Privacy Statement

Status: June 2024

We take the protection of your data very seriously at YT. We treat your personal data confidentially and in accordance with the European Union's General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). In this privacy policy, we inform you about the processing of your personal data when you use our website and how we handle your data with regard to marketing measures and when you purchase our products.

1. WHO IS RESPONSIBLE FOR THE PROCESSING OF MY DATA?

The controller responsible for data processing is

YT Industries GmbH
Pilatus Campus 9
91353 Hausen
Phone: +49 9191 736 305-0

E-Mail: service@yt-industries.com

(hereinafter also "YT", "we", "us")

For further questions about data protection and the processing of your personal data in connection with our website and our services, you can contact our data protection officer at any time by post at the above address, for the attention of the data protection officer, and by e-mail to: dataprivacy@yt-industries.com .

2. WHAT DO WE USE YOUR DATA FOR (PURPOSE OF PROCESSING) AND WHAT IS THE LEGAL BASIS FOR PROCESSING?

2.1 Fulfilment of contractual obligations pursuant to Art. 6 para. 1 lit. b) GDPR

The primary purpose of data processing is to establish, implement and terminate the joint business relationship. This includes in particular:

Processing of your order
Processing of your service requests
Processing of inquiries about products

2.2 Consent pursuant to Art. 6 para. 1 lit. a) GDPR

In addition, your separate consents may be used as a legal basis for certain purposes, in particular:

Newsletter subscription
Receipt of targeted information and offers
Personalized use of the website

You can revoke your consent at any time with effect for the future.

2.3 Safeguarding our legitimate interests in accordance with Art. 6 para. 1 lit. f) GDPR

Where necessary, we also process your data to protect our legitimate interests.

These include in particular:

Monitoring, optimisation and further development of services and products
to prevent, investigate and prosecute criminal offences such as fraud, e.g. credit card or identity fraud
Credit checks Enforcement of legal claims and defence in the event of legal disputes
for auditing purposes
Ensuring the security and operability of our IT systems
the purposes of direct marketing
Shopping basket cancellation mails

2.4 Legal obligations pursuant to Art. 6 para. 1 lit. c) GDPR

We are subject to various legal obligations, in particular:

Retention obligations under commercial and tax law

3. WHEN DO WE COLLECT DATA ABOUT YOU?

3.1 Calling up the website

Each time you use our website, we collect technical access data in so-called server log files, which your browser automatically transmits to ensure the technical functionality of our website. The access data includes in particular:

IP address of the requesting device,
Browser type, browser version and operating system,
Online identifiers (e.g. device identifiers),
the name of the requested file,
Date and time of retrieval,
amount of data transferred,
Requesting provider

Data processing is carried out on the legal basis of Art. 6 para. 1 lit. f) GDPR. Our legitimate interest lies exclusively in ensuring the trouble-free operation of the website, guaranteeing the security of our systems and analysing them to improve our offering. The information stored in the log files does not allow any direct conclusions to be drawn about your person. Further personal data is only collected if you provide this information voluntarily, for example when making an enquiry or registering or via your browser settings.

3.2 Purchase in the online shop

You have the option of registering with a customer account on our website and ordering our products.

a) Registration of a customer account

For every customer who registers accordingly, we set up password-protected access to their existing data stored with us (customer account). Here you can view your order history and the status of your order, customise it for your order depending on the payment method (prepayment or credit card) and enter and change your contact details.

For the purpose of registration and in order to provide you with the functions of the account (e.g. login authentication, verification of authorisation for account management, contact regarding notices, updates, security messages, ensuring the technical functionality of the site), the following mandatory information is collected in addition to optional information when the customer account is created:

Master data (title, surname, first name)
Communication data (e-mail address, telephone number)
Private or corporate customer status
Address data (street, house no., postcode, city, country)
Access data (password)
Time and date of registration
IP address
VAT ID no., country codes, company name (for corporate customers)

The legal basis for the processing of your data is Art. 6 para. 1 lit. b) GDPR.

b) Order

For the purpose of order processing, the following data is collected and processed from you in addition to details of the product ordered:

Name
First name
Salutation
Billing and delivery address
E-mail address
Telephone number
Customer number
Payment data

The legal basis for data processing in the context of a purchase or purchase initiation via your customer account is Art. 6 para. 1 b) GDPR. This means that we use your data for pre-contractual measures, such as providing advice about our products and processing the purchase contracts concluded between us. In addition, we also use your personal data to assert rights arising from the purchase contracts concluded or initiated with you.

c) Payment

As part of the payment process in our online shop, we collect certain personal data from you, depending on the payment method selected, in order to process the payment transaction via one of the following payment service providers. The payment information is processed as part of the payment process in order to carry out the payment method you have selected and to process the online order. The legal basis for the transfer of your data to external payment service providers is your consent in accordance with Art. 6 para. 1 lit. a) GDPR and for the fulfilment of the contract in accordance with Art. 6 para. 1 lit. b) GDPR.

The data will be stored for as long as is necessary for the processing of the purchase, unless there are retention periods under commercial or tax law.

(1) Payment processing (via Adyen)

We offer various payment options, such as payment by credit card, PayPal, Klarna, e-wallet (such as Google Pay, Apple Pay, Mobile Pay and Twint), Oney and Sofortüberweisung . We use Adyen N.V., Simon Carmiggeltstraat 6-50, 1011 DJ Amsterdam, the Netherlands ("Adyen") to process payment transactions. For this purpose, the contact and payment data required for the respective payment method are transmitted to Adyen. The transfer takes place in order to receive the payments on our behalf and to take care of everything related to the financial transaction. The legal basis for the processing is Art. 6 para. 1 sentence 1 lit. b) GDPR. Further information can be found in Adyen's privacy policy Information on data processing by Adyen can be found in the privacy policy https://www.adyen.com/privacy-policy including their contact information.

In view of the fact that Adyen acts as an intermediary between commercial providers of payment platforms and customers, the respective privacy policy of the selected payment method must also be observed:

PayPal: https://www.paypal.com/de/webapps/mpp/ua/privacy-full
Klarna: https://www.klarna.com/de/datenschutz/ Please note that if an address and credit check is required during the order process and checkout, your personal data will be forwarded to Klarna for this purpose.The legal basis for this processing is Art. 6 para. 1 sentence 1 lit. f) GDPR.
Google Pay: https://support.google.com/googlepay/topic/11450788?hl=en&sjid=8287724881126793928-EU
Apple Pay: https://support.apple.com/de-de/101554
Mobile Pay (only for Finland and Denmark): https://mobilepay.dk/app/legal/privacy-notice/en
Twint (only for Switzerland): https://www.twint.ch/en/data-privacy/
Oney (only for France): https://www.oney.com/en/personal-data-and-recruitment/

(2) Prepayment

After submitting your order and deciding to pay in advance, you will receive a confirmation email. In this e-mail you will be informed of the data required for the transfer, such as invoice amount, order number and bank details. When making the transfer, please state the exact purpose of the transfer, which will be shown in the e-mail.

(3) Financing (only for Germany)

You can also use financing from our financing partner Consors Finanz BNP Paribas S.A. Niederlassung Deutschland (hereinafter referred to as Consors) to pay for our products. After you have been redirected to the Consors website, we transmit the following data from the billing address to Consors: first name, surname, address, invoice amount. As part of the financing approval process, Consors collects further data about you on its own responsibility and carries out a credit check on its own responsibility in order to avoid and minimise late payments, bad debts and corresponding risks. We receive information from Consors as to whether the financing has been approved or rejected. Further information on data protection at Consors can be found here https://www.consorsfinanz.de/datenschutz#-websiteand in the respective financing conditions.

(4) Leasing

We work with the following leasing partners at YT, which are available to you as a customer as a payment method in the checkout.

aa) JobRad (only for Germany)

If you decide in favour of a leasing offer from JobRad Leasing, your personal data (name, address, contact details, payment information) will be forwarded to the provider JobRad GmbH, Heinrich-von-Stephan-Str. 13, 79100 Freiburg ("JobRad"). JobRad may carry out a credit check. We have no influence on the data processing at JobRad. The processing of your data is based on your consent in accordance with Art. 6 para. 1 sentence 1 lit. a) GDPR and is necessary for the fulfilment of the contract. Further information on JobRad's data protection provisions can be found at the following link: https://www.jobrad.org/datenschutz/jobrad-eng.

bb) Bikeleasing (only for Germany)

In the case of a leasing offer from Bikeleasing Leasing, your personal data will be forwarded to the provider Bikeleasing-Service GmbH & Co KG, Ernst-Reuter-Straße 2, 37170 Uslar ("Bikeleasing"). The processing of your data is based on your consent in accordance with Art. 6 para. 1 sentence 1 lit. a) GDPR. Please note that the processing of the data is also necessary for the fulfilment of the contract. You can find more information about Bikeleasing's privacy policy at: https://bikeleasing.de/en/data-privacy-notice

cc) German service bike (only for Germany)

In the case of a leasing offer from Deutsche Dienstrad, your personal data will be forwarded to the provider DD Deutsche Dienstrad GmbH, Sven-Wingquist-Str. 2, 97424 Schweinfurt ("Deutsche Dienstrad"). The processing of your data is based on your consent in accordance with Art. 6 para. 1 sentence 1 lit. a) GDPR. Please note that the processing of the data is also necessary for the fulfilment of the contract. You can find more information about Deutsche Dienstrad's privacy policy at: https://www.deutsche-dienstrad.de/datenschutzerklaerung/.

d) Transport service provider

We use transport service providers to dispatch the goods and transmit your contact details (name, address) to them. If necessary, we also transmit your e-mail address and telephone number to the transport service providers commissioned by us so that they can contact you in advance of the delivery and coordinate the details of the delivery.

The transfer is necessary for the fulfilment of our contractual obligations with you. The legal basis is therefore Art. 6 para. 1 lit. b) GDPR.

3.3 Contact , Services

You have various options for getting in touch with us. These include various contact forms and contacting us by e-mail. In this context, we process your data exclusively for the purpose of communicating with you. In the context of communication with interested parties, the legal basis is our legitimate interest in accordance with Art. 6 para. 1 lit. f) GDPR and if data processing is necessary for the implementation of pre-contractual measures or for the fulfilment of a contract, Art. 6 para. 1 lit. b) GDPR is relevant. In the context of service requests, we may forward your data to component manufacturers in pseudonymised form for service purposes.

The data collected by us when using the contact forms will be automatically deleted after your enquiry has been fully processed, unless we still need your enquiry to fulfil contractual or legal obligations.

We have integrated the following contact forms on our website:

Contact form
Service form (maintenance and repair)
Service form (Crash Replacement)
Guarantee form

Which mandatory data is collected in each case can be seen from the respective input forms. This includes in particular:

Title, surname, first name
E-mail address
address
Order number
Invoice data
Concerns
Photos or videos (damage to thebike)

3.4 Existing customer acquisition

If you have already purchased a product from us, we will record your registration and contact details in our database and list you as an existing customer. If you have provided us with your e-mail address as part of a registration, we will use it to send you advertising for our own or similar goods and services. The legal basis for this processing of your data is Art. 6 para. 1 lit. f) GDPR in conjunction with Section 7 para. 3 UWG, based on our interest in carrying out direct advertising to our existing customers.

You can object to data processing for the aforementioned purposes at any time, free of charge and with effect for the future. All you need to do is unsubscribe via the link in the respective email or send an email to the contact details above.

3.5 Newsletter

You have the option of subscribing to our newsletter, in which we inform you up to four times a month about offers and news from YT. The data collected can be seen from the registration form. To order our newsletter, we use the so-called double opt-in procedure, i.e. we will only send you the newsletter by e-mail if you confirm in our notification e-mail by clicking on a link that you are the owner of the e-mail address provided. If you confirm your e-mail address, we will store your e-mail address, the time of registration and the IP address used for registration until you unsubscribe from the newsletter. The sole purpose of this storage is to send you the newsletter and to be able to prove your registration.

The legal basis for the processing is your consent in accordance with Art. 6 para. 1 lit. a) GDPR.

We use the services of Salesforce to send newsletters. The provider is Salesforce Inc. Salesforce Tower, 415 Mission Street, 3rd Floor, San Francisco, CA 94105, United States.

We have concluded a so-called "Data Processing Agreement" with Salesforce, in which we oblige Salesforce to protect our customers' data and not to pass it on to third parties.

Salesforce is a service that can be used to organise and analyse the sending of newsletters, among other things. If you enter data for the purpose of subscribing to the newsletter (e.g. email address), this data is stored on Salesforce's servers in Germany.

With the help of Salesforce, we can analyse our newsletter campaigns. When you open an email sent with Salesforce, a file contained in the email (known as a web beacon) connects to the Salesforce servers in Germany. This makes it possible to determine whether a newsletter message has been opened and which links, if any, have been clicked on. Technical information is also collected (e.g. time of access, IP address, browser type and operating system). This information cannot be assigned to the respective newsletter recipient. It is used exclusively for the statistical analysis of newsletter campaigns. The results of these analyses can be used to better adapt future newsletters to the interests of the recipients and to understand the effectiveness of our advertising measures.

The legal basis for newsletter tracking is your consent (Art. 6 para. 1 lit. a) GDPR), which you give in connection with subscribing to the newsletter. You can revoke your consent to tracking at any time by unsubscribing from the newsletter.

3.9 Registration as a B2B customer In addition to the data requested in the registration process, the VAT identification number is checked. For this purpose, the following data will be transmitted for verification: VAT ID number, country codes, company name, postcode, city, street. The legal basis is Art. 6 para. 1 lit. b GDPR.You can unsubscribe from the newsletter at any time. A corresponding unsubscribe link can be found in every newsletter message. Alternatively, you can also send your unsubscribe request at any time to the contact details above. This will not incur any costs other than the transmission costs according to the basic tariffs of your internet service provider. You can also unsubscribe from the newsletter directly on the website.

The data you provide us with for the purpose of subscribing to the newsletter will be stored by us until you unsubscribe from the newsletter and deleted from both our servers and the Salesforce servers after you unsubscribe from the newsletter. Data stored by us for other purposes (e.g. email addresses for the member area) remain unaffected by this.You can read more about this in Salesforce's privacy policy: https://www.salesforce.com/eu/company/privacy/

3.6 Rolling Circus and YT Mill

We collect and process the data you provide to us when you register for the Rolling Circus event and in the YT Mill.

Specifically, we collect your data for the following purposes:

Processing the bike reservation
Communication in connection with the bike reservation
Handling of claims survey in connection with the use of the bike
Sending of our newsletter (after consent)

Which data is collected can be seen from the input form.

We use a bikerentalmanager booking system from the company Taste Provence Ltd (Europa House, Goldstone Villas, Hove, England, BN3 3RQ, United Kingdom) to process bike bookings. As part of the cooperation, we have concluded an order processing contract with the company in accordance with Art. 28 GDPR. The legal basis for the processing of your data in connection with the bicycle reservation is Art. 6 para. 1 lit. b) GDPR.

The legal basis for sending marketing information is your consent pursuant to Art. 6 para. 1 lit. a) GDPR. We store your data for as long as is necessary to process the loan and the associated services, or for as long as we have a legitimate interest in further storage or have received your consent.

During our events, photos and films are occasionally taken which may be used for publication in social media and press reports. The legal basis for the described data processing is generally our legitimate interests in accordance with Art. 6 para. 1 lit. f) GDPR or, in special cases, the consent of the participants in accordance with Art. 6 para. 1 lit. a) GDPR. We have a legitimate interest in photo and film recordings to inform the public about the event. You can object to data processing or withdraw your consent at any time. This and other information will be displayed in a visible place at each event.

3.7 Voucher campaigns

With us you can benefit from voucher offers. If you have rented and tested a bike at one of our events, you will receive a personalised voucher code for your next purchase from us by email. We process your data as part of the voucher redemption and merge the data with your personal data. The legal basis for this is your consent pursuant to Art. 6 para. 1 lit. a) GDPR and, in the case of existing customers, Art. 6 para. 1 lit. f) GDPR. We have a legitimate interest in sending existing customers personalised vouchers and discounts.

You can object to the processing of your data for advertising purposes or withdraw your consent at any time.

3.8 Customer Relationship Management System

We use a CRM system from salesforce.com Germany GmbH, Erika-Mann-Str. 31, 80636 Munich, Germany, to maintain and manage our customer data and to process your enquiries quickly and efficiently.

The legal basis for the processing of your personal data is Art. 6 para. 1 lit. b) GDPR in order to fulfil our obligation arising from the contractual relationship with you. In addition, we have a legitimate interest within the meaning of Art. 6 para. 1 lit. f) GDPR in the use of the system for the proper structuring of our customer data.

3.9 Registration as a B2B customer

In addition to the data requested in the registration process, the VAT identification number is checked. For this purpose, the following data will be transmitted for verification: VAT ID number, country codes, company name, postcode, city, street. The legal basis is Art. 6 para. 1 lit. b GDPR.

4. WHY DOES THIS WEBSITE USE COOKIES?

In order to make visiting our website attractive and to enable, protect and improve the use of certain functions, we use browser cookies, scripts, web beacons, tracking URLs, pixel tags and similar technologies (hereinafter "cookies") to provide, protect and improve our website and applications. Below we explain how our cookies work, what their purpose is, what kind of data they collect and how you can manage your cookie settings.

4.1 What are cookies and how do they work?

These are small text files that are stored on your end device. Some of the cookies we use are deleted again at the end of the browser session, i.e. after you close your browser (so-called session cookies). Other cookies remain on your device and enable us to recognise your browser on your next visit (persistent cookies). You can set your browser so that you are informed about the setting of cookies and decide individually whether to accept them or to exclude the acceptance of cookies for certain cases or in general. If you do not accept cookies, the functionality of our website may be limited.

Most web browsers (see Help function in the menu bar of your browser) can be set by you so that they do not accept new cookies, that you receive a message that a new cookie has been placed or that all cookies received are switched off. For smartphones, tablets and other mobile and stationary devices, you can find the necessary settings in the respective operating instructions.

However, we recommend that you leave the cookie functions switched on completely, as only with cookies is it possible to further improve our website for your needs. Our cookies do not store any sensitive data such as passwords, credit card details or similar. They do not cause any damage to your end device and do not contain any viruses.

When you visit our website for the first time, a pop-up window, the so-called Cookie Consent Manager, opens automatically. In this Consent Manager, you can select which category of cookies you would like to accept. You can change your selection at any time by clicking on the "Cookie settings" link at the bottom of the website.

4.2 Technically necessary cookies

Cookies that are required to manage the website and carry out the electronic communication process or to provide certain functions that you have requested (e.g. shopping basket function, language settings) are stored on the basis of Art. 6 para. 1 lit. f) GDPR. We have a legitimate interest in the storage of cookies for the technically error-free and optimised provision of our services. These cookies cannot be deactivated, but can be deleted if they are displayed to you.

4.3 Statistics and tracking cookies

If you have consented to the setting of comfort functions, statistics and tracking cookies, the collection, storage and evaluation of the cookies listed below is carried out on the basis of Art. 6 para. 1 lit. a) GDPR and § 25 para. 1 TDDDG, insofar as the consent includes the storage of cookies or access to information in the user's terminal device within the meaning of the TDDDG.

a) Google Tag Manager

On our website, we use Google Tag Manager (hereinafter referred to as "GTM"), a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

The Google Tag Manager is a tag management system that enables and simplifies the management and control of website tags via an interface. This means that the GTM only implements tags. Tags are small code elements such as tracking codes or conversion pixels from analysis tools, such as Google Analytics, which are integrated into our website. No additional cookies are used via the GTM and no user profiles are created, but only the loading of other analysis tools is controlled, which in turn collect data to measure user behaviour on our website, display interest-based advertising and record the impact of advertisements. GTM does not access this data. If you deactivate cookies in your browser or cookie settings, this also has a direct effect on the tracking tags that are implemented with the GTM.

You can find more information on data protection at Google here: https://policies.google.com/privacy and the data protection conditions for advertising here: https://policies.google.com/technologies/ads?hl=en&

b) Google (Universal) Analytics

This website uses Google (Universal) Analytics, a web analytics service provided by Google Ireland Limited (www.google.de). Google (Universal) Analytics uses methods that enable your use of the website to be analysed, such as so-called "cookies", text files that are stored on your end device. The information generated about your use of this website is usually transmitted to a Google server in the USA and stored there. By activating IP anonymisation on this website, the IP address is shortened before transmission within the member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there. Google will use this information on our behalf to analyse your use of the website, to compile reports on website activity and to provide us with other services relating to website activity and internet usage. The anonymised IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data.

You can prevent Google from collecting the data generated by the cookie and relating to your use of the website (including your IP address) and from processing this data by Google by downloading and installing the browser plug-in available at the following link: https://tools.google.com/dlpage/gaoptout As an alternative to the browser plugin, you can click this link to prevent Google Analytics from collecting data on this website in the future. An opt-out cookie will be stored on your device. If you delete your cookies, you must click the link again.

This website uses the "demographic characteristics" function of Google Analytics. This allows reports to be created that contain statements about the age, gender and interests of site visitors. This data comes from interest-based advertising from Google and visitor data from third-party providers. This data cannot be assigned to a specific person. You can deactivate this function at any time via the ad settings in your Google account or generally prohibit the collection of your data by Google Analytics as described above.

c) Google AdSense

This website uses Google AdSense, a service for integrating adverts from Google Inc ("Google"). The provider is Google Inc, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google AdSense uses "cookies", which are text files placed on your computer, to help the website analyse how users use the site. Google AdSense also uses so-called web beacons (invisible graphics). These web beacons can be used to analyse information such as visitor traffic on these pages.

The information generated by cookies and web beacons about the use of this website (including your IP address) and the delivery of advertising formats is transmitted to a Google server in the USA and stored there. This information may be passed on by Google to contractual partners of Google. However, Google will not merge your IP address with other data stored by you. You may refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of this website. By giving your consent, you agree to the processing of the data collected about you by Google in the manner described above and for the aforementioned purpose.

d) Google AdWords and Google Conversion Tracking

This website uses Google AdWords. AdWords is an online advertising programme of Google Inc, 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States ("Google"). As part of Google AdWords, we use what is known as conversion tracking. When you click on an advert placed by Google, a cookie is set for conversion tracking. Cookies are small text files that the Internet browser stores on the user's computer. These cookies lose their validity after 30 days and are not used to personally identify the user. If the user visits certain pages of this website and the cookie has not yet expired, Google and we can recognise that the user clicked on the ad and was redirected to this page.

Each Google AdWords customer receives a different cookie. The cookies cannot be tracked via the websites of AdWords customers. The information collected using the conversion cookie is used to generate conversionstatistics for AdWords customers who have opted for conversion tracking. Customers are told the total number of users who clicked on their advert and were redirected to a page with a conversion tracking tag. However, they do not receive any information that can be used to personally identify users. If you do not wish to participate in tracking, you can withdraw your consent by deactivating the Google conversion tracking cookie via your Internet browser under user settings. You will then not be included in the conversion tracking statistics. You can find more information about Google AdWords and Google Conversion Tracking in Google's privacy policy: https://policies.google.com/privacy?gl=de&hl=en

You can set your browser so that you are informed about the setting of cookies and only allow cookies in individual cases, exclude the acceptance of cookies for certain cases or in general and activate the automatic deletion of cookies when closing the browser. If you deactivate cookies, the functionality of this website may be restricted.

e) Facebook Pixel

Within our website, the so-called "Facebook pixel" of the social network Facebook, which is operated by Facebook Inc, 1601 South California Avenue, Palo Alto, CA 94304, USA, or if you are based in the EU, Facebook Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland ("Facebook"), is used.

With the help of the Facebook pixel, it is possible for Facebook to determine you as a visitor to our online offering as a target group for the display of adverts (so-called "Facebook ads"). Accordingly, we use the Facebook pixel to display the Facebook ads placed by us only to those Facebook users who have also shown an interest in our online offering or who have certain characteristics (e.g. interests in certain topics or products determined on the basis of the websites visited) that we transmit to Facebook (so-called "custom audiences"). With the help of the Facebook pixel, we also want to ensure that our Facebook ads correspond to the potential interest of users and are not annoying. With the help of the Facebook pixel, we can also track the effectiveness of Facebook adverts for statistical and market research purposes by seeing whether users were redirected to our website after clicking on a Facebook advert (so-called "conversion"). We only receive statistical data from Facebook for this purpose without reference to a specific person.

If you do not want Facebook to assign the information collected directly to your Facebook user account, you can deactivate the Custom Audiences remarketing function here: https://www.facebook.com/settings?tab=ads. You must be logged in to Facebook to do this.

You can read more data protection information from Facebook here: https://www.facebook.com/policy.php.

f) Microsoft Advertising

We use the Microsoft Advertising service provided by Microsoft Ireland Operations Limited (Ireland/EU) (formerly Bing Ads) on our website. Microsoft Advertising is an online marketing service that uses the Universal Event Tracking (UET) tool to help us display targeted adverts via the Microsoft Bing search engines. Microsoft Advertising uses cookies for this purpose. Personal data is processed in the form of online identifiers (including cookie identifiers), IP addresses, device identifiers and information about device and browser settings. Microsoft Advertising collects data via UET that we can use to track target groups thanks to remarketing lists. For this purpose, a cookie is stored on the end device used when you visit our website. This enables Microsoft Advertising to recognise that our website has been visited and to display an advertisement when Microsoft Bing or Yahoo is subsequently used. The information is also used to create conversion statistics, i.e. to record how many users have reached our website after clicking on an advert. This tells us the total number of users who clicked on our advert and were redirected to our website.

However, we do not receive any information with which users can be personally identified.

Processing will only take place with your consent in accordance with Art. 6 para. 1 letter a GDPR. You can revoke your consent via our Consent Management Tool.

You can also deactivate personalised advertising at Microsoft at: https://account.microsoft.com/privacy/ad-settings/

In the case of Microsoft services, the transfer of data to Microsoft Corp. in the USA cannot be ruled out. Please note the information in the section "Data transfer to third countries". Further information on data protection at Microsoft can be found in Microsoft's privacy policy at: https://www.microsoft.com/en-us/privacy/privacystatement.

g) AdRoll

To control web retargeting, we use the AdRoll service provided by NextRoll, Inc, 201 California Street, 5th Floor, Suite 500, San Francisco, CA 94111, United States. The company also has an Irish registered office at Level 6, 1 Burlington Plaza, Burlington Road, Dublin 4, D04RH96 Ireland.

With the help of an AdRoll cookie, personalised marketing messages can be sent to interested parties who have visited our website and have consented to this processing. We also use AdRoll to track our marketing performance. This is for the purpose of providing you with relevant offers and information about our products.

The processed data includes:

Activity data (device type, browser type, navigation information, advertising data)
User data (IP address, device ID, location)

The legal basis for the processing of your personal data is your consent in accordance with Art. 6 para. 1 lit. a) GDPR.

The AdRoll cookies stored on your device expire 13 months after your last access to our website. AdRoll also processes your data in the USA, among other places. AdRoll uses so-called standard contractual clauses (https://www.nextroll.com/terms/data-protection) as the basis for data processing or data transfer. Through these clauses, AdRoll undertakes to comply with the European level of data protection when processing your data, even if the data is stored, processed and managed in the USA.

Further information on data processing by AdRoll can be found here: https://www.nextroll.com/privacy.

h) Consent with Usercentrics

This website uses Usercentrics' consent technology to obtain your consent to the storage of certain cookies on your end device or to the use of certain technologies and to document these in compliance with data protection regulations. The provider of this technology is Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich, Germany ("Usercentrics").

When you enter our website, the following personal data is transmitted to Usercentrics: your consent(s) or the revocation of your consent(s), IP address, browser information, information about your end device and the time of your visit to our website. Furthermore, Usercentrics stores a cookie in your browser in order to be able to assign the consents given or their revocation. The data collected in this way is stored until you ask us to delete it, delete the Usercentrics cookie yourself or the purpose for data storage no longer applies. Mandatory statutory retention obligations remain unaffected.

Usercentrics is used to obtain the legally required consent for the use of certain technologies. The legal basis for this is Art. 6 para. 1 lit. c) GDPR. Further information on data processing by Usercentrics can be found here: https://usercentrics.com/privacy-policy/.

i) Microsoft Clarity

Various user information is collected and stored on this website via the "Microsoft Clarity" service of Microsoft Ireland Operations Ltd. for the statistical analysis of user behaviour and for optimisation and marketing purposes. In particular, Clarity records mouse movements and creates a graphical representation of which part of the website users scroll on particularly frequently (heat maps). We also receive information about general user behaviour within our website. Clarity generates statistical data on how visitors use the website. Microsoft anonymises your personal data before a potential transfer to a third country.

The legal basis for the processing of your personal data is your consent pursuant to Art. 6 para. 1 lit. a) GDPR. If you do not want information about your behaviour to be analysed by Microsoft as explained above, you can refuse the setting of a cookie required for this - for example, by changing your browser settings to generally deactivate the automatic setting of cookies. You can also prevent the collection of data generated by the cookie and related to your use of the website and the processing of this data by Microsoft by clicking on the following link: http://choice.microsoft.com/de-DE/opt-out to declare your objection. Further information and Microsoft Clarity's privacy policy can be found at https://clarity.microsoft.com/terms and https://clarity.microsoft.com/privacy

4.4 Plug-ins

If you have consented to the setting of comfort functions, statistics and tracking cookies, the collection, storage and evaluation of the plug-ins listed below is carried out on the basis of Art. 6 para. 1 lit. a) GDPR and § 25 para. 1 TDDDG, insofar as the consent includes the storage of cookies or access to information in the user's terminal device within the meaning of the TDDDG.

a) Google Maps

This site uses the Google Maps map service via an API. The provider is Google Inc, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

To use the functions of Google Maps, it is necessary to save your IP address. This information is usually transmitted to a Google server in the USA and stored there. The provider of this site has no influence on this data transfer.

The use of Google Maps is in the interest of an appealing presentation of our online offers and to make it easy to find the places we have indicated on the website. This constitutes a legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR.

You can find more information on the handling of user data in Google's privacy policy: https://policies.google.com/privacy?hl=en&gl=de.

b) YouTube

We use YouTube on our website. This is a video portal of YouTube LLC, 901 Cherry Ave, 94066 San Bruno, CA, USA, hereinafter referred to as "YouTube". YouTube is a subsidiary of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, hereinafter referred to as "Google".

This connection is necessary in order to be able to display the respective video on our website via your internet browser. In the course of this, YouTube will at least record and process your IP address, the date and time and the website you have visited. In addition, a connection to Google's "DoubleClick" advertising network is established. In the event that personal data is transferred to the USA, we have agreed standard contractual clauses with YouTube in accordance with Art. 46 para. 2 lit. c) GDPR.

If you are logged in to YouTube at the same time, YouTube will assign the connection information to your YouTube account. If you want to prevent this, you must either log out of YouTube before visiting our website or make the appropriate settings in your YouTube user account.

For the purpose of functionality and analysis of user behaviour, YouTube permanently stores cookies on your end device via your Internet browser. If you do not agree to this processing, you have the option of preventing the storage of cookies by changing the settings in your Internet browser.

Google provides further information about the collection and use of data as well as your rights and protection options in this regard in the data protection information available at https://policies.google.com/privacy.

5. WHAT DO WE USE SOCIAL MEDIA FOR?

5.1 Social media plug-ins

We offer you the option of using so-called "social media buttons" on our website. These buttons are only integrated on the website as a graphic that contains a link to the corresponding website of the button provider. By clicking on the graphic, you will be redirected to the services of the respective provider. Only then will your data be sent to the respective provider. Among other things, the provider receives the information that you have visited our website with your IP address. If you are logged into your respective social media account, the respective provider can assign the visit to our website to your user account. If you do not wish this to happen, please log out of your social media account. If you do not click on the graphic, there will be no exchange between you and the providers of the social media buttons. Information about the collection and use of your data in the social networks can be found in the respective terms of use of the corresponding providers.

We have integrated the social media buttons of the following companies on our website:

Facebook Inc. (1601 S. California Ave - Palo Alto - CA 94304 - USA) for Facebook and Instagram
Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) for YouTube

5.2 Social media profiles

Content and offers are regularly published and shared on the social media profiles of YT Industries GmbH. Below we explain how we handle your personal data on our social media pages.

a) Controller for the processing of your data

YT operates social media pages on the social networks of:

Facebook Ireland Limited (4 Grand Canal Square, Dublin 2, Ireland) for the Facebook page
New Work SE (Am Strandkai 1 - 20457 Hamburg - Germany) for the Xing page
Facebook Ireland Limited (4 Grand Canal Square, Dublin 2, Ireland) for the Instagram page
LinkedIn Ireland Unlimited Company (Wilton Plaza, Wilton Place, Dublin 2 Ireland) for the LinkedIn page
Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) for the YouTube page
Twitter Inc. (1355 Market Street, Suite 900, San Francisco, CA 94103, USA) for the Twitter page
Tik Tok Technology Limited (10 Earlsfort Terrace, Dublin, D02 T380, Ireland) for the Tik Tok site

Due to legal provisions, there is joint responsibility between us, YT Industries GmbH, and the operator of the respective social network in accordance with Art. 26 GDPR.

If you communicate directly with us via our social media profiles or share personal content with us, YT is responsible for processing your data. Exceptions apply to the data processing described below, e.g.

when analysing usage (so-called analysis services or page insights); we are jointly responsible for this with the operator of the respective social media platform or
insofar as the operator of the respective social media platform is responsible for determining the type, scope and purposes of data processing.

b) What data is collected and for what purpose?

We maintain social media profiles for the purpose of providing information about products, promotions and offers and to get in touch with you as a visitor and user of the respective page. When you visit our social media pages, YT generally collects all messages, content and other information that you share with us directly, for example when you post, like or share something on a social media page or send us a private message.

The legal basis for the processing of your data is our above-mentioned legitimate interests pursuant to Art. 6 para. 1 lit. f) GDPR and Art. 6 para. 1 lit. b) GDPR if you send us an enquiry about our company, our products or services in order to initiate or fulfil a contract.

If you have an account with the respective social network, we can of course also see your public information, for example your user name, profile picture, other information in your public profile and content that you share with a public target group. The legal basis here is your consent in accordance with Art. 6 para. 1 lit. a) GDPR.

c) Processing of your data by the operator of the respective social media platform

Please note that the operator of the respective social media platform is solely responsible for the processing of your data on the social media platform and determines the type, scope and purposes of the processing of your data when you use it. With every interaction on our social media pages, the operator of the respective social media platform records your usage behaviour using cookies and similar technologies. Social network operators can view general statistics on the interests and demographic characteristics (such as age, gender, region) of social media platform users. We would like to point out that when you visit our social media pages, your user data may also be processed outside the EU.

We have no influence on the data processing procedures on the social media platforms or on the possible transfer of your data to countries outside the EU and are not covered in this privacy policy. In this respect, we refer you to the data protection information of the operator of the respective social media platform:

Facebook data policy at https://www.facebook.com/policy,
Instagram privacy policy at https://help.instagram.com/519522125107875,
Xing privacy policy at https://privacy.xing.com/en/your-privacy
LinkedIn privacy policy at https://www.linkedin.com/legal/privacy-policy?trk=homepage-basic_footer-privacy-policy
YouTube privacy policy at https://policies.google.com/privacy
X privacy policy at https://x.com/de/privacy
Tik Tok privacy policy at https://www.tiktok.com/legal/privacy-policy-eea?lang=de

Every time you interact with our social media pages, the operator of the respective social media platform uses cookies and similar technologies to record the usage behaviour of visitors and followers of the respective social media pages. On this basis, the operators of the social media platforms receive so-called "page insights data". Page Insights only contain statistical, anonymised information about visitors, which therefore cannot be assigned to a specific person. The anonymous usage statistics are based on comments, likes, shares, number of visitors, reach of a post, views of individual page areas and statistics on followers by age, language, origin or interests. We do not have access to the personal data used by the operators of the social media platforms to create Page Insights ("Page Insights data"). The selection and processing of Page Insights data is carried out exclusively by the operator of the respective social media platform.

With the help of page insights, we gain knowledge about how our social media profiles are used, what interests the visitors to our social media profiles have and which topics and content are particularly popular. This enables us to optimise our social media profile activities, for example by better responding to the interests and usage habits of our audience when planning and selecting our content.

The legal basis for processing is our legitimate interest (Art. 6 (1) (f) GDPR) in analysing the data provided to us by the operator of the respective social media platform for the purpose of optimising our website and our marketing measures.

YT and the operator of the respective social media platform are jointly responsible for the data processing that serves to provide page insights. Further information on the processing of your personal data by the operator of therespective social media platform in the context of the creation and processing of usage statistics can be found in the information on usage statistics on the following websites of the respective social media platform:

Facebook information on Page Insights data at https://www.facebook.com/legal/terms/information_about_page_insights_data
Instagram Insights at https://help.instagram.com/788388387972460?helpref=faq_content
Xing at https://privacy.xing.com/en/your-privacy
LinkedIn Privacy Policy (Aggregated Insights) at https://www.linkedin.com/legal/privacy-policy?trk=homepage-basic_footer-privacy-policy
YouTube Insights at https://youtubeinsights.withgoogle.com/
X Audience Insights at https://x.com/en/privacy

Further information on data processing by the operator of the respective social media platform in the context of interest-based advertising as well as the setting options for your profile and your advertising preferences can be found on the following websites of the respective social media platform

Facebook at https://www.facebook.com/adpreferences/?entry_product=ad_preferences_delegation
Instagram at https://help.instagram.com/410983803065364?locale=en_US&helpref=search&cms_id=410983803065364&sr=6&query=werbung&force_new_ighc=false
Xing at https://privacy.xing.com/en
LinkedIn at https://www.linkedin.com/psettings/
YouTube at https://policies.google.com/privacy
X at https://help.x.com/en/safety-and-security/privacy-controls-for-tailored-ads
Tik Tok at https://www.tiktok.com/legal/page/global/tiktok-website-cookies-policy/en

d) What rights do you have and against whom can you exercise them?

If you no longer wish YT to process the data described here under 5. in the future, please cancel the connection of your user profile to the respective YT social media site by using the functions "I no longer like this page" and/or "No longer subscribe to this page".

With regard to data processing by YT, you can assert your rights mentioned in section 9 against YT and with regard to data processing by the operator of the respective social media platform against the respective operator at any time. Further information on this can be found in the data protection declarations (see section 5.2. c)) of the operator of the respective social network.

If you have given YT your consent, you can revoke it at any time with effect for the future by e-mail or by post using the contact details above. If YT processes your data on the basis of a balancing of interests, you can object to the processing.

6. WHO WILL YOUR DATA BE PASSED ON TO?

The data collected by us will only be passed on if:

you have given your express consent in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR,
the disclosure pursuant to Art. 6 para. 1 sentence 1 lit. f GDPR is necessary for the assertion, exercise or defence of legal claims and there is no reason to assume that you have an overriding interest worthy of protection in not disclosing your data,
we are legally obliged to pass on data in accordance with Art. 6 para. 1 sentence 1 lit. c GDPR or this is legally permissible and
it is necessary in accordance with Art. 6 para. 1 sentence 1 lit. b GDPR for the processing of contractual relationships with you or for the implementation of pre-contractual measures that are carried out at your request.

Within our company, only those persons and departments (e.g. financial accounting, purchasing, sales, customer service) that require your personal data to fulfil our contractual and legal obligations will receive it.

If external service providers are used to operate the website or to provide services, they may only use your data to fulfil their tasks. The service providers have been carefully selected and commissioned by us. They are contractually bound by our instructions, have suitable technical and organisational measures in place to protect therights of the data subjects and are regularly monitored by us. Data processing by our processors takes place predominantly in Germany or within another member state of the European Union.

If a service provider processes your data outside the European Union, we will inform you separately in this privacy policy. In this case, your data may be transferred to a country that does not offer the same data protection standards as the European Union. In this case, we will ensure that the respective service providers contractually (e.g. by concluding standard contractual clauses in accordance with Commission Decision (EU) 2021/914 of 4 June 2021) or otherwise guarantee a level of data protection equivalent to that of the European Union in accordance with Chapter 5 of the GDPR.

In addition, data may be passed on in connection with official enquiries, court orders and legal proceedings if this is necessary for legal prosecution or enforcement.

7. WHEN WILL YOUR DATA BE DELETED?

In principle, we only store personal data for as long as necessary to fulfil contractual or legal obligations. Once a contract has been fully processed or your customer account has been deleted, your data will be blocked for further use and deleted after the retention periods under tax and commercial law have expired, unless we still need the data for evidence purposes for civil law claims until the statutory limitation period has expired or you have expressly consented to the further use of your data. The deletion of your customer account is possible at any time and can be done either by sending an informal message to the above-mentioned contact details or via a function provided for this purpose in the customer account.

8. OBLIGATION TO PROVIDE YOUR DATA

As part of our business relationship, you must provide the personal data that is necessary for the establishment, execution and termination of the business relationship and the fulfilment of the associated contractual obligations or that we are legally obliged to collect. Without this data, we will not be able to conduct our business relationship with you.

9. WHAT DATA PROTECTION RIGHTS DO YOU HAVE?

You have a right of access (Art. 15 GDPR), a right to rectification (Art. 16 GDPR), a right to erasure (Art. 17 GDPR), a right to restriction of processing (Art. 18 GDPR) and a right to data portability (Art. 20 GDPR) vis-à- vis YT Industries GmbH under the respective legal requirements. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent supervisory authority in Bavaria is Bavarian State Office for Data Protection Supervision, Promenade 27, 91522 Ansbach, email: poststelle@lda.bayern.de.

If you have given your consent to YT Industries GmbH, you can revoke it at any time with effect for the future by sending an e-mail or letter to the above-mentioned contact details.

If YT Industries GmbH processes your data on the basis of a balancing of interests, you can object to the processing. If you object, your data will no longer be processed unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

10. CHANGES TO THE PRIVACY POLICY

We occasionally update this data protection notice, for example when we customise our website or when legal or regulatory requirements change.

YT Boonie Hat