them.

Personal data means any data by which you can be personally identified. The processing of your personal data may take place for various purposes. Essentially, the data processing activities carried out by Mobility Hub Parkservice GmbH (hereinafter also “MH Parkservice” or “we”) can be divided into the following areas of application:

• General: General information on data protection, data processing operations and data subject rights that applies to all data processing operations carried out by us can be found in Part A below.
• Our online presences: In connection with our website https://www.mh-parkservice.de/ (hereinafter: “Website”) or related external online presences—such as our social media profiles, our service portal (https://service.mh-parkservice.de/) or our subsequent payment service (https://parken.mh-parkservice.de/)—from which we refer to these Privacy Notices (Website and external online presences jointly also: “Online Presences”), we process data of visitors exchanged between their internet-enabled devices and the server operated by us, as well as data that is provided to us when using the Website. Details can be found in Part B.
• Parking area users: For information on the processing of data of users of parking areas managed by us—for example in connection with payment processes via the MHP Online Shop or our subsequent payment service, the pursuit of parking violations by MH Parkservice, or viewing details of parking violations via our service portal—please refer to Part C.
• B2B: For the purpose of performing or initiating contracts, we process the data of our business customers and prospective customers that is required for this. Data of our business partners and supplier data is used exclusively for the direct placement, processing and/or performance of orders. More information can be found in Part D.

Please refer to the individual sections if you wish to quickly obtain context-specific information on particular processing situations.

A. General information on data protection and data subject rights

I. Who is responsible for data processing and whom can you contact with questions?

The controller within the meaning of the General Data Protection Regulation and other national data protection laws of the Member States, as well as other data protection provisions, is:

Mobility Hub Parkservice GmbH
Nördliche Münchner Straße 27a
82031 Grünwald, Germany
Tel.: +49 89 2778299 51
E-mail: info@mh-parkservice.de

If you have questions about data protection, you may contact our Data Protection Officer using the following contact details:

Richard Metz
External Data Protection Officer (TÜV certified) / Attorney-at-law
LLP Data Protect GmbH
Würmtalstraße 20a (postal address)
81375 Munich, Germany
Email: datenschutz@mh-parkservice.de

II. What are your rights regarding your personal data?

If we process your personal data, you are a “data subject” under the GDPR and may have the rights listed below. If you would like to exercise these rights with MH Parkservice as the controller, please reach out to us using the contact details provided above.

1. Right of access

Under Art. 15 GDPR, you can ask us to confirm whether we are processing your personal data and request details about the scope of that processing.

2. Right to rectification

If your personal data is incorrect or incomplete, you have the right to have it corrected or completed as per Art. 16 GDPR.

3. Right to erasure

If the requirements of Art. 17 GDPR are met, you can request that we delete your data if we are processing it unlawfully or if the processing unfairly impacts your protected interests. Please keep in mind that there may be legal reasons, such as mandatory retention periods, that prevent us from deleting your data immediately.

Regardless of any request for erasure, we will delete your data completely once the purpose for processing it has ended, unless we are legally required or contractually obligated to keep it for a longer period.

4. Right to restriction of processing

In the situations outlined in Art. 18 GDPR, you can ask us to restrict the processing of your data. If processing is restricted, we may only store your data and process it with your consent, for legal claims, to protect the rights of another person, or for important public interest reasons.

5. Right to data portability

Under Art. 20 GDPR, you have the right to receive the data you provided to us—which we process based on your consent or a contract—in a structured, commonly used, and machine-readable format, and to have it transferred to you or a third party. If you ask us to transfer the data directly to another controller, we will do so if it is technically feasible.

The right to data portability does not apply to data processing necessary for tasks performed in the public interest or in the exercise of official authority.

6. Right to object

If we process your data based on a legitimate interest under Art. 6(1)(f) GDPR, you can object at any time for reasons related to your specific situation; this also applies to profiling (see Art. 21 GDPR). If you object, we will stop processing your data unless we can show compelling legitimate grounds that override your interests, rights, and freedoms, or if the processing is necessary for legal claims.

If we process your data for direct marketing, you have the right to object at any time, including to any related profiling. If you object, we will stop using your data for direct marketing. You can opt out of direct marketing at any time without needing to provide a reason.

7. Right to withdraw consent

Some processing activities require your express consent under Art. 6(1)(a) GDPR. You can withdraw your consent at any time, effective for the future. This does not affect the lawfulness of any processing done before your withdrawal. Please note that even after you withdraw consent, we may still be able to process your data if there is another legal basis for doing so.

8. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR (Art. 77 GDPR in conjunction with § 19 BDSG). A list of the data protection authorities and their contact details can be found at: www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html.

If you believe that we are infringing German or European data protection law when processing your data, we ask you to contact us so that we can clarify any questions.

You also have the right to contact the supervisory authority responsible for us at our registered office:

Bavarian State Office for Data Protection Supervision (BayLDA)
Promenade 18
91522 Ansbach, Germany
Fax: +49 (0) 981 180093-800
E-mail: poststelle@lda.bayern.de
Website: www.lda.bayern.de

III. What personal data is processed and from which sources does this data originate?

1. Source of the personal data

We predominantly process data that we receive directly from data subjects in the course of initiating business or during the business relationship, or when they use our Website (see also Part B, Section VI).

Via our Website and our services, we process data that we receive during your visit or that you actively provide to us in the course of your use (e.g. when using our online shop). Other data is automatically collected by our IT systems when you visit the Website or use one of our services. This mainly concerns technical data (e.g. internet browser, operating system or time of a page view). This data is collected automatically as soon as you enter our Website or access one of our services. Details can be found in Part B.

In individual cases, we also process data that we have lawfully received or acquired from other third parties such as credit agencies, creditor protection associations or authorities, or that we have lawfully taken, received or acquired from publicly accessible sources (e.g. telephone directories, company registers, press, internet or other media).

2. Categories of personal data

The personal data we regularly process includes master data/contact data such as: title, first name and surname, salutation, date of birth, address, e-mail address, telephone number, fax number, position in the company.

In addition, depending on the order, service or other relationship with you, we process the following other personal data:

• Address data: street, house number, any address additions, postal code, city, country
• Contact data: telephone number(s), e-mail address(es)
• Vehicle data: vehicle registration number, vehicle owner
• Parking space management data: photographs, date and period of use of a parking space, parking authorizations, bank account details, payment details
• Registration data: information about the service for which you registered; dates and technical information on registration, confirmation and deregistration; data provided by you during registration
• Quotation data
• Access data: date and time of the visit to our service; the page from which the accessing system reached our site; pages accessed during use; data for session identification (session ID); as well as information about the accessing computer system such as IP address, browser type and version, device type, operating system and similar technical information
• Information on the type and content of our business relationship: contract data, order data, turnover and receipt data, customer and supplier history, consulting documents
• Advertising and sales data
• Documentation data (e.g. consultation records, data from service calls or support cases)
• Other data received in the course of our business relationship (e.g. in customer meetings)
• Documentation of declarations of consent

IV. For what purposes and on what legal basis are the data processed?

We process your data in accordance with the provisions of the GDPR and the BDSG in the respectively applicable version, in particular on the following bases:

1. Performance of (pre-)contractual obligations (Art. 6(1)(b) GDPR)

Personal data is processed on the basis of Art. 6(1)(b) GDPR for the performance of contractual obligations of MH Parkservice, in particular in connection with the sale and distribution of our goods and services (hereinafter also “parking services”) and all activities that are customary in the industry and required for the operation and/or administration of MH Parkservice (e.g. customer and user administration). The data may also be processed at the pre-contractual stage in the course of initiating business with MH Parkservice or in the performance of other contractual relationships with MH Parkservice.

Art. 6(1)(b) GDPR is the legal basis, for example, in the following cases:

• creation and management of a partner or supplier account in our CRM system
• creation and management of customer/prospect files and/or our customer/prospect database in our CRM system
• sending of information
• offering and selling MH Parkservice products
• offering and performance of our services

Details regarding the purpose of this data processing can be found in the relevant contractual documents and terms and conditions.

2. Safeguarding legitimate interests (Art. 6(1)(f) GDPR)

On the basis of a balancing of interests, processing may, beyond the actual performance of a contract, take place to safeguard legitimate interests of MH Parkservice or third parties. This is permissible provided that your interests or fundamental rights and freedoms which require the protection of personal data do not prevail.

Processing to safeguard legitimate interests occurs, for example, in the following cases:

• provision of the online offering, its functions and content
• use of technically necessary cookies or comparable technologies within the meaning of § 25(2) TDDDG
• responding to contact enquiries and communicating with users
• transfer of data to affiliated companies and partners
• execution of payment processes via external service providers
• engagement of debt collection service providers and attorneys to collect and/or enforce claims in court
• assertion of other legal claims and defence in legal disputes
• advertising or marketing
• market and opinion research
• measures for business management and further development of our services
• maintaining databases on customers/prospects or service providers to improve our offering
• conducting a risk assessment (due diligence) in the context of possible corporate restructurings or a company purchase/sale
• ensuring IT security and IT operations of our company and our services
• measures for building and facility security

3. Compliance with legal obligations (Art. 6(1)(c) GDPR)

Processing of your data may, in part, be necessary for the purpose of complying with various legal obligations and requirements to which we are subject, e.g. under the German Commercial Code (Handelsgesetzbuch) or the Fiscal Code (Abgabenordnung).

4. Consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG)

If a service used by us stores information in the user’s terminal equipment in any way or accesses such information, consent is required pursuant to § 25(1) sentence 1 TDDDG. If the service operates without any access to the terminal equipment, the GDPR applies. Where we request your consent within the scope of the GDPR, this is done on the basis of Art. 6(1)(a) in conjunction with Art. 7 GDPR.

If, in an individual case, you have given us consent to process your data, processing will take place in accordance with the purposes specified in the declaration of consent and to the extent agreed therein. Consent given, e.g. for sending a newsletter, may be withdrawn at any time with effect for the future. Please contact us using the contact details stated in Part A, Section I or Section II. Please note that processing operations carried out prior to the withdrawal are not affected by the withdrawal and that processing may, where appropriate, still be possible at least in part on the basis of another legal basis.

V. Who receives my data?

Within MH Parkservice, those employees and organizational units receive your data that require it to fulfil our contractual and legal obligations or to pursue our legitimate interests.

For the initiation and/or performance of a contractual relationship (e.g. sale or provision of parking services) pursuant to Art. 6(1) sentence 1(b) GDPR and—depending on the nature of the specific contractual relationship—and on the basis of our legitimate interests pursuant to Art. 6(1) sentence 1(f) GDPR, your data is transmitted in particular to companies that we regularly use in connection with providing our services or for contract performance. This concerns the following recipients and/or categories of recipients:

• IT service providers (e.g. e-mail service providers, web hosting companies)
• Amazon Web Services, Inc., 410 Terry Avenue North, Seattle WA 98109, USA (cloud storage provider)
• Amplitude Inc., 201 Third Street, Suite 200, San Francisco, CA 94103, USA (optimization of app functions)
• Airparser, Sepapaja tn 6, Tallinn 11415, Estonia (provider of document management software)
• Celonis SE, Theresienstr. 6, 80333 Munich, Germany (integration platform provider)
• Datadog Inc., 620 8th Avenue, 45th Floor, New York, NY 10018, USA (system security, monitoring)
• Decagon AI, Inc., 2261 Market Street, STE 5378, San Francisco, CA 94114, USA (AI platform operator and provider of an AI chat function)
• Deutsche Post Adress GmbH & Co. KG, Am Anger 33, 33332 Gütersloh, Germany (address determination)
• Freshworks, Inc., 2950 S. Delaware Street, Suite 201, San Mateo, CA 94403, USA (ticket system provider)
• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
• Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland (e-mail service provider)
• HubSpot Inc., 25 First Street, 2nd Floor, Cambridge, MA 02141, USA (CRM system provider)
• LanguageTooler GmbH, Karl-Liebknecht-Str. 37, 14482 Potsdam, Germany (proofreading service provider)
• Leaping AI UG (haftungsbeschränkt), Potsdamer Straße 72, 10785 Berlin, Germany (provider of AI-based call centre software)
• Okta Inc., 100 First Street, Floor 6, San Francisco, CA 94105, USA (provider of Auth0; deletion for system security)
• OpenAI Ireland Ltd, 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland (AI model provider)
• Peter Park System GmbH, Balanstr. 71a, 81541 Munich, Germany (provision of IT systems as managed services and parking management systems)
• sevDesk GmbH, Hauptstraße 115, 77652 Offenburg, Germany (accounting software provider)
• Talkdesk Inc., 201 Spear Street, Suite 1100, San Francisco, CA 94105, USA (contact centre software provider)
• Trustpilot A/S, Pilestræde 58, 5th Floor, DK-1112 Copenhagen, Denmark (review process provider)
• Webflow, Inc., 398 11th Street, San Francisco, CA 94103, United States (web hosting service provider for the Website)
• Weglot SAS, 138, rue Pierre Joigneaux, 92270 Bois-Colombes, France (translation service provider)
• Sales partners
• Advertising partners
• Insurance companies
• Banks
• Communications providers (telephone providers, fax providers)
  • Payment service providers, including:
  • Adyen N.V., Simon Carmiggeltstraat 6, 1011 DJ Amsterdam, Netherlands
  • Stripe Deutschland GmbH, Prielmayerstr. 3, 80335 Munich, Germany
  • secuPay AG, Goethestraße 6, 01896 Pulsnitz, Germany
• Shipping and logistics service providers
• Credit agencies
• Auditors
• Tax and legal advisers

If we use a service provider as a processor within the meaning of Art. 28 GDPR, we nevertheless remain responsible for protecting your data. Where required by law, processors are contractually obliged by means of a data processing agreement to treat your data confidentially and to process it only within the scope of providing the service. The processors commissioned by us receive your data insofar as they require it to perform their respective services.

Data is only transmitted to governmental bodies and authorities and/or collected for this purpose within the framework of mandatory national legal provisions or if you instruct us to do so.

VI. How long will my data be stored?

Your personal data will be used only for the purpose for which you provided it to us or to which you consented, and will be stored only for as long as that purpose is fulfilled. After the purpose has been fully achieved and/or as soon as you request deletion of your data, your data will be stored only for as long as required due to statutory limitation periods or retention obligations (in particular under tax and commercial law). At the latest after expiry of these periods, the data will be deleted unless you have expressly consented to further or other use. Even during retention periods you may exercise rights, such as the blocking of your data; see Part A, Section II.

We will delete or block your data as soon as the purpose for storage no longer applies or you request deletion.

In particular, we generally process and store your data no longer than until the end of the business relationship or until the expiry of the applicable warranty, guarantee or limitation periods. For example, the limitation period pursuant to §§ 195 et seq. BGB is generally three years, but in certain cases may be up to thirty years. In addition, it may be necessary to retain data until the final and binding conclusion of any legal disputes in which the data is required as evidence.

We are also subject to statutory documentation and retention requirements (e.g., under § 257 HGB, the German Money Laundering Act, or § 147 AO). These periods typically range from two to ten years. For instance, we may need to keep your data after our contract ends until the tax audit for the last calendar year you were a customer is complete.

VII. Is personal data transferred to countries outside the EU?

In some business areas, your personal data may be transferred to entities in countries outside the EU or EEA where the European Commission has not yet confirmed an adequate level of data protection, such as the USA. If such a transfer is necessary, it will only happen based on an adequacy decision, standard contractual clauses, appropriate safeguards, or your explicit consent.

B. Using our websites

You can generally visit our websites for informational purposes without providing any personal details (like registering or placing an order). In these cases, we only process data that is necessary to keep the site running or data transmitted by cookies or similar technologies when you visit.

Details on our own cookies and similar technologies are in Part B, Section II. Other cookies may allow our partners or third parties to recognize your browser when you return. You can find information about these third-party technologies in Part B, Section III.

We generally only process user data after receiving consent. An exception applies when getting prior consent isn't possible for practical reasons and the processing is permitted by law.

I. Website hosting and log files

How we process your data

Every time you visit our site, our system automatically collects data from your device that your browser sends to us or our web host (log files). These files include IP addresses or other data that could potentially identify you, for example, if the link you used to reach our site or the link you click to leave it contains personal information.

Our hosting provider collects and stores the following information:

• browser type and version
• operating system
• referrer URL
• host name of the accessing computer
• time of the server request
• IP address

This data is stored in our web host's log files and is not kept together with any other personal data about you.

We use Webflow, Inc., 398 11th Street, San Francisco, CA 94103, USA (www.webflow.com) to host and operate our website, forms, and other web elements. You can find Webflow’s privacy policy at https://webflow.com/legal/eu-privacy-policy. We have a data processing agreement with them (https://webflow.com/legal/dpa). Data may be transferred to the USA based on standard contractual clauses or other equivalent data protection safeguards.

Legal basis and purpose

The legal basis for temporarily storing this data in log files is Art. 6(1)(f) GDPR. This information is also necessary to provide our services under § 25(2) no. 2 TDDDG.

We need to store your IP address temporarily to deliver the website to your computer. It must remain stored for the duration of your session.

Log files help us ensure the website works properly. They also help us optimize the site and keep our IT systems secure.

Retention period and your rights

We delete the data as soon as it is no longer needed for the purpose it was collected. For website access data, this happens once your session ends.

Data stored in log files is deleted after no more than 7 days.

Collecting data to provide the website and storing it in log files is essential for the site to function. Therefore, users cannot opt out of this.

II. Using cookies and similar technologies

How we process data

Our website uses cookies and similar tools (like web beacons or local storage) to collect and process usage data (such as access times and pages visited) or metadata and communication data (like your IP address and device info), including personal data. For simplicity, we’ll refer to all these technical methods as “cookies” from here on.

Cookies are small text files containing a unique string of characters. They are saved by your browser on your computer, allowing us to recognize your browser the next time you visit our site.

Some cookies are deleted as soon as you close your browser (session cookies). These are technically necessary, for example, to keep you logged in as you move between pages during your visit.

Other cookies stay on your device for a set period, allowing us to recognize your browser on your next visit (persistent/protocol cookies). These help us provide a better user experience, recognize you, and show you fresh content when you return.

We may use cookies from partners or third parties for advertising, personalized content, or statistics (third-party cookies). Unless we specify that a cookie is from a third party, it belongs to our service (first-party cookies). Flash cookies do not have an expiration date.

For more details, please use our cookie management tool, CookieHub, provided by CookieHub ehf, Hafnargata 18, 230 Reykjanesbær, Iceland. When you visit our site, you can use this tool to set your preferences and provide consent.

CookieHub specifically processes:

• Consent data: anonymized log data (Consent ID, Processor ID, Controller ID), consent status, and timestamp
• Device data: shortened IP addresses (IPv4, IPv6), device info, and timestamp
• User data: email, ID, browser info, setting IDs, and changelog

CookieHub privacy policy: https://www.cookiehub.com/legal/privacy-policy

You can find more information in CookieHub under “More options” / “Cookie declaration.” CookieHub automatically scans the site to see which cookies are in use and updates the declaration accordingly.

Legal basis and purpose of processing

We process personal data via cookies and similar technologies based on Art. 6(1)(f) GDPR to ensure our website is secure, functional, and user-friendly, unless we have asked for your consent under Art. 6(1)(a) GDPR.

The legal basis for storing and accessing information is § 25(1) TDDDG for cookies that require consent. For cookies essential to the website’s functionality, § 25(2) no. 2 TDDDG applies.

CookieHub helps you manage your consent. It blocks all non-essential cookies unless you choose to enable them. You can select:

• “Accept all”: allow everything
• “More options”: choose specific categories and click “Save settings”
• “Essential cookies only”: block all non-essential cookies

Retention period / how to object and remove data

You can find details on how long our cookies are stored in CookieHub under “Cookie declaration”.

You can restrict or disable cookies through your browser settings and delete them whenever you like. Just keep in mind that if you turn them off, some parts of our website might not work as intended.

You can also withdraw your consent or change your preferences at any time by clicking “Cookie settings” (found at the bottom left of our site).

III. Website analytics and reach measurement

1. Google Analytics

How we process your data

We use Google Analytics, which is provided in Europe by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”), a subsidiary of Google LLC, Amphitheatre Parkway, Mountain View, CA 94043, USA.

Google Analytics uses cookies. The information collected is usually sent to a Google server in the USA and stored there. Google provides us with reports on things like audience, user behavior, and real-time activity. We use Google Analytics exclusively with the “anonymizeIp()” extension enabled.

More info: https://policies.google.com/privacy?hl=en

Legal basis and purpose

We use Google Analytics to understand how people use our website and services, to create reports, and to offer other services related to site usage. We also use it to analyze data from AdWords and the DoubleClick cookie for statistical purposes.

We ask for your consent to use Google Analytics and store its cookies based on § 25(2) TDDDG.

By giving your consent, you also agree under Art. 49(1) sentence 1(a) GDPR to your data being processed in the USA, where transfers aren't protected by EU standard contractual clauses. The European Court of Justice considers the USA to have an inadequate level of data protection by EU standards.

You can withdraw your consent at any time, and it will apply to all future activity.

We have a data processing agreement in place with Google.

Storage duration and how to opt out

You can manage or delete cookies directly through your browser settings.

You can opt out of data collection by installing the Google Analytics opt-out browser add-on: http://tools.google.com/dlpage/gaoptout?hl=en.

You can also set an opt-out cookie via https://developers.google.com/analytics/devguides/collection/gajs/?hl=en#disable. If you clear your cookies, you’ll need to set the opt-out cookie again.

Alternatively, you can manage your cookie preferences through CookieHub.

2. Google Tag Manager

How we process your data

Google Tag Manager is a tool from Google Ireland Limited used to manage website tags. The Tag Manager itself is a cookie-free domain and doesn't collect any personal data. While it can trigger other tags that might collect data, the Tag Manager doesn't have access to that information.

We only use Google Tag Manager to display Google Ads for our search engine marketing.

Find out more here: https://www.google.com/intl/en/tagmanager/use-policy.html

3. Google Ads & Google Ads Conversion Tracking

How we process your data

We use Google Ads to show ads and see how well our advertising is working. Google Ads uses cookies and web beacons. The information generated—including your IP address—may be sent to and stored on Google servers in the USA.

Find out more here: https://policies.google.com/privacy?hl=en and https://policies.google.com/technologies/ads?hl=en

Legal basis and why we process your data

Google Ads cookies and web beacons are stored based on Art. 6(1)(a) GDPR. We also use Google Ads based on our legitimate interest under Art. 6(1)(f) GDPR.

We have a data processing agreement in place with Google.

How long we keep your data / how to opt out

You can block Google Ads cookies through your browser settings or various opt-out tools, and you can manage your preferences via CookieHub. Just keep in mind that if you do, some features of our site might not work as intended.

4. Amplitude

How we process your data

We use Amplitude, provided by Amplitude Inc. (201 Third Street, Suite 200, San Francisco, CA 94103, USA), to improve our online shop and mobile payment app. This involves collecting usage data, device info, and identifiers (including a shortened IP address). Cookies are stored on your device, and data may be sent to and stored on Amplitude servers in the USA.

We have a data processing agreement with Amplitude that includes the EU Standard Contractual Clauses. Amplitude is also certified under the EU–US Data Privacy Framework.

Find out more here: https://amplitude.com/privacy

Legal basis and why we process your data

We ask for your consent to use Amplitude and store cookies in accordance with Section 25(2) of the TDDDG.

Retention period / right to object and delete

You can block cookies by adjusting your browser settings and manage your preferences through CookieHub.

IV. More about the tools, plugins, and procedures used to build this site

1. SSL/TLS encryption

For security and to protect the transmission of sensitive content, this site uses SSL/TLS encryption. You can tell a connection is encrypted when the address bar changes from “http://” to “https://” and a lock icon appears. When SSL/TLS is active, any data you send to us cannot be read by third parties.

2. make.com

How we process your data

We use make, a service provided by Celonis SE (Theresienstr. 6, 80333 Munich, Germany), to connect various databases and web tools and to automate our workflows.

Learn more here: https://www.make.com/en/privacy-notice and https://www.celonis.com/de/privacy-notice/

Legal basis and purpose

We use make.com based on Art. 6(1)(f) GDPR. We have a legitimate interest in automating our processes efficiently, which involves importing and exporting personal and contact information.

3. Website language versions (translations via Weglot)

How we process your data

We use Weglot (Weglot SAS, 138, rue Pierre Joigneaux, 92270 Bois-Colombes, France). Using Weglot connects you to their servers and transmits data, including your IP address and device details. Weglot processes this data as a processor under Art. 28 GDPR within the EU.

Learn more here: https://www.weglot.com/privacy

Legal basis and purpose

Our legal basis is our legitimate interest under Art. 6(1)(f) GDPR to provide our website in multiple languages, provided we haven't requested your consent under Art. 7 GDPR and Section 25 TDDDG.

Retention period / right to object and delete

Weglot is necessary to offer the website in different languages. If you would like your personal data deleted, you can exercise your rights as outlined in Part A.

4. Embedding YouTube content

Description of data processing

We occasionally embed YouTube videos or link to our YouTube channel. When you play embedded videos, your IP address is sent to YouTube, and they receive information about the subpage you visited. If you are logged into YouTube, this activity may be linked to your profile.

Further information: https://policies.google.com/privacy?hl=en&gl=en

Legal basis and purpose of data processing

We use YouTube based on our legitimate interests under Art. 6(1)(f) GDPR to provide and link to video content and to handle inquiries or comments.

Storage period / possibility of objection and removal

To prevent your activity from being linked to your profile, log out of YouTube before playing videos. You can manage your privacy settings via your Google/YouTube account.

5. Auth0

Description of data processing

We use Auth0 (Okta Inc., 10800 NE 8th Street, Suite 700, Bellevue, WA 98004, USA) for registration and login in our online shop. Any data you enter is exchanged directly between your browser and Auth0. This includes account information, security data, and metadata (such as your IP address, timestamp, and browser/device details).

Further information: https://www.okta.com/legal/privacy-policy/

We have chosen Europe as the server location for data storage. Any necessary transfers to the USA are protected by EU Standard Contractual Clauses.

Legal basis and purpose of data processing

Auth0 is integrated based on Art. 6(1)(f) GDPR. It is also required to provide the service for accessing your user account in accordance with § 25(2) no. 2 TDDDG.

Storage period / possibility of objection and removal

You can manage your cookie preferences through your browser settings or CookieHub.

6. Datadog

Description of data processing

We use Datadog (Datadog, Inc., 620 8th Avenue, 45th Floor, New York, NY 10018, USA) as a processor to monitor system stability, analyze errors, and ensure IT security. This may involve processing log data (including IP addresses), performance metrics, and metadata.

Transfers to the USA may occur. We have entered into a data processing agreement that includes EU Standard Contractual Clauses. DataDog is certified under the EU–US Data Privacy Framework.

More information: https://www.datadoghq.com/legal/privacy/

Legal basis and purpose of data processing

Processing is based on Art. 6(1)(f) GDPR. DataDog is required to provide our services within the scope of access to the user account under § 25(2) no. 2 TDDDG.

Retention period / right to object and erasure

Data is deleted or anonymized once the error analysis is complete.

V. Links to third-party websites

Our website may contain links to other sites. We have no control over the content or design of these third-party offerings. Consequently, this privacy policy does not apply to external content or services we link to.

If you are redirected to other sites via links on our pages, please check their respective privacy policies to see how your data is handled.

VI. Social media and platform presence

How we process data

We maintain a presence on various social networks and platforms (e.g., Facebook, Xing, LinkedIn, YouTube) and link to them from our website. When you visit these platforms, their specific terms and data processing policies apply. Data may be processed in the USA and used for market research and advertising, including profiling. If you are logged in, cookies may be stored on your device.

Unless otherwise noted, we only process user data when you interact with us directly on these networks (e.g., through comments or messages).

Legal basis and purpose of data processing

We only process your personal data when you contact us or interact with our content. Unless otherwise stated, this is based on Art. 6(1)(f) GDPR. If your contact is related to a contract, the legal basis is Art. 6(1)(b) GDPR.

Where the platform alone determines the purposes and means of processing, that platform acts as the sole controller.

Retention period / right to object and erasure

If you do not want a social network to link data collected through our site with your profile, please log out before visiting our site. For details and opt-out options, please check the provider's own information. Requests regarding your data rights are usually most effective when sent directly to the providers.

Facebook
We run a Facebook fan page. Facebook Ireland Ltd. and we are joint controllers for certain processing activities (Page Insights). We have entered into agreements and provide the relevant information and links here:

• Controller Addendum: https://www.facebook.com/legal/controller_addendum
• Data Processing Terms: https://www.facebook.com/legal/terms/dataprocessing/update
• Facebook Data Policy: https://www.facebook.com/about/privacy
• Page Insights information: https://www.facebook.com/legal/terms/information_about_page_insights_data
• Opt-out options: https://www.facebook.com/settings?tab=ads and http://www.youronlinechoices.com

LinkedIn

‍LinkedIn plug-ins may transmit information about your visit (and the subpages you’ve viewed) to LinkedIn, especially if you’re logged in. You can prevent this by logging out before visiting.

• Privacy policy: https://www.linkedin.com/legal/privacy-policy
• Opt-out: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out

XING

‍XING plug-ins may transmit information about your visit (and the subpages you’ve viewed) to XING, especially if you’re logged in. You can prevent this by logging out before visiting.

• Privacy policy: https://privacy.xing.com/de/datenschutzerklaerung

VII. Active use of our website

1. Contact forms and email

How we process your data

We have a contact form on our website. When you use it, the information you provide is sent to us and stored:

• company/municipality (required)
• first name (required)
• last name (required)
• email (required)
• phone (optional)
• message (optional)

When you submit the form, we also store:

• your IP address
• date and time of submission

If you contact us via email, we store the personal data you include in your message.

If you provide a mobile number to receive status updates on your payment request, we will use it only for that purpose.

We use HubSpot Forms (HubSpot CRM) to host our forms and process the data you enter. We also use Google Workspace for email (server location: Europe, covered by a data processing agreement; Google confirms no data is transferred to the USA).

We use AI-powered services to help organize and sort inquiries (ChatGPT via OpenAI Ireland Ltd, Google Gemini). We also use LanguageTool for proofreading and Airparser to process attachments (PDF/Word). You can find the relevant privacy policies and DPAs for these providers in the text provided.

Legal basis and purpose of processing

The legal basis is Art. 6(1)(f) GDPR; if your inquiry is related to a contract, Art. 6(1)(b) GDPR also applies. We process this data to handle your requests, get in touch, prevent misuse, and maintain IT security. Our use of AI services is based on Art. 6(1)(f) GDPR.

Storage period and your right to object or delete

Data is deleted once it is no longer necessary (typically when the conversation has ended), unless legal requirements mandate longer retention. Users can withdraw consent at any time and object to storage; in that case, the conversation may not be continued unless another legal basis applies or overriding interests exist.

2. Telephone hotline

Description of data processing

When you call us, we record the incoming number and technical call data (start time/duration) and note key details and information provided. We use Leaping AI for pre-qualification. Call recordings and transcripts are only created with your consent. We use Talkdesk as our contact center platform (EU region; SCCs apply for third-country transfers).

Legal basis and purpose of data processing

Call handling data is processed under Art. 6(1)(f) GDPR (and, where applicable, Art. 6(1)(b) GDPR). Call recordings and transcripts are processed solely based on your consent under Art. 6(1)(a) GDPR.

Storage period / possibility of objection and removal

Data is deleted once it is no longer needed. If no statutory retention period applies, recordings and notes are stored in line with statutory limitation periods; transcripts are deleted after 6 months. You can withdraw your consent at any time, and we will delete recordings and transcripts without undue delay, unless legal obligations require us to keep them.

3. Ticket system

Description of data processing

We use Freshdesk (Freshworks, Inc.) to receive and manage inquiries across all channels. Data is stored on Freshdesk servers, and we use EU-based processing whenever possible.

Legal basis and purpose of data processing

Processing is based on Art. 6(1)(f) GDPR in conjunction with a data processing agreement under Art. 28 GDPR. If a transfer to the USA is necessary in specific cases, it is based on EU Standard Contractual Clauses.

Storage period / possibility of objection and removal

Data is stored for the duration of our business relationship or until your inquiry is resolved. You can request deletion as described in Part A.

4. Chat function

Description of data processing

We offer an AI chatbot via Decagon. Please avoid entering personal data unless specifically requested. We may process technical log data (IP address, API metadata, timestamp). Requests that require human review are forwarded to our team and stored in our CRM or ticket system, outside of Decagon.

Legal basis and purpose of data processing

Processing is based on Art. 6(1)(f) GDPR in conjunction with a data processing agreement under Art. 28 GDPR. EU data residency applies; if transfers to the USA are required and authorized, they are based on EU Standard Contractual Clauses.

Storage period / right to object and erasure

Data is stored for the duration of our business relationship and/or until the conversation in question has concluded. You can request the deletion of your data as described in Part A.

C. Data processing related to the use of MHP parking areas

(Your text references this section; the detailed wording follows the structure of your source text for: Online Shop, payment services, Trustpilot reviews, managed parking areas and enforcement, activation of parking authorisations, disability free-parking process, service portal, and invoicing.)

D. Contractual relationships with business customers and partners
(Your text references this section; the detailed wording follows the structure of your source text for: obligation to provide data, HubSpot, communication, sales processing, newsletter, and data transfers.)

E. Other
As we continue to develop our website and services, or due to changes in legal or regulatory requirements, we may need to update this Privacy Policy. You can access the current version of our Privacy Policy on our website at any time and print it out if needed.

Data Protection Information (effective as of 03/30/2026)

This data protection information is intended to give you an overview of what happens to your personal data (hereinafter: Data) within our company and to inform you of your data protection rights under the Swiss Federal Act on Data Protection (FADP) and the Data Protection Ordinance (DPO). Please read this information carefully and print or save it for your records if necessary.

Personal data is any information that can be used to identify you personally. Your personal data may be processed for various purposes. In essence, the data processing operations carried out by Mobility Hub Parkservice Switzerland GmbH (hereinafter also referred to as MH Parkservice or We) can be categorized into the following areas:

• General: In Part A below, you will find general information regarding data protection, data processing operations, and the rights of data subjects, which apply to all data processing activities we perform.
• Our websites: As part of our website https://www.mh-parkservice.ch/en (hereinafter "website") or linked external online sites, such as our social media profiles, our service portal (https://service.mh-parkservice.ch/en/), or our post-payment service (https://parken.mh-parkservice.ch/en), which refer to this data protection information (website and external online sites collectively referred to as "websites"), we process visitor data exchanged between their internet-connected devices and the server we operate, as well as data provided to us through the use of the website. You can find details on this in Part B.
• Parking users: For more information on the processing of data from users of the parking facilities we manage—for example, in the context of payment transactions via the MHP online shop or our post-payment service, the tracking of parking violations by MH Parkservice, or viewing parking violation details via our service portal—please refer to Part C.
• B2B: For the purpose of processing or initiating contracts, we process the necessary data of our business clients and interested parties. Data from our business partners and suppliers is used exclusively for the direct placement, processing, and execution of orders. You can find more information on this in Part D.

Please visit the respective sections if you would like quick, context-specific information regarding particular processing situations.

A. General information on data protection and the rights of data subjects

I. Who is responsible for data processing and who can you contact if you have questions?

The controller responsible under the FADP and other data protection provisions is:

Mobility Hub Parkservice Switzerland GmbH
c/o BDO AG
Obere Spichermatt 12
6370 Stans
Switzerland
Phone: +41 21 561 36 30
Email: info@mh-parkservice.ch

If you have any questions regarding data protection, you can reach us using the contact details above or by emailing: datenschutz@mh-parkservice.ch

II. What are your rights regarding personal data?

If your personal data is being processed, you are a data subject under the FADP, which may grant you the rights described below. If you wish to exercise your rights against MH Parkservice as the controller, we recommend that you contact us using the details provided above:

1. Right of access
In accordance with Article 25 of the FADP, you may ask us to confirm whether we are processing your data and to inform you about the scope of our data processing.

2. Right to rectification
If your data is incorrect or incomplete, you have the right under Article 32 of the FADP to have it corrected and/or completed.

3. Right to erasure
If the legal requirements of Article 32 of the FADP are met, you may request that we delete your data if we are processing it unlawfully or if the processing unjustifiably infringes upon your legitimate interests in protection. Please note that there may be reasons that prevent immediate deletion, such as legal retention obligations. Regardless of whether you exercise your right to erasure, we will delete your data completely and immediately to fulfill our legal obligations as soon as the purpose of the processing has been achieved, provided there are no statutory or legal retention periods to the contrary.

4. Right to data portability
In accordance with Article 28 of the FADP, you have the right to request that the data you provided to us, which we process automatically based on your consent or for the performance of a contract, be transmitted to you or a third party in a structured, machine-readable format. If you request the direct transfer of data to another controller, this will only be done to the extent that it is technically feasible. The right to data portability does not apply to the processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

5. Right to withdraw consent under data protection law
Certain data processing operations are only possible with your explicit consent under Article 6(7) of the FADP. You may withdraw your consent at any time with future effect. However, the legality of any data processing carried out prior to the withdrawal remains unaffected. Please note that even after you withdraw your consent, we may still be able to process some or all of your data based on other legal provisions.

6. Right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, particularly in the member state where you reside, work, or where the alleged infringement occurred, if you believe that the processing of your personal data violates applicable law.

If you believe that we are not complying with applicable data protection laws when processing your data, please contact us so we can clarify the situation.

You are, of course, entitled to contact the supervisory authority responsible for our registered office:

Federal Data Protection and Information Commissioner (FDPIC)
Feldeggweg 1
CH - 3003 Bern

III. What personal data is processed and what are the sources of this data?

1. Origine des données personnelles
Nous traitons principalement les données qui nous sont directement communiquées par les personnes concernées dans le cadre d'une initiation de transaction ou au cours de la relation commerciale lors de l'utilisation de notre site Internet (voir également à ce sujet la partie B, point VI).

Through our website and services, we process data that we receive during your visit or that you actively provide to us while using our services (e.g., when using our online shop). Other data is automatically collected by our IT systems when you visit the site or use our services. This primarily involves technical data (e.g., internet browser, operating system, or the time a page was accessed). This data is collected automatically as soon as you access our website or one of our services. You can find more details on this in Part B.

In some cases, we also process data that we have lawfully obtained or acquired from other third parties, such as credit agencies, debt collection associations, or authorities, or that we have lawfully collected, obtained, or acquired from publicly accessible sources (e.g., telephone directories, business registers, the press, the internet, or other media).

2. Categories of personal data
The personal data we regularly process includes contact and master data such as: Title, first name and surname, academic title, date of birth, address, email address, telephone number, fax, and job title.

En outre, nous traitons les autres données personnelles suivantes en fonction de la commande, du service ou de toute autre relation avec vous :

• Address data: street, house number, address details if applicable, postal code, city, country
• Contact details: telephone number(s), email address(es)
• Vehicle data: vehicle license plate number, vehicle owner
• Parking management data: Photographs, date and duration of parking space usage, parking permits, bank details, payment information.
• Login information: information about the service you are using; dates and technical details regarding registration, confirmation, and cancellation; information provided during registration
• Offer data
• Access data: date and time of your visit to our service; the page from which the access system reached our site; pages visited during use; session ID; additionally, the following information from the accessing computer system: Internet Protocol address (IP address), browser type and version, device type, operating system, and other technical information.
• Information regarding the nature and content of our business relationship, such as contract data, order data, revenue and receipt data, customer and supplier history, and consultation documents.
• Advertising and distribution data,
• documentation data (e.g., consultation minutes, data from service discussions or support cases)
• other data we have obtained from you in the course of our business relationship (e.g., during customer meetings),
• documentation of consent declarations

IV. For what purposes is the data processed?

We process your data in accordance with the provisions of applicable data protection laws, particularly for the following purposes:

1. Fulfillment of (pre-)contractual obligations.
Personal data is processed as part of fulfilling MH Parkservice's contractual obligations, particularly regarding the sale and distribution of our goods and services (hereinafter also referred to as parking services), as well as for all activities necessary for the operation and management of MH Parkservice (e.g., customer and user management). Data may also be processed at a pre-contractual stage during business negotiations with MH Parkservice or in the course of fulfilling other contractual relationships with MH Parkservice.
This includes, for example, the following cases:

• Creation and management of a partner or supplier account in our CRM system
• Creation and management of customer/prospect files or our customer/prospect database in our CRM system
• Sending information
• Offering and selling MH Parkservice products
• Offering and implementing the services we provide

Details regarding the purpose of these data processing activities can be found in the relevant contractual documents and terms of business.

2. Safeguarding overriding legitimate interests
Data processing may take place beyond the actual fulfillment of a contract to protect the legitimate interests of MH Parkservice or third parties. This is permitted provided that your interests or fundamental rights and freedoms, which require the protection of personal data, do not override them. Data processing to safeguard legitimate interests occurs, for example, in the following cases:

• Providing the online offer, its functions, and its content
• Use of technically necessary cookies or comparable technologies
• Responding to contact inquiries and communicating with users
• Transmitting data to affiliated companies and partners
• Executing payment transactions via external service providers
• Using debt collection agencies and lawyers to recover debts and/or enforce claims in court
• Exercising other legal rights and defending against legal disputes
• Advertising or marketing
• Opinion and market surveys
• Business management and service development measures
• Managing customer/prospect or service provider databases to improve our offerings
• Conducting risk assessments (due diligence) in the context of potential corporate restructuring or the purchase or sale of a company
• Ensuring the IT security and functionality of our company and services.
• Building and facility security measures

3. Compliance with legal obligations
Processing your data may be necessary to fulfill various legal obligations and requirements to which we are subject, for example under commercial or tax law.

4. Consent
If we request your consent within the scope of the FADP, this is done on the basis of Art. 6 No. 6 and No. 7 FADP.
If you have given us your consent for the processing of your data in a specific case, the processing will be carried out in accordance with the objectives set out in the agreement and to the extent agreed therein. Consent can be revoked at any time with effect for the future. To do so, please use the contact details mentioned in Part A, points I or II. Please note that processing that took place before the revocation is not affected by the revocation and that, under certain circumstances, data processing may continue to be possible, at least in part, on the basis of another legal ground.

V. Who receives my data?

At MH Parkservice, the employees or organizational units that receive your data are those who need it to fulfill our contractual and legal obligations or to process and pursue our legitimate interests.

Your data is used for the initiation or execution of a contractual relationship (e.g., sale or provision of parking services) or, depending on the nature of the specific contractual relationship and based on our legitimate interests, particularly by companies we regularly use to provide our services or fulfill the contract. This concerns the following recipients or categories of recipients:

• IT service providers (e.g., email service providers, web hosting companies)
• Amazon Web Services, Inc., 410 Terry Avenue North, Seattle WA 98109, USA (Online storage provider)
• Amplitude Inc., 201 Third Street, Suite 200, San Francisco, CA 94103, USA (Optimization of app functions)
• Airparser, Sepapaja tn 6, Tallinn 11415, Estonia (Document management software provider)
• Celonis SE, Theresienstr. 6 80333 Munich (Integration-platform-as-a-service provider)
• Datadog Inc., 620 8th Avenue, 45th Floor, New York, NY 10018, USA (System security, monitoring)
• Decagon AI, Inc., 2261 Market Street, STE 5378, San Francisco, CA 94114 USA (AI platform operator and AI chat function provider)
• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
• Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland (Email service provider)
• HubSpot Inc. 25 First Street, 2nd Floor, Cambridge, MA 02141 USA (CRM system provider)
• Freshworks Inc. , 2950 S. Delaware Street, Suite 201, San Mateo, CA 94403, USA (Ticketing system provider)
• LanguageTooler GmbH, Karl-Liebknecht-Str. 37, 14482 Potsdam, Germany
• Leaping AI UG (limited liability), Potsdamer Strasse 72, 10785 Berlin, Germany (AI-based call center software provider)
• Octa Inc., 100 First Street, Floor 6, San Francisco, CA 94105, USA (Provider of Auth0, a system security solution.)
• OpenAI Ireland Ltd, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland (AI model provider)
• Peter Park System GmbH, Balanstr. 71a, 81541 Munich, Germany (Provision of IT systems as managed services as well as parking management systems)
• Planet Payment Group Holdings Limited, IDA Business Park, Dangan, Galway H91A06C, Ireland (Payment system gateway provider)
• sevDesk GmbH, Hauptstrasse 115, 77652 Offenburg, Germany (Accounting software provider)
• Talkdesk Inc. 201 Spear Street, Suite 1100, San Francisco, CA
• Trustpilot A/S, Pilestraede 58, 5th floor, DK-1112 Copenhagen, Denmark (Review solution provider)
• UAB Baltsoft, Kosciuskos 26-17, Vilnius, LT-01100, Lithuania (Conversion software solution provider)
• Webflow, Inc., 398 11th Street, San Francisco, CA 94103, USA (Hosting service provider for the website)
• Weglot, SAS, 138, rue Pierre Joigneaux, Bois-Colombes 92270 France (Translation service providers)
• Distribution partners
• Advertising partners
• Insurers
• Banks
• Communication operators (telephone operators, fax operators)
• Payment service providers
• Adyen N.V. Simon Carmiggeltstraat 6, 1011 DJ, Amsterdam, Netherlands
• Datatrans AG, Kreuzbhlstr. 26, CH-8008 Zurich, Switzerland
• Stripe Deutschland GmbH, Prielmayerstr. 3, 80335 Munich, Germany
• secuPay AG, Goethestrasse 6, 01896 Pulsnitz, Germany
• Planet Payment Group Holdings Limited, IDA Business Park, Dangan, Galway H91A06C, Ireland
• Planet Merchant Services SAS, 1 Terrasse Bellini, Puteaux, 92919 Paris La Défense Cedex, France
• Shipping and logistics service providers
• Credit rating agencies
• Auditors
• Tax and legal advisors

If we use a service provider for data processing in accordance with Art. 9 of the FADP, we remain responsible for the protection of your data. To the extent required by law, those commissioned with data processing are contractually bound by a data processing agreement to treat your data confidentially and to process it only within the scope of providing the service. The processors we have commissioned receive your data to the extent they need it to perform their respective services.

The transmission of your data to public institutions and authorities or the collection of such data for this purpose only takes place within the framework of mandatory national legal provisions or if you have instructed us to do so.

VI. How long is my data stored?

Your personal data will only be used for the purpose for which you provided it to us or for which you have given your consent, and will only be stored until that purpose is achieved. After the purpose has been fully accomplished or as soon as you have asked us to delete your data, it will only be stored for as long as is necessary due to statutory limitation or retention periods (particularly those of a tax and commercial nature). However, the data will be deleted no later than the expiration of these periods, unless you have expressly consented to further or different use. Even during the retention periods, you can exercise your rights, such as blocking your data. See Part A, point II for more on this.

We delete or block your data as soon as the purpose for its storage is no longer valid or you ask us to delete it.

We process and store your data until the end of our business relationship or until the applicable warranty, guarantee, and statutory limitation periods have expired. Additionally, it may be necessary to retain data until the legal conclusion of any disputes where the data is required as evidence.

Furthermore, we are subject to statutory documentation and retention requirements (e.g., for commercial or tax purposes) that mandate we keep your data even after a contract has ended.

VII. Is data transferred to a third country?

As part of our processing activities, personal data may, in certain cases or areas of business, be transferred to entities located in third countries outside of Switzerland that have not yet been recognized by the Swiss Federal Council as having an adequate level of data protection. If such a transfer is necessary in a specific case, it will only occur if appropriate data protection can be ensured, for example, through international treaties, standard data protection clauses, appropriate safeguards for data protection compliance, or your explicit consent.

B. Use of our websites

In principle, you can visit and use our websites for informational purposes without providing any personal information (such as registering, placing orders, or submitting other personal details). In such cases, we only process personal data from our users to the extent necessary to provide a functional website and our content and services, or to the extent that cookies or similar technologies used on the website transmit personal information to us during your visit. You can find information about the cookies or similar technologies we use in Part B, Section II. Other cookies or similar technologies allow us, our partners, or third parties to recognize your browser on your next visit. For more information on these third-party cookies or similar technologies from third-party providers, please refer to Part B, Section III.

The processing of our users' personal data generally only takes place with the user's consent. An exception applies in cases where obtaining prior consent is not possible for practical reasons and the data processing is permitted by legal provisions.

I. Providing the website and creating log files

Description of data processing

Every time you access our website, our system automatically collects data and information from the computer system of the accessing device, which your internet browser automatically transmits to us or our hosting provider (so-called log files). These server log files contain IP addresses or other data that can be linked to a user. This could be the case, for example, if the link to the website from which the user accesses our site or the link to the website the user navigates to contains personal data. The following information is collected and stored by our hosting provider:

• Browser type and version
• Operating system used
• Referrer URL
• Hostname of the accessing computer
• Time of the server request
• IP address

The data is stored in our web host's log files. This data is not stored together with other personal data of the user.

We use Webflow, Inc., 398 11th Street, San Francisco, CA 94103, USA (www.webflow.com) (hereinafter: "Webflow") as our hosting provider and software supplier for creating, providing, and operating our website, online forms, and other web elements. You can find information about data protection at Webflow at https://webflow.com/legal/eu-privacy-policy. We have entered into a Data Processing Addendum with Webflow (see https://webflow.com/legal/dpa). As part of the aforementioned services provided by Webflow, personal data may be transferred to the USA based on the standard contractual clauses that Webflow has agreed upon with us in its Data Processing Addendum or an equivalent data protection guarantee for the processing of personal data on our behalf.

Purpose of data processing

The temporary storage of the IP address by the system is necessary to enable the user's computer to access the website. To do this, the user's IP address must remain stored for the duration of the session.

Storage in log files occurs to ensure the website's functionality. Additionally, this data helps us optimize the website and ensure the security of our IT systems.

Duration of storage / Right to object and erasure

The data is deleted as soon as it is no longer required to achieve the purposes for which it was collected. In the case of data collected to provide the website, this occurs when the respective session ends.

If data is stored in log files, it is deleted after no more than 7 days.

The collection of data for providing the website and the storage of data in log files is strictly necessary for the operation of the website. Therefore, the user cannot object to this.

II. Use of cookies and similar technologies

Description of data processing

Our website uses cookies or similar procedures and collects, processes, and uses usage data (e.g., access times, pages visited) or metadata and communication data (IP address, device information).

Cookies are text files containing a unique string of characters that are saved in or by the internet browser on the user's computer system, allowing the browser to be clearly identified when the site is visited again. When a user visits a website, a cookie may be saved on the user's operating system. A cookie contains a unique string of characters. These cookies are used to make the website more user-friendly, efficient, and secure. When you visit a website with an integrated cookie, the data you have entered is saved exclusively in the cookie on your computer. In this case, the data is only transmitted to our servers when a page is requested.

Some cookies are deleted after the browser session ends when the browser is closed (session cookies). These cookies are technically necessary, for example, to allow you to log in to the application and stay logged in while visiting our site.

Other cookies remain on your computer for a set period and allow us to recognize your browser on your next visit (persistent or protocol cookies). The purpose of these cookies is to provide you with an optimal user experience, recognize you, present you with a website that is as varied as possible, and offer you new content during repeat visits.

Cookies from partner companies or third parties may be used to collect information about advertisements, personalized content, or statistics (third-party cookies). Unless we identify cookies as coming from third-party providers, they originate from our own services (first-party cookies). We will specifically inform you about any third-party cookies or "tracking" technologies we use in the following sections of our privacy policy.

Flash cookies are stored on your computer as data elements by websites when they use Adobe Flash. Flash cookies have no time limit.

For more information about the cookies we use to make our website more user-friendly, their purpose, and the data stored or transmitted to third parties, please check our cookie management tools provided by CookieHub ehf, Hafnargata 18, 230 Reykjanesbr, Iceland. This allows you to provide your consent for cookie usage based on your preferences when visiting our website.

Our cookie management tool collects log files and consent data via JavaScript. This JavaScript is used to inform the user about their consent for certain tags on our website and to obtain, manage, and document that consent. The cookie management tool saves the settings and consent you provided during your visit to the website and processes the following data:

• Consent data (anonymized log data (Consent ID, Processor ID, Controller ID), consent status, timestamp)
• Device data (including encrypted IP addresses (IP v4, IP v6), device information, timestamp)
• User data (e.g., email, ID, browser information, SettingIDs, changelog)

For this purpose, the cookie management tool saves a technically necessary cookie. For more information on data protection at CookieHub, please visit: https://www.cookiehub.com/legal/privacy-policy

For more information about the cookies we use to make our website more user-friendly, their purpose, and the data stored or transmitted to you, please refer to the detailed information from CookieHub, which you can view in the Cookie Information section. CookieHub automatically scans the cookies placed on the site. The cookie declaration is also updated automatically.

Purpose of data processing

Processing personal data using cookies is necessary to protect our legitimate interests in the optimal functionality and security of the website, as well as for a user-friendly and efficient site visit, provided we do not require your consent. We have integrated CookieHub to make it easier for users to provide consent for each category of cookies we use or manage.

CookieHub blocks all categories of cookies that are not essential for the proper functioning of the site unless you agree to the use of additional tools. When you visit our website, a banner appears. By clicking the "Allow all cookies" button, you can either allow all cookies or decide individually via the "Cookie Settings" button (by activating the individual toggle and clicking the final "Save settings" button) which cookies and/or cookie-based applications you consent to, or you can refuse all non-essential cookies by clicking the "Reject all" button.

The use of technically necessary cookies is essential to facilitate the use of websites by users and is therefore mandatory for providing the service. Certain functions of our website cannot be offered without the use of cookies. For this, it is necessary for the browser to be recognized even after changing pages.

We have integrated CookieHub for collecting consent. This makes it easier for users to provide or manage their consent for the various categories of cookies and similar technologies we use. CookieHub blocks all categories of cookies that are not essential for the proper functioning of the website unless you agree to the use of additional tools. When opening our website, users see an interface for this purpose:

By clicking the "Accept all cookies" button, you can either authorize all procedures or decide individually via the "More options" button (by activating the various selection toggles and clicking the final "Save settings" button) which cookies and/or cookie-based applications and the resulting data processing you consent to.

You can also refuse all non-essential cookies by clicking the "Essential cookies only" button and use the website only with the cookies necessary for its operation.

Technically necessary cookies are used to make our website easier and more comfortable for you to use, which is required for providing our service under Section 25(2) No. 2 of the TDDDG. Certain features of our website simply won't work without these cookies. Specifically, they are needed to keep the browser recognizing you as you move from page to page.

Furthermore, the purpose of the cookies we use in the "Analytics," "Marketing," and "Necessary" categories depends on the specific services and data processing involved. You can find more details in the following sections of our privacy policy and within CookieHub.

As the website operator, we have a legitimate interest in processing data through our cookie management tool to ensure that cookie consent is handled in a user-friendly, legally compliant, and personalized way, and to keep our online presence in line with legal requirements.

Retention period / Right to object and delete

For more details on how long our cookies are stored, please check the CookieHub information in the Cookie Declaration section.

Cookies are stored on your device and sent to our website from there. This means you, as the user, have full control over how cookies are used. You can disable or restrict the transmission of cookies by changing your browser settings. Cookies that have already been saved can be deleted at any time, and this can even be done automatically.

If you disable cookies for our website, you may find that some of its features no longer work as intended.

You can also use the features of our integrated cookie consent tool to withdraw your consent or change your preferences at any time by clicking the "Cookie Settings" button.

‍

III. Statistical website analysis / Reach measurement

1. Google Analytics

Description of data processing

We use Google Analytics for our online services. The provider in Europe is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter: "Google"), a subsidiary of Google LLC, Amphitheatre Parkway, Mountain View, CA 94043, USA.

Google Analytics also uses cookies. The information generated by a Google cookie about your use of this website is generally transmitted to and stored on a Google server in the USA. Google processes this data, and we receive reports on your user behavior. These reports may include, but are not limited to:

• Audience reports: These help us get to know our users better and understand exactly who is interested in our service.
• Behavior reports: We learn how you interact with our site, such as how you arrived here and which links you click.
• Real-time reports: We can see what is happening on our site at any given moment, such as how many users are currently reading this text.

Google Analytics uses a tracking code to create a unique ID associated with your browser cookie. This is how Google Analytics recognizes you as a new user. If you visit our site again, you will be recognized as a returning user. All collected data is stored under this user ID, allowing for the creation of pseudonymous user profiles.

Tags like cookies measure your interactions on our site—essentially any action you take. If you use other Google services (like a Google account), the data generated by Google Analytics may be linked with third-party cookies. Google does not share data with Google Analytics unless we, as the site operator, authorize it, except where required by law. The cookies used by Google Analytics are described in the detailed information within our CookieHub tool, which you can find under Cookie Declaration.

Our site uses Google Analytics exclusively with the anonymizeIp() extension. This means your IP address is truncated and anonymized by Google within the EU or other EEA member states before being transmitted to the USA, making it impossible to identify individual visitors. In exceptional cases, the full IP address may be sent to a Google server in the USA and truncated there. Below is an overview of the most important data collected by Google Analytics:

• Heatmaps: Google creates heatmaps that show exactly where you click, giving us insight into how you navigate our site.
• Session duration: This is the time you spend on our site without leaving. If you are inactive for 20 minutes, the session ends automatically.
• Bounce rate: A "bounce" occurs when you visit only one page on our site and then leave.
• Account creation: If you create an account or place an order on our site, Google Analytics collects this data.
• Location: Your IP address is used to determine your country and approximate location, also known as IP localization.
• Technical information: This may include your browser type, internet service provider, or screen resolution.
• Referral source: We are naturally interested in which website or advertisement brought you to our site.

This list is not exhaustive and is intended only as a general guide to the data stored by Google Analytics. For more information on how Google processes data, please refer to Google's privacy policy: https://policies.google.com/privacy?hl=en

Purpose of data processing

We use Google Analytics to evaluate the use of our website and services, to generate reports on website and service activity, and to provide us with other services related to the use of our website, services, and the internet. We also use Google Analytics to evaluate data from AdWords and the DoubleClick cookie for statistical purposes. As operators of websites and services, we have a strong interest in analyzing user behavior to optimize our website, our offerings, and our advertising.

The information generated by the cookie about your use of our website or services is generally transmitted to a Google server in the USA and stored there. If IP anonymization is activated, your IP address will be truncated by Google within the member states of the European Union or other states party to the Agreement on the European Economic Area. In exceptional cases, however, the full IP address may be transmitted to a Google server in the USA and truncated there. By agreeing to the activation of cookies used by Google Analytics, you also consent to your data being processed in the USA, provided that the data transfer is not secured on the basis of standard data protection clauses. The Swiss Federal Council considers the USA to be a country with an inadequate level of data protection by Swiss standards. In particular, there is a risk that your data may be processed by US authorities for control and surveillance purposes, possibly without any legal recourse. If you click the "Reject All" button or make a restricted choice without Google cookies, the described transmission to Google will not take place. You can revoke your consent at any time with effect for the future.

Google will use this information to analyze your use of the website. We will use this information to analyze the use of the site and services, compile reports on site activity for us, and provide other services related to site activity and internet usage. Google also states that it may pass this information on to third parties where required to do so by law, or where such third parties process the data on Google's behalf. Google has contractually committed not to associate your IP address with any other data held by Google. To ensure this, as well as our own data processing, we have entered into a data processing agreement with Google.

Retention period / Right to object and deletion

Cookies are stored on the user's computer and transmitted to our site. As a user, you therefore have full control over the use of cookies. By changing the settings in your internet browser, you can disable or restrict the transmission of cookies. Cookies that have already been saved can be deleted at any time. This can also be done automatically. If cookies are disabled for our website, you may not be able to use all of the website's functions.

By installing the browser add-on to disable Google Analytics (http://tools.google.com/dlpage/gaoptout?hl=en), you can object to the use of your data and its collection by Google Analytics. This informs Google Analytics that you do not want information about your visit to the website to be transmitted to them.

Furthermore, especially with mobile device browsers, you can install an opt-out cookie on your device by clicking this link https://developers.google.com/analytics/devguides/collection/gajs/?hl=en#disable to prevent future data collection by Google Analytics on our website. Please note that if you delete the cookies on your device, you will need to reinstall the opt-out cookie.

You can also set your cookie preferences via the Cookie Hub consent tool we have integrated.

2. Google Tag Manager

Description of data processing

Google Tag Manager is a solution from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter "Google"), which allows marketers to manage website tags via an interface. The Google Tag Manager itself (which implements the tags) is a cookie-free domain and does not collect personal data. Google Tag Manager facilitates the integration and ensures the execution of other tags, code snippets, tracking codes, and conversion pixels on a webpage, which may in turn collect data. Google Tag Manager does not access this data. Google Tag Manager provides us with an easy-to-use user interface that does not require extensive programming knowledge or changes to the website's source code.

We use Google Tag Manager solely to display Google Ads (formerly Google AdWords) as part of our search engine marketing activities.

For more information on Google Tag Manager, see: https://www.google.com/intl/en/tagmanager/use-policy.html.

3. Google Ads (formerly Google AdWords) and Google Ads Conversion Tracking

Description of data processing

We use Google Ads, a service provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, offered in Europe by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland, to integrate advertisements into our online offering and to draw attention to our attractive offers using advertising media on external websites.

This allows us to determine the success of individual advertising measures. These advertising materials are delivered by Google via so-called AdServers. Google AdWords uses cookies for this purpose (see the general explanations above). The installation of cookies allows for the analysis of the use of our webpages. Each time you access one of the pages of the website we operate on which a Google Ads component has been integrated, the internet browser on the data subject's computer system is automatically prompted by the respective Google Ads component to transmit data to Google for the purpose of online advertising and commission billing. As part of this technical process, Google gains knowledge of personal data, such as the IP address of the data subject, which serves, among other things, to help Google trace the origin of visitors and clicks and subsequently enable commission calculations. Regarding the cookie used, the following information is generally recorded as analysis values: unique cookie ID, number of ad impressions per placement (frequency), last impression (relevant for post-view conversions), and opt-out information (marking that the user no longer wishes to be contacted). These cookies allow Google to recognize your web browser. If you do not agree to the storage of cookies on your computer, please follow the general instructions on this topic or at the end of this explanation.

Furthermore, Google Ads uses so-called web beacons (invisible graphics). These web beacons allow for the evaluation of information such as visitor traffic on the pages of this offering.

The information generated by cookies and web beacons regarding the use of our website, including your IP address and the delivery of advertising formats, is transmitted to a Google server in the USA and stored there. This information may be shared by Google with its contractual partners (see https://support.google.com/admanager/answer/94149?visit_id=637060482444635472-69980 806&rd=1). In detail, we have no influence over the data collected by Google, nor are we aware of the full extent of the data collection or the duration of storage. However, to our knowledge, Google will not associate your IP address with other data you have stored. If you are logged into a Google account, however, your data may be directly attributed. If you do not want your Google profile to be associated with this site, please log out before using our online offering.

You can find more information about data protection with Google Ads at https://policies.google.com/privacy?hl=en, as well as at https://policies.google.com/technologies/ads?hl=en

Purpose of data processing

Google Ads cookies and web beacons are stored based on our legitimate interest as a website operator in analyzing the reach of our offerings, displaying relevant and interesting ads, improving campaign performance reports, and ensuring fair calculation of advertising costs, provided we do not ask for your consent.

We have also entered into a data processing agreement with Google.

Right to object and removal

You can prevent the installation of Google Ads cookies in several ways: a) by adjusting your browser settings accordingly; specifically, disabling third-party cookies prevents you from receiving ads from third-party providers; b) by disabling interest-based ads on Google via the link www.google.com/ads/preferences, noting that this setting is reset if you delete your cookies; c) by disabling interest-based ads from providers participating in the About Ads self-regulatory campaign via the link www.aboutads.info/choices, noting that this setting is reset if you delete your cookies; d) by permanently disabling them in your Firefox, Internet Explorer, or Google Chrome browsers by following the link www.google.com/settings/ads/plugin. Please note that in this case, you may not be able to fully use all the features of our online services.

You can also set your cookie preferences via the CookieHub cookie management tool we have integrated.

4. Amplitude

Description of data processing

To optimize our online shop and mobile payment app, we use the web analytics software Amplitude, a service provided by Amplitude Inc., 201 Third Street, Suite 200, San Francisco, CA 94103, USA ("Amplitude"). This process is used to evaluate and analyze user behavior and to generate activity reports for us. Data is captured in near real-time as soon as the user performs a specific action (e.g., clicking a button, loading a page, or completing a purchase). The following categories of data are involved:

• Usage data: clicks, pages visited, time spent, feature usage.
• Device data: operating system, browser type, device type, screen resolution.
• Identifiers: pseudonymized user IDs, internal Amplitude IDs, IP address. In this context, a truncated IP address is processed.

For this purpose, cookies are also stored on your computer.

The information generated is transmitted to an Amplitude server in the United States and stored there. We have entered into a Data Processing Addendum with Amplitude, which includes standard contractual clauses as a mechanism for transferring personal data from Switzerland to the United States. Amplitude is a certified participant in the Swiss/EU-US Data Privacy Framework, which sets minimum standards for the protection of personal data of Swiss citizens whose data is stored or processed in the United States.

Further information on data processing by Amplitude can also be found in Amplitude's privacy policy (https://amplitude.com/privacy).

Purpose of data processing

We use Amplitude to evaluate the use of our services and to generate reports on service activities to better understand how our services are used. This helps us identify opportunities for improvement and optimize the performance of our pages and features. Since, as a service provider, we have a significant interest in this analysis of user behavior for product improvement purposes, we ask for your consent to use Amplitude and store cookies.

Retention period / Right to object and removal

If you do not wish for cookies to be stored, please configure your internet browser to delete cookies, block all or some cookies, or provide a warning before cookies are saved. You can also set your cookie preferences via the CookieHub cookie management tool we have integrated.

IV. Other information on procedures, plugins, and tools used for website design

1. SSL or TLS encryption

For security reasons and to protect the transmission of confidential content, such as orders or inquiries you send to us as the site operator, this site uses SSL or TLS encryption. You can recognize an encrypted connection by the fact that the browser's address line changes from http:// to https:// and by the padlock symbol in your browser line. If SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

If SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

2. make.com

Description of data processing

To integrate various databases and web tools, we use make, a service provided by Celonis SE, Theresienstr. 6, 80333 Munich. make is an interface that allows various cloud-based software applications to be connected. Data required or processed in the connected applications is automatically transferred via these links. The goal is to enable digital processes to run autonomously, particularly standardized and repetitive tasks. This results in automated data flow and efficient processes.

You can find more information about data protection at Celonis at https://www.make.com/en/privacy-notice and https://www.celonis.com/de/privacy-notice/.

Purpose of data processing

The use of make.com is intended to efficiently automate processes, integrate various services, and import and export the resulting personal and contact data.

3. Multilingual website versions (translations with Weglot)

Description of data processing

On our website, we use the Weglot translation service from Weglot SAS, 138, rue Pierre Joigneaux, 92270 Bois-Colombes, France. Weglot is loaded when the website is opened and allows you to set the website language using the corresponding language icons. By integrating the Weglot translation service, a connection is established between your browser and Weglot's servers when you visit our website, and your IP address and information about your device are transmitted to Weglot. The transmitted data is necessary for the proper functioning of Weglot.

Data processed in connection with the use of Weglot is handled by Weglot as a data processor based on a data processing agreement within the European Union.

Information on the processing of personal data by Weglot can be found at https://www.weglot.com/privacy.

Purpose of data processing

The data processing carried out by Weglot is intended to provide our website in multiple languages, including a corresponding selection option for website visitors.

Right to object and removal

The use of the Weglot service is strictly necessary to provide the website in different language versions.

You can exercise your right to object and request deletion as described in the general information in Part A.

4. Integration of YouTube content

Description of data processing

We occasionally use content or service offerings from the YouTube video platform to embed video content on our website via a plugin or to link to videos on our YouTube channel. YouTube is a subsidiary of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, and is provided in Europe by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter referred to as "Google").

We may process data you have entered on our YouTube channel (such as your username and any content you have published under your account) if we respond to your posts or messages via our YouTube channel.

Otherwise, we only receive certain non-personal information from Google regarding post activity, such as the number of clicks on a profile or media, and the watch time for a specific video. This data can be viewed via our YouTube account. Furthermore, data processing by Google is carried out under their own responsibility; we have no way to prevent or disable the use of analysis tools and other features by Google on YouTube.

If you choose to play embedded videos using this plugin (by clicking the Play button), your IP address is sent to YouTube, as YouTube cannot deliver the video content to your browser without it. The IP address is therefore necessary for viewing. Additionally, the YouTube server is informed which sub-page of our website you have visited. If you are logged into your YouTube account as a member, you also allow YouTube to associate your usage behavior directly with your personal profile when playing our videos. You can find more information about how Google processes data when using YouTube in the YouTube terms of service: https://policies.google.com/privacy?hl=en&gl=us

Purpose of data processing

The use of YouTube is based on our legitimate interests in providing content on our website or linking to it, and in responding to inquiries or comments.

Retention period / Right to object and erasure

To prevent your activity from being associated with your user account, please log out of your YouTube profile before viewing our video content. You should inform yourself about the options for limiting Google's data processing via Google or within your YouTube user account. You can access your general Google account settings as well as the "Privacy and Security" section. Additionally, on mobile devices (smartphones, tablets), you can restrict Google's access to contact and calendar data, photos, location data, etc., in the corresponding settings menu. However, this depends on the operating system you are using.

5. Auth0

Description of data processing

For registration and login to our online shop, we use the cloud-based identity management platform Auth0, provided by Okta Inc., 10800 NE 8th Street, Suite 700, Bellevue, WA 98004, USA.

When a user enters data into a form provided by Auth0, this data is exchanged directly between the user's browser and Auth0. For identity management, authentication (login/registration), and user account security, the following data is processed:

• Basic data: email address, name, and profile picture if applicable (Social Login).
• Security data: password hashes, multi-factor authentication (MFA) data, session tokens.
• Metadata: connection IP address, timestamps, browser/device used (for fraud detection).

Data entry occurs exclusively during the login or registration process as well as during each session refresh.

You can find more information about data processing at Auth0 here: https://www.okta.com/legal/privacy-policy/.

We have chosen Europe as the server location for data storage. Insofar as a transfer of data to the USA may be necessary in isolated cases, we rely on standard contractual clauses that we have concluded in addition to a data processing agreement.

Purpose of data processing

Auth0 is integrated to ensure that only authorized and identified individuals have access when we provide our services. Furthermore, Auth0 is strictly necessary for providing the service in the context of user account access.

Retention period / Right to object and erasure

If you do not want cookies to be stored, please configure your internet browser to delete cookies, block all or some cookies, or issue a warning before cookies are saved. You can also set your cookie preferences via the CookieHub cookie management tool we have integrated.

6. Datadog

Description of data processing

We use Datadog, a service provided by Datadog, Inc., 620 8th Avenue, 45th Floor, New York, NY 10018, USA ("Datadog"), as a data processor within the meaning of Art. 4 No. 8 and Art. 28 of the GDPR.

We use Datadog to monitor system stability and analyze errors (such as unexpected deviations, anomalies including latency—i.e., the delay in data transmission to our servers—availability, and response times) on our websites and services, as well as for IT security purposes.

For this purpose, Datadog collects the following data on our behalf:

• Log data: Technical protocols for server requests (includes user IP addresses).
• Performance data: Application response times, error rates, error information, and crash reports (stack traces, i.e., the history of applications leading to an error, as well as the time the error occurred).
• Metadata: System configurations (e.g., browser type and version, operating system) and anonymized user IDs for tracking errors across different microservices.

With this data and the help of Datadog, errors can be detected, evaluated, and corrected immediately. The personal data collected may be transferred to and stored by Datadog in the United States. We have entered into a Data Processing Agreement with Datadog that includes standard contractual clauses. Furthermore, Datadog is certified under the Swiss/EU-U.S. Data Privacy Framework, which serves as the basis for data transfers to certified companies and organizations in the United States.

You can find more information about how Datadog processes data in Datadog Inc.'s privacy policy: https://www.datadoghq.com/legal/privacy/

Purpose of data processing

After this period expires, only aggregated data without any personal reference is retained. The purpose of processing this data is to ensure the error-free and needs-based operation of our websites and services, as well as to detect and fix errors. The use of Datadog is therefore necessary for providing our websites and services in connection with user account access.

Retention period / Right to object and erasure

Data collected via Datadog is deleted or anonymized after the error has been analyzed.

V. Links to third-party websites

Our website may contain links to other websites. We have no influence over the content or design of third-party offerings. Therefore, these data protection notices do not apply to external providers to whom we only provide links.

If you are redirected to other sites via links on our website, please check their respective data processing policies.

VI. Online presence on social media and platforms

Description of data processing

We maintain an online presence on various social networks or professional networks (such as Facebook, Xing, or LinkedIn) (hereinafter also referred to as "SN") and platforms (e.g., YouTube), and we link to them from our website. By clicking on the respective buttons (recognizable by the logos of the social networks or platforms), you will be taken to the respective online presence of that SN. The purpose of these online presences is to communicate with customers, interested parties, and active users, and to inform them about our services.

When visiting the respective networks and platforms, the terms and conditions and data processing guidelines of their respective operators apply.

Since the use of these SNs takes place outside of our website or services, we have no influence over it, unless otherwise stated below. However, we would like to point out that when using the aforementioned platforms and networks to which we provide links, data may also be processed in the United States by these SN companies and may be used by the respective operators for market research and advertising purposes, including the creation of user profiles. If you are logged into the relevant networks and platforms, they may also store cookies on your device to track your use of our platform or services, as well as other information about your user behavior.

Sauf indication contraire dans notre politique de confidentialité, nous ne traitons les données des utilisateurs que lorsqu'ils communiquent avec nous au sein des réseaux sociaux et des plateformes, par exemple en écrivant des commentaires ou en nous envoyant des messages.

Afin de vous faciliter l'information sur les traitements de données respectifs et les possibilités d'opposition des exploitants respectifs, nous vous renvoyons ci-après aux déclarations et informations sur la protection des données des exploitants des réseaux respectifs.

Objectif du traitement des données

Nous ne traitons vos données personnelles que dans le cadre d'une prise de contact directe avec nous via le RS concerné ou d'une interaction avec notre présence ou son contenu. Sauf indication contraire dans le cadre de notre déclaration de protection des données, nous traitons les données des utilisateurs sur la base de nos intérêts légitimes pour informer efficacement les utilisateurs et communiquer uniquement dans la mesure où ceux-ci communiquent avec nous au sein des réseaux sociaux et des plateformes (par exemple, lorsque les utilisateurs rédigent des articles sur nos présences en ligne ou nous envoient des messages). Si votre prise de contact vise la conclusion d'un contrat, le traitement sert cet objectif.

Dans la mesure où des données personnelles sont traitées en relation avec notre présence sur un RS et que le RS concerné décide seul des finalités et des moyens du traitement, le RS concerné est par ailleurs le seul responsable du traitement. Veuillez examiner avec soin les données personnelles que vous nous communiquez par le biais d'un site Internet du RS. Si vous souhaitez éviter que le RS ne traite les données personnelles que vous lui avez transmises, veuillez nous contacter par d'autres moyens.

Durée de la conservation / Possibilité d'opposition et de suppression

Si vous êtes membre d'un des RS sur lesquels nous avons des présences en ligne et que vous ne souhaitez pas que le RS collecte des données vous concernant par le biais de notre offre et les associe à vos données auprès du RS, vous devez vous déconnecter de votre RS avant de visiter notre offre. Pour une présentation détaillée des traitements respectifs, des informations sur la durée d'enregistrement des données par le RS concerné et les possibilités de ef (Opt-Out), nous vous renvoyons aux indications des fournisseurs dont les liens figurent ci-après.

Nous attirons également l'attention sur le fait que les demandes de renseignements et l'exercice des Droits des utilisateurs peuvent être exercés le plus efficacement auprès des fournisseurs. Seuls les fournisseurs ont accès aux données des utilisateurs et peuvent prendre des mesures et fournir des informations directement. Si vous avez besoin d'aide, n'hésitez pas à nous contacter.

Facebook

Nous gérons une page d'entreprise Facebook (page fan) sur le RS de Facebook Ireland Ltd, 4 Grand CanalSquare, Grand Canal Harbour, Dublin 2, Irlande).

Facebook Irlande est responsable, avec nous, de la collecte des données des visiteurs de notre page fan, raison pour laquelle nous avons conclu des conditions de traitement des données supplémentaires : .

Controller Addendum: https://www.facebook.com/legal/controller_addendum
"Data Processing Terms": https://www.facebook.com/legal/terms/dataprocessing/update

Nous sommes responsables de fournir aux personnes concernées au moins les informations susmentionnées et suivantes. Les informations de Facebook sur l'obtention de données personnelles sont disponibles dans la politique de données de Facebook Irlande à l'adresse https://www.facebook.com/about/privacy.

Facebook Inc., Menlo Park, California, USA (ci-après : Facebook Inc.) collecte et utilise en outre ce que l'on appelle les statistiques de page à des fins d'analyse. Les statistiques de page sont un ensemble de données qui nous permettent, à nous et à Facebook Inc., de savoir comment nos utilisateurs interagissent avec notre site. Les statistiques de page peuvent être basées sur des données personnelles collectées dans le cadre de la visite de nos utilisateurs ou de leurs interactions sur notre site. Pour ce faire, nous avons conclu avec Facebook un addendum pour les responsables ( Addendum du contrôleur, voir ci-dessus), qui régit notamment les mesures de sécurité prises par Facebook dans le cadre des statistiques de page et la manière dont Facebook répond aux demandes des utilisateurs. Les objectifs pour lesquels la collecte et la transmission des données personnelles qui constituent le traitement commun sont effectuées sont détaillés dans l'addendum du contrôleur ci-dessus.

Les informations recueillies lors de la visite de notre page fan comprennent également des informations sur les types de contenu que les utilisateurs regardent ou avec lesquels ils interagissent, ou sur les actions qu'ils effectuent (voir la section Ce que vous et d'autres faites et fournissez dans la politique de confidentialité de Facebook : https://www.facebook.com/policy), ainsi que d'autres informations sur les outils utilisés par les utilisateurs (par exemple, les adresses IP, le système d'exploitation, le type de navigateur, les paramètres de langue, les données de cookie, décrites en détail dans les informations sur les outils dans la politique de confidentialité de Facebook : https://www.facebook.com/policy).

Cependant, en maintenant la Page Facebook Entreprise, nous partageons la responsabilité des statistiques de page et nous avons convenu avec Facebook Irlande que Facebook Irlande est responsable du respect des Droits des personnes concernées en ce qui concerne les données personnelles stockées par Facebook Irlande après le traitement commun. C'est pourquoi nous avons l'obligation de signaler à Facebook les demandes de protection des données que nous recevons concernant les statistiques de page. Veuillez noter que nous transmettons les demandes d'informations sur les statistiques de page à Facebook Irlande. En outre, veuillez vous reporter aux explications relatives aux Droits des personnes concernées dont vous disposez dans la partie A. Pour plus d'informations sur la façon dont Facebook Irlande traite les données personnelles et sur la façon dont les personnes concernées peuvent exercer leurs Droits vis-à-vis de Facebook Irlande, veuillez consulter la politique de données de Facebook Irlande à l'adresse https://www.facebook.com/about/privacy.

L'évaluation des données collectées par le biais de statistiques de page sert à améliorer notre présence sur Internet ainsi qu'à des fins publicitaires. Nous gérons notre page fan Facebook dans le but de communiquer et de canaliser facilement les demandes de contact des utilisateurs de Facebook. La collecte de ces données et leur traitement ultérieur sont dans notre intérêt légitime ainsi que dans l'intérêt légitime de Facebook Inc.

Nous attirons l'attention sur le fait que nous ne pouvons pas activer ou désactiver la fonctionalité statistiques de page. Nous devons donc transmettre la plupart de ces demandes à Facebook-Irlande, dans la mesure où nous n'avons pas collecté de données nous-mêmes. Si vous ne souhaitez pas que Facebook Inc. recueille vos données, nous vous prions de ne pas utiliser notre site d'entreprise Facebook et/ou de configurer votre navigateur de manière à empêcher l'installation de cookies et/ou de vous déconnecter de Facebook lorsque vous utilisez notre site.

Data protection information:
https://www.facebook.com/about/privacy/, https://www.facebook.com/legal/terms/information_about_page_insights_data

Opt-out option:
https://www.facebook.com/settings?tab=ads and http://www.youronlinechoices.com

LinkedIn

LinkedIn is a service provided by LinkedIn Corporation, 2029 Stierlin Court, Mountain View, CA 94043, USA, and operated in Europe by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. LinkedIn is an internet-based social network that allows users to connect with existing professional contacts and build new ones. With over 400 million registered members in more than 200 countries, LinkedIn is currently the largest platform for professional networking and one of the most visited websites in the world.

Whenever you visit our website, if it includes a LinkedIn component (plug-in), your browser will automatically download a corresponding representation of that component from LinkedIn. For more information on LinkedIn plug-ins, please visit https://developer.linkedin.com/plugins. During this technical process, LinkedIn is notified of the specific subpage of our website that you are visiting.

If you are logged into LinkedIn at the same time, LinkedIn recognizes which specific subpage of our website you are visiting every time you access our site and for the entire duration of your visit. This information is collected by the LinkedIn component and associated by LinkedIn with your personal LinkedIn account. If you click on an integrated LinkedIn button on our website, LinkedIn links this information to your personal LinkedIn user account and stores this personal data.

The LinkedIn component ensures that LinkedIn is always notified that you have visited our website if you are logged into LinkedIn at the time of your visit, regardless of whether you click on the LinkedIn component or not. If you do not want this information to be transmitted to LinkedIn, you can prevent this by logging out of your LinkedIn account before accessing our website.

LinkedIn offers the option to unsubscribe from emails, SMS messages, and targeted ads, and to manage your ad settings at https://www.linkedin.com/psettings/guest-controls. LinkedIn also works with partners such as Quantcast, Google Analytics, BlueKai, DoubleClick, Nielsen, Comscore, Eloqua, and Lotame, who may place cookies. You can opt out of such cookies at https://www.linkedin.com/legal/cookie-policy. LinkedIn's current privacy policy can be found at https://www.linkedin.com/legal/privacy-policy. LinkedIn's cookie policy can be found at https://www.linkedin.com/legal/cookie-policy.

Privacy Policy https://www.linkedin.com/legal/privacy-policy
Opt-out option:
https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out

XING

The operating company for Xing is XING AG, Dammtorstrasse 29-32, 20354 Hamburg, Germany (XING).

Xing is an internet-based social network that allows users to connect with existing professional contacts and build new ones. Individual users can create a personal profile on Xing. Companies can, for example, create company profiles or post job openings on Xing.

Whenever you visit a page on this website that includes a Xing component (plug-in), your browser is automatically prompted by the Xing component to download a representation of the corresponding Xing component. For more information on Xing plug-ins, please visit https://dev.xing.com/plugins. During this technical process, Xing is notified of the specific subpage of our website that you are visiting.

If you are logged into Xing at the same time, Xing recognizes which specific subpage of our website you are visiting every time you access our site and for the entire duration of your visit. This information is collected by the Xing component and associated by Xing with your personal Xing account. If you use one of the Xing buttons integrated on our website, such as the share button, Xing links this information to your personal Xing user account and stores this personal data.

The Xing component ensures that Xing is always notified that you have visited our website if you are logged into Xing at the time of your visit, regardless of whether you click on the Xing component or not. If you do not want this information to be transmitted to Xing, you can prevent this by logging out of your Xing account before accessing our website.

The data protection provisions published by Xing, which can be found at https://www.xing.com/privacy, provide information on the collection, processing, and use of personal data by Xing. Additionally, Xing has published privacy information for the XING share button at: https://www.xing.com/app/share?op=data_protection.

Privacy Policy / Opt-out option:
https://privacy.xing.com/en/privacy-policy

VII. Active use of our website

1. Contact forms and email contact

Description of data processing

Our website includes a contact form that can be used for electronic communication. If you use this option, the data entered into the input fields will be transmitted to us and stored.

• Company/Municipality (required)
• First name (required)
• Last name (required)
• Email address (required)
• Phone (optional)
• Message (optional)

When you send a message via one of our contact forms, the following data is also saved:

• The user's IP address
• Date and time of submission

If you contact us via an email address we have provided, the personal data you include in your email will be saved.

If you provide a mobile phone number to receive updates on the status of your payment request, we will use the number you provided for that purpose.

We use HubSpot Forms on our website, a service provided by our CRM system, HubSpot, to integrate contact forms and process the data entered into them (see Part C, Section II). HubSpot Forms offers features for SEO, content creation, lead management, email marketing, and analytics. User data entered into these forms is saved in our customer relationship management system provided by HubSpot.

We use Google's email services, provided via Google Workspace by Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland (hereinafter: "Google"). In addition to our CRM software, which is our primary system for managing and processing requests, emails are also stored on Google's servers. We have selected the "Europe" region as our server location and have entered into a data processing agreement with Google. Google contractually guarantees that these emails will not be transferred to third countries, particularly the United States.

To channel and sort incoming requests, we use an interface to access AI-based services designed to understand and generate natural language, analyze information, and make predictions:

For this purpose, we use the ChatGPT language model from OpenAI Ireland Ltd, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland. We have agreed with OpenAI that our data will not be used to train their models, nor will it be shared with OpenAI. You can find OpenAI's privacy policy at https://openai.com/de/policies/eu-privacy-policy. We have entered into a data processing agreement with OpenAI regarding personal data ("Data Processing Addendum," see https://openai.com/policies/data-processing-addendum). Since data is transferred to the United States when using the OpenAI API, the Data Processing Addendum stipulates that EU Standard Contractual Clauses apply to ensure an adequate level of data protection, even when transferring data to a third country.

We also use the Google Gemini artificial intelligence system, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Gemini was developed to provide advanced speech and image processing functions. It uses machine learning to understand and generate natural language and analyze images, offering a wide range of applications across various fields. We use the Google Gemini model to pre-screen incoming emails and documents. As a Google Workspace customer, we have Google's guarantee that information collected while using Google Gemini is not used by Google to train its publicly available artificial intelligence models.

To check the spelling of responses to incoming emails, we use the LanguageTool application, software from LanguageTooler GmbH, Karl-Liebknecht-Str. 37, 14482 Potsdam, a subsidiary of Learno Inc., which includes AI features for spelling and grammar checking as well as refining phrasing. You can find the provider's privacy policy for LanguageTool here: https://languagetool.org/de/legal/privacy. LanguageTool stores checked records and any errors they contain on their servers (not on permanent storage) for a maximum of 15 minutes. This storage occurs without an IP address or other information that would allow the records to be linked to an individual. However, if the text contains personal data, this is also saved for that short duration. We have entered into a data processing agreement with Learno Inc. that includes the EU Standard Contractual Clauses required for data processing in the United States, through which the provider contractually commits to complying with current legal data protection provisions: https://languagetool.org/de/legal/dpa

To extract attachments containing PDF or Word files, we use the software solution Airparser, Sepapaja tn 6, Tallinn 11415, Estonia. Airparser uses artificial intelligence technology to recognize and extract structured data. We have entered into a data processing agreement with Airparser in accordance with Article 28 of the GDPR, by which Airparser is contractually obligated to comply with applicable data protection provisions (see https://airparser.com/dpa/). You can view Airparser's privacy policy at https://airparser.com/gdpr/.

Purpose of data processing

Article 6(1)(f) of the GDPR serves as the legal basis for processing data transmitted when sending a request via a contact form or email. If the contact form request or email contact is aimed at concluding a contract, Article 6(1)(b) of the GDPR serves as an additional legal basis for processing.

Processing the personal data from the input form allows us to handle your requests and get in touch with you. In the case of contact via email, this also constitutes the necessary legitimate interest for processing the data. If you provide a mobile phone number to receive updates on the status of your payment request, we will use the number you provided for that purpose.

The use of AI-based services is based on our legitimate interest under Article 6(1)(f) of the GDPR. Due to the high volume of incoming messages, we rely on such pre-screening and assignment to the appropriate departments within the company to ensure fast and targeted processing of these requests, which is in our interest as well as the interest of the applicants or senders of messages addressed to us.

Information provided by users may also be stored in our customer relationship management system (CRM software) or a comparable request management system, based on our legitimate interests.

Other personal data processed during the submission process serves to prevent misuse of the contact form and to ensure the security of our IT systems.

Retention period / Right to object and erasure

Data is deleted as soon as it is no longer necessary for the purposes for which it was collected. For personal data from the contact form input mask and data sent via email, this is the case when the respective conversation with the user has ended. The conversation is considered ended when the circumstances indicate that the matter in question has been definitively clarified and no legal requirements mandate longer retention.

Users have the option to revoke their consent to the processing of their personal data at any time.

Si l'utilisateur prend contact avec nous, il peut à tout moment s'opposer à l'enregistrement de ses données personnelles. Dans un tel cas, la conversation ne peut pas être poursuivie, à moins que nous puissions la fonder sur une autre base légale de protection des données ou que nous ayons un intérêt prépondérant à poursuivre le traitement des données.

Toutes les données personnelles enregistrées dans le cadre de la prise de contact seront alors supprimées, à moins que des dispositions légales n'exigent un enregistrement plus long.

2. Ligne d'assistance téléphonique

Description du traitement des données

Si un utilisateur fait usage de la possibilité de nous contacter par téléphone à un numéro indiqué sur nos sites Internet, nous saisissons le numéro d'appel entrant de l'appelant ainsi que d'autres informations techniques provenant du système téléphonique (début de la conversation et durée de la conversation), qui ont été soit générées à cet endroit, soit mises à disposition par la transmission de l'opérateur téléphonique, et nous enregistrons le contenu essentiel de la conversation ainsi que les informations fournies à nos collaborateurs par les personnes concerées (nom, demande, possibilités de contact pour des questions complémentaires, etc.).

Pour préqualifier les appels que nous recevons, nous utilisons une solution logicielle basée sur l'IA du fournisseur Leaping AI UG (haftungsbeschränkt), Potsdamer Straße 72, 10785 Berlin. Cette solution permet d'obtenir les données nécessaires pour classer l'appel et le transmettre au bon service spécialisé ou répondre aux questions de l'utilisateur (notamment notre numéro de dossier, le numéro d'immatriculation, le nom de l'appelant) et de traiter certaines questions des clients de manière automatisée. Pour ce faire, nous avons conclu un accord avec Leaping AI pour le traitement des données en sous-traitance conformément à l'article 28 du RGPD.

Nous vous demanderons si vous acceptez que votre conversation soit enregistrée. Si l'appelant consent à un enregistrement de la conversation téléphonique, nous conservons le contenu complet de la conversation et établissons automatiquement une transcription de la conversation. Nous utilisons les enregistrements des appels et les transcriptions à des fins de formation et d'entraînement de notre personnel de service, pour résoudre les plaintes des clients, ainsi que pour établir des évaluations internes anonymes (classification des appels, établissement de statistiques sur les motifs des appels) et à des fins de preuve dans le cadre de l'exercice de droits légaux qui nous reviennent ou de la défense de droits légaux dirigés contre nous.

Nous utilisons la plateforme de centre de contact dans le cloud Talkdesk du fouisseur Talkdesk Inc. 201 Spear Street, Suite 1100, San Francisco, CA 94105 États-Unis (ci-après : « Talkdesk »). Nous avons conclu avec Talkdesk un accord de traitement des commandes ainsi que les clauses contractuelles standard pour les transferts de données vers des pays tiers, par lequel Talkdesk est contractuellement tenu de respecter les dispositions légales en vigueur en matière de protection des données. Nous avons également convenu avec Talkdesk que notre instance Talkdesk sera mise à disposition dans une région en Europe et que nos données seront ainsi traitées par défaut dans un cloud régional au sein de l'Union Européenne.

Objectif du traitement des données

Lors de la réception de l'appel, nous collectons automatiquement les données nécessaires au traitement de l'appel (notamment notre numéro de dossier, notre numéro d'immatriculation, le nom de l'appelant) dans le but d'automatiser et de traiter plus efficacement certaines demandes de clients ou certains éléments de l'interaction, sur la base de l'article 6, paragraphe 1, point f), du RGPD. Si l'appel téléphonique a un rapport avec nos prestations et une relation contractuelle existante, terminée ou prévue avec l'appelant, la base juridique supplémentaire pour le traitement est l'art. 6, al. 1, let. b du RGPD.

Lors de la prise de l'appel, nous collectons de manière automatisée les données nécessaires au traitement de l'appel dans le but d'automatiser et de traiter plus efficacement certaines demandes de clients ou éléments d'interaction.

Les données des utilisateurs peuvent en outre être enregistrées dans notre système de gestion de la relation client (logiciel CRM) ou dans une organisation de demande comparable, sur la base de nos intérêts légitimes

Durée de la conservation / Possibilité d'opposition et de suppression

Les données sont effacées dès qu'elles ne sont plus nécessaires à la réalisation de l'objectif de leur collecte. C'est le cas lorsque la conversation avec l'utilisateur est terminée. La conversation est considérée comme terminée lorsque les circonstances permettent de conclure que les faits concernés ont été définitivement clarifiés et qu'aucune disposition légale ne requiert une conservation plus longue.

Dans la mesure où aucun délai de conservation légal n'est prescrit pour les enregistrements, la durée de conservation des enregistrements et des notes d'entretien s'oriente sur les délais de prescription légaux (les droits à des dommages et intérêts ou à une réparation morale se prescrivent par trois ans). Les transcriptions d'enregistrements d'entretiens sont effacées après six mois.

L'utilisateur a la possibilité de révoquer à tout moment son consentement au traitement de ses données personnelles. Si un appelant consent à l'enregistrement de la conversation à sa transcription et à la sauvegarde de cet enregistrement et de la transcription, il peut à tout moment révoquer ce consentement. Dans un tel cas, les enregistrements ou les transcriptions seront immédiatement effacés, à moins que des dispositions légales ne nous obligent à les conserver plus longtemps.

3. système de tickets

Description du traitement des données

Nous utilisons comme système de tickets Freshdesk, une solution logicielle de Freshworks, Inc, 2950 S.Delaware Street, Suite 201 à San Mateo, CA 94403 États-Unis. Freshdesk est une plateforme de service à la clientèle qui facilite le traitement des demandes et des requêtes des clients par différents canaux. Nous utilisons Freshdesk pour accepter et gérer les demandes de contact. Si vous faites des demandes de contact par le biais d'un formulaire de contact sur nos sites Internet ou si vous nous contactez par e-mail ou par téléphone, les informations et le contenu de la conversation fournis au cours de la prise de contact ainsi que les données que nous avons collectées (voir les points VII. 2 et VII. 3 ci-dessus) sont enregistrés et organisés dans le système de tickets afin de permettre un traitement chronologique et d'améliorer l'expérience de service.

Les informations enregistrées sont collectées sur des serveurs de données personnelles selon l'étendue de leur mise à disposition, mais en tout cas le nom, le prénom et l'adresse e-mail, transmises au Freshdesk, où elles sont enregistrées et lues. Nous avons fait usage de la possibilité de faire effectuer le traitement des données sur des serveurs situés dans l'UE. Cela devrait garantir techniquement que les données se trouvent dans l'Union européenne et qu'un accès par les autorités américaines n'est pas possible.

You can find more information about data protection at Freshdesk at https://www.freshworks.com/privacy/.

Purpose of data processing

We process information collected via Freshdesk based on our legitimate interest in organizing our customer service efficiently and responding to your inquiries as quickly as possible to support our customers and users. We have entered into a data processing agreement with Freshdesk to ensure data protection and, in particular, to prohibit unauthorized disclosure to third parties.

If a transfer of data to the United States is necessary in a specific case, it is based on standard contractual clauses.

Retention period / Right to object and erasure

We store your data for the duration of our contractual relationship with the data subjects or until the respective conversation has been completed.

You can exercise your right to object and erasure as described in the general information in Part A.

‍

4. Chat function

Description of data processing

The chat function we provide on our website consists of an AI-based chatbot from Decagon AI, Inc., 2261 Market Street, STE 5378, San Francisco, CA 94114, USA (hereinafter "Decagon"). Decagon operates an AI platform for automating customer service processes using customer service "agents." The chat function allows you to ask and receive answers to frequent or general questions about our parking system or specific parking facilities we manage (e.g., opening hours, rates), or to report issues at a parking facility we manage so they can be forwarded to our customer service team.

As soon as you enter a question in the chat text field (a "prompt"), Decagon automatically analyzes the question and provides a text response from the agent.

Generally, we do not need any personal information about you (e.g., name, email address, phone number, address, license plate number, case reference) for this. Please refrain from voluntarily entering personal data about yourself or others in the input field. We only collect and store such data if you provide it to us voluntarily.

For the display and technical operation of the chat function, the following technical data is processed as part of the log data during use:

• IP address
• Metadata via API requests
• Date and time of access

Processing is fully automated by the chat function and only occurs when data is sent in the chat. The agent works autonomously within clearly defined limits and does not make any independent decisions that could affect your rights or your access to our services. If a request requires human judgment or exceeds the scope of the AI agent's capabilities, it is forwarded to one of our human agents via a supervised process and recorded in our CRM or ticketing system for further processing outside of Decagon.

Decagon has contractually guaranteed that user data provided via the chat function is not used to train other AI models. We have entered into a data processing agreement with Decagon that ensures data protection and prohibits any unauthorized disclosure to third parties.

You can find more information about data protection at Decagon at https://decagon.ai/legal/privacy.‍

Purpose of data processing

The purpose of the processing is to support our customers and users in answering general questions or support requests. We process the information entered via Decagon based on our legitimate interest in organizing our customer service efficiently and responding to your request as quickly as possible.

We have also agreed with Decagon that data is processed exclusively within the EU as part of the normal operation of the chat function (data residency in the EU). If a transfer of data to the USA is necessary in a specific case for technical support of the chat function and is authorized by us, this will be based on standard contractual clauses.

Storage duration / right to object and erasure

We store personal data exchanged during chats for the duration of the legal relationship between us and the individuals concerned, or until the relevant conversation has ended.

C. Processing of data related to the use of MHP parking facilities

1. Use of the MHP online shop

Description of data processing

Through our MH Parkservice online shop (hereinafter referred to as the "online shop"), you have the option to book and pay for the parking services described there for the parking facilities we manage, based on our current terms and conditions. For example, you can pay your parking fees online.

We use cookies to make our online shop more user-friendly. Some elements of our website require the browser to be identified even after navigating to a different page. The user's language and region are saved in these cookies.

Furthermore, cookies allow us to analyze browsing behavior in the online shop. The following data may be collected in this way: search terms entered, frequency of page views, and use of website features.

To book parking services or pay for your parking, you must enter your vehicle's license plate number in the designated input field and, if applicable, select the parking facility you wish to use and/or a case number or reference. We need the license plate number and other information to assign the parking fee due to the specific transaction or parking service.

Data processed during the booking process includes license plate information, the amount to be paid, and other communication, contract, and payment data from our customers, prospects, and other business partners. Processing is carried out for the purpose of providing contractual services as part of operating our online shop, billing, delivery, and customer service. During the booking process, we process details provided in the respective input forms, such as name, company, address, email, and phone number. Mandatory information is generally marked with an * or noted as required, and includes the information necessary for providing and billing the ordered service, as well as contact details to reach you or inform you of important order-related information (such as mandatory legal notices, deadline changes, etc.).

We process and use the data collected for this purpose to allow you to select, book, and pay for our parking services. We also process the data to handle and, if necessary, send the booking you have made. For more details on the legal and organizational conditions, please refer to the corresponding terms and conditions. For more details on the payment service providers we use, please see point 2 of this Part C below.

Purpose of data processing

Processing the data collected during a booking is necessary for concluding a contract, detecting and prosecuting harmful behavior, detecting and preventing other negative experiences, maintaining the integrity of the online shop, and promoting protection and security. We, as well as other users of our services, have an interest in preventing, detecting, or investigating illegal activities, fraud, or security breaches.

Processing the personal data in the input form allows us to handle the corresponding booking and provide the associated parking service.

Processing of data entered in the online shop may also be based on your consent, if we have requested it. You can revoke your consent at any time. The legality of data processing already carried out remains unaffected by the revocation. Please note that due to your revocation, we may not be able to provide you with the full booking process, and any booking already made may no longer be executable.

Storage duration / right to object and erasure

Data is deleted as soon as it is no longer needed to achieve the purposes for which it was collected. For personal data in the booking process input form, this is the case after a contract for our parking services has been concluded, at the earliest once the relevant parking service has been fully provided. As a general rule, however, we store contract-related data until the expiration of legal warranty obligations. In the event of a legal archiving obligation, the relevant data will be deleted once that period expires.

2. Use of payment providers in order processing (payment services)

Description of data processing

Si, après la conclusion d'un contrat payant portant sur des prestations de stationnement, il existe une obligation de nous transmettre vos données de paiement (par ex. numéro de compte en cas d'autorisation de prélèvement automatique), ces données sont nécessaires au traitement du paiement.

Pour un traitement moderne, simple et sur des paiements, nous proposons à nos clients différents moyens de paiement pour lesquels nous utilisons, outre les banques et les établissements de crédit, d'autres prestataires de services de paiement (désormais appelés collectivement : fournisseurs de services de paiement).

Le trafic des paiements via les moyens de paiement habituels (p. ex. Visa/MasterCard) s'effectue exclusivement via une connexion SSL ou TLS cryptée. Vous reconnaissez une connexion cryptée au fait que la ligne d'adresse du navigateur passe de « http:// » à « https:// » et au symbole du cadenas dans la ligne de votre navigateur.

En cas de communication cryptée, les données de paiement que vous nous transmettez ne peuvent pas être lues par des tiers.

Si vous avez choisi d'utiliser les services de paiement d'un fournisseur de services de paiement particulier comme option de paiement, le fournisseur de services de paiement fournira ses services sur la base d'un contrat conclu entre vous et le fournisseur de services de paiement, sur la base des conditions commerciales ou d'utilisation en vigueur du fournisseur de services de paiement. Les traitements de données qu'ils effectuent relèvent de leur responsabilité, nous n'avons aucune influence sur ces traitements. En conséquence, nous devons nous référer au fournisseur de services de paiement concerné en cas d'exercice des Droits des personnes concernées dans ce contexte. Le cas échéant, le fournisseur de services de paiement vous demandera des autorisations supplémentaires, par exemple pour effectuer une vérification d'identité ou de solvabilité. Les données personnelles traitées par les fournisseurs de services de paiement comprennent généralement le prénom et le nom, l'adresse, la date de naissance, le sexe, l'adresse e-mail, l'adresse IP, le numéro de téléphone ainsi que les données nécessaires au traitement du paiement et liées à la commande, telles que le nombre d'articles, le numéro d'article, le montant de la facture et le pourcentage de taxes, ou les données bancaires nécessaires à l'exécution de la transaction, telles que les numéros de compte ou de carte de crédit, les mots de passe, les numéros TAN et les sommes, ainsi que les données relatives au contrat, au montant et au destinataire.

Le fournisseur de services de paiement traite ces données dans le but d'offrir le mode de paiement en question et de vérifier l'identité et/ou la solvabilité, l'administration des paiements et la prévention des fraudes, le cas échéant.

Objectif du traitement des données

La transmission de vos données aux fournisseurs de services de paiement que nous utilisons a lieu dans le cadre de l'exécution du contrat conclu avec nous ainsi que dans le but de traiter efficacement et en temps voulu les opérations de paiement en ligne, sauf si nous vous demandons votre consentement. Vous avez la possibilité de révoquer à tout moment votre consentement au traitement des données par les prestataires de paiement, avec effet pour l'avenir. La révocation n'a pas d'incidence sur la validité des opérations de traitement des données effectuées dans le passé.

Adyen
Pour certains types de paiement, nous utilisons le prestataire de services de paiement Adyen N.V. Simon Carmiggeltstraat 6, 1011 DJ, Amsterdam, Pays-Bas (ci-après : « Adyen »). Si un paiement via Adyen est sélectionné, des données personnelles sont transmises automatiquement à Adyen. Les données personnelles transmises à Adyen sont en général le type de carte (par exemple Visa ou Mastercard), le nom du titulaire de la carte, le numéro de la carte, le chiffre de contrôle et la durée de validité. Le rôle d'Adyen est de demander au système de paiement concerné, par exemple Mastercard, Visa, d'autoriser la transaction et d'envoyer cette autorisation à la banque de l'acheteur pour approbation. Si la banque l'autorise, Adyen en est informé par le système de paiement concerné et procède au paiement à notre banque. Adyen traite vos données pour le traitement des paiements ainsi que pour la vérification de l'identité et de la solvabilité. Dans ce cas, Adyen traite vos données personnelles en tant que responsable du traitement. Nous n'avons donc aucune influence sur le traitement des données par Adyen.
Vous trouverez les informations d'Adyen concernant la protection des données sur : https://www.adyen.com/fr_FR/privacy-policy, et pour le traitement des transactions sur : https://www.adyen.com/fr_FR/privacy-policy/transaction.

Stripe
Pour le paiement en ligne des services payants que nous fournissons, nous utilisons Stripe, un service de paiement en ligne fourni par le prestataire technique Stripe Payments Europe Ltd. 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Irlande (Stripe).

Si vous avez choisi Stripe comme mode de paiement, les informations communiquées au cours du processus de commande seront transmises à Stripe, en plus des informations relatives à votre commande et des informations requises selon le mode de paiement (nom, adresse, adresse électronique, numéro de client, numéro de commande, établissement bancaire, numéro de compte, code bancaire, éventuellement numéro de carte de crédit, durée de validité de la carte de crédit, numéro de la carte de crédit (CVC), montant de la facture, devise et numéro de transaction, date et heure de la transaction, lieu, nom du fournisseur). La transmission des données a lieu exclusivement dans le but de traiter les paiements avec Stripe et uniquement dans la mesure où elle est nécessaire à cet effet. Sans la transmission de vos données personnelles, nous ne pouvons pas effectuer de paiement via Stripe.

Stripe joue un double rôle de responsable du traitement et de (sous-)traitant dans le cadre des activités de traitement des données. En tant que responsable du traitement, Stripe utilise les données que vous avez fournies sur la base des conditions générales et d'utilisation de Stripe en vigueur, afin d'exécuter la relation contractuelle entre vous et Stripe concernant le traitement des paiements et de satisfaire aux obligations réglementaires. Nous n'avons aucune influence sur ce processus. Vous trouverez les informations sur la protection des données de Stripe ainsi que d'autres informations à ce sujet sur : https://stripe.com/de/privacy

Stripe agit en tant que processeur de commandes afin de pouvoir conclure des transactions au sein des réseaux de paiement. Dans le cadre du contrat de traitement des commandes, Stripe agit exclusivement selon nos instructions et s'est engagé contractuellement, au sens de l'article 9 de la LPD, à respecter les dispositions légales relatives à la protection des données.

secuPay
Sur notre boutique en ligne, nous proposons des procédures de paiement sans numéraire de secupay AG (Goethestr. 6, 01896 Pulsnitz ; secupay). Secupay est un institut de paiement au sens de la loi sur la surveillance des services de paiement (ZAG) et est enregistré auprès de la Bundesanstalt für Finanzdienstleistungsaufsicht (Graurheindorfer Str. 108, 53117 Bonn ; BaFin) et permet le paiement sans argent liquide de produits et de services sur Internet. En cas d'utilisation de secupay comme procédure de paiement, la créance du prix d'achat est cédée à secupay. Les exploitants de boutiques en ligne sont ainsi en mesure de livrer des marchandises, des services ou des téléchargements au client immédiatement après la commande. Si, au cours d'un processus de commande, vous choisissez le « prélèvement automatique », « l'achat sur facture » ou « la carte de crédit » comme mode de paiement via secupay, des données vous concernant seront automatiquement transmises à secupay. Lors du traitement des paiements par secupay, les données relatives aux moyens de paiement sont transmises à secupay. secupay procède ensuite à une vérification technique du risque de non-paiement. Le résultat de la transaction nous est ensuite communiqué de manière automatisée. Les données personnelles échangées avec secupay sont le prénom, le nom, l'adresse, l'adresse e-mail, l'adresse IP, le numéro de téléphone ou d'autres données nécessaires au traitement des paiements.

Les données personnelles échangées entre secupay et nous peuvent être transmises par secupay à des agences d'évaluation du crédit. Cette transmission a pour but la vérification de l'identité et de la solvabilité. Le cas échéant, secupay transmet les données personnelles à des entreprises liées et à des prestataires de services ou à des sous-traitants, dans la mesure où cela est nécessaire à l'exécution des obligations contractuelles ou si les données doivent être traitées sur mandat. Ces traitements de données sont effectués sous la responsabilité de secupay. Nous n'y avons aucune influence. Vous avez la possibilité de révoquer à tout moment auprès de secupay les consentements donnés à secupay concernant le traitement des données personnelles. Une révocation n'a pas d'effet sur les données personnelles qui doivent impérativement être traitées, utilisées ou transmises par nous pour le traitement des paiements (conformément au contrat). La politique de confidentialité en vigueur de secupay peut être consultée sur https://www.secupay.com/de/datenschutz .

Planet (Datatrans)
‍Pour notre boutique en ligne, nous utilisons la passerelle de paiement Datatrans de la société Planet Payment Group Holdings Limited, IDA Business Park, Dangan, Galway H91A06C, Irlande, ainsi que les services d'acquisition fournis par ce biais pour le traitement, l'exécution et le règlement des paiements sans numéraire de produits et de services via notre boutique en ligne de la société Planet Payment Group Holdings Limited, enregistrée en tant qu'établissement de paiement auprès de l'Autorité de Contrôle Prudentiel et de Résolution (n° d'enregistrement : 83991), Planet Merchant Services SAS, 1 Terrasse Bellini, Puteaux, 92919, Paris La Défense Cedex, France, au moyen des catégories de moyens de paiement que nous acceptons (Mastercard/Maestro, Visa, Twint). Planet Payment Group Holdings Limited et la société Planet Merchant Services SAS sont ci-après dénommées Planet.

Planet joue un double rôle de responsable du traitement et de (sous-)traitant dans les activités de traitement des données.

La passerelle permet de traiter les données techniques nécessaires à la transmission en temps réel des données relatives aux opérations de paiement entre un canal de paiement et Planet. Pour ce faire, nous avons conclu un accord de traitement des commandes avec Planet.

En tant que responsable, Planet utilise les données que vous lui avez transmises pour satisfaire aux obligations réglementaires et pour le traitement du processus de paiement. L'exécution de la transaction s'effectue exclusivement dans la relation entre l'utilisateur et le site web d'origine par le débit du moyen de paiement déposé auprès de Planet. Si vous avez donc opté pour un mode de paiement proposé par Planet, les informations communiquées dans le cadre du processus de commande sont transmises par Planet. Il en est de même pour les informations relatives à votre commande et des informations requises selon le mode de paiement (p. ex. nom, adresse, adresse électronique, numéro de client, numéro de commande, établissement bancaire, numéro de compte, code bancaire, éventuellement numéro de carte de crédit, durée de validité de la carte de crédit, numéro de contrôle de la carte de crédit (CVC), montant de la facture, monnaie et numéro de transaction, date et heure de la transaction, lieu, nom du fournisseur). La transmission des données a lieu exclusivement dans le but de traiter les paiements avec Planet et uniquement dans la mesure où elle est nécessaire à cet effet. Sans la transmission de vos données personnelles, nous ne pouvons pas effectuer de paiement via Planet. L'utilisation de Planet dans le cadre des services d'acquisition se fait sur la base des conditions d'utilisation et de vente de Planet en vigueur. Nous n'avons aucune influence sur ce point.

Le traitement de ces données personnelles est nécessaire pour pouvoir fournir les services ou le traitement des paiements, la vérification de la solvabilité, l'information sur la disponibilité, la lutte contre la fraude ou le traitement des réclamations et des remboursements, ainsi que pour satisfaire aux exigences réglementaires.

You can find information on data protection at Planet here: https://www.weareplanet.com/privacy-policy and https://www.planetpayment.com/en/privacy/

‍

3. Using MHP online shop reviews

Description of data processing

We use the review portal "Trustpilot" from TrustPilot A/S, Pilestraede 58, 5th Floor, 1112 Copenhagen, Denmark. Trustpilot gives users the opportunity to rate our products and services.

When you purchase parking services online through our shop and receive your receipt via email, we include a Trustpilot button in that email containing a unique link generated by Trustpilot. We maintain an interface ("API") with Trustpilot to create these invitation links. Clicking this link takes you directly to the Trustpilot review platform. If you click the button with the invitation link, the Trustpilot form is automatically pre-filled with your details, allowing you to post your review on their portal. Reviews are verified using the reference number from the generated link. Leaving a review is entirely voluntary.

For this purpose, we share the following data with Trustpilot:

• Email address
• First and last name
• Reference number
• Language and country-specific shop domain, access data (including IP address)
• Selected parking service

In this context, we use Trustpilot as a data processor and have entered into a data processing agreement with them to ensure your data is handled in compliance with data protection regulations.

Please note that you need a Trustpilot user account to post a review. Once you submit your review and accept Trustpilot's terms of use, Trustpilot becomes the data controller for the subsequent processing and publication of your review. You can find more details on Trustpilot's data protection policy at https://fr.corporate.trustpilot.com/legal/for-businesses/privacy-policy.

Purpose of data processing

Data is processed to create an invitation link and verify that the shop was used, enabling the review process. This, along with collecting user feedback to improve our services, constitutes a legitimate interest.

Retention period / Right to object and erasure

Invitation data transmitted to Trustpilot is stored for one year.

4. Using parking facilities managed by MH Parkservice

Description of data processing

When using our parking facilities, the following data is collected automatically: vehicle license plate (including front and rear views), entry/exit time, date and location stamp, and the amount and payment method for the parking fee.

Before leaving the parking facility, users must enter their license plate number at the automated pay station, unless they have a permanent parking permit. If the entered license plate is found in our database, the parking fee is calculated and paid by the user. For more details on data processing during payments via our online shop, please refer to Part C, points 1 and 2, and the applicable terms of use.

In the event of a breach of the general terms of use, all personal data of the vehicle owner and driver relevant to legal enforcement—specifically for collecting imposed contractual penalties and/or asserting property rights and protection (tracking)—will also be processed.

If you receive a claim letter as the owner of a vehicle involved in a parking violation, your license plate number was previously obtained by us from the locally responsible vehicle registration authority (the cantonal vehicle licensing office or the eAutoindex portal provided by the cantons). If you are not the vehicle owner, your data was provided to us by the owner or another third party (e.g., a car rental or leasing company) who confirmed you were the driver at the time of the violation. If you are no longer registered at the address held by the vehicle registration authority, we obtained your data from the person currently registered at that address, a credit reporting agency, or a debt collection agency.

To process collection documents received from competent authorities containing holder data and to assign records to the respective holders, we use the ConvertAPI platform provided by UAB Baltsoft, Kosciuskos 26-17, Vilnius, LT-01100, Lithuania. This tool is used to process PDF files and, if necessary, to convert files into other formats (e.g., PDF to DOCX). In this process, personal data contained in the documents—typically the name and address of the registered keeper—is processed on the provider's servers. Data streams exchanged between us and ConvertAPI are fully encrypted. ConvertAPI has committed to us to comply with current data protection standards https://www.convertapi.com/static/docs/compliance/PP_DPA.pdf (and has been ISO 27001 certified by TÜV Thüringen (https://www.convertapi.com/compliance).

Purpose of data processing

Processing the collected data is necessary to safeguard the legitimate interests of the parties involved in operating the parking area and related standard administrative activities (Art. 6(1)(f) GDPR), as well as for the contractual fulfillment of services provided under the General Terms and Conditions (e.g., calculating and billing parking fees, verifying registered parking permits, reconciling app-based payments, reconciling payments via the service portal, and monitoring compliance with maximum parking durations, free parking periods, or grace periods) (Art. 6(1)(b) GDPR).

Holder data (specifically name and address) is requested from the competent authority or agency by submitting the license plate number (holder inquiry). Driver data may be requested via the identified vehicle owner, rental company, or leasing firm and may also be shared with third parties (e.g., lawyers, collection agencies) for the aforementioned purposes. For the technical operation of parking equipment and software, as well as for enforcing compliance with the General Terms and Conditions, data is processed by MH Parkservice and its subcontractors (Peter Park System GmbH for parking technology and software operation, and Amazon Web Services EMEA SARL for data storage). This processing occurs to fulfill the contract or to pursue legitimate interests in protecting the property rights of MH Parkservice and third parties, ensuring the proper functioning of parking facilities, and accelerating vehicle processing within the parking area.

Retention period / Obligation to provide data / Right to object and erasure

Personal data we have collected will be deleted once all claims arising from or related to the use of the parking facility have been settled and all statutory retention or limitation periods have expired. If there is no violation of the parking facility's General Terms and Conditions and the user leaves the parking area within the applicable grace period after entry, the user's data is automatically deleted 48 hours after exit, provided no legal retention obligations prevent this.

Providing your data when using the parking facilities we manage is contractually required by the respective General Terms and Conditions or is necessary for the conclusion of the contract. Without providing your data, it would not be possible to fulfill the underlying contract or provide parking management services. Since data collection and subsequent processing are mandatory, users cannot object to this. As license plate registration occurs upon entry, you should—if the site layout allows—turn around before the entry point to avoid data collection if you do not wish to proceed. In principle, it is possible to turn around before the entry point to avoid data capture, provided the facility layout permits.

5. Activation of parking permits

Description of data processing

For some of the parking facilities we manage, it is possible to request parking permits via terminals or online booking interfaces (on the MH Parkservice website, online, or, for example, at local retail stores or institutions located there), such as for parking spaces designated for specific groups (e.g., employees, visitors, or customers) and/or for free parking periods, in accordance with the specific conditions applicable to the parking facility.

To do this, you must enter the required data into the corresponding input interface. Entering the vehicle's license plate number is always required. In some cases, additional data is needed to verify eligibility for a specific category, such as employee ID numbers. This information may be shared with our clients or their customers to verify eligibility or may be compared against data provided by them.

Purpose of data processing

Processing data collected during a booking is necessary for the intended conclusion of a contract, with the goal of efficiently managing parking permits and facilitating the provision of the relevant parking service.

Where a comparison with other data is necessary to validate the permit, or where additional data is processed as indicated in the form, this may also be based on your consent. You may revoke your consent at any time. The legality of data processing already performed remains unaffected by the revocation. Please note that due to your withdrawal, we may be unable to complete the booking process, and any existing booking may no longer be valid.

Retention period / Obligation to provide data / Right to object and erasure

Data is deleted as soon as it is no longer required to achieve the purposes for which it was collected. For personal data from the input interface, this occurs after the conclusion of a contract for our parking services, at the earliest once the corresponding parking service has been fully provided. Generally, however, we retain contract-related data until the expiration of statutory warranty obligations. In the event of a legal archiving obligation, the relevant data will be deleted upon the expiration of that period.

6. Parking spaces with free parking options for people with disabilities

Description of data processing

For some of the parking facilities we manage, special regulations allow people with disabilities to park for free in designated spaces during their stay. To utilize this, affected users must provide us with proof of their disability parking permit (e.g., the blue disability parking card).

Specifically, in accordance with the conditions posted at the parking facility where such free parking is offered, the right to use this option must be verified. This can be done, for example, by scanning a QR code on the corresponding sign, visiting our website, and submitting the parking permit via the provided input form.

Finalité du traitement des données

Le traitement des données collectées dans le cadre d'une réservation est effectué en vue de la conclusion d'un contrat, et par ailleurs aux fins d'un traitement efficace des autorisations de stationnement et pour soutenir la fourniture de la prestation de stationnement concernée. Dans le cas du traitement de données relatives à la santé en tant que données personnelles particulièrement sensibles, nous recueillerons votre consentement à cet effet.

Durée de conservation / Obligation de fourniture / Possibilité d'opposition et de suppression

La preuve correspondante de l'autorisation de stationnement pour personnes handicapées est vérifiée exclusivement aux fins de confirmer l'existence d'un droit et est supprimée sans délai après la fin du processus de stationnement.

‍

7. Utilisation du portail service de MH Parkservice

Description du traitement des données

Nous offrons aux utilisateurs des parkings que nous gérons, la possibilité de nous adresser des demandes d'assistance via notre portail service (https://service.mh-parkservice.ch/en) (demandes de précisions, contestations de demandes de paiement ou clarifications d'autres questions), de consulter des informations sur les infractions de stationnement, y compris des images de justificatifs et des possibilités de paiement, ou d'accéder à d'autres informations spécifiques au client.

Le portail est accessible via notre site web au moyen d'un code QR laissé à la disposition des utilisateurs (par exemple dans le cadre d'une demande de paiement). Après authentification, vous pouvez accéder au portail PCN. Dans le cadre du processus d'authentification, l'utilisateur fournit les données personnelles suivantes:

• Référence du dossier
• Numéro d'immatriculation

Pour des raisons techniques, un nombre limité de données (appelées données de connexion) sont collectées à chaque accès au portail. Ces données sont techniquement nécessaires à l'établissement et à l'exécution d'une connexion entre le terminal de l'utilisateur et nos serveurs. En outre, ces données sont nécessaires pour maintenir la session après une connexion et pour empêcher les accès non autorisés à cette session. Dans le cadre de chaque processus d'inscription ainsi que de l'utilisation du portail client ou du portail, nous ou le prestataire de services d'hébergement que nous utilisons l'adresse IP et le moment de l'action respective de l'utilisateur (timestamp), le fournisseur d'accès à Internet, le navigateur web et le système d'exploitation utilisés ou les informations de version respectives, les paramètres de langue, l'URL de référence ainsi que le nom du site web consulté.

Une fois connecté au portail du PCN, un cookie est créé, nécessaire au maintien de la session et à sa protection. Pour utiliser le portail, vous devez autoriser ce cookie dans votre navigateur web.

Si une solution à un problème ou une réponse à une question signalée sur le portail du PCN ne peut être trouvée qu'en faisant appel à d'autres partenaires ou prestataires de services, nous leur transmettons les informations liées à la demande/l'incident.

Objectif du traitement des données

Le traitement des données relatives à l'utilisation du portail du PCN, aux demandes de renseignements et aux téléchargements est effectué dans le cadre de l'exécution d'un contrat d'utilisation du parking conclu avec l'utilisateur et a pour but de fournir un moyen efficace de contact et de communication avec nos équipes d'assistance respectives, de gérer, de traiter et de résoudre les demandes reçues par ce biais et d'assurer une connexion sécurisée entre les terminaux des utilisateurs et nos serveurs.

Durée de la conservation / Possibilité d'opposition et de suppression

Les données sont supprimées dès qu'elles ne sont plus nécessaires à la réalisation des objectifs pour lesquels elles ont été collectées. En général, c'est le cas pour les données personnelles issues de l‘interface de saisie de l'inscription lorsque le processus d'utilisation correspondant est terminé. Toutes les données personnelles qui ont été enregistrées lors d'une prise de contact par l'utilisateur sont supprimées au plus tard lorsqu'aucune disposition légale n'exige un enregistrement plus long (par exemple, les délais de garantie légaux en rapport avec les demandes d'assistance).

8. Facturation

Description du traitement des données

Pour l'établissement et l'envoi de factures ainsi que pour leur documentation et leur enregistrement comptable, nous utilisons le logiciel de comptabilité basé sur le cloud sevDesk de la société sevDesk GmbH, Hauptstrasse 115, 77652 Offenburg, Allemagne. Dans ce cas, les données de contact du destinataire de la facture sont traitées avec sevDesk. Les informations sur la protection des données de sevDesk peuvent être consultées sur https://sevdesk.de/datenschutz/.

Purpose of data processing

We use sevDesk for the aforementioned purposes to fulfill our legal obligations, for contractual purposes, and in our legitimate interest in efficient accounting management. We have entered into a data processing agreement with sevDesk, which requires them to comply with applicable data protection requirements.

Retention period / Right to object and erasure

We store your data for the duration of our contractual relationship and until the end of the statutory retention periods for accounting-related documents.

You may exercise your right to object and erasure as described in the general information in Part A.

D. Contractual relationships with clients and business partners

I. Am I required to provide data?

If you contact us with questions about our services, enter into contract negotiations, accept one of our offers, or have other contractual agreements with us, we will process the personal data you provide in this context. The specific data processed depends primarily on the relevant purchase items or services you request or receive. In this context, processing your data is generally mandatory for the preparation, conclusion, and performance of the contract. If you do not provide this information, we may be forced to refuse to enter into a contract or fulfill an order, or we may no longer be able to perform an existing contract.

If we use data in the context of preparing or performing a contract with a business client, business partner, or cooperation partner, our interest in processing your data lies in facilitating and maintaining communication with the relevant client or partner, typically within the scope of a contractual or other relationship. Insofar as you act as a contact person in your capacity as an employee of these companies, you generally do not have an overriding interest to the contrary, as this interaction with us is part of your job duties, meaning a right to object is typically excluded.

However, you are not required to provide consent for data processing that is not relevant to the performance of the contract or required by law.

II. CRM System (HubSpot)

Description of data processing

We use the features of the HubSpot customer relationship management (CRM) system. HubSpot is a software solution from HubSpot Inc., 25 First Street, 2nd Floor, Cambridge, MA 02141, USA, which is offered in Europe by HubSpot Ireland Limited, 2nd Floor, 30 North Wall Quay, Dublin 1, Ireland. HubSpot is an integrated software solution that allows us to cover various aspects of our online marketing. These include: email marketing, social media publishing & reporting, reporting, contact management (e.g., user segmentation & CRM), landing pages, and contact forms.

We use HubSpot to manage and implement inbound marketing across various features of our online sites. The information recorded is stored on HubSpot's servers. We may use the processed data to gain detailed insights into how our online sites are used, to contact our site visitors, and to determine which of our company's services they are interested in.

HubSpot uses web beacons (invisible graphics or code) and cookies that are embedded in web pages or emails and stored on users' devices. This collects information such as IP address, geographic location, browser type, duration of the visit, and pages viewed.

In addition, HubSpot collects data entered by the user when they (a) subscribe to our newsletter or (b) fill out one of our contact forms.

For more information on HubSpot's privacy policy, please visit https://legal.hubspot.com/de/privacy-policy.

Purpose of data processing

We use the information collected via HubSpot based on our legitimate interest in optimizing our marketing, analyzing the use of our online presence, continuously improving it to make it more user-friendly, and being able to inform our users in a more targeted manner.

Right to object and erasure

You can prevent cookies from being saved by adjusting your browser settings. If you would like other personal data to be deleted, you can exercise your right to object and request deletion as described in the general information under section A.

You can also manage your cookie preferences using the CookieHub tool we have integrated.

III. Communication

Generally, we collect the necessary data from you during personal interactions. You are, of course, welcome to contact us by phone, fax, mail, or via our email address (see legal notice) or the email addresses of our staff provided to you. In the latter case, personal data sent via email is stored. Please note that, for technical reasons, email communication is not encrypted.

Your data is used to process the conversation and follow up on the content of your inquiry or meeting. If the communication relates to the performance of a contract or is necessary for pre-contractual measures, we process your data for these purposes.

In all other cases, processing is based on our legitimate interest in efficiently handling the inquiries we receive.

In this context, data is not shared with third parties unless it is necessary for the performance of a contract, the pursuit of our rights or legitimate interests, or if there is a legal obligation to do so.

IV. Data processing in sales

Personal data is processed for the purpose of providing the services you request, particularly for the performance of our contracts or pre-contractual measures, as well as for all activities necessary for the operation and management of MH Parkservice.

The resulting purposes of data processing primarily depend on the specific activities and services agreed upon with you. These may include consulting services or activities related to managing sales processes (e.g., preparing documents, sending information about MH Parkservice products or events, providing services by MH Parkservice), as well as supporting sales negotiations and contract execution.

For more details on the scope, purpose of data processing, and recipients of your data, please refer to the respective contractual documents and the corresponding terms and conditions.

Where necessary for our operational processes, we process your data in connection with our services beyond the actual performance of the contract in order to protect our legitimate interests.

We may be subject to specific legal obligations regarding the offer or provision of our services, such as tax law requirements. The purposes of processing your data may therefore include, among other things, compliance with tax audit and reporting obligations, customs or export regulations, and risk assessment and management.

V. Newsletter

Description of data processing

Description of data processing

We would like to regularly inform our customers and interested parties about our services and other products, services, webinars, news, or updates from MH Parkservice via email or other electronic communication channels (hereinafter referred to as the "Newsletter"). To do this, we need your email address. Additional information may be requested in newsletter registration forms to provide you with content tailored to your interests.

You can subscribe to our newsletters using the relevant function in a registration form or by checking a box (opt-in) during a registration process. We provide various options on our websites or within registration or ordering interfaces to sign up for our newsletters (potentially on specific topics). Details regarding the specific content of the newsletters are described in the corresponding registration form. This description is the basis for your consent.

After you register, we will send you an email asking you to confirm your newsletter subscription (the double opt-in procedure). This confirmation is necessary to ensure that no one else has misused your email address to sign up for our newsletter. Your email address will only be activated for the newsletter once you click the link provided in that email.

To manage subscriptions and send emails related to our newsletter, we use the MailChimp service provided by the US company Rocket Science Group, LLC, 675 Ponce De Leon Ave NE #5000, Atlanta, GA 30308, USA (hereinafter "MailChimp"). This allows us to automate the registration process and the sending of necessary emails in a simple and user-friendly way. Since MailChimp's computer system is located in the United States, registration data from input forms is transferred to and processed in the US. To ensure appropriate processing of the data we transmit, we have entered into a data processing agreement with MailChimp, which includes the EU standard contractual clauses for data transfers to third countries. You can find more information about how MailChimp processes personal data here: https://mailchimp.com/legal/privacy/.

To verify your subscription, we log the newsletter sign-up along with your email address, name, IP address, and the timestamp of your registration.

Purpose of data processing

The legal basis for sending our newsletter is the consent you provided as a recipient (Article 3 of the Swiss Federal Act against Unfair Competition). If consent is not required by applicable law, we process your data based on our legitimate interest in conducting direct marketing.

We log the registration process based on our legitimate interest in maintaining a secure and effective newsletter system that aligns with our business goals and your needs, as well as to provide proof of consent.

Retention period / Right to object and withdraw consent

You can opt out of the newsletter or withdraw your consent at any time, either in full or in part. You will find an unsubscribe link at the bottom of every newsletter. Alternatively, you can contact us directly using the details provided in the imprint.

Unsubscribing from the newsletter does not affect other communications. If your data is still required for contract fulfillment, we will continue to store it. We also reserve the right to retain necessary records until the statutory retention periods for proof of proper newsletter delivery have expired.

VI. Data transfer

Depending on the services provided, your data or documents may be shared with public authorities, private service providers, or our regular business partners during the inquiry, proposal, or contract fulfillment phases (see Part A, Section V).

E. Other

As we continue to develop our website and services, or as legal and regulatory requirements change, we may need to update this privacy policy. You can view and print the current version of our privacy policy on our website at any time.

Privacy Policy (effective from 30/03/2026)

This Privacy Policy provides an overview of how we handle your personal data (hereinafter referred to as "data") and informs you about your rights under the Swiss Federal Act on Data Protection ("FADP") and the Data Protection Ordinance ("DPO"). Please take a moment to read this policy, and feel free to save or print it for your records.

Personal data includes any information that can be used to identify you personally. We process your data for various purposes. In general, data processing by Mobility Hub Parkservice Switzerland GmbH (hereinafter "MH Parkservice" or "we") falls into the following categories:

• General information: You can find general details regarding data protection, our processing procedures, and your rights as a data subject—which apply to all processing activities we perform—in Part A below.
• Our websites: When you use our website at https://www.mh-parkservice.ch/ (hereinafter "website") or our other online platforms, such as our social media profiles, our service portal (https://service.mh-parkservice.ch), or our post-payment service (https://parken.mh-parkservice.ch/), which link to this Privacy Policy (collectively referred to as "online platforms"), we process data exchanged between your internet-enabled device and our servers, as well as any information you provide while using these sites. Further details are available in Part B.
• Parking customers: For information on how we process data for users of our parking facilities—such as payments via the MHP Online Shop or our post-payment service, monitoring parking violations, or viewing violation details via our service portal—please see Part C.
• B2B: We process the necessary data of our business customers and prospects to initiate or fulfill contracts. Data from our business partners and suppliers is used exclusively for the direct placement, processing, and execution of orders. More information on this can be found in Part D.

Please refer to the individual sections if you would like quick, context-specific information on particular processing activities.

A. General information on data protection and your rights

I. Who is responsible for data processing, and who can you contact with questions?

The controller responsible for data processing under the FADP and other data protection regulations is:

Mobility Hub Parkservice Switzerland GmbH
Obere Spichermatt 12
6370 Stans
Switzerland
Phone: +41 21 561 36 30
Email: info@mh-parkservice.ch

If you have any questions regarding data protection, please contact us using the details above or via email at: datenschutz@mh-parkservice.ch

II. What are your rights regarding your personal data?

If your personal data is being processed, you are a "data subject" under the FADP and are entitled to the rights described below. If you wish to exercise your rights against MH Parkservice as the controller, please contact us using the details provided above:

1. Right of access
Under Art. 25 FADP, you have the right to obtain confirmation from us as to whether we are processing your personal data and to be informed about the scope of that processing.

2. Right to rectification
If your personal data is incorrect or incomplete, you have the right to have it corrected and/or completed in accordance with Art. 32 FADP.

3. Right to erasure
If the legal requirements of Art. 32 FADP are met, you may request that we delete your data if we are processing it unlawfully or if the processing disproportionately interferes with your legitimate interests in data protection. Please note that there may be reasons that prevent immediate deletion, such as statutory retention obligations.

Regardless of whether you exercise your right to erasure, we will delete your data immediately and completely once the purpose of the processing has been fulfilled, in order to comply with our statutory deletion obligations, unless there is a contractual or legal retention period that dictates otherwise.

4. Right to data portability
In accordance with Art. 28 FADP, you have the right to receive the data you have provided, which we process automatically based on your consent or for the performance of a contract, in a commonly used and machine-readable format, or to have it transmitted to a third party. You have the right to have your personal data transmitted directly from one controller to another, where technically feasible. The right to data portability does not apply to processing that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

5. Right to withdraw consent for data protection
Certain personal data processing procedures are only possible with your explicit consent pursuant to Art. 6 para. 7 FADP. You may withdraw your consent at any time with effect for the future. The withdrawal of consent does not affect the validity of any processing that has already taken place. Please note that even after you withdraw your consent, the processing of the data in question may still be possible, in whole or in part, based on other legal grounds.

6. Right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, particularly in the member state where you habitually reside, work, or where the alleged infringement occurred, if you believe that the processing of your personal data violates applicable law.
If you believe that our processing of your personal data violates current data protection regulations, we invite you to contact us to clarify any concerns.

Of course, you also have the right to contact the federal supervisory authority based on our company headquarters:
Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, CH - 3003 Bern

‍

III. What personal data is processed and where does it come from?

1. Origin of personal data
We primarily process data that we receive directly from the data subjects when they use our website during the initiation of a business relationship or in the course of an existing business relationship (see also Part B, Section VI).

Through our website and services, we process data that we receive during your visit or that you actively provide to us during your use (e.g., when using our online shop). Other data is collected automatically by our IT systems when you visit the website or use one of our services. This primarily involves technical data (e.g., internet browser, operating system, or the time a page was accessed). This data is collected automatically as soon as you enter our website or access one of our services. Details on this can be found in Part B.

In individual cases, we also process data that we have lawfully received or acquired from other third parties, such as credit agencies, creditor protection associations, or authorities, or that we have inferred, received, or acquired lawfully from publicly accessible sources (e.g., telephone directories, business registers, the press, the internet, or other media).

2. Categories of personal data
The personal data we regularly process includes master/contact data such as: title, first and last name, form of address, date of birth, address, email address, telephone number, fax, and job title.

Furthermore, depending on the order, service, or other relationship with you, we also process the following personal data:

• Address: street, house number, any additional address details, postal code, city, country
• Contact details: telephone number(s), email address(es)
• Vehicle data: license plate, vehicle owner
• Data reserved for parking management: photographs, date and duration of parking usage, parking permits, bank details, payment information
• Registration data: information about the service used for registration; time and technical information regarding registration, confirmation, and logout; data provided by you during registration.
• Offer data
• Access data: date and time of your visit to our service; the page from which the accessing system reached our site; pages visited during use; session identification data (session ID); as well as the following information from the accessing computer system: internet protocol (IP) address used, browser type and version, device type, operating system, and similar technical information.
• Information on the nature and content of our business relationship, such as contract data, order data, sales data and invoices, customer and supplier history, and consulting documents.
• Marketing and sales data,
• Documentation data (e.g., consultation protocols, service call records, or support cases)
• Other data we have received from you in the context of our business relationship (e.g., during customer meetings),
• Documentation of consent declarations

IV. For what purposes is the data processed?

We process your data in accordance with the provisions of the Data Protection Act, in particular for the following purposes:

1. Fulfillment of (pre-)contractual obligations
The processing of personal data for the fulfillment of MH Parkservice's contractual obligations, particularly in relation to the sale and distribution of our goods and services (hereinafter also referred to as “parking services”), as well as all activities necessary for the operation or administration of MH Parkservice, in accordance with industry standards (e.g., customer and user administration). Data may also be processed at the pre-contractual stage as part of initiating a business relationship with MH Parkservice or in the course of other contractual relationships with MH Parkservice.
For example, in the following cases:

• Creation and management of a partner or supplier account in our CRM system
• Creation and management of customer/prospect files or our customer/prospect database in our CRM system
• Sending information
• Offering and selling MH Parkservice products
• Offering and executing the services we provide

Details regarding the purposes of this data processing can be found in the respective contractual documents and Terms and Conditions.

2. Pursuit of overriding legitimate interests
Data may be processed beyond the actual execution of a contract for the pursuit of legitimate interests of MH Parkservice or third parties. This is lawful provided that the interests or fundamental rights and freedoms of the data subject requiring the protection of personal data do not override them. Data processing for the pursuit of legitimate interests takes place, for example, in the following cases:

• Providing our online services, their functions, and content
• Using necessary technical cookies or comparable technologies
• Responding to contact requests and communicating with users
• Transferring data to affiliated companies and partners
• Processing payments via external service providers
• Using debt collection agencies and lawyers to recover debts and/or enforce claims in court
• Exercising other legal rights and defending against legal disputes
• Advertising or marketing
• Market and opinion research
• Business management and further development of our services
• Managing customer, prospect, or service provider databases to improve our offerings
• Conducting risk assessments (due diligence) as part of corporate reorganizations, acquisitions, or sales
• Ensuring IT security and the operational functionality of our company and services
• Measures for building and facility security

3. Compliance with legal obligations
Processing your data may be necessary to fulfill legal obligations and requirements to which we are subject, such as those under commercial or tax law.

4. Consent
If we request your consent under the FADP, this is based on Art. 6 para. 6 and 7 FADP.
If you have provided consent for the processing of your data in specific cases, it will be processed in accordance with the purposes specified in the consent declaration and to the extent agreed upon. You may withdraw your consent at any time with future effect. Please use the contact details provided in Part A, Section I or II for this purpose. Please note that processing that occurred prior to the withdrawal is not affected, and that data processing may still be possible, at least in part, based on other legal grounds.

V. Who receives my data?

Your data is received by those employees or organizational units at MH Parkservice that require it to fulfill our contractual and legal obligations or to process and pursue our legitimate interests.

Your data will be transferred to initiate or execute a contractual relationship (e.g., sale or provision of parking services) or—depending on the specific type of contract—based on our legitimate interests, particularly to companies we regularly use in connection with providing our services or executing the contract. The above point concerns the following recipients or categories of recipients:

• IT service providers (e.g., email service providers, web hosting companies)
  
  • Amazon Web Services, Inc., 410 Terry Avenue North, Seattle WA 98109, USA (Cloud storage provider)
  • Amplitude Inc., 201 Third Street, Suite 200, San Francisco, CA 94103, USA (App functionality optimization)
  • Airparser, Sepapaja tn 6, Tallinn 11415, Estonia (Document management software provider)
  • UAB Baltsoft, Kosciuskos 26-17, Vilnius, LT-01100, Lithuania (Conversion software solution provider)
  • Celonis SE, Theresienstr. 6 80333 Munich (Integration platform provider)
  • Datadog Inc., 620 8th Avenue, 45th Floor, New York, NY 10018, USA (AI platform operator and AI chat function provider)
  • Decagon AI, Inc., 2261 Market Street, STE 5378, San Francisco, CA 94114 USA (AI platform operator and AI chat function provider)
  • Freshworks, Inc., 2950 S. Delaware Street, Suite 201, San Mateo, CA 94403 USA (Ticketing system provider)
  • Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
  • Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland (Email service provider)
  • HubSpot Inc. 25 First Street, 2nd Floor, Cambridge, MA 02141 USA (CRM system provider)
  • Octa Inc., 100 First Street, Floor 6, San Francisco, CA 94105, USA (Zero-authentication provider for system security deletion)
  • Leaping AI UG (haftungsbeschränkt), Potsdamer Straße 72, 10785 Berlin (AI-supported call center software provider)
  • Peter Park System GmbH, Balanstr. 71a, 81541 Munich, Germany (Provision of IT systems as managed services and parking management systems)
  • Planet Payment Group Holdings Limited, IDA Business Park, Dangan, Galway H91A06C, Ireland (Provider payment system gateway)
  • sevDesk GmbH, Hauptstraße 115, 77652 Offenburg (Accounting software provider)
  • Talkdesk Inc. 201 Spear Street, Suite 1100, San Francisco, CA 94105 USA (Contact center software provider)
  • Trustpilot A/S, Pilestraede 58, 5th Floor, DK-1112 Copenhagen, Denmark (Review procedure provider)
  • Webflow, Inc, 398 11th Street, San Francisco, CA 94103, USA (Web hosting service provider for the website)
    
  • Weglot, SAS, 138, rue Pierre Joigneaux, Bois-Colombes 92270, France (Translation service provider)
• Business partners
• Advertising partners
• Insurance companies
• Banks
• Communication service providers (telephone service providers, fax service providers)
• Payment service provider
  
  • Datatrans AG, Kreuzbühlstr. 26, CH-8008 Zurich, Switzerland
  • Adyen N.V. Simon Carmiggeltstraat 6, 1011 DJ, Amsterdam, Netherlands
  • Stripe Deutschland GmbH, Prielmayerstr. 3, 80335 Munich, Germany
  • secuPay AG, Goethestraße 6, 01896 Pulsnitz, Germany
  • Planet Payment Group Holdings Limited, IDA Business Park, Dangan, Galway H91A06C, Ireland
  • Planet Merchant Services SAS, 1 Terrasse Bellini, Puteaux, 92919 Paris La Défense Cedex, France

• Shipping and logistics service providers
• Credit agencies
• Auditors
• Tax and legal advisors

If we use a service provider as a processor under Art. 9 FADP, we remain responsible for the protection of your data. Where required by law, processors are contractually obligated via a data processing agreement to treat your data confidentially and only within the scope of providing services. The processors we commission will receive your data if they need it to perform their respective services.

Your data will be transmitted to state institutions and authorities or collected for such purposes only within the scope of mandatory national provisions or if you have instructed us to do so.

VI. How long is my data stored?

Your personal data will only be used for the purpose for which you provided it or for which you consented to processing, and will be stored only until that purpose is achieved. Once the purpose is fully achieved or as soon as you request deletion, your data will only be stored for the duration required by statutory limitation periods or retention periods (particularly under tax and commercial law). However, the data will be deleted no later than after these periods expire, unless you have expressly consented to further or different use. You may exercise your rights, such as blocking your data, even during the retention periods. Please see Part A, Section II for details.

Your data will be deleted or blocked by us as soon as the purpose for storage no longer applies or you request that we delete it.

We process, and specifically store, your data only until the end of the business relationship or until the expiration of applicable warranty and guarantee periods and the current statute of limitations. Furthermore, it may be necessary to store data until the final conclusion of any legal disputes in which the data is required as evidence.

In addition, we are subject to statutory documentation and retention periods (e.g., under commercial or tax law), according to which we must retain your data even after the contract has ended.

VII. Is data transferred to a third country?

As part of our processing operations, for certain business transactions or areas of activity, personal data may also be transferred to entities in so-called third countries outside of Switzerland that have not yet been certified by the Swiss Federal Council as having an adequate level of data protection. If such a data transfer is necessary in individual cases, it will only occur if adequate data protection can be guaranteed, for example, based on international treaties, standard contractual clauses, appropriate safeguards for compliance with data protection, or your explicit consent.

‍

B. Use of our online presence

In principle, you can visit our websites and use them for informational purposes without having to provide any personal data (e.g., registering, placing orders, or providing other personal information). In this case, we process our users' personal data only to the extent necessary to provide a functional website and our content and services, or to the extent that cookies or similar technologies used on the website transmit personal information to us when you visit. Information about the cookies or similar technologies we use can be found in Part B, Section II. In addition to us, other cookies or similar technologies may allow our partner companies or third parties to recognize your browser on your next visit. For information on such cookies or similar technologies from third-party providers, please refer to Part B, Section III.

We generally only process our users' personal data with their consent. An exception applies in cases where prior consent cannot be obtained for factual reasons and the processing of the data is permitted by law.

I. Website provision and log file creation

Description of data processing

Every time you visit our website, our system automatically collects data and information from your computer system, which your internet browser transmits to us or our web host (so-called log files). These server log files contain IP addresses or other data that could identify a user. This might happen, for example, if the link to the website you used to reach our site or the link to the website you navigate to next contains personal data. Our hosting provider collects and stores the following information:

• Browser type and version
• Operating system used
• Referrer URL
• Hostname of the accessing computer and time of access
• IP address

The data is stored in our system's log files. This data is never stored together with other personal data of the user.

We use Webflow, Inc., 398 11th Street, San Francisco, CA 94103, USA (www.webflow.com) as our web host and software provider (hereinafter: "Webflow"). You can find Webflow's privacy policy here: https://webflow.com/legal/eu-privacy-policy. We have entered into a data processing agreement with Webflow (Data Processing Addendum, see https://webflow.com/legal/dpa). As part of these Webflow services, personal data may be transferred to the USA based on standard contractual clauses that Webflow has agreed to with us as part of its Data Processing Addendum, or via an equivalent data protection guarantee for processing personal data on behalf of US entities.

Legal basis and purpose of data processing

The system must temporarily store the IP address to enable the website to be delivered to your computer. To do this, your IP address must remain stored for the duration of the session.

Data is stored in log files to ensure the website functions correctly. We also use this data to optimize the website and ensure the security of our IT systems.

Retention period / Right to object and erasure

Data is deleted as soon as it is no longer needed for the purpose for which it was collected. When the purpose is to provide the website, this happens once the session ends.

In the case of data stored in log files, this occurs after 7 days at the latest.

Collecting data to provide the website and storing it in log files is essential for the website to function. Therefore, users cannot object to this.

II. Use of cookies and similar technologies

Description of data processing

Our website uses cookies or similar processes (e.g., web beacons, local storage) to collect, process, and use usage data (e.g., access times, pages visited) or meta and communication data (IP address, device information), including personal data. For simplicity, we refer to these technical processes generally as "cookies."

Cookies are text files containing a unique string of characters that are stored by your internet browser on your computer system, allowing your browser to be uniquely identified when you return to the website. When you access a website, a cookie may be stored on your operating system. This cookie contains a characteristic string of characters. These cookies are used to make our website more user-friendly, effective, and secure. When you visit a website where a cookie is embedded, the data entered is stored exclusively in the cookie on your computer. In this case, the data is only transmitted to our website's servers when a page is requested.

Some cookies are deleted at the end of your browser session when you close it (so-called session cookies). These cookies are technically necessary, for example, to allow you to log in to an application and stay logged in while navigating our website.

Other cookies remain on your device for a set period, allowing us to recognize your browser on your next visit (so-called persistent or protocol cookies). The purpose of these cookies is to offer you an optimal user experience, "recognize" you, and present you with a varied website and new content during repeat visits.

Cookies from partner companies or third parties may be used, for example, to collect information for advertising purposes, personalized content, or statistics (“third-party cookies”). If we do not identify cookies as coming from third-party providers, they are from our own website (“first-party cookies”). We will inform you separately about any third-party cookies or tracking technologies we use in the following sections of our privacy policy.

Flash cookies are stored as website data elements on your computer if you use Adobe Flash. Flash cookies have no expiration date.

For more information on which cookies and similar technologies we use to design our website, their purposes, and what data is stored or transmitted to third parties, please refer to our cookie management tool, “CookieHub,” provided by CookieHub ehf, Hafnargata 18, 230 Reykjanesbær, Iceland. You can use this tool to provide your consent for the use of cookies and similar technologies based on your selected preferences when visiting our website.

Our cookie management tool collects log file and consent data using JavaScript. This JavaScript allows us to inform users about their consent for specific tags on our website and to obtain, manage, and document that consent. The cookie management tool saves your selected settings and the consent you provided when accessing the website and processes the following data:

• Consent data (anonymized log data (consent ID, processor ID, controller ID), consent status, timestamp)
• Device data (including shortened IP addresses (IP v4, IP v6), device information, timestamp)
• User data (including email, ID, browser information, SettingIDs, changelog)

To do this, the cookie management tool stores a technically necessary cookie. You can find CookieHub’s data protection information here: https://www.cookiehub.com/legal/privacy-policy

For more information on which cookies we use to build our website, their purpose, and what data is stored or transmitted to third parties, please refer to the detailed information provided by CookieHub, which you can access under “More options” or “Cookie declaration.” CookieHub automatically scans which cookies are set on the site. The list of processes used and the cookie declaration are then updated automatically.

Legal basis and purpose of data processing

Processing personal data via cookies and similar technologies is necessary to safeguard our legitimate interests in the optimal functionality and security of the website, as well as to ensure an effective and user-friendly design, unless user consent is required.

We have integrated CookieHub to obtain consent. This makes it easier for users to give or manage consent for the individual categories of cookies and similar technologies we use. CookieHub blocks all cookie categories that are not essential for the proper functioning of the website unless you consent to the use of additional tools. When you access our website, an interface is displayed for this purpose:

By clicking the “Accept all” button, you can allow all processes, or use the “More options” button to decide individually (by toggling the selection sliders and clicking the final “Save settings” button) which cookies and/or cookie-based applications and the resulting data processing you consent to.

Alternatively, you can reject all non-essential cookies by clicking the “Only essential cookies” button and use the website only with the cookies necessary for its operation.

The use of technically necessary cookies is intended to simplify the use of websites for users or to make them more convenient, and is therefore necessary to provide the service. Some features of our website cannot be offered without the use of cookies. In particular, these features require the browser to recognize users even after navigating to a different page.

Furthermore, the purpose of the cookies we use in the “Analytical cookies,” “Marketing cookies,” and “Necessary cookies” categories of the cookie declaration depends on the services used and the subsequent data processing, which is explained in more detail in the following sections of the privacy policy and in CookieHub.

As the website operator, we have a legitimate interest in the data processed via our cookie management tool to ensure legally compliant, user-specific, and user-friendly cookie consent management, as well as a legally compliant website design.

Storage duration / Right to object and restrict

For details on the storage duration of our cookies, please refer to the CookieHub information under “Cookie declaration.”

Cookies are stored on your computer and transmitted to our website from there. You therefore have full control over the use of cookies. You can deactivate or restrict the transmission of cookies by changing your internet browser settings. Cookies that have already been saved can be deleted at any time. This can also be done automatically.

If cookies are deactivated for our website, it may no longer be possible to use all the functions of the website in their entirety.

Alternatively, you can also use the features of the cookie consent tool we have integrated to revoke your consent at any time or change your mind by clicking the “Cookie settings” button to access and adjust your settings.

III. Statistical website analysis / Increasing reach

1. Google Analytics

Description of data processing

We use the features of the web analytics service Google Analytics for our online service. The provider in Europe is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter: "Google"), an affiliate of Google LLC, Amphitheatre Parkway, Mountain View, CA 94043, USA.

Google Analytics also uses cookies. The information generated by the cookie about your use of this website is generally transmitted to a Google server in the USA and stored there. Google processes the data, and we receive reports on user behavior. This can include, among other things, the following reports:

• Target group reports: Target group reports allow us to get to know our users better and to know more precisely who is interested in our service.
• Behavior reports: Here we find out how you interact with our website. We can track the path you take on our site and the links you click on.
• Real-time reports: Here we find out immediately what is happening on our page at any given moment. For example, we can see how many users are currently reading this text.

With the help of a tracking code, Google Analytics creates a random, unique ID that is associated with your browser's cookie. This is how Google Analytics recognizes you as a new user. The next time you visit our site, you will be recognized as a "returning" user. All data collected is stored together with this user ID. This makes it possible to analyze pseudonymous user profiles.

Your interactions on our website are measured using identifiers such as cookies. Interactions are all types of actions you perform on our website. If you also use other Google systems (such as a Google account), the data generated via Google Analytics can be associated with third-party cookies. Google does not pass on Google Analytics data unless we, as the website operator, authorize it. Exceptions may be made if required by law. The cookies used by Google Analytics are listed in the detailed information of our cookie management tool, CookieHub, which you can access under "Cookie Declaration".

Our website uses Google Analytics exclusively with the "anonymiseIp()" extension. This means your IP address is not stored in full; it is truncated by Google within the member states of the European Union or other contracting states to the Agreement on the European Economic Area before being transmitted to the USA. The website visitor is not identified. Only in exceptional cases will the full IP address be sent to a Google server in the USA and truncated there. In addition, we show you an overview of the most important data collected by Google Analytics below:

• Heatmap: Google creates so-called heatmaps, which allow us to see exactly where you click. This gives us information about where you are on our site.
• Session duration: Google defines session duration as the time you spend on our site without leaving. If the user is inactive for 20 minutes, the session ends automatically.
• Bounce rate: A bounce occurs when a user leaves the site after viewing only one web page.
• Account creation: When a user creates an account on our website or places an order, Google Analytics collects this data.
• Location: The country and location can be determined via the IP address. This process is also known as IP geolocation.
• Technical information: Technical information also includes the browser type, internet provider, or screen resolution.
• Origin: Google Analytics and we are, of course, also interested in knowing which website or advertisement brought you to our site.

This list is not exhaustive and serves only as a general guide to data storage by Google Analytics. For more information on how Google processes data, please read Google's privacy policy: https://policies.google.com/privacy?hl=en

Legal basis and purpose of data processing

We use Google Analytics to analyze the use of our website and services, to compile reports on the activities of our website and services, and to provide us with other services related to the use of our website, our services, and the internet. We also use Google Analytics to analyze AdWords and double-click cookie data for statistical purposes. As operators of the website and services, we have a strong interest in this analysis of user behavior in order to optimize both our website and our offers and advertising on the site itself.

The information generated by the cookie about your use of our website or services is generally transmitted to a Google server in the USA and stored there. However, if IP anonymization is activated, your IP address will first be truncated by Google within the member states of the European Union or other contracting states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be sent to a Google server in the USA and truncated there. By consenting to the activation of cookies used by Google Analytics, you also consent to the processing of your data in the USA, unless the data transfer is guaranteed on the basis of standard contractual clauses. The USA is considered by the Swiss Federal Council to be a country with an inadequate level of data protection by Swiss standards. In particular, there is a risk that your data may be processed by US authorities for control and monitoring purposes, possibly without the possibility of legal recourse. If you click on the "Reject all" button or decide to manage your preferences without Google cookies, the described transmission to Google will not take place. You can revoke your consent at any time with effect for the future.

Google will use this information to analyze your use of the website or services, to produce reports on website activity for us, and to provide other services related to website activity and internet usage. Google may transmit the data it collects based on this information to third parties under its own responsibility, provided this is permitted by law or if third parties process this data on Google's behalf. Google has contractually guaranteed that it will never associate your IP address with other Google data. To safeguard this and the data processing carried out for us, we have entered into a data processing agreement with Google.

Retention period / Right to object and restrict

Cookies are stored on the user's computer and transmitted from there to our website. Therefore, as a user, you have full control over the use of cookies. By changing the settings in your internet browser, you can deactivate or restrict the transmission of cookies. Cookies that have already been saved can be deleted at any time, including automatically. If you deactivate cookies for our website, it is possible that you will not be able to use all the website's functions to their full extent.

By installing the browser add-on to deactivate Google Analytics (http://tools.google.com/dlpage/gaoptout?hl=en), you can object to the use and collection of your data by Google Analytics. This informs Google Analytics that no information regarding your visit to the website should be transmitted.

In addition, you can install an opt-out cookie on your device via this link https://developers.google.com/analytics/devguides/collection/gajs/#disable, particularly for mobile device browsers, to prevent future data collection by Google Analytics on our website. Please note that if you delete the cookies on your device, you must also reinstall the opt-out cookie.

Alternatively, you can also set your cookie preferences via the Cookie Consent Tool Cookie Hub that we have integrated.

2. Google Tag Manager

Description of data processing

Google Tag Manager is a solution provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter: "Google"), which allows marketers to manage website tags through an interface. The Google Tag Manager itself (which implements the tags) is a cookie-free domain and does not collect personal data. Google Tag Manager facilitates the integration and activation of other tags, code snippets, tracking codes, and conversion pixels on a website, which may in turn collect data. Google Tag Manager does not access this data. It provides us with a user-friendly interface that does not require extensive programming knowledge or changes to the website's source code.

We use Google Tag Manager only to display Google Ads (formerly Google AdWords) for our search engine marketing activities.

Further information on Google Tag Manager can be found at https://www.google.com/intl/en/tagmanager/use-policy.html.

3. Google Ads (formerly Google AdWords) and Google Ads Conversion Tracking

Description of data processing

We use Google Ads, a service provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, and offered in Europe by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland, to incorporate advertisements into our online offerings and draw attention to our attractive deals using advertising material on external websites.

This allows us to evaluate the success of individual advertising measures. These advertising materials are provided by Google via so-called "AdServers." For this purpose, Google AdWords uses cookies (see the explanations above). By installing the cookie, the use of our websites can be analyzed. Each time you access one of the individual pages of our website where a Google Ads component has been integrated, the internet browser on your computer system is automatically prompted by the respective Google Ads component to transmit data to Google for the purposes of online advertising and commission billing. During this technical process, Google gains knowledge of personal information such as your IP address, which allows them to determine the origin of visitors and clicks, and subsequently calculate commissions. These cookies typically store details such as a unique cookie ID, the number of ad impressions per placement (frequency), the last impression (relevant for post-view conversions), and opt-out information (noting that the user no longer wishes to be contacted). These cookies allow Google to recognize your browser. If you do not agree to the installation of cookies on your computer, please follow the general instructions provided at the end of this explanation.

Google Ads also uses so-called web beacons (invisible graphics). These web beacons can be used to evaluate information such as visitor traffic on the pages of this site.

The information generated by cookies and web beacons about your use of our website, including your IP address, and the delivery of ad formats is transmitted to a Google server in the USA and stored there. This information may be shared by Google with Google's contractual partners (see https://support.google.com/admanager/answer/94149?visit_id=637060482444635472-69980806&rd=1). In detail, we have no influence over the data collected by Google, nor are we aware of the full extent of the data collection or the storage period. However, to our knowledge, Google will not merge your IP address with other data stored by them. If you are logged into a Google account, however, your data may be directly associated with it. If you do not want this association with your Google profile, please log out before using our website.

Further information on data protection in Google Ads can be found at https://policies.google.com/privacy?hl=en and https://policies.google.com/technologies/ads?hl=en.

Legal basis and purpose of data processing

The storage of Google Ads cookies and web beacons is based on our legitimate interest in analyzing the reach of our offerings, publishing relevant and interesting advertisements, improving campaign performance reports, and obtaining a fair calculation of advertising costs, unless we have requested your consent.

We have also entered into a data processing agreement with Google.

Right to object and restriction

You can prevent the installation of cookies by Google Ads in several ways: a) by adjusting your browser software settings, specifically by blocking third-party cookies, which will prevent you from receiving ads from third-party providers; b) by disabling interest-based ads on Google via the link www.google.com/ads/preferences, noting that this setting is deleted if you clear your cookies; c) by disabling interest-based ads from providers that are part of the "About Ads" self-regulatory campaign via the link www.aboutads.info/choices, noting that this setting is deleted if you clear your cookies; d) by permanently disabling them in your Firefox, Internet Explorer, or Google Chrome browsers via the link www.google.com/settings/ads/plugin. Please note that in this case, you may not be able to fully use all the features of our online offering.

Alternatively, you can also set your cookie preferences using the CookieHub cookie management tool we have integrated.

4. Amplitude

Description of data processing

Per ottimizzare il nostro negozio online e la nostra app di pagamento mobile, utilizziamo il software di analisi web Amplitude, un servizio del fornitore Amplitude Inc., 201 Third Street, Suite 200, San Francisco, CA 94103, USA (“Amplitude”). Questo procedimento serve a valutare e analizzare l’utilizzo da parte degli utenti e a compilare report sulle attività per noi. I dati vengono raccolti in tempo reale non appena l’utente compie una determinata azione (ad esempio clic su un pulsante, caricamento di una pagina o completamento di un acquisto). Le categorie di dati interessate sono le seguenti:

• Usage data: clicks, pages visited, time spent, feature usage.
• Device data: operating system, browser type, device type, screen resolution.
• Identifiers: pseudonymized user IDs, internal Amplitude IDs, IP address (a shortened IP address is processed).

To this end, cookies are also stored on your computer.

The information generated in this way is transmitted to an Amplitude server in the USA and stored there. We have entered into a Data Processing Addendum with Amplitude, which includes standard contractual clauses as a mechanism for transferring personal data from Switzerland to the USA. Amplitude participates in the Swiss/EU-US Data Privacy Framework, which sets minimum standards for the protection of personal data of Swiss citizens whose data is stored or processed in the USA.

Further information on how Amplitude processes data can be found in Amplitude’s privacy policy (https://amplitude.com/privacy).

Purpose of data processing
We use Amplitude to evaluate the use of our services, compile activity reports, and better understand how our services are used. This helps us identify potential improvements and optimize site performance and functionality. As service providers, we have a legitimate interest in analyzing user behavior to improve our products, so we ask for your consent to use Amplitude and store cookies.

Retention period / Right to object and delete
If you do not want cookies to be saved, you can set your internet browser to delete cookies, block them entirely or partially, or notify you before they are stored. You can also manage your cookie preferences using the cookie management tool we use, CookieHub.

IV. Further information on procedures, plugins, and tools used for the website

1. SSL or TLS encryption

This site uses SSL or TLS encryption for security reasons and to protect the transmission of confidential content, such as orders or inquiries you send to us as the site operator. You can recognize an encrypted connection by the fact that the browser's address bar changes from “http://” to “https://” and by the padlock symbol in your browser bar.

If SSL or TLS encryption is enabled, the data you transmit to us cannot be read by third parties.

2. make.com

Description of data processing

To integrate various databases and web tools, we use make, a service from Celonis SE, Theresienstr. 6, 80333 Munich, Germany. make is an interface that allows you to connect various cloud-based software applications. Data requested or processed in the connected applications is automatically transferred via these connections. The goal is to enable the independent execution of digital processes, particularly standardized and recurring ones. This creates an automated data flow and efficient processes.

Further information on data protection at Celonis can be found at https://www.make.com/en/privacy-notice and https://www.celonis.com/de/privacy-notice/

Legal basis and purpose of data processing

make.com is used for efficient process automation, merging various services, and the associated import and export of personal and contact data.

3. Language versions of websites (translations with Weglot)

Description of data processing

On our website, we use the Weglot translation service provided by Weglot SAS, 138, rue Pierre Joigneaux, 92270 Bois-Colombes, France. Weglot loads when you access the site and allows you to set the site language using the appropriate language icons. By integrating the Weglot translation service, a connection is established between your browser and Weglot's servers when you visit our website, and your IP address and device information are transmitted to Weglot. The transmitted data is necessary for Weglot to function.

Data processed when using Weglot is handled by Weglot as a data processor under a data processing agreement within the European Union.

You can find information on how Weglot handles personal data at https://www.weglot.com/privacy.

Legal basis and purpose of data processing

Data processing via Weglot is used to provide our website in multiple languages, including a selection option for site visitors.

Right to object and restrict processing

Using the Weglot service is strictly necessary to provide the website in different language versions.

You can exercise your right to object and request deletion as described in the general information in Part A.

4. Integration of YouTube content

Description of data processing

We occasionally use content and services from the YouTube video platform to embed videos on our website or link to videos from our YouTube channel. YouTube is a subsidiary of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, and is provided in Europe by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter: “Google”).

We may process data you enter on our YouTube channel (specifically your username and content you post via your account) if we respond to your posts or messages on our channel.

Otherwise, we only receive non-personalized information from Google regarding post activity, such as the number of clicks on profiles or media and the watch time for specific videos. This data can be viewed via our YouTube account. Google is responsible for the remaining data processing; we have no way to prevent or disable Google’s use of analytics tools and similar features within YouTube.

If you choose to play embedded videos using this plugin (by clicking the play button), your IP address will be sent to YouTube, as YouTube cannot deliver the video content to your browser without it. The IP address is therefore required for playback. The YouTube server is also notified of which subpage of our website you visited. If you are logged into your YouTube account, you allow YouTube to associate your usage behavior directly with your personal profile when you play our videos. Further information on how Google processes data when using YouTube can be found in their privacy policy: https://policies.google.com/privacy?hl=en

Legal basis and purpose of data processing

YouTube is used based on our legitimate interests in making our website available, linking to it, and handling inquiries or comments.

Retention period / Right to object and restrict processing

To prevent your activity from being linked to your user account, please log out of your YouTube profile before playing our video content. You should check your options for limiting Google’s data processing via Google or your YouTube user account. For example, you can access the general settings of your Google account under “Privacy and Security.” Additionally, you can restrict Google’s access to contact and calendar data, photos, location data, etc., within your mobile device settings (smartphone, tablet), though this depends on your operating system.

5. Auth0

Description of data processing

We use the Auth0 identity management cloud platform from Okta Inc., 10800 NE 8th Street, Suite 700, Bellevue, WA 98004, USA, for registration and login in our online shop.

When users enter data into a form provided by Auth0, that information is exchanged directly between the user's browser and Auth0. For identity management, authentication (login/registration), and user account security, the following data is processed:

• Personal data: email address, name, and profile picture if using Social Login.
• Security data: password hashes, two-factor authentication (MFA) details, and session tokens.
• Metadata: login IP address, timestamps, and browser/device information (for fraud detection).

Data is collected exclusively during the login or registration process and whenever a session is refreshed.

You can find more information about how Auth0 handles data at https://www.okta.com/legal/privacy-policy/.

We have selected Europe as the location for our data storage servers. If an occasional transfer to the USA is necessary, it is carried out based on standard contractual clauses included in a Data Processing Agreement.

Purpose of data processing
The Auth0 integration ensures that only authorized and identified individuals can access our services. Auth0 is also essential for providing our user account login service.

Retention period / Right to object and delete
If you do not want cookies to be stored, you can set your browser to delete cookies, block them entirely or partially, or notify you before they are saved. You can also manage your cookie preferences using the CookieHub management tool.

6. DataDog

Description of data processing

We use DataDog, a service provided by DataDog, Inc., 620 8th Avenue, 45th Floor, New York, NY 10018, USA (“DataDog”), as a data processor in accordance with Art. 4 No. 8 and 28 of the GDPR.

We use DataDog to monitor system stability and analyze errors (such as unexpected deviations, anomalies, latency, availability, and response times) on our websites and services, as well as for IT security purposes.

For this purpose, DataDog collects the following data on our behalf:

• System logs: technical records of server requests (including user IP addresses).
• Performance data: app response times, error rates, error details, and crash reports (stack traces and timestamps).
• Metadata: system configurations (browser type and version, operating system) and anonymized user IDs to track errors across different microservices.

This data allows DataDog to detect, analyze, and fix errors promptly. The personal data collected may be transferred to and stored in the USA. We have entered into a Data Processing Agreement with DataDog that includes standard contractual clauses. DataDog also participates in the Swiss/EU-US Data Privacy Framework, which provides a legal basis for transferring data to certified companies and organizations in the USA.

Further information on how DataDog processes data can be found in the DataDog Inc. privacy policy: https://www.datadoghq.com/legal/privacy/

Purpose of data processing
Data processing is used to ensure the proper and reliable operation of our websites and services, as well as to detect and fix any errors. DataDog is therefore essential for providing our services and managing user account access.

Retention period / Right to object and delete
Data collected by DataDog is deleted or anonymized once error analysis is complete.

V. Links to third-party websites

Our website may contain links to other sites. We have no control over the content or structure of these third-party offerings. Therefore, the statements in this Privacy Policy do not apply to external providers whose content or services we link to.

If you are redirected to other sites via links on our pages, please check their respective privacy policies to learn how your data is handled.

VI. Online presence on social networks and platforms

Description of data processing

We maintain other online presences within social networks or professional networks (such as Facebook, Xing, or LinkedIn) (hereinafter also referred to as "SN") and platforms (e.g., YouTube) and link to them from our website. Clicking on the respective buttons (recognizable by the logos of the social networks or platforms) will take you to the respective SN online presence. The purpose of these online presences is to communicate with customers, interested parties, and active users and to inform them about our services.

When you access these social networks and platforms, the terms and conditions and data processing guidelines of the respective operators apply.

Since the use of SNs takes place outside of our website or our services, we have no influence over it, unless otherwise stated below. However, please be aware that when you use the aforementioned platforms and social networks that we link to, data may also be processed in the United States by these SN companies and may be used by the respective operators for market research and advertising purposes, including the creation of user profiles. When you log in to the respective social networks and platforms, they may also store cookies on your device that track your use of our platform or services, as well as other information about your user behavior.

Unless otherwise stated in our Privacy Policy, we only process user data if they communicate with us within the social networks and platforms, e.g., by writing comments or sending us messages.

To make it easier for you to find information about the respective data processing and the opt-out options provided by the respective operators, we provide links to the privacy policies and information of the respective network operators below.

Legal basis and purpose of data processing

We only process your personal data in the context of direct contact with us via the respective SN or through interaction with our SN presence or its content. Unless otherwise stated in our Privacy Policy, we only process user data based on our legitimate interests in effectively informing and communicating with users if they communicate with us within the social networks and platforms (e.g., when users post on our online presences or send us messages). If your contact is aimed at concluding a contract, the processing is carried out for that purpose.

In relation to our presence on an SN, to the extent that further personal data is processed and the respective SN independently determines the purposes and means of processing, the respective SN is the sole controller. Please check carefully what personal data you share with us via the SN presence. If you wish to prevent an SN from processing the personal data you have transmitted to us, please contact us by other means.

Retention period / Right to object and restrict processing

If you are a member of one of the SNs where we maintain an online presence and do not want the SN to collect data about you via our site and link it to the data already held by the SN, you must log out of your SN before visiting our site. For a detailed description of the respective processing, information on the duration of data storage by the respective SN, and opt-out options, please refer to the links to the providers' information below.

Regarding requests for information and the exercise of user rights, please note that these can be asserted most effectively with the providers. Only the providers have access to user data and can take appropriate measures and provide information directly. If you still need help, you can contact us.

Facebook

We operate a Facebook business page ("Fanpage") on the SN of Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

Facebook Ireland is a joint controller with us for the collection of data from visitors to our Fanpage, which is why we have entered into additional terms for data processing:

"Controller Addendum": https://www.facebook.com/legal/controller_addendum
"Data Processing Terms": https://www.facebook.com/legal/terms/dataprocessing/update

We are responsible for providing data subjects with at least the information above and the following. Facebook's information on the collection of personal data is available in the Facebook Ireland Privacy Policy at https://www.facebook.com/about/privacy.

Facebook Inc., Menlo Park, California, USA (hereinafter: Facebook Inc.) also collects and uses so-called Page Insights for analysis purposes. Page Insights are a summary of data with which both we and Facebook Inc. can obtain information about how our users interact with our page. Page Insights may be based on personal data collected in connection with visits or interactions by our users on our page. To this end, we have entered into a Controller Addendum with Facebook (see above), which specifically governs the security measures taken by Facebook in the context of Page Insights and how Facebook responds to user requests. The purposes for which the collection and transmission of personal data constituting joint processing are carried out are detailed in the aforementioned Controller Addendum, which refers to the Data Processing Terms.

Data collected during visits to our "Fanpage" includes information about the types of content users view or interact with, or the actions they take (see the section "Actions taken and information provided by you and others" in the Facebook Data Policy: https://www.facebook.com/policy), as well as information about the devices used by users (e.g., IP addresses, operating system, browser type, language settings, cookie data as described in detail in the "Device Information" section of the Facebook Privacy Policy: https://www.facebook.com/policy).

However, by managing our Facebook business page, we share responsibility for Page Insights and have agreed with Facebook Ireland that they are responsible for upholding the rights of data subjects regarding personal data stored by Facebook Ireland following joint processing. Therefore, we are obligated to notify Facebook if we receive data protection inquiries concerning Page Insights. Please note that we forward Page Insights-related requests to Facebook Ireland. We also encourage you to review the information regarding your rights as a data subject in Part A. For further details on how Facebook Ireland processes personal data and how you can exercise your rights as a data subject against them, please refer to Facebook Ireland’s Privacy Policy at https://www.facebook.com/about/privacy.

Data collected via Page Insights is analyzed to improve our website and for advertising purposes. We operate our Facebook Fanpage for communication purposes and to provide a simple channel for contact requests from Facebook users. The collection and further processing of this data are in our legitimate interest and in the legitimate interest of Facebook Inc.

Please be aware that we cannot enable or disable the Page Insights technology. Therefore, we must forward most related requests to Facebook Ireland, unless we have collected the data ourselves. If you do not wish for Facebook Inc. to collect your data, please do not use our Facebook business page and/or configure your browser to block cookies and/or log out of Facebook while using our site.

Privacy Policy:
https://www.facebook.com/about/privacy/, https://www.facebook.com/legal/terms/information_about_page_insights_data

Opt-out options:
https://www.facebook.com/settings?tab=ads and http://www.youronlinechoices.com

LinkedIn

LinkedIn is a service provided by LinkedIn Corporation, 2029 Stierlin Court, Mountain View, CA 94043, USA, and operated in Europe by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. LinkedIn is an internet-based social network that allows users to connect with existing professional contacts and build new business opportunities. With over 400 million registered users in more than 200 countries, it is currently the largest platform for professional networking and one of the most visited websites in the world.

Each time you visit our website equipped with a LinkedIn component (LinkedIn plug-in), this component prompts your browser to download a corresponding representation of the LinkedIn component. Further information on LinkedIn plug-ins is available at https://developer.linkedin.com/plugins. As part of this technical process, LinkedIn receives information about which specific subpage of our website you have visited.

If you are logged into LinkedIn at the same time, LinkedIn recognizes which specific subpage of our website you are visiting every time you access our site and for the entire duration of your stay. This information is collected by the LinkedIn component and associated by LinkedIn with your personal LinkedIn account. If you click on one of the LinkedIn buttons integrated into our website, LinkedIn assigns this information to your personal LinkedIn user account and stores this personal data.

Through the component, LinkedIn always receives notification that you have visited our website if you are logged into LinkedIn at the same time; this occurs regardless of whether you click on the LinkedIn component or not. If you do not want this information to be transmitted, you can prevent it by logging out of your LinkedIn account before visiting our website.

LinkedIn offers the option to unsubscribe from email messages, SMS, and targeted ads, as well as to manage ad settings at https://www.linkedin.com/psettings/guest-controlsdie. LinkedIn also uses partners such as Quantcast, Google Analytics, BlueKai, DoubleClick, Nielsen, Comscore, Eloqua, and Lotame, which may set cookies. These cookies can be rejected at https://www.linkedin.com/legal/cookie-policy. You can view LinkedIn’s current Privacy Policy at https://www.linkedin.com/legal/privacy-policy. You can view LinkedIn’s Cookie Policy at https://www.linkedin.com/legal/cookie-policy.

Privacy Policy https://www.linkedin.com/legal/privacy-policy
Opt-out options:
https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out

XING

The operating company for Xing is XING AG, Dammtorstraße 29-32, 20354 Hamburg, Germany (“XING”)

Xing is an internet-based social network that allows users to connect with existing professional contacts and build new business opportunities. On Xing, individual users can create a personal profile. Companies can, for example, create business profiles or post job offers on Xing.

When you visit one of the individual pages of this website operated by the controller on which a Xing component (Xing plug-in) has been integrated, the internet browser on your computer system will automatically be prompted by the respective Xing component to download a display of the corresponding Xing component. Further information on Xing plug-ins is available at https://dev.xing.com/plugins. As part of this technical process, Xing receives information about which specific subpage of our website you have visited.

If you are logged into Xing at the same time, Xing recognizes which specific subpage of our website you are visiting every time you access our site and for the entire duration of your stay. This information is collected by the Xing component and associated by Xing with your personal Xing account. If you click on one of the Xing buttons integrated into our website, Xing assigns this information to your personal Xing user account and stores this personal data.

Through the component, Xing always receives notification that you have visited our website if you are logged into Xing at the same time; this occurs regardless of whether you click on the Xing component or not. If you do not want this information to be transmitted, you can prevent it by logging out of your Xing account before visiting our website.

The Privacy Policy published by Xing, available at https://www.xing.com/privacy, provides information on the collection, processing, and use of personal data by Xing. Additionally, Xing has published the Data Protection Policy for the Xing share button at https://www.xing.com/app/share?op=data_protection.

Privacy Policy / opt-out options:
https://privacy.xing.com/de/datenschutzerklaerung

VII Active use of our website

1. Contact form and email contact

Description of data processing

Our website features a contact form that can be used to get in touch with us electronically. If you choose to use this option, the data entered into the input fields will be transmitted to us and stored.

• Company / Municipality (required field)
• First name (required field)
• Last name (required field)
• Email (required field)
• Phone (optional)
• Message (optional)

When you send a message via our contact form, the following data is stored:

• User's IP address
• Date and time of submission

If you contact us via an email address provided by us, the personal data transmitted with the email will be stored.

If you provide a mobile number to receive status updates on your payment request, we will use the number provided for that purpose.

We use HubSpot Forms on our website, a service provided by our CRM system HubSpot, to integrate contact forms and process the data entered (see Part C, Section II). HubSpot Forms offers features for SEO, content creation, contact management, email marketing, and analytics. User data entered into the forms is stored in our customer relationship management system provided by HubSpot.

We use email services from Google, provided via Google Workspace by Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland (hereinafter: “Google”). In addition to our CRM software, which is our central system for managing and processing requests, emails are also stored on Google's servers. We have selected the “Europe” region as the server location and have entered into a data processing agreement with Google. These emails are not transferred to third countries, particularly the United States, as contractually guaranteed by Google.

To channel and sort incoming requests, we use an interface for AI-based services designed to understand and generate natural language and associated inputs, analyze information, and make predictions.

We use the ChatGPT language model from the provider OpenAI Ireland Ltd, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland. We have agreed with OpenAI that our data will not be used for training their models, nor will it be shared with OpenAI. OpenAI's privacy policy can be found at https://openai.com/de/policies/eu-privacy-policy. We have entered into a Data Processing Addendum with OpenAI (see https://openai.com/policies/data-processing-addendum). Since data is transferred to the United States when using the OpenAI API, the Data Processing Addendum stipulates that EU standard contractual clauses apply to ensure an adequate level of data protection even when transferred to a third country.

We also use the Google Gemini AI system, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Gemini is designed to provide advanced language and image processing capabilities. It uses machine learning to understand and generate natural language and analyze images, offering versatile applications across various sectors. We use the Google Gemini model to pre-screen incoming emails and documents. As a Google Workspace customer, Google guarantees that the use of Google Gemini will not be used by Google to train its generally available AI models.

We use the LanguageTool application, software from LanguageTooler GmbH, a subsidiary of Learno Inc.
Karl-Liebknecht-Str. 37, 14482 Potsdam, Germany, with AI functions for spell checking, grammar correction, and stylistic adjustments. The privacy policy of the LanguageTool provider is available at: https://languagetool.org/de/legal/privacy. LanguageTool stores the checked records and any errors found on their servers for a maximum of 15 minutes (not on permanent storage media). Data is stored without an IP address or other information that would allow the data records to be attributed to a specific person. However, if the text contains personal data, this is also stored for a short period. We have entered into a data processing agreement with Learno Inc. that also includes the EU standard contractual clauses required for data processing in the United States, under which the provider is contractually obligated to comply with applicable data protection regulations: https://languagetool.org/de/legal/dpa

To read attachments such as PDF or Word files, we use the software solution Airparser, Sepapaja tn 6, Tallinn 11415, Estonia. Airparser uses AI technology to recognize and extract structured data. We have entered into a data processing agreement with Airparser, under which Airparser is contractually obligated to comply with applicable data protection regulations (see https://airparser.com/dpa/). You can view Airparser's data protection information at https://airparser.com/gdpr/.

Legal basis and purpose of data processing

Data transmitted during the submission of a request via a contact form or email is processed based on our legitimate interests. If the contact form request or email contact is aimed at concluding a contract, the processing is also carried out for the purpose of initiating and executing that contract.

Processing personal data from the input form serves to handle requests and establish contact. If you contact us via email, this also constitutes a legitimate interest necessary for data processing. If you provide us with a mobile number to receive updates on the status of your payment request, we will use the number you provided for that purpose.

We use AI-based services to increase the efficiency of our technical and operational processes, in our interest and that of our users. Due to the high volume of incoming messages, we rely on this pre-screening and assignment to the appropriate departments within the company in order to process requests quickly and effectively, in our interest and in the interest of the applicants or senders of messages addressed to us.

User data may also be stored in our customer relationship management system (CRM software) or a similar organization for inquiry purposes, based on our legitimate interests.

Other personal data processed during the submission process is used to prevent misuse of the contact form and to ensure the security of our IT systems.

Retention period / Right to object and erasure

Data is deleted as soon as it is no longer needed for the purpose for which it was collected. For personal data from the contact form input screen and data sent by email, this occurs when the conversation with the user has ended. The conversation ends when it is clear from the circumstances that the matter has been definitively resolved and there are no legal requirements for further retention.

You have the right to withdraw your consent to the processing of your personal data at any time.

If you contact us by email, you can object to the storage of your personal data at any time. In such a case, the conversation cannot be continued, unless another legal basis for data processing applies or we have a compelling interest in further processing.

All personal data stored during our contact with you will be deleted, unless legal requirements mandate a longer retention period.

2. Telephone Hotline

Description of data processing

If you choose to contact us by phone using a number provided on our website, we record the caller's incoming phone number as well as other technical information generated by the phone system (start time and duration of the call) or provided by the telephone company. We also log the essential content of the conversation and any information provided to our employees by the callers (name, concerns, contact details for follow-up, etc.).

To pre-qualify incoming calls, we use an AI-based software solution from Leaping AI UG (haftungsbeschränkt), Potsdamer Strasse 72, 10785 Berlin. This solution obtains the data necessary to categorize the call, route it to the correct department, or answer your questions (including our case number, registration number, and caller name) and to handle certain customer inquiries automatically. A data processing agreement has been signed with Leaping AI for this purpose.

We will ask if you consent to the recording of your call. If you agree, we save the entire content of the call and automatically generate a transcript. We use these recordings and transcripts to train our support staff, resolve customer complaints, create anonymous internal reports (call classification, statistics on reasons for calling), and for verification purposes regarding legal claims or defenses.

We use the cloud contact center platform Talkdesk, provided by Talkdesk Inc., 201 Spear Street, Suite 1100, San Francisco, CA 94105 USA. We have entered into a data processing agreement with Talkdesk, including standard contractual clauses for data transfers to third countries, ensuring Talkdesk is contractually obligated to comply with applicable data protection regulations. We have also agreed with Talkdesk that our instance will be deployed in a European region and that our data will be processed by default in a regional cloud within the European Union.

Legal basis and purpose of data processing

When you call, we automatically collect the data necessary to process the call in order to automate and handle certain customer inquiries or interactions more efficiently.

During the conversation, we manually save your request in our system and store this note at the end of the call. The conversation itself is not recorded. Call recordings are only made and processed based on your prior consent.

Your information may also be stored in our customer relationship management system (CRM software) or a similar inquiry organization based on our legitimate interests.

Retention period / Right to object and erasure

Data will be deleted as soon as it is no longer needed for the purpose for which it was collected. This occurs when the respective conversation with you has ended. The conversation ends when it is clear from the circumstances that the matter has been definitively resolved and there are no legal requirements for further retention.

If no legal retention period applies to recordings, the storage duration for recordings and call notes is based on statutory limitation periods (claims for damages expire after three years). Transcripts of call recordings are deleted after 6 months.

You can withdraw your consent to the processing of your personal data at any time. If a caller consents to the recording of a call, its transcription, and the storage of that recording and transcription, they may revoke this consent at any time. In such cases, the recordings or transcriptions will be deleted immediately, unless we are legally required to retain them for longer.
‍

3. Ticketing System

Description of data processing

We use Freshdesk, a software solution from Freshworks, Inc., 2950 S. Delaware Street, Suite 201, San Mateo, CA 94403, USA, as our ticketing system. Freshdesk is a customer service platform that simplifies the processing of customer inquiries and requests across various channels. We use Freshdesk to receive and manage contact requests. If you submit contact requests via our website using a contact form, or contact us via email or phone, the information and content provided during the conversation, as well as data collected by us (see sections VII. 2 and VII. 3 above), will be stored in the ticketing system and organized to allow for chronological processing and to improve the service experience.

The stored information is collected on personal data servers depending on the extent of the information provided, but in any case, your surname, first name, and email address are transmitted to, stored in, and read by Freshdesk. We have utilized the option to have data processed on servers within the EU. This is intended to technically ensure that the data remains within the European Union and that access by US authorities is not possible.

Further information on data protection can be found at Freshdesk at https://www.freshworks.com/privacy/.

Legal basis and purpose of data processing

We process the information collected via Freshdesk based on our legitimate interests in efficiently organizing our customer service and responding to your requests as quickly as possible to support our customers and users. We have entered into a data processing agreement with Freshdesk on our behalf, which is intended to ensure data protection and, in particular, to prohibit unauthorized disclosure to third parties.

If, in individual cases, a transfer of data to the USA is necessary, this will take place on the basis of standard contractual clauses.

Retention period / Right to object and restrict processing

We store your data for the duration of the contractual relationship between us and the data subject, or until the respective conversation has been completed.

You may exercise your right to object and request deletion as described in the general information in Part A.

4. Chat function

Description of data processing

The chat function on our website consists of an AI-based chatbot provided by Decagon AI, Inc., 2261 Market Street, STE 5378, San Francisco, CA 94114, USA (hereinafter: “Decagon”). Decagon operates an AI platform for automating customer service processes through so-called customer service “agents.”

Through the chat function, you can ask frequently asked or general questions about our parking system or specific areas managed by us (e.g., opening hours, rates), or report issues regarding a parking area we manage so they can be forwarded to our Customer Support team.

As soon as you enter a question into the chat text field (so-called prompts), Decagon automatically analyzes the request and provides a text response generated by the agent. Generally, it is not necessary to provide personal information (e.g., name, email, phone number, address, vehicle license plate). We therefore ask that you do not enter any personal data of your own or of third parties unless requested. Personal data is only collected and stored if you provide it voluntarily.

For the purpose of displaying and technically operating the chat, the following technically necessary data is processed as log data:

• IP address
• API request metadata
• Date and time of access

Processing occurs automatically on the chat side and only at the moment the data is sent. The agent operates autonomously within defined limits and does not make independent decisions that could affect your rights or access to our services. If a request requires human judgment or falls outside the AI agent's scope of competence, it is handled via a supervised process and stored for further processing outside of Decagon in our CRM or ticketing system.

Decagon has contractually guaranteed that user data provided via the chat will not be used to train other AI models. We have entered into a data processing agreement with Decagon, which ensures data protection and prohibits the unauthorized disclosure of data to third parties.

Further information on Decagon’s privacy policy can be found at https://decagon.ai/legal/privacy.

Purpose of data processing
The purpose of processing is to support our customers and users in answering general questions or support requests. Data collected via Decagon is processed based on our legitimate interest in ensuring efficient customer service and providing quick responses to inquiries.

We have also agreed with Decagon that data is processed exclusively within the EU during normal chat operations (EU data residency). If, in exceptional cases, a transfer to the USA is necessary for technical chat support, this will be carried out in accordance with standard contractual clauses.

Retention period / Right to object and erasure
Personal data exchanged during chats is stored for the duration of the contractual relationship with the data subjects or until the conversation is concluded.
If you would like your personal data to be deleted, you can exercise your right to object and erasure as described in the general information in Part A.

C. Data processing related to the use of MH Parkservice parking facilities

1. Using the MH Parkservice online shop

Description of data processing

Through our MH Parkservice online shop (hereinafter “online shop”), you have the option to book and pay for the parking services described there in more detail for the parking facilities we manage, based on the applicable General Terms and Conditions. For example, you can pay for parking fees online.

We use cookies to make our online shop more user-friendly. Some elements of our website require the accessing browser to be identified even after a page change. The user’s language and region are stored in cookies.

In addition, cookies allow for the analysis of browsing behavior in the online shop and may transmit the following data: search terms entered, frequency of site visits, and use of website functions.

To book parking services or pay for their use, you must enter your vehicle’s license plate number in the designated input field and, if applicable, select the desired parking space and/or a case number or reference. We need the license plate and other data to associate the parking fee due with the respective parking session or service.

Data processed during booking includes license plate information, the amount to be paid, as well as other communication, contract, and payment data of our customers, interested parties, and other business partners. Processing is carried out for the provision of contractual services within the scope of our online shop operations, billing, delivery, and customer service. During booking, we process the individual data indicated in the respective input forms, such as name, company, address, email, and phone number. Mandatory information is usually marked with an * or labeled as “optional” and includes data necessary for the provision and billing of the ordered service, as well as contact information so we can reach you or inform you of important order-related information (e.g., mandatory legal notices, delays, etc.).

We process and use the data collected in this context to allow you to select and book our parking services and pay for them. We also process the data to fulfill and, if necessary, send the booking made. Further details on legal and organizational conditions can be found in the respective General Terms and Conditions. Details on the payment service providers we use are provided in point 2 of this Part C below.

Legal basis and purpose of data processing

Data collected during a booking in anticipation of contract performance is also processed to identify and combat harmful behavior, to detect and prevent other negative experiences, to maintain the integrity of the online shop, and to promote protection and security. Both we and other users of our services have an interest in preventing, discovering, or investigating illegal activities, fraud, or security breaches.

Processing the personal data from the input screen allows us to fulfill the respective booking and provide the corresponding parking service.

Data entered in the online shop may also be processed based on your consent, if we request it. You can revoke any consent given at any time. The revocation of consent does not affect the validity of processing that occurred previously. Please note that following your revocation, we may not be able to complete the booking process, or a booking already made may no longer be possible.

Retention period / Right to object and restriction

Data is deleted as soon as it is no longer necessary for the purpose for which it was collected. For personal data from the booking process input screen, this occurs only after a contract for our parking services has been concluded, and not before the respective parking service has been fully provided. As a rule, however, we store contract-related data until the expiration of statutory warranty obligations. In the event of a legal retention obligation, such data will be deleted after the period expires.

2. Using payment service providers during the ordering process (“payment services”)

Description of data processing

If you are required to provide us with payment details (e.g., an account number for direct debit authorization) after entering into a contract for parking services, this information will be necessary for the payment process.

To ensure modern, simple, and secure payment processing, we offer our customers various payment options, for which we work with banks, credit institutions, and other payment service providers (hereinafter collectively referred to as “payment service provider”).

Payment transactions made via standard payment methods (e.g., Visa/MasterCard) are processed exclusively through an encrypted SSL or TLS connection. You can identify an encrypted connection by the browser address bar changing from “http://” to “https://” and by the padlock icon in your browser bar. Thanks to this encrypted communication, the payment data you transmit to us cannot be read by third parties.

If you have opted for the payment services of a specific provider, that provider will deliver its services based on a contract between you and them, in accordance with the provider’s current terms and conditions. Data processing carried out by these providers is their responsibility, and we have no influence over it. Consequently, you must contact the respective payment service provider directly if you wish to exercise your rights as a data subject. The payment service provider may ask for additional consent, for example, to perform an identity or credit check. The personal data processed by the payment service provider generally includes your first and last name, address, date of birth, gender, email address, IP address, phone number, and the data required to process the order-related payment, such as item quantities, item numbers, invoice amounts, tax rates, or bank details required for the transaction (such as account or credit card numbers, passwords, TANs, and checksums), as well as contract, total, and recipient information.

The payment service provider processes this data to offer the relevant payment method, perform necessary identity and/or credit checks, manage payments, and prevent fraud.

Legal basis and purpose of data processing

Your data is transmitted to the payment service providers we use to fulfill the contract concluded with us and for the purpose of efficient and timely online payment processing, unless we have requested your consent. You have the option to revoke your consent for data processing by payment service providers at any time, with effect for the future. A revocation does not affect the validity of data processing procedures that have already taken place.

Stripe

We use Stripe, an online payment service provided by the technical service provider Stripe Payments Europe Ltd, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland (“Stripe”), for online payment transactions for the services we provide.

If you have chosen Stripe as your payment method, the information provided during the ordering process will be transmitted to Stripe, along with order information and, depending on the payment method, other required details (name, address, email address, customer number, order number, bank, account number, IBAN, credit card number if applicable, credit card expiration date, credit card verification code (CVC), invoice amount, currency, transaction number, date and time of the transaction, location, and provider name). Data is transmitted only for the purpose of settling the payment with Stripe and only to the extent necessary for that purpose. We cannot process payments via Stripe without transferring your personal data.

In its data processing activities, Stripe acts in a dual role as a “data controller” and/or a “(sub-)processor.” As a data controller, Stripe uses the data transmitted to it based on its own Terms and Conditions to fulfill the contractual relationship between you and Stripe regarding payment settlement and to comply with regulatory obligations. We have no influence over these processes. Stripe’s privacy policy and further information are available at: https://stripe.com/it/privacy

As a data processor, Stripe is tasked with completing transactions within payment networks. Within the scope of this processor relationship, Stripe acts exclusively in accordance with our instructions and is contractually obligated to comply with data protection regulations pursuant to Art. 9 of the FADP.

Adyen

For certain payment methods, we use the payment service provider Adyen N.V., Simon Carmiggeltstraat 6, 1011 DJ, Amsterdam, Netherlands (hereinafter: "Adyen"). If payment via Adyen is selected, personal data is automatically transmitted to Adyen. The personal data transmitted to Adyen typically includes the card type (e.g., Visa or Mastercard), cardholder name, card number, security code, and expiration date. Adyen’s role is to request authorization for the transaction from the relevant payment system, such as Mastercard or Visa, and to send that authorization to the buyer’s bank for approval. If the bank authorizes it, Adyen receives a notification from the payment system and processes the payment to our bank. Adyen processes user data for payment processing and for identity and credit checks. In this case, Adyen processes your personal data as a data processor. We therefore have no influence over data processing by Adyen.
For information on data protection by Adyen, please visit: https://www.adyen.com/de_DE/privacy-policy; for transaction processing, please visit https://www.adyen.com/de_DE/privacy-policy/transaction.

‍

secuPay

In our online shop, we offer the cashless payment method provided by secupay AG (Goethestr. 6, 01896 Pulsnitz; “secupay”). Secupay is a payment institution under the Payment Services Supervision Act (ZAG) and is registered with the Federal Financial Supervisory Authority (Graurheindorfer Str. 108, 53117 Bonn; “BaFin”) (registration number: 126737), enabling cashless payments for products and services on the internet. When using secupay as a payment process, the claim to the purchase price is assigned to secupay. This allows online shop operators to deliver goods, services, or downloads to the customer immediately after the order. If you select “direct debit,” “payment by invoice,” or “credit card” via secupay during the checkout process, your data is automatically transmitted to secupay. During the processing of payment transactions via secupay, data related to the payment method is transmitted to secupay. Secupay then performs a technical check for the risk of payment default. We are subsequently informed automatically of the transaction outcome. The personal data exchanged with secupay includes your first name, last name, address, email address, IP address, phone number, or other data necessary for processing the payment transaction.

Personal data exchanged between us and secupay may be transmitted by secupay to credit scoring agencies. The purpose of this transmission is to verify identity and creditworthiness. Secupay may transmit personal data to affiliated companies and service providers or subcontractors if necessary to fulfill contractual obligations or if data must be processed on our behalf. This data processing occurs under the responsibility of secupay, and we have no influence over it. You have the option to revoke your consent given to secupay for the processing of personal data at any time. The revocation does not affect personal data that must be processed, used, or transmitted by us for the purpose of processing the payment transaction (in accordance with the contract). Secupay’s current data protection provisions are available at https://www.secupay.com/en/privacy.

Planet (Datatrans)

For our online shop, we use the “Datatrans” payment gateway provided by Planet Payment Group Holdings Limited, IDA Business Park, Dangan, Galway H91A06C, Ireland. We also use the acquiring services provided through this gateway to process, settle, and invoice cashless payments for products and services in our Planet webshop. These services are provided by Planet Merchant Services SAS, a payment institution registered with the Autorité de Contrôle Prudentiel et de Résolution (registration number: 83991), located at 1 Terrasse Bellini, Puteaux, 92919, Paris La Défense Cedex, France, for the payment methods we accept (Mastercard/Maestro, Visa, Twint). Planet Payment Group Holdings Limited and Planet Merchant Services SAS are collectively referred to as “Planet” below.

In its data processing activities, Stripe acts in the dual capacity of “data controller” and/or “(sub-)processor.”

The gateway processes the data technically required for the real-time transfer of payment transaction information between a payment channel and Planet, which is necessary for payment operations. We have entered into a data processing agreement with Planet for this purpose.

As a data controller, Planet uses the data you submit to fulfill regulatory obligations and settle the payment process. The transaction is executed exclusively between you and the originating website by charging the payment method stored in Planet. If you have chosen Planet as your payment method, the information provided during the ordering process will be transmitted to Planet, along with order details and, depending on the payment method, other required information (name, address, email address, customer number, order number, bank, account number, IBAN, credit card number if applicable, credit card expiration date, credit card verification code (CVC), invoice amount, currency, transaction number, date and time of the transaction, location, and merchant name). Data is transmitted only for payment settlement with Planet and only to the extent necessary for that purpose. We cannot process payments via Planet without transferring your personal data. The use of Planet as part of our acquiring services is governed by Planet’s Terms and Conditions of Use, over which we have no influence.

Processing this personal data is necessary to provide services, settle payments, verify creditworthiness, check availability, prevent fraud, handle complaints and refunds, and comply with regulatory requirements.
Planet’s privacy policy is available at: https://www.weareplanet.com/privacy-policy
and https://www.planetpayment.com/en/privacy/

Retention period / Right to object and restrict processing

3. Using MHP Online Shop reviews

Description of data processing

We use the “Trustpilot” review portal, operated by Trustpilot A/S, Pilestraede 58, 5th Floor, 1112 Copenhagen, Denmark. Trustpilot allows users to rate our products and services.

When you purchase a parking service online through our shop and receive your receipt via email, we include a Trustpilot button in that email containing a unique link generated by Trustpilot. To do this, we maintain an interface (“API”) with Trustpilot to create these invitation links. By clicking the link, you are redirected directly to the Trustpilot review platform. The Trustpilot form is automatically populated with your details, allowing you to submit your review. Reviews are verified using the reference number associated with the link. Participation in the review process is voluntary.

The data transmitted to Trustpilot includes:

• Email address
• First and last name
• Reference number
• Our language- and country-specific shop domain, access data (including IP address)
• Selected parking service

For this reason, we use Trustpilot as a data processor and have entered into a data processing agreement that ensures your privacy is protected.

Please note that you need a Trustpilot account to leave a review. Once you submit your review and accept Trustpilot’s terms of use, Trustpilot becomes the data controller for the management and publication of that review. Further details on Trustpilot’s privacy practices can be found at https://de.corporate.trustpilot.com/legal/for-businesses/privacy-policy.

Purpose of data processing
Data processing is used to create the invitation link and verify to Trustpilot that you have used our shop, in order to conduct the review process. Additionally, collecting user feedback to improve our services is a legitimate interest.

Retention period / Right to object and delete

Data related to the Trustpilot invitation is stored for one year.

4. Using parking facilities managed by MH Parkservice

Description of data processing

Nell’ambito dell’utilizzo del parcheggio vengono registrati automaticamente i seguenti dati: targa del veicolo, compresa la parte anteriore o posteriore del veicolo, ora di entrata/uscita, data e timbro della località, importo e metodo di pagamento della sosta.

A meno che non sia in possesso di un’autorizzazione permanente per il parcheggio, l’utente deve inserire la targa del veicolo alla cassa automatica prima di lasciare l’area di parcheggio. Una volta che la targa inserita viene trovata nel nostro database, la tariffa della sosta viene calcolata e quindi pagata dall’utente. I dettagli sul trattamento dei dati per i pagamenti tramite il nostro online-shop sono disponibili nella parte C, punti 1 e 2 e nelle Condizioni d’Uso in vigore.

In caso di violazione delle Condizioni Generali d’Uso, vengono trattati anche tutti i dati personali del proprietario e del conducente del veicolo necessari per l’azione legale contro la violazione, in particolare per la riscossione di una penale contrattuale maturata e/o per l’esercizio dei diritti di protezione della proprietà e del possesso (“tracciamento”).

Se ricevete una lettera di sollecito come proprietario del veicolo che ha causato una violazione di parcheggio, abbiamo precedentemente inviato il vostro numero di targa all'Autorità federale dei trasporti automobilistici all'organo competente per le informazioni sui proprietari (ufficio della circolazione stradale del rispettivo cantone o portale eAutoindex dei Cantoni). Se non sei il proprietario del veicolo, i tuoi dati ci sono stati forniti dal proprietario del veicolo o da un altro terzo (ad esempio società di noleggio veicoli o società di leasing) che ci ha confermato che eri il conducente del veicolo al momento del infrazione divieto sosta. Se non abitate più all'indirizzo registrato presso l'Autorità federale dei trasporti automobilistici presso l'ufficio competente per le richieste dei proprietari, abbiamo ricevuto i vostri dati dalla persona attualmente registrata a questo indirizzo, da un'agenzia di credito o da un'agenzia di recupero crediti.

Per elaborare i documenti di raccolta ricevuti dalle autorità competenti con i dati dei titolari e distribuire i record per titolare, utilizziamo la piattaforma ConvertAPI del fornitore UAB Baltsoft, Kosciuskos 26-17, Vilnius, LT-01100, Lituania. Questo strumento viene utilizzato per elaborare i file PDF e, se necessario, per convertire i file in altri formati (ad esempio, da PDF a DOX). In questo caso, i dati personali contenuti nei documenti vengono elaborati sui server del fornitore, solitamente il nome e l'indirizzo del titolare dell'autorizzazione. I flussi di dati scambiati tra noi e ConvertAPI sono completamente criptati. ConvertAPI si impegna a rispettare gli attuali standard di protezione dei dati https://www.convertapi.com/static/docs/compliance/PP_DPA.pdf (ed è stata certificata ISO 27001 dal TÜV Thüringen (https://www.convertapi.com/compliance).

Base giuridica e finalità del trattamento dei dati / destinatari dei dati

Il trattamento dei dati raccolti è necessario per salvaguardare i legittimi interessi delle parti nella gestione del parcheggio e delle relative attività amministrative consuete nel settore (art. 6 par. 1 lett. f GDPR) nonché per l'elaborazione contrattuale dei servizi da fornire in conformità alle condizioni generali di utilizzo (ad es. determinazione e fatturazione della tariffa di parcheggio, confronto con le autorizzazioni di parcheggio depositate, confronto con i pagamenti tramite app, confronto con i pagamenti tramite il portale dei servizi).ad es. determinazione e fatturazione della tariffa di parcheggio, confronto con le autorizzazioni di parcheggio depositate, confronto con i pagamenti tramite app, confronto con i pagamenti tramite il portale dei servizi, determinazione del rispetto della durata massima consentita del parcheggio o della durata del parcheggio gratuito o del periodo di tolleranza) (Art. 6 comma 1 lett. b GDPR).

I dati relativi al proprietario (in particolare nome e indirizzo) vengono richiesti all’autorità o all’ufficio preposti, inoltrando la targa (“Richiesta di informazioni sul proprietario”). I dati del conducente possono essere richiesti tramite il proprietario del veicolo identificato, la società di noleggio o di leasing del veicolo e possono anche essere trasmessi a terzi per le finalità sopra menzionate (ad es. avvocati, agenzie di recupero crediti). I dati vengono trattati da MH Parkservice e dai suoi commissionari (Peter Park System GmbH (gestione della tecnologia e del software di parcheggio) e Amazon Webservices EMEA SARL (archiviazione dei dati)) per il funzionamento della tecnologia e del software di parcheggio, nonché per il controllo delle violazioni delle Condizioni Generali d’Uso. Questo trattamento viene effettuato per l’esecuzione del contratto o per perseguire il legittimo interesse a salvaguardare la proprietà e i diritti di proprietà di MH Parkservice e di terzi e il loro legittimo interesse a garantire il corretto funzionamento dei parcheggi, nonché a velocizzare la gestione dei veicoli nel parcheggio.

Durata della conservazione / Messa a disposizione dei dati / Possibilità di opposizione e limitazione

I dati personali da noi raccolti saranno cancellati una volta risolti tutti i reclami esistenti derivanti dall’uso del parcheggio e in relazione ad esso e con la scadenza di tutti i periodi di conservazione e limitazione previsti dalla legge. Se non vi è alcuna violazione delle Condizioni Generali d’Uso del parcheggio e l’utente lascia il parcheggio entro il periodo di tolleranza applicabile dal momento dell’ingresso, i dati dell’utente saranno automaticamente cancellati 48 ore dopo l’uscita dal parcheggio, salvo che non vi siano obblighi di conservazione previsti dalla legge.

Il conferimento dei suoi dati durante l’utilizzo dei parcheggi da noi gestiti è previsto dal contratto secondo le rispettive Condizioni Generali d’Uso o è obbligatorio per la conclusione del contratto. Senza il conferimento dei suoi dati, non sarebbe possibile adempiere al rapporto di debito sottostante né fornire i servizi di gestione del parcheggio. Tuttavia, non utilizziamo i suoi dati nel contesto di un processo decisionale automatizzato, compresa la profilazione. Dato che la raccolta dei dati e il loro successivo trattamento sono obbligatori, gli utenti non hanno la possibilità di opporsi. La targa viene riconosciuta al momento dell’ingresso nel parcheggio, e quindi è possibile in genere tornare indietro prima per evitare la raccolta dei dati, ove le condizioni strutturali lo consentano.

5. Attivazione delle autorizzazioni per la sosta

Descrizione del trattamento dei dati

Per alcune delle aree di parcheggio da noi gestite, le autorizzazioni di parcheggio possono essere richieste tramite terminali o maschere di prenotazione online (tramite il sito web di MH Parking Service, online o, ad esempio, presso i negozi al dettaglio o le istituzioni locali), ad esempio per posti auto designati per determinati gruppi di persone autorizzate (ad esempio, dipendenti, visitatori o clienti) e/o tempi di parcheggio gratuiti, in conformità alle condizioni applicabili in loco per la rispettiva area di parcheggio.

A tal fine, è necessario inserire i dati richiesti nella schermata di inserimento appropriata. L’inserimento della targa è sempre obbligatorio. Potrebbe essere necessario inserire ulteriori informazioni per stabilire l’appartenenza a un gruppo autorizzato, come i numeri di identificazione dei dipendenti. Queste informazioni possono essere trasmesse al nostro committente o ai loro clienti per il chiarimento dell’autorizzazione o possono essere confrontate con i dati da loro forniti.

Base giuridica e finalità del trattamento dei dati / destinatari dei dati

Il trattamento dei dati raccolti nell’ambito di una prenotazione è necessario in previsione della conclusione di un contratto, per l’efficace elaborazione delle autorizzazioni di parcheggio e per supportare la fornitura del relativo servizio di parcheggio.

Se è necessario un confronto con altri dati per convalidare l’autorizzazione o il trattamento di dati aggiuntivi forniti nel modulo, questo può essere effettuato anche sulla base di un consenso da lei espresso. Può revocare uno dei consensi espressi in qualsiasi momento. La revoca del consenso non pregiudica la validità del trattamento avvenuto in precedenza. Le facciamo presente che a seguito della sua revoca, potremmo non essere in grado di completare il processo di prenotazione o la prenotazione effettuata potrebbe non essere più possibile.

Durata della conservazione / Messa a disposizione dei dati / Possibilità di opposizione e limitazione

I dati vengono cancellati non appena non saranno più necessari alla finalità per cui sono stati raccolti. Per i dati personali provenienti dalla schermata di inserimento della procedura di prenotazione, questo avviene solo dopo la conclusione di un contratto per i nostri servizi di parcheggio, non prima che il rispettivo servizio di parcheggio sia stato completamente fornito. Di norma, tuttavia, conserviamo i dati relativi al contratto fino alla scadenza degli obblighi di garanzia previsti dalla legge. In caso di obbligo legale di archiviazione, tali dati saranno cancellati dopo la scadenza del periodo.

6. Parking areas with free parking for people with disabilities

Description of data processing

In some of the parking areas we manage, people with disabilities are offered the option to park for free during their stay in designated spaces. To take advantage of this, users must provide proof of their disability parking permit (e.g., a blue badge).

Specifically, eligibility for free parking must be verified according to the conditions posted at the parking area. This can be done, for example, by scanning a QR code on the sign, visiting our website, and registering the parking permit via the provided form.

Purpose of data processing

Data collected during the registration process is used to fulfill our contract, effectively manage parking permits, and support the provision of parking services. If we need to process health-related data, which is considered sensitive, we will ask for your explicit consent.

Retention period / Obligation to provide data / Right to object and erasure

Proof of your disability parking permit is verified solely for the purpose of granting free parking and is deleted immediately after your parking session ends.

‍

7. Using the MH Parkservice portal

Description of data processing

We offer users of our parking facilities the option to submit support requests via our service portal (https://service.mh-parkservice.ch/)—for example, to ask questions, dispute payment notices, clarify other issues, view information about parking violations including receipt images and payment methods, or access other personalized information.

The portal is accessed via a QR code provided to users (e.g., on a payment notice). After authentication, you can access the PCN portal. During authentication, the user provides the following personal data:

• Case number
• Vehicle license plate

Technically, limited connection data is collected every time the portal is accessed. This is necessary to establish and maintain the connection between the user's device and our servers, keep the session active, and prevent unauthorized access. During each login and use of the portal, we or our hosting provider record:

• IP address and timestamp of user actions
• Internet service provider
• Browser and operating system (including version details)
• Language settings, referrer URL, and the name of the webpage visited

After logging in, a cookie is set to maintain and secure your session. You must allow this cookie in your browser to use the portal.

If resolving an issue reported via the PCN portal or answering a question requires the involvement of other partners or service providers, information regarding the request or incident will be shared with them.

Purpose of data processing

Data processed via the PCN portal and submitted requests is used to fulfill the parking contract between you and us, enable effective communication with our support teams, manage and resolve inquiries, and ensure a secure connection between user devices and our servers.

Storage duration / Right to object and erasure

Data is deleted as soon as it is no longer needed for the purpose for which it was collected. Personal data provided during authentication is generally deleted once the usage process is complete. Any personal data stored during support interactions is deleted no later than when there are no longer any legal retention obligations (e.g., statutory warranty periods for support requests).

8. Invoicing

Description of data processing

To create and send invoices, as well as for documentation and accounting purposes, we use the cloud accounting software sevDesk, provided by sevDesk GmbH, Hauptstrasse 115, 77652 Offenburg. In this context, the invoice recipient's contact details are processed via sevDesk. You can find the sevDesk privacy policy at https://sevdesk.de/datenschutz/.

Purpose of data processing

We use sevDesk to fulfill our legal obligations, for contractual purposes, and for our legitimate interest in managing our accounting efficiently. We have entered into a data processing agreement with sevDesk, which requires them to comply with current data protection regulations.

Storage duration / Right to object and erasure

We store your data for the duration of the contractual relationship and until the statutory retention periods for relevant accounting documents have expired.
If you would like your personal data to be deleted, you can exercise your right to object and erasure as described in the general information in Part A.

D. Contractual relationships with customers and business partners

I. Am I required to provide my data?

If you contact us with questions about our services, enter into contract negotiations with us, accept one of our offers, or enter into other contractual agreements with us, we will process the personal data you provide in this context. The specific data we process depends largely on the goods and services you purchase from us or request. In this context, processing your data is generally strictly necessary for the preparation, conclusion, and execution of the contract. If you do not provide this data, we may be forced to refuse to enter into a contract or execute an order, or we may no longer be able to fulfill an existing contract.

When we use data in the context of initiating or executing a contract with a business customer, business partner, or cooperation partner, our interest in processing your data lies in the ability to maintain communication with the business customer or the respective partner, typically within the scope of a contractual or other relationship. If you are acting as a point of contact—typically in your capacity as an employee of these companies—you generally do not have an overriding interest to the contrary, provided that this interaction with us falls within your scope of duties, meaning that a right to object usually does not apply.

However, you are not required to consent to the processing of data that is not relevant to the performance of the contract or required by law.

II. CRM System ("HubSpot")

Description of data processing

We use the features of the customer relationship management (CRM) system HubSpot. HubSpot is a software solution from HubSpot Inc., 25 First Street, 2nd Floor, Cambridge, MA 02141, USA, offered in Europe by HubSpot Ireland Limited, 2nd Floor, 30 North Wall Quay, Dublin 1, Ireland. HubSpot is an integrated software solution that we use to cover various aspects of our online marketing. These include: email marketing, social media publishing & reporting, analytics, contact management (e.g., user segmentation & CRM), landing pages, and contact forms.

We use HubSpot to drive and implement inbound marketing in relation to various features of our online presence. The information stored is kept on HubSpot's servers. We may use the processed data to gain detailed insights into the use of our online presence, to contact our website visitors, and to identify which of our company's services are of interest to them.

HubSpot uses "web beacons" (invisible images or code) and cookies that are embedded in websites or emails and stored on users' devices to record their IP address, geographic location, browser type, duration of the visit, and the pages visited.

In addition, HubSpot records user data entered when subscribing to our newsletter or filling out one of our contact forms.

You can find more information about HubSpot’s data protection at https://legal.hubspot.com/privacy-policy.

Legal basis and purposes of data processing

In addition, we use the information collected via HubSpot based on our legitimate interest in optimizing our marketing, analyzing the use of our online presence, and continuously improving it to provide a more user-friendly experience and deliver more targeted information to our users.

Right to object and restrict processing

You can prevent cookies from being stored by adjusting your browser settings. If you would like your other personal data deleted, you can exercise your right to object and restrict processing as described in the general information in section A.

Alternatively, you can manage your cookie preferences using the CookieHub management tool we have integrated.

III Communication

Generally, we collect the necessary data directly from you through personal contact. You are also welcome to reach out via phone, fax, mail, or the email addresses we provide (see Legal Notice) or those of our staff. In the latter case, the personal data you send via email will be stored. Please note that email communication is not encrypted for technical reasons.

Your data will be used to process your inquiry and follow up on the content of our conversation. If your communication relates to the fulfillment of a contract or is necessary for pre-contractual measures, we will process your data for those purposes.

In all other cases, processing is based on our legitimate interest in effectively handling the inquiries we receive.

In this context, your data will not be shared with third parties unless it is necessary to pursue our legal claims or legitimate interests, or if we are legally required to do so.

IV. Data processing in the context of sales

Personal data is processed to provide the services you commission, specifically for the execution of our contracts or pre-contractual measures, as well as for all activities necessary for the operation and administration of MH Parkservice.

The resulting purposes for data processing are primarily based on the specific activities and individual services agreed upon with you. This may include consulting, managing sales processes (e.g., preparing documents, sending information about MH Parkservice products or events, providing services), or supporting sales negotiations and contract closures.

Further details regarding the scope, purposes of data processing, and recipients of your data can be found in the respective contractual documents and their associated Terms and Conditions.

To the extent necessary for our business processes, we process your data in connection with our services beyond the actual conclusion of the contract to safeguard our legitimate interests.

In connection with offering or providing our services, we may be subject to specific legal obligations, such as tax law requirements. The purposes of processing your data may therefore include fulfilling tax audit and reporting obligations, customs or export regulations, and risk assessment and management.

V. Newsletter

Description of data processing

Description of data processing
We like to keep our business clients and interested parties regularly updated with promotional messages about our services and other products, webinars, innovations, or news from MH Parkservice via email or other electronic notifications (hereinafter referred to as the “newsletter”). For this, we need your email address. In our newsletter sign-up forms, we may ask for additional information to send you content tailored to your interests.

You can subscribe to our newsletters by using the corresponding function in our newsletter sign-up form or by checking the box during the registration process (known as an opt-in). To this end, we provide various options for subscribing to our newsletters (potentially categorized by topic) on our websites or within our sign-up or ordering interfaces. The specific content of each newsletter is described in detail in the respective sign-up form. This description is the basis for your consent.

Once you have signed up, you will receive an email from us asking you to confirm your newsletter subscription (the double opt-in procedure). This confirmation is necessary to ensure that no one else has misused your email address to sign up for our newsletter. Your email address will only be activated for newsletter delivery after you click the hyperlink provided in that email.

For managing subscriptions and sending out our newsletters, we use the MailChimp service provided by the US company Rocket Science Group, LLC, 675 Ponce De Leon Ave NE #5000, Atlanta, GA 30308, USA (hereinafter "MailChimp"). This allows us to automate the sign-up process and the associated email delivery in a simple and intuitive way. The registration data entered in the form is transmitted to and processed in the United States, as MailChimp's IT infrastructure is located there. To ensure the proper handling of the data we transmit, we have entered into an agreement with MailChimp that includes the EU standard contractual clauses for data transfers to third countries. Further information on how MailChimp handles personal data can be found at: https://mailchimp.com/legal/privacy/

To verify the newsletter delivery, we store your IP address and the date of registration ("timestamp") in addition to your email address and name.

Legal basis and purpose of data processing / data recipients

The legal basis for sending newsletters is the consent provided by you as the recipient in accordance with Article 3 of the Swiss Federal Act against Unfair Competition (UWG). If consent is not required by applicable law, data processing is carried out based on our legitimate interest in direct marketing activities.

Documentation and tracking during the registration process are based on our legitimate interests in maintaining a secure and targeted newsletter system that meets both our commercial sales interests and the preferences and needs of our recipients, as well as ensuring that the consent provided can be verified.

Retention period / Right to object and restrict processing

You may object to the delivery of the newsletter at any time and revoke your consent to receive it, either in full or in part, by using the unsubscribe link at the bottom of every newsletter. You can also contact us directly using the contact details provided at the beginning of the newsletter.

Unsubscribing from the newsletter does not affect other business communications. Your data will remain stored with us if it is necessary for the performance of a contract. Furthermore, we reserve the right to retain necessary evidence until the statutory limitation periods have expired to prove that the newsletter was sent in compliance with the law.

VI Data transfer

Depending on the scope of the service, your data or documents may be transferred to public authorities, private service providers, or individuals with whom we regularly collaborate (see Part A, Section V), whether during the inquiry or quotation phase or during the execution of a contract.

E. Other

The ongoing development of our website, services, and other offerings, as well as changes in legal or regulatory requirements, may necessitate updates to this Privacy Policy. The current version of the Privacy Policy is always available on our website and can be printed if needed.