A. General Information

We are pleased about your visit to our website. We place great value on the secure and confidential processing of your data, especially in consideration of the applicable legal regulations of the General Data Protection Regulation (GDPR), the Telecommunications Digital Services Data Protection Act (TDDDG), and other data protection provisions.

I. Personal Data

The term ‘personal data’ is used below within the meaning of Art. 4(1) GDPR. This is all information that relates to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by association with an identifier such as a name, an identification number, location data, an online identifier, or one or more special features. In this case, this includes, for example, names, addresses, telephone numbers, email, or IP addresses.

II. Security

We have taken various technical and organizational protective measures to protect your data (e.g., against destruction, loss, manipulation, and unauthorized access). All our security measures are regularly reviewed, revised, and updated in line with technical progress.

B. Operation of the Website

I. General Data Collection/Processing During Visit

1. Purposes of Processing

We collect data that is technically necessary so that the page you accessed can be displayed to you. We also use some of this data for statistical evaluations and to improve the website. Through it, we can detect possible errors on the pages, such as broken links.

2. Data Affected

Until automatic deletion, the following data is stored without further input from the visitor:

• Browser used

3. Data Subjects

Visitors to our website are affected.

4. Type of Processing

When this website is accessed, the internet browser used by users automatically sends data to this website’s server and stores it for a limited time in a log file.

In connection with the use of the website, the IP address of the computer used by visitors is recorded, among other things. We may be able to identify users of the website via the IP address. However, we do not conduct an evaluation of the recorded IP addresses for this purpose. The IP addresses are evaluated exclusively on a statistical basis in anonymized form.

5. Legal Basis

The legal basis for storing this data arises from Art. 6(1) sentence 1 lit. f) GDPR. Our legitimate interest is the stable, secure, and technically flawless provision of our website.

6. Storage Duration

They are deleted within 7 days after accessing the website.

7. Recipient

Our website runs on the network of Combell nv, Skaldenstraat 121, 9042 Gent, Belgium. The service provider may access the personal data collected in the context of hosting and support.

8. Right to Object

Insofar as the collection of your data is technically necessary for the provision of our website, there is no right to object to the processing of your personal data. Otherwise, the statements on the right to object in the section on data subject rights apply.

II. Cookies

Our website uses cookies. Cookies are small text files that are stored by your browser on your end device when you visit our website. They serve to enable individual functions, facilitate the use of the website, and store certain settings.

Via the displayed consent banner (see below), you can decide for yourself whether and which non-essential cookies may be set. Technically necessary cookies are set so that the website can function at all (e.g., for session control or to store your consent decision).

Cookies can either be stored temporarily (they are automatically deleted when the browser is closed) or permanently on your device until you delete them yourself or your browser does so automatically.

You can set your browser to inform you about the setting of cookies, allow cookies only in individual cases, or refuse the acceptance of specific or all cookies. Please note that some functions of the website may then not be fully available.

Further information on the processing of personal data in connection with cookies and the services used can be found in the following sections of this privacy notice.

III. Borlabs Cookie

1. Purposes of Processing

We use Borlabs Cookie, a so-called cookie banner, to ensure the collection, documentation, management, and revocation of our website users’ consent regarding the use of cookies and comparable technologies.

2. Data Affected

• Cookie runtime • Cookie version • Domain and path of the website • Selected consents (Opt-in/Opt-out) • Randomly generated UID (no personal reference)

3. Data Subjects

Visitors to our website who actively make a decision in the Borlabs Cookie box.

4. Type of Processing

When you access our website, your browser loads the cookie banner from Borlabs. A technically necessary cookie named “borlabs-cookie” is stored on your device. This cookie contains information about the time of your consent, the selected consents (e.g., for certain services like YouTube or Google Analytics), a cookie version, the cookie’s runtime, and a randomly generated user ID without personal reference. As long as no consent is given, the tool automatically blocks the loading of external content. Only when you make a selection will the respectively approved content be loaded—without the page needing to reload.

5. Legal Basis

Art. 6(1) sentence 1 lit. c) GDPR; Art. 6(1) sentence 1 lit. f) GDPR; § 25(2) No. 2 TDDDG

6. Storage Duration

Your consent and settings are stored in the cookie and are automatically deleted after 12 months. If you delete the cookie yourself or withdraw your consent, the data is also deleted.

7. Recipient

Borlabs Cookie is operated by Borlabs GmbH, Hamburger Str. 11, 22083 Hamburg. Further information: https://de.borlabs.io/datenschutz/.

8. Objection

You may have a right to object to the processing. The statements on the right to object in the section on data subject rights apply.

IV. jsDelivr (Content Delivery Network)

1. Purposes of Processing

We use the Content Delivery Network (CDN) jsDelivr for the fast and secure provision of JavaScript libraries, CSS files, and other web resources.

By using the CDN, the website’s loading speed is improved, failure risks are reduced, and user-friendliness is increased.

2. Data Affected

When using the CDN, the following data is technically transmitted to jsDelivr’s servers:

• IP address of the accessing end device
• Browser type and version
• Operating system and device type
• Accessed resource (e.g., file URL)
• Time and duration of access
• Referrer URL (the previously visited page)

This data is necessary to establish the connection between your browser and the CDN server.

3. Data Subjects

Visitors to our website whose end device requests content (e.g., scripts, stylesheets) via jsDelivr when loading the page.

4. Type of Processing

When you access our website, your browser automatically loads the required files from the CDN’s servers.

A connection is established to servers of jsDelivr / ProspectOne to deliver the corresponding content.

The CDN uses a worldwide server network (Anycast), whereby requests are generally processed via geographically close servers.

Communication is encrypted (HTTPS).

jsDelivr is an open-source CDN service operated via various infrastructure partners (including Cloudflare, Fastly, and Quantil).

Data processing occurs exclusively for the technical operation of the CDN and not for analysis or marketing purposes.

5. Legal Basis

Art. 6(1) sentence 1 lit. f) GDPR: legitimate interest in a technically secure, high-performance, and efficient provision of our website.

6. Storage Duration

jsDelivr itself does not store personal data permanently.

Log files on the CDN’s servers contain IP addresses and are automatically deleted at short intervals according to the operator (usually within 7 days).

Longer-term storage only takes place in aggregated, anonymized form to ensure system stability.

7. Recipient

Volentio JSD Limited, Suite 2a1, Northside House, Mount Pleasant, Barnet, England, EN4 9EB. (Operator of jsDelivr.net)

Further information can be found at: https://www.jsdelivr.com/privacy-policy-jsdelivr-net

8. Basis for Third-Country Transfers

According to jsDelivr, data is distributed via a global network that also uses servers outside the EU (e.g., in the USA or Asia).

A data transfer to third countries can therefore not be excluded.

Where necessary, the transfer is based on Standard Contractual Clauses according to Art. 46(2) lit. c) GDPR.

9. Objection

You may have a right to object to the processing. The statements on the right to object in the section on data subject rights apply.

The functionality of the website may be impaired if deactivated.

C. Embedded Content, Social Media

I. Social Media

1. General (Social Media)

a. Purposes of Processing

We use social media to open communication channels, promote our products and our brands, and to draw attention to ourselves as an employer and interest potential employees in us.

b. Data Affected

Visitors can read which data is collected when visiting our social media presences from the respective social media providers. This usually includes the IP address and data stored in cookies. This may allow their user behavior to be analyzed, which may provide information about interests. In this context, access times, in particular, may be recorded.

c. Data Subjects

Visitors to our social media presences are affected.

d. Type of Processing

All these services have in common that they collect data about visitors to their websites and store it in the form of profiles. Via their IP address and the cookies set, the social media provider can associate this information with their devices.

If users log in to their social media accounts before visiting a website, accessing the page may be associated with them personally.

The profiles created are used for advertising and market research purposes. Users may be shown advertising on and off the social media platforms that is assigned to their interests.

If you do not want the respective social media providers to collect data about you, please do not visit the websites. You may be able to restrict data collection through settings in your browser. You may be able to change the data processing in your user account with the respective social media provider.

Please note that the use of the respective social network is fundamentally subject to the terms of use and data protection conditions of that company, over which we have no influence.

e. Legal Basis

The legal basis for the processing is our legitimate interests, which arise from the purposes, according to Art. 6(1) sentence 1 lit. f) GDPR.

f. Data Subject Rights

It is recommended to direct your inquiries and rights as a data subject directly to the social media providers. This is particularly effective as they possess the relevant data and can take appropriate measures.

2. Social-Media-Icons

The connection to social media such as Instagram, Facebook, Xing, or LinkedIn on our website may only be via links. If you click on the corresponding symbols, you leave our website and are taken to the respective social media provider.

3. Facebook-Fanpage

You can also find us on Facebook: We use the Facebook Fanpage https://www.facebook.com/egeplastinternational/.

a. Data Affected

When you visit our Facebook presence, Facebook collects data about the types of content users interact with or view, as well as their activities (see “Things you and others do and provide” in Facebook’s Data Policy: https://www.facebook.com/policy). Furthermore, information about users’ devices, such as IP addresses, operating systems, browser type, language settings, and cookies, is collected (can be read under “Device Information” in Facebook’s Data Policy).

b. Type of Processing

Together with Meta Platforms Ireland Limited, we are joint controllers for the collection (but not for the further processing) of data from visitors to our Facebook page, known as “Fanpage”. According to Facebook’s Data Policy in the section “How do we use this information?”, Facebook collects and uses the data to provide analysis tools, known as “Page Insights,” to page operators. These tools allow operators to understand how users interact with their pages and the associated content. A special agreement with Facebook (“Information about Page Insights,” https://www.facebook.com/legal/terms/page_controller_addendum) specifies which security measures Facebook must take and ensures that data subject rights are upheld (i.e., users can, for example, make requests for access or erasure directly to Facebook). These agreements do not restrict user rights (including access, erasure, objection, and complaint to a supervisory authority). Details on this can be found in the “Information about Page Insights” (https://www.facebook.com/legal/terms/information_about_page_insights_data). The joint responsibility is limited to data collection and transmission to Meta Platforms Ireland Limited, based in the EU. Meta Platforms Ireland Limited is solely responsible for further data processing, including data transfer to the parent company Meta Platforms, Inc. in the USA.

Through Page Insights, we only receive anonymized statistics with no personal reference.

If you post contributions, leave comments, like or share posts, or otherwise interact with other users on our Fanpage, this can be seen by other users. We have no influence on how other users handle this information. In particular, we cannot prevent you from being contacted unwantedly by other users.

c. Duration of Storage

If you visit our Facebook presence without your visit being associated with your Facebook user profile, Facebook stores your IP address for 90 days.

Which data Facebook stores about you as a registered Facebook user and how long this data is retained by Facebook is determined by the terms of use you have agreed to with Facebook.

d. Recipient

The operator of Facebook is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. The Data Policy can be found at: https://www.facebook.com/about/privacy.

e. Basis for Third-Country Transfers

EU-US – Data Privacy Framework (DPF); Switzerland: Adequacy decision for Ireland; Standard Contractual Clauses ( https://www.facebook.com/legal/EU_data_transfer_addendum)

4. Instagram

You can find our web presences on Instagram at:

• https://www.instagram.com/egeplast_international/
• https://www.instagram.com/egeplast_karriere/

a. Data Affected

Meta collects data about user interactions with public content, such as pages, videos, and spaces on Instagram, including browser and app usage logs. This data collection also includes basic information about the devices from which Meta-affiliated apps are downloaded, such as the device model and operating system.

Additionally, through the use of cookies and similar technologies, like the Meta Pixel or social media plugins, Meta learns about user activities on other websites and in apps that use Meta’s business tools or other Meta products.

b. Type of Processing

With the individual user code, Meta is able to connect to the information of users who are registered with the platform operators.

We use Instagram Insights to analyze and gather statistics on our Instagram posts. This serves to evaluate interactions on our profile.

c. Duration of Storage

If you visit our Instagram presence without your visit being associated with your Instagram user profile, Instagram stores your IP address for 90 days.

Which data Instagram stores about you as a registered Instagram user and how long this data is retained by Instagram is determined by the terms of use you have agreed to with Instagram.

d. Recipient

Instagram is operated by: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. The Data Policy can be found at: https://instagram.com/about/legal/privacy

e. Basis for Third-Country Transfers

EU-US – Data Privacy Framework (DPF); Switzerland: Adequacy decision for Ireland;

Standard Contractual Clauses ( https://www.facebook.com/legal/EU_data_transfer_addendum)

5. LinkedIn

You can also find us on LinkedIn: https://de.linkedin.com/company/egeplast-international-gmbh.

a. Data Affected

During a visit to our page, techniques such as cookies and pixels are used, which are utilized by the platform operators to generate a unique code for each user.

b. Type of Processing

The generated unique user code enables a link to the data of users who are registered with the platform providers.

We use LinkedIn Page Analytics to manage our LinkedIn profile. This allows us to gain insights into the interaction with our posts.

c. Duration of Storage

LinkedIn stores personal data for as long as it is needed to provide its services or the user account is active. This includes information provided either directly by users or by third parties, as well as data generated from the use of the services. User profiles remain active even if the services are only used occasionally, for example, for job searching every few years, unless the user decides to close their account. Furthermore, LinkedIn reserves the right to store certain data, such as analyses of service usage, in anonymized or aggregated form.

d. Recipient

LinkedIn Ireland Unlimited Company Wilton Place, Dublin 2, Ireland: https://www.linkedin.com; The privacy policy can be found here: https://www.linkedin.com/legal/privacy-policy

e. Basis for Third-Country Transfers

EU-US – Data Privacy Framework (DPF); Switzerland: Adequacy decision for Ireland;

f. Right to Object

At https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out you can object to tracking for advertising purposes (Opt-Out).

If you are not a member of LinkedIn, you can object to the tracking of your visits on LinkedIn by LinkedIn and its service providers for advertising purposes on the page https://www.linkedin.com/psettings/guest-controls . This objection is linked to cookies. This means it is browser-specific and is undone by deleting or blocking cookies.

Please note that the setting for non-members is not intended for use by members and only applies to www.linkedin.com, and only when you are logged out of LinkedIn.

At https://de.linkedin.com/legal/l/dpa? you will find LinkedIn’s data processing agreement for the transfer of European data (Standard Contractual Clauses).

6. YouTube

a. Purposes of Processing

Embedding of YouTube videos including thumbnails to provide audiovisual content directly on our website.

You can view the thumbnail and only play the video after your consent and a click.

b. Data Affected

IP address, device and browser information, referrer URL, date and time, visited subpage, and playback interactions such as play or pause. When loading the thumbnail, the URL of the image is also processed.

c. Data Subjects

Visitors who actively consent via the consent banner or click on the thumbnail.

Without consent, no data exchange with Google occurs.

d. Type of Processing

After your consent, your browser first loads a static thumbnail from ytimg.com.

Only after another click is the video reloaded via an iFrame from youtube-nocookie.com; Google may set cookies in this process to collect video statistics, improve user-friendliness, and prevent abusive actions.

e. Legal Basis

Consent according to Art. 6(1) sentence 1 lit. a) GDPR for loading the thumbnail, video, and for setting cookies or similar technologies.

f. Storage Duration

We do not store any personal data.

Cookies set by Google can have a runtime of up to 24 months; the specific duration is determined by Google.

g. Recipient

Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. You can learn more about YouTube here: https://www.youtube.com; YouTube’s privacy notice can be found here: https://policies.google.com/privacy.

h. Basis for Third-Country Transfers

EU-US – Data Privacy Framework (DPF); Switzerland: Adequacy decision for Ireland

i. Right to Withdraw Consent

You can withdraw your consent directly from Google or by deactivating YouTube in our consent manager.

7. Xing

You can find our web presence on Xing at https://www.xing.com/pages/egeplastinternationalgmbh.

a. Data Affected

When visiting our Xing page, Xing performs tracking. During tracking, Xing collects data such as visit times, the origin page, IP address, cookie identifiers, location data, as well as information about the browser or device, such as the visitor’s product and version number. Xing also collects data on interaction on the platform, such as pages viewed, search queries, and changes in applications.

Using technologies like cookies, pixels, local storage, and other similar methods, Xing collects data from logged-in users and visitors to provide its services and analyze user behavior. This also serves to optimize its advertising measures.

To identify users during their visit to XING, Xing uses session cookies, which are automatically deleted after the session. These cookies are necessary for the use of XING. If users select the option to stay logged in during login, a cookie is stored that makes re-logging in unnecessary. Additionally, Xing performs a rough geographical localization at the city level, based on a shortened and anonymized IP address and the user’s geocoordinates, provided they have allowed this on their device. No precise locations or geocoordinates are stored, only the cities where the user regularly stays.

b. Storage Duration

Xing stores the data in connection with the visit to our Xing page for 12 months. Data associated with a user account at Xing is stored until the account is deleted.

c. Recipient

The provider is XING AG, Dammtorstraße 29-32, 20354 Hamburg, Germany.

Further information on data protection and the processing of personal data when using Xing can be found at https://privacy.xing.com/de/datenschutzerklaerung and in more detail: https://privacy.xing.com/de/datenschutzerklaerung/druckversion.

II. Yumpu

The website uses Yumpu services to display egeNews. The provider is i-magazine AG, Gewerbestrasse 3, 9444 Diepoldsau, Switzerland.

If you use an egeNews page, a connection to Yumpu’s servers may be established. This occurs after your consent, either by clicking a button on the respective page or through a cookie you accept.

During the session, the Yumpu server is informed which of our pages you have visited. When you access online magazines on our website, a connection is established to Yumpu’s servers in Switzerland. Accessing the online magazines requires Yumpu to perceive the user’s IP address, as without the IP address, the content generally cannot be sent to your browser.

You can find further information on Yumpu in the privacy policy of i-magazine AG: https://www.yumpu.com/de/info/privacy_policy

III. Reader Puzzle

As part of our reader puzzle in our customer magazine egeNews, we collect the data you enter for the competition. If you submit the competition entry by email, we collect your email address; if submitted by fax, your fax number. The data collection serves to determine the winners and notify them. It is based on Art. 6(1) sentence 1 lit. b) GDPR. We do not pass on your data. Your data is not stored and will be destroyed within 3 months after the competition is held. You are not obliged to provide information. However, if you do not provide your name and address, we cannot send you the prize.

D. Analysis, Advertising, Marketing

I. Google Analytics

1. Purposes of Processing

We use Google Analytics for reach measurement. This allows us to evaluate which content and functions of our website are accessed how often, at what time, and for how long, and whether visitors to our website have visited our website repeatedly. Based on this information, we recognize which areas of our website need to be adapted.

We can also create multiple versions of our website and evaluate via Google Analytics which version our visitors prefer.

We also use Google Analytics for remarketing. This means that visitors are shown advertising for our products on external websites after they have visited our page. We also advertise to other people who belong to the same target group as our visitors. For this, the surfing behavior of our visitors is assigned to a target group.

2. Data Affected

The following information may be collected: when and how which of our web pages were accessed and used, visitor interests, age, gender, and other demographic information in pseudonymous form, and which browser or operating system was used. If consent for collection was given, information on location may also be processed.

The IP address is shortened and thus used pseudonymously.

3. Data Subjects

All persons who access our website and activate the use of Google Analytics in the consent banner are affected.

4. Type of Processing

Google can create profiles from the listed data. For this purpose, information may also be stored in the visitor’s browser or otherwise on their device and retrieved again.

Via the visitors’ consent within the framework of the consent banner we use, we document, on the one hand, that we comply with our data protection obligations, and on the other hand, we pass the consent on to Google, as Google must obtain consent under the Digital Markets Act.

5. Legal Basis

Consent according to Art. 6(1) sentence 1 lit. a) GDPR

Legitimate interests according to Art. 6(1) sentence 1 lit. f) GDPR: Optimization of the website and its economic efficiency.

6. Storage Duration

We do not store any personal data in connection with the use of Google Analytics. Google Analytics cookies can be valid for up to 24 months; the specific duration is determined by Google. At https://policies.google.com/technologies/retention visitors can find out how long data is stored by Google itself.

7. Recipient

The data is collected and processed by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, based on the visitors’ consent. Google’s privacy notices can be found here: https://policies.google.com/privacy.

The data processing agreement with Google can be found here: https://business.safety.google/adsprocessorterms/

The transfer of data to the USA is based on the EU-US Data Privacy Framework (DPF) and Standard Contractual Clauses, which are available here: https://policies.google.com/privacy/frameworks

Via this plugin, visitors can generally deactivate Google Analytics in their browser: https://tools.google.com/dlpage/gaoptout?hl=de

8. Right to Object

The statements on the right to object in the section on data subject rights apply (see below).

9. Right to Withdraw Consent

You can withdraw your consent via the consent banner at any time with future effect.

II. Google AdSense for YouTube

1. Purposes of Processing

Our online offering uses Google AdSense for YouTube to display personalized and non-personalized advertising in embedded YouTube videos. The service allows us to play out ads and analyze their effectiveness for billing and optimization purposes.

2. Data Affected

In particular, the following are processed:

• IP address
• Device and browser information
• Referrer URL
• Usage and interaction data (e.g., clicks, viewing duration, playback times)
• Cookie IDs and advertising IDs
• Google account data (for logged-in users)

3. Data Subjects

Visitors to our website who access or play embedded YouTube videos.

4. Type of Processing

Google uses cookies and similar technologies to collect information about user behavior. This data is stored on Google servers, analyzed, and, if applicable, assigned to existing Google profiles to display personalized advertising.

For embedded YouTube videos, Google may link data with other Google services (e.g., Google Ads or Google Analytics). Further information on processing by Google can be found at https://policies.google.com/technologies/ads

5. Legal Basis

Processing is based on your consent according to Art. 6(1) sentence 1 lit. a) GDPR.

The setting of cookies or comparable technologies occurs according to § 25(1) TDDDG only with your consent.

6. Storage Duration

Cookies set by Google can remain stored for up to 13 months. Usage and profile data are deleted as soon as they are no longer required for advertising or analysis purposes or you withdraw your consent.

7. Recipient

Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland

Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA

Further information on the data protection provisions and processing conditions can be found at:

https://policies.google.com/privacy

8. Basis for Third-Country Transfers

A data transfer to the USA cannot be excluded. The basis is the EU-US Data Privacy Framework, for which Google LLC is certified.

In addition, Standard Contractual Clauses according to Art. 46(2) lit. c) GDPR are in place.

9. Right to Withdraw Consent

You can withdraw your consent at any time with future effect, e.g., via the consent banner used on our website or by deleting the set cookies in your browser.

III. Google Tag Manager

1. Purposes of Processing

We use the Google Tag Manager, a solution from Google, to manage website tags centrally via a user interface. The tags are small code elements on our website that serve to record and analyze various visitor activities. The use of this technology supports us in continuously optimizing the performance and offering of our website.

2. Data Affected

The use of Google Tag Manager results in your IP address being transmitted to Google. This is technically necessary to start other services integrated into our website.

3. Data Subjects

Visitors to our website are affected.

4. Type of Processing

Google Tag Manager itself does not create user profiles, set cookies, or conduct independent analyses. It allows us to integrate tools and services for our website in a simple and efficient way.

Nevertheless, when using Google Tag Manager, the users’ IP address is transmitted to Google, which is technically necessary to execute the various services we use. This data processing only occurs if services are integrated via the Tag Manager for which this integration is necessary. Further information on these services and their data processing can be found in the corresponding sections of our privacy notices.

5. Legal Basis

Consent (Art. 6(1) sentence 1 lit. a) GDPR)

6. Storage Duration

IP addresses are generally retained by Google for a period of up to 9 months.

7. Recipient

The recipient is Google Ireland Limited, Address: Gordon House, Barrow Street, Dublin 4, Ireland. Further information is available at: https://marketingplatform.google.com. Google’s privacy notices can be found at: https://policies.google.com/privacy; The data processing agreement can be viewed here: https://business.safety.google/adsprocessorterms.

8. Basis for Third-Country Transfers

EU-US – Data Privacy Framework (DPF); Switzerland: Adequacy decision for Ireland

9. Right to Withdraw Consent

The statements on the right to withdraw consent in the section on data subject rights apply (see below).

E. Download of Materials

I. Purposes of Processing

You can download various brochures and documents on our website if you register before the download.

The processing serves to track download requests, analyze interest in our products and services, and, if applicable, for contact by our sales team.

II. Data Affected

• First and last name
• Email address
• Company
• Address
• Telephone number
• Time of form submission

III. Data Subjects

Visitors to the website who wish to download documents from the website.

IV. Type of Processing

Collection and storage of the entered form data via a plugin in the website database.

The data is processed there for internal evaluation and optional contact.

V. Legal Basis

Art. 6(1) sentence 1 lit. b) GDPR, insofar as the download is related to the initiation or execution of a contract,

Art. 6(1) sentence 1 lit. f) GDPR, based on our legitimate interest in internal tracking and optimization of our information and product offering,

VI. Storage Duration

The registration data stored in the database is regularly reviewed and deleted as soon as the purpose of processing ceases to apply or you object to the processing, provided no statutory retention obligations conflict. Deletion occurs within 7 days after the visit to the website at the latest.

VII. Recipient

No disclosure to third parties takes place.

VIII. Right to Object

The statements on the right to object in the section on data subject rights apply (see below).

F. Communication & Newsletter

I. Contact Form

1. Purposes of Processing:

On our website, you will find the option to contact us via contact forms, e.g., to order information material or for availability inquiries for our training and conference rooms.

We use your information to answer your inquiry and to send you information about our products and offers by post.

The additionally collected metadata serves to prevent misuse of the contact form and to ensure the security of our information technology systems.

2. Data Affected:

The mandatory information is company, name, and email address. In the case of the online inquiry, your telephone number is also mandatory; for the request for info material, your address; and for the inquiry about the availability of our rooms, your address, desired room, and desired booking date are mandatory. Any other information you provide is voluntary.

With the submission, the following data (metadata) is also stored: Your IP address; Date and time of submission.

3. Data Subjects:

Persons who fill out contact forms on the website.

4. Type of Processing:

Only the fields marked as mandatory must be filled out for your inquiry so that we can answer it.

The data you enter in the forms is transmitted to us via SSL encryption and stored.

We then process your request and, if necessary, contact you, insofar as this is necessary to fulfill your request.

We use Microsoft 365 for the technical implementation of our email communication. Your email is stored on Microsoft’s servers in Germany.

5. Legal Basis:

The legal basis for processing the data you transmit is Art. 6(1) sentence 1 lit. f) GDPR, or, if your inquiry aims at concluding a contract, Art. 6(1) sentence 1 lit. b) GDPR.

The legitimate interest in storing your information lies in conducting direct advertising.

6. Storage Duration:

We store the personal data you provide for 3 years. If an order results from your inquiry, we store the communication and the related personal data for 10 years to comply with our tax-related documentation obligations. The metadata additionally collected during submission will be deleted after a period of 7 days at the latest.

Server-side, the messages from the contact forms are stored for 6 months.

7. Recipient:

Since our email communication takes place via Microsoft servers, your communication via the contact form also reaches the service provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland (https://microsoft.com/de-de). Privacy notice: https://privacy.microsoft.com/de-de/privacystatement, Security information from Microsoft: https://www.microsoft.com/de-de/trustcenter; Data Processing Addendum: https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA.

8. Basis for Third-Country Transfers

The legal basis for data processing in Ireland is, for Switzerland: Adequacy decision for Ireland.

9. Right to Withdraw Consent:

You can object to the storage of your personal data at any time under the conditions of Art. 21 GDPR. In such a case, your inquiry cannot be processed further. You can submit your objection, stating the mandatory information you provided (for verification of your authorization), by email to info@egeplast.de or via our inquiry form. In the event of your objection, we will no longer process the personal data, unless there are compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or for the establishment, exercise, or defense of legal claims.

II. Email Communication

Alternatively to using our contact forms, you can also write to us at the specified email addresses.

1. Purposes of Processing

The purpose of the processing is the handling of electronic communication with customers, business partners, interested parties, and other contact persons. This includes in particular:

• Answering inquiries,
• Initiation, execution, and documentation of contractual relationships,
• Internal and external business communication,
• Fulfillment of legal documentation and retention obligations,
• Ensuring IT and information security.

2. Data Affected

• Email addresses
• Content of the email including any attachments
• Communication metadata (time, IP address, server path, etc.)
• Signature and delivery information
• Other contact details (name, position, telephone number, organization)

3. Data Subjects

Persons who communicate with us by email or are contacted by us by email (e.g., customers, suppliers, service providers, employees, interested parties).

4. Type of Processing

Emails are received, stored, and sent via the Microsoft 365 Exchange Online platform.

Communication is encrypted by default (TLS). Access to mailboxes is only possible for authorized persons.

To ensure system integrity and detect abuse, Microsoft logs certain technical events (e.g., login attempts, delivery errors).

Backups and replications take place within Microsoft’s European data centers.

5. Legal Basis

Art. 6(1) sentence 1 lit. b) GDPR, if the communication serves the initiation or execution of a contract,

Art. 6(1) sentence 1 lit. c) GDPR, insofar as legal retention obligations exist,

Art. 6(1) sentence 1 lit. f) GDPR, based on our legitimate interest in efficient and secure electronic communication.

6. Storage Duration

Emails are archived according to the statutory retention periods:

• Business and tax-relevant correspondence: up to 10 years,
• Other correspondence: 3 years after completion of the matter,
• Technical log data: maximum 90 days.

After these periods, the data is deleted, provided no other legal obligations conflict.

7. Recipient

Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland (https://microsoft.com/de-de). Privacy notice: https://privacy.microsoft.com/de-de/privacystatement, Security information from Microsoft: https://www.microsoft.com/de-de/trustcenter; Data Processing Addendum: https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA.

8. Basis for Third-Country Transfers

The legal basis for data processing in Ireland is, for Switzerland: Adequacy decision for Ireland.

9. Right to Object

The statements on the right to object in the section on data subject rights apply (see below).

III. Newsletter

1. Purposes of Processing

On our website, users have the opportunity to subscribe to our newsletter.

We store a log of the newsletter registration to comply with our data protection accountability obligations and to be able to prove the registration.

2. Data Affected

To subscribe to our newsletter, providing the email address is necessary. Optionally, company, salutation, and name can also be provided for a personal address in the newsletter.

To fulfill our data protection accountability obligations, we store the IP address, the time of registration, and the time of clicking the link in the confirmation email that subscribers receive from us (metadata).

3. Data Subjects

Only persons who subscribe to or have subscribed to our newsletter are affected.

4. Type of Processing

After registering for the newsletter using the double opt-in process, subscribers receive our newsletter until they unsubscribe. The registration process is documented so that it can be proven that the newsletter was sent based on effectively granted consent.

5. Legal Basis

The legal basis for storing your personal data provided when registering for the newsletter is your consent according to Art. 6(1) sentence 1 lit. a) GDPR. The legal basis for storing the aforementioned metadata is Art. 6(1) sentence 1 lit. c) GDPR, as we are obliged to be able to provide proof of your consent to receive our newsletter.

6. Storage Duration

We store all personal data collected in connection with your newsletter registration until you cancel the newsletter / withdraw your consent to the processing of your personal data. We may store the aforementioned metadata and your email address for up to three years after canceling the newsletter, as proof of your original consent to receive newsletters. This data is processed exclusively for the possible defense against claims. You can request the immediate deletion of your data if you simultaneously confirm the original existence of consent.

7. Recipient

We pass your information on to our newsletter service provider CleverReach GmbH & Co. KG, Schafjückenweg 2, 26180 Rastede, Germany, whom we have entrusted with the technical implementation of our newsletter. You can find further information on data processing by our service provider in the corresponding section of this privacy notice.

(8) Right to Withdraw Consent

You can cancel the receipt of our newsletter at any time, or withdraw your consent to processing. The option to cancel is indicated in every newsletter, and cancellation can be done via a link contained in the email. You can find further information on objection in this privacy notice under “Right to Withdraw Consent”.

G. Appointment Booking

I. Online Appointment Booking via eTermin

1. Purposes of Processing

Provision of a convenient online appointment booking, management of appointment requests and their confirmation, as well as internal appointment organization and communication with interested parties and customers.

2. Data Affected

• Mandatory information: Name, email address, desired appointment (date and time)
• Optional information: Telephone number, message in the free text field, or other voluntary information
• Technical data: IP address, date and time of booking, browser and device data

3. Data Subjects

Persons who request or book appointments via the online appointment booking function integrated on our website.

4. Type of Processing

Data entry takes place via an embedded form from the eTermin service.

By submitting the appointment request, the entered data is stored on eTermin’s servers and transmitted to us for processing the appointment.

The data is used for appointment planning, confirmation, and, if necessary, for contacting in connection with the booking.

The use of eTermin is voluntary. Alternatively, appointments can also be made by telephone or email.

SSL-encrypted data transmission occurs when submitting via eTermin.

eTermin describes further technical and organizational security measures in its own data protection information.

5. Legal Basis

Art. 6(1) sentence 1 lit. b) GDPR, insofar as the processing serves the implementation of pre-contractual measures or the fulfillment of a contract,

Art. 6(1) sentence 1 lit. a) GDPR, for voluntary information or further consent (e.g., reminder functions or additional contact).

6. Storage Duration

The personal data is deleted as soon as the appointment is completed and no statutory retention obligations exist.

Data required for the processing or documentation of contractual relationships is retained for up to 10 years in accordance with commercial and tax law regulations.

7. Recipient

eTermin GmbH, Im Wiesengrund 8, 8304 Wallisellen, Switzerland (Website: https://www.etermin.net)

A contract for data processing according to Art. 28 GDPR exists with the provider. Further information can be found in eTermin’s privacy notice: https://www.etermin.net/online-terminbuchung-datenschutz

8. Basis for Third-Country Transfers

Switzerland has an adequacy decision according to Art. 45 GDPR, which ensures a level of data protection corresponding to that of the EU.

No further third-country transfer takes place.

9. Right to Withdraw Consent

Insofar as processing is based on your consent according to Art. 6(1) sentence 1 lit. a) GDPR, you can withdraw this at any time with future effect.

The withdrawal can be made, e.g., by email to us or via the contact details in the appointment confirmation.

H. Application Procedure

You have the opportunity to apply to our company. For your application, you can use our application portal concludis, Auenweg 3, 50679 Cologne, Germany, an email, or a postal application. Regardless of the transmission method, we process your data as described below. The processing is necessary to carry out the selection process; without the information, we cannot consider your application.

I. General (Application Procedure)

The information under this heading applies unless deviations arise regarding specific application types.

1. Purposes of Processing

We use the data you provide exclusively for filling positions within our company. It will not be passed on to third parties without your express consent.

2. Type of Processing

Your application is reviewed internally; if necessary, we ask follow-up questions and invite you to interviews. This may result in interview notes that support our decision. If hired, we place the documents in your personnel file; if rejected, we retain them until the deadline mentioned below and then delete them securely.

3. Legal Basis

The legal basis for processing your application is Art. 88(1) GDPR in conjunction with § 26(8) sentence 2, 1st case, (1) sentence 1 BDSG (German Federal Data Protection Act).

In the case of your consent to further storage after a possible rejection, the legal basis is Art. 6(1) sentence 1 lit. a) GDPR.

4. Storage Duration

Your personal data will be deleted six months after the completion of the application process. This does not apply if legal provisions prevent deletion, further storage is necessary for evidentiary purposes, or you have expressly agreed to longer storage.

If we cannot offer you a currently vacant position, but believe, based on your profile, that your application might be interesting for future job openings, we will store your personal application data for twelve months – provided you consent to this.

5. Right to Withdraw Consent

If you consent to the further storage of your application after a rejection, you can withdraw your consent at any time with future effect. After withdrawal, the personal data will no longer be processed for the purposes stated in the declaration of consent. The application can then no longer be processed.

6. Right to Object

The statements on the right to object in the section on data subject rights apply (see below).

II. Online Application (Concludis)

1. Purposes of Processing

We use the applicant portal from concludis for online applications.

2. Data Affected

If you use our online application form, the following personal data is collected:

• Salutation, First name, Last name, Address, Postal code, City, Email address,
• Tabular CV, school and work references, other proof of activity,
• Optional: Telephone number, personal cover letter, voluntary information in the free text field.

3. Data Subjects

Persons who use our online application are affected.

4. Type of Processing

In addition to hosting, concludis also handles service and maintenance of the applicant management software. As part of the service, telephone support in handling the software is also provided. In this context, it may happen that employees of concludis GmbH have access to applicant data. A contract for data processing has been concluded with concludis, which also includes the confidential handling of applicant data.

Your CV is automatically processed by the parsing tool from Textkernel BV.

Before you submit your online application, you will receive access to more detailed information about the processing of your application in connection with the service provider concludis.

Alternatively, you can also apply by email.

If we cannot offer you a currently vacant position, but believe, based on your profile, that your application might be interesting for future job openings, we will store your personal application data for twelve months – provided you consent to this.

Regarding further information on the application procedure, reference is made to the section General (Application Procedure).

5. Recipient

We use an applicant portal from concludis GmbH, Frankfurter Str. 561, 51145 Cologne. The applicant portal is hosted on servers of Hetzner Online GmbH, Industriestr. 25 in 91710 Gunzenhausen. Your CV is automatically processed by the parsing tool from Textkernel BV. The parsing takes place on a server in Germany. Your data is deleted from Textkernel BV after the parsing process.

III. Email Application

1. Data Affected

All personal data that you send us by email.

2. Data Subjects

Applicants who apply by email.

IV. Postal Application

1. Data Affected

All personal data that you send us by post.

2. Data Subjects

Applicants who apply by post.

I. Web Calculator

With the egeplast Web Calculator (https://Webkalkulator.egeplast.de/), we offer you a web-based tool on our website with which you can make cost comparisons between different methods for new installation and renewal of pipelines. To use these services, it is necessary for you to register as a user.

In this context, we collect the following data from you: Company, First name, Last name, Street / House number, Postal code / City, Telephone, and Email address. As voluntary information, you can provide your department and your country.

To comply with our data protection obligation to be able to prove your registration, your registration for the Web Calculator is logged. For this purpose, we store your IP address, the time of your registration, and your clicking of the link in the confirmation email you receive from us (metadata).

We use your data to inform you by post and telephone about products and offers from egeplast international and to contact you for this purpose. In return, you can use our planning tools free of charge. Furthermore, we collect the mentioned personal data to prevent the misuse of our tools.

You can unsubscribe from the Web Calculator at any time. To do so, please send an email to info@egeplast.de. We may store the aforementioned metadata and your email address for up to 3 years after your unsubscription, as proof of your original registration for our online services.

In connection with postal mailings, we pass on the information required for postal delivery (name, address) to a service provider (lettershop). This provider uses the information to process the transaction, in particular, enveloping and shipping.

For the technical implementation of our Web Calculator service, we use Microsoft Azure. Microsoft Azure is a service of Microsoft Corporation, One Microsoft Way, Redmond, Washington 98052 USA, Telephone: (+1) 425-882-8080. The data you enter during registration, as well as your IP address, are transmitted to Microsoft. The transmission takes place within the framework of the European Commission’s standard data protection clauses.

Information about data processing by Microsoft can be found at https://privacy.microsoft.com/de-de/data-privacy-notice.

The legal basis for processing the personal data you provide is Art. 6(1) sentence 1 lit. f) GDPR. The legitimate interest in using the data lies in providing direct marketing. The legitimate interest in using Microsoft Azure is efficient user administration.

You can object to the use of your personal data if necessary. Further information on objection can be found in this privacy notice under ‘Right to Object’.

J. Rights, Contact Details

I. Data Subject Rights

Please direct the assertion of your data subject rights in writing to our Data Protection Officer. (Contact details see below)

Should you make use of your data subject rights, we will store your request and the response to it in order to comply with our accountability obligations.

The legal basis for processing your data in the event of a data subject rights request is based on Art. 5(2) GDPR in conjunction with Art. 6(1) sentence 1 lit. f) GDPR. Your request and our response will be stored for a period of 3 years.

1. Right to Information (Access)

You can request information according to Art. 15 GDPR about your personal data that we process.

2. Right to Rectification

Should the information concerning you not (or no longer) be correct, you can request rectification according to Art. 16 GDPR. Should your data be incomplete, you can request completion.

3. Right to Erasure

You can request the erasure of your personal data according to Art. 17 GDPR.

4. Right to Restriction of Processing

You have the right according to Art. 18 GDPR to request a restriction of the processing of your personal data.

5. Right to Object

According to Art. 21(1) GDPR, you have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data which is based on Art. 6(1) sentence 1 lit. f) GDPR. The controller will then no longer process the personal data unless they can demonstrate compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject, or the processing serves the establishment, exercise, or defense of legal claims. The collection of data for the provision of the website and the storage of log files are mandatory for the operation of the website.

6. Right to Lodge a Complaint

If you are of the opinion that the processing of your personal data violates data protection law, you have the right according to Art. 77(1) GDPR to lodge a complaint with a data protection supervisory authority of your choice. This also includes the data protection supervisory authority responsible for the controller: State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia, https://www.ldi.nrw.de/kontakt/ihre-beschwerde.

7. Right to Withdraw Consent

Consent for data processing based on consent (Art. 6(1) sentence 1 lit. a) GDPR) can be withdrawn at any time with future effect via the data protection symbol displayed on our website. To do this, the respective checkmark must be removed or the switch set to inactive.

II. Contact Details Controller

egeplast international GmbH

Robert-Bosch-Straße 7 D-48268 Greven

Tel. +49 – (0)2575 – 9710-0 Fax +49 – (0)2575 – 9710-110 E-Mail: info@egeplast.de

III. Contact Details Data Protection Officer

Assessor Jur. Paul Zacheus KATLEX Datenschutz-Management a brand of ncc guttermann GmbH

Wolbecker Windmühle 55 48167 Münster

Telephone: +49 2506 9320 600 datenschutz.egeplast@katlex.de www.katlex.de

IV. Change of Provisions

We reserve the right to change the privacy notice. A change to the privacy notice may occur for technical as well as data protection reasons. We, therefore, ask you to note the current version.

As of 10/2025