1. Legal basis for the processing of personal data

We process your personal data in accordance with applicable data protection laws, including the General Data Protection Regulation (GDPR), if:

• you have given your consent (Art. 6(1)(a) GDPR),
• it is necessary for the performance of a contract with you or to take steps at your request prior to entering into a contract (Art.6(1)(b) GDPR),
• it is necessary for compliance with legal obligations to which we are subject (Art.6(1)(c) GDPR), or
• it is necessary for the purposes of our legitimate interests or those of third parties (Art.6(1)(f)GDPR), in particular our legitimate interests to pursue the purposes described in this Privacy Notice.

2. Categories of recipients

We may share your personal data with the following categories of recipients if necessary for the purposes described in this Privacy Notice:

• other group companies, who need your personal data, for example, to provide centralized services to us,
• third-party service providers and business partners, who need your personal data to provide their services to us, including:
  • administration services (e.g. document service providers),
  • customer service and support services (e.g. call center, help desk or customer relationship management providers),
  • finance and accounting services (e.g. accountants, banks, credit check agencies, insurers, payment processors or tax advisors),
  • IT services (e.g. IT service and telecommunication providers),
  • legal and compliance services (e.g. auditors, lawyers, or other experts),
  • marketing and sales services (e.g. marketing and advertising, social media platforms or other media companies),
  • strategy and business development services (e.g. management consultants, government authorities, who need your personal data to perform their public tasks (e.g.business intelligence providers or other advisors),
• government authorities, who need your personal data to perform their public tasks (e.g.courts for litigation, tax authorities for tax administration or law enforcement authorities for investigations), or
• other third parties, such as potential buyers of our business (e.g. in case of a sale, merger, or acquisition), counterparties including their service providers (e.g. in litigation), or other recipients at your direction.

3. Third country transfers

We usually process your personal data within the EU/EEA. If we transfer your personal data to recipients in countries outside of the EU/EEA ("third countries"), we apply the following safeguards to ensure that the protection of your personal data is not undermined:

• For recipients in third countries with an adequate level of protection (you can find the current list of adequate third countries here: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en ), we rely on the EU Commission's adequacy decisions under Art.45 GDPR,
• For recipients in third countries without an adequate level of protection, we usually rely on standard contractual clauses (here: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en ) under Art.46 GDPR, and
• For recipients in third countries without an adequate level of protection and in the absence of standard contractual clauses, we rely on the following derogations under Art.49 GDPR, for example, if
  • you have given your explicit consent,
  • it is necessary for the conclusion or performance of a contract with you or in your interests, or
  • it is necessary to establish, exercise, or defend legal claims.

For more details about our third country transfers or copies of these safeguards please reach out to us via the contact details stated under "Data subjects rights and questions" section below.

4. Storage periods

We store your personal data for no longer than is necessary for the purposes described in this Privacy Notice. To determine our storage periods, we particularly use the following criteria:

• if you withdraw your consent or object to the processing of your personal data and we cannot rely on another legal basis, we will usually not store your personal data for any longer,
• if we are legally obliged to store your personal data, we will usually retain your personal data for the prescribed retention period (e.g. for six and ten years under Sec. 257 Commercial Code (Handelsgesetzbuch) and Sec. 147 Fiscal Code (Abgabenordnung)),
• if we are legally obliged to delete your personal data, we will usually not store your personal data for any longer,
• if we need your personal data to establish, exercise, or defend legal claims, we will usually store your personal data for the statutory limitation period (e.g. for three years under Sec.195 Civil Code (Burgerliches Gesetzbuch)),
• if we have an existing relationship with you, we will usually store your personal data for the period of our relationship, or
• if we likely need to use your personal data in the future, we will usually store your personal data for this anticipated period in the future.

Once our applicable storage periods expire, we will delete or anonymize your personal data. For more details on our storage practices, please reach out to us via the contact details stated under "Data subjects rights and questions" section below.

5. Sources of personal data

We usually collect personal data from you directly, in particular:

• when you communicate with us,
• when you use our services, offerings, or technologies,
• when you otherwise interact with us directly.

You can provide your personal data voluntarily to us, unless you are legally or contractually obliged to do so, or it is necessary to enter into a contract. If you do not provide your personal data to us, you will likely not be able to enter into or maintain a contractual relationship with us or you will likely not be able to interact with us. For more details on your obligations and possible consequences, please contact us via the contact details stated in the "Data subjects rights and questions" section below.

We may also collect personal data from other sources than you, in particular from:

• other group companies,
• third-party service providers and business partners,
• government authorities (e.g. law enforcement authorities for investigations),
• other third parties, such as providers of publicly accessible sources (e.g. public websites, media, social media profiles, registers, records, or databases), counterparties including their service providers (e.g. in litigation), or other companies or individuals at your direction.

6. Data subject rights and questions

You have the following rights under the GDPR:

• right to withdraw consent: you can withdraw your consent at any time (Art.7(3) GDPR),
• right of access to personal data: you can ask us to provide access to your personal data (Art.15 GDPR),
• right to rectification: you can ask us to rectify inaccurate personal data or complete incomplete personal data (Art.16 GDPR),
• right to erasure: you can ask us to delete your personal data (Art. 17 GDPR),
• right to restriction of processing: you can ask us to restrict the processing of your personal data (Art. 18 GDPR),
• right to data portability: you can ask us to transfer your personal data to you or to another recipient at your choice (Art.20 GDPR),
• right to object: you can object to the processing of your personal data (Art. 21 GDPR).

If you want to exercise these rights or have questions about this privacy notice, please contact us via [data_privacy@aqrose.com]. Please note that your rights can be restricted in certain situations. In such case, we will inform you of the restriction's reason.

If you have any concerns about how we process your personal data, we encourage you to let us know so we can try to resolve your concerns. Irrespective of this, if you think we have not complied with data protection laws, you have the right to lodge a complaint with the competent supervisory authority under Art.77 GDPR.

7. Existence of automated decision-making

As a matter of principle, we do not use automated decision-making and, in this context, no profiling within the meaning of Art.22 GDPR.

1. Provision of the website and creation of log files

Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing computer. For example, the following data can be collected:

• IP address
• Information about the browser type and the browser version used
• Operating system of the user
• Internet provider of the user
• Date and time of access
• Websites that are accessed by the user's system via our website

The data is also stored in the log files of our system.

The temporary storage of the IP address by the system is necessary to enable the website to be delivered to the user's computer.

The data is stored in log files to ensure the functionality of the website. We may also use the data to optimise the website and to ensure the security of our information technology systems.

Legal basis: Art. 6(1)(f) GDPR

If data is collected to provide the website, your data will be deleted when the respective session has ended. If the data is stored in log files, this is the case after seven days at the latest.

2. Order management

You can place an order by contacting us.

When placing an order, you only need to provide the data that we require to process your order and which we have therefore labelled as mandatory information for you.

Data processing in connection with your orders, including processing of goods and payment transactions, are necessary for contract initiation or contract fulfilment, which is why the legal basis for this data processing is Art. 6(1)(b) GDPR or Art. 6(1)(f) GDPR.

Data that we process for an order is subject to statutory retention obligations, meaning that we must comply with retention periods under tax and commercial law in particular. These generally amount to ten years, meaning that your data can only be deleted afterwards.

3. Newsletter and e-mail advertising

On our website, you have the opportunity to find out about our products and services via e-mail and to subscribe to a free newsletter (hereinafter "newsletter"). The only mandatory information for sending the newsletter is your e-mail address. The provision of further, separately marked data is voluntary and is used to address you personally.

We use the so-called double opt-in procedure to register for our newsletter. This means that after you have registered, we will send you an e-mail to the e-mail address you have provided in which we ask you to confirm that you wish to receive the newsletter. You must confirm your registration within 24 hours in order to activate your registration. In addition, we store the IP addresses used and the times of registration and confirmation. The purpose of this procedure is to be able to prove your registration and, if necessary, to clarify any possible misuse of your personal data. After your confirmation, we process your e-mail address for the purpose of sending you the newsletter.

If you have given your consent, our newsletters may also contain personalised advertising or personalised content.

In addition, we may also measure the success of our newsletter based on your consent, for example whether our newsletter has been read.

The processing includes the following types of personal data:

• E-mail address
• First name and surname
• IP address
• Information about the end device and operating system (e.g. device type, browser identification)
• Information on user behaviour (e.g. access to content and advertisements, time of access)

Legal basis: Art. 6(1)(a) GDPR

The legal basis for data processing as part of the double opt-in procedure and in connection with the proof of your consent is Art. 6(1)(c) in conjunction with Art. 5(1)(a),(2), Art. 7(1) GDPR.

Personal data is stored for as long as the subscription to the newsletter is active or the e-mail advertising is requested. The subscription can be cancelled at any time by withdrawing the consent given (e.g. via the "Unsubscribe newsletter" link in the newsletter). However, we may store your email address and proof of your consent for the duration of the statutory limitation period, i.e. three years, in the interest of and for the purpose of proving your consent and in defence against possible claims.

If you do not confirm your registration for our newsletter as part of the double opt-in procedure within 24 hours, your information will be automatically deleted.

4. Advertising for similar goods and services

If you have given us your e-mail address in connection with the purchase of goods or services from us, we may also use your e-mail address to inform you regularly about our own similar goods or services by means of direct advertising.

Legal basis: Art. 6(1)(f) GDPR in conjunction with Sec. 7(3) UWG

The data will be deleted as soon as you object to the use of your e-mail address for advertising for similar goods and services. You will not incur any costs for the objection other than the transmission costs according to the basic tariffs.

5. Direct advertising by postal mail

We use the postal contact details provided by you in connection with the purchase of goods or services or when you contact us to inform you regularly about our products and services (e.g., sending product catalogues) by postal mail by way of direct advertising.

The legal basis for data processing is Art. 6 (1) (f) GDPR.

The data will be deleted as soon as you object to the use of your data for direct advertising by letter.

6. Contacting us

When you contact us (e.g., via a form on our website or by e-mail, the data you provide such as your e-mail address and any other data you provide) will be transmitted to us and processed by us to process your enquiry.

If the contact is aimed at concluding a contract, Art. 6 (1) (b) GDPR or Art. 6 (1) (f) GDPR is the legal basis for the processing. The legal basis for the processing of data transmitted in the course of making contact in other cases is Art. 6 (1) (f) GDPR.

The data collected in this context will be deleted once your request has been processed and there are no longer any legal retention requirements. The statutory retention periods typically amount to ten years.

7. Consent management

We use a consent management service to enable you to give and manage consent on our website. This service helps us to obtain consent from you on our website for data processing that requires consent as well as cookies and similar technologies. In addition, consent management via this service enables you to withdraw the consent you have given.

The legal basis for data processing is Art. 6 (1) (c) in conjunction with Art. 7 (1) GDPR or Art. 6 (1) (f) GDPR.

We may store personal data for the duration of the statutory limitation period, i.e. three years, in the interest of and for the purpose of proving your consent and for the defence of possible claims.

8.Website analysis for success measurement and to optimize user-friendliness

In order to be able to measure the success of activities in connection with the use of our website and to optimize user friendliness of our website, we analyse the use of our website with aggregated data.

The processing includes the following types of personal data:

• Domain name
• Information on website usage (e.g. number of visitors, time and duration of website visits, access to content)

The results of our performance measurement can be recorded in (aggregated) reports.

The legal basis for the processing of personal data is your consent (Art. 6 (1) (a) GDPR).

Personal data processed by us in connection with the website analysis to measure success and to optimize user friendliness of our website will be deleted by us no later than 3 months after their collection.

To analyze the usage of our website with aggregated data, we utilize the following Cookies, given your consent:

9. Company presence on social media

We also utilise social media to present ourselves on social media and to stay in contact and interact with you. In addition, we analyse how our company page is used on social media so that we can design and optimise it in line with requirements based on the insights gained.

The legal basis for the processing of personal data is our legitimate interest in accordance with Art. 6 (1) (f) GDPR or the consent you have given us in accordance with Art. 6 (1) (a) GDPR.

Personal data that we process in connection with social media will be deleted by us no later than 12 months after its collection.

The social media providers themselves are generally responsible for compliance with data protection regulations on their platform. In addition to these providers, we are only responsible under data protection law to a limited extent. The extent to which we are responsible alongside the providers can be found in the respective information on joint controllership.

We are active on the following social media platforms:

• LinkedIn, LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Irland. Information on data protection at LinkedIn can be found at https://www.linkedin.com/legal/privacy-policy. Information on joint controllership and the associated agreement can be found at https://legal.linkedin.com/pages-joint-controller-addendum . We have agreed that: (1) we are joint controllers with LinkedIn for the processing of Page Insights data; (2) LinkedIn will assume primary responsibility and is principally responsible for providing you with information about the joint processing and enabling you to exercise your rights under the GDPR; (3) the Irish Data Protection Commission will be the lead supervisory authority overseeing the processing under joint controllership. From LinkedIn, we receive aggregated data in the following areas: reach (impressions, page views, unique users, access to subpages); audience (demographic information); interaction (impressions, reactions, click-through rate, likes, shares, comments, link clicks, engagement rate); and audience (demographic/geographic information).
• Youtube, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland. Information on data protection at Youtube can be found at https://policies.google.com/privacy. From YouTube, we receive aggregated data in the following areas: number of impressions, profile visits, and followers (including growth and trends over time).