Data privacy statement

3.    General
The website’s design is targeted to collect as little data from you as possible. In doing so, we always ensure that your personal data is only processed in accordance applicable law or if consent is granted by you. We comply with the regulations of the General Data Protection Regulation (the German Datenschutz-Grundverordnung or DSGVO), hereinafter referred to as GDPR, which is in force since 25.5.2018, and the respective applicable national regulations, such as the German Federal Data Protection Act (hereinafter referred to as Bundesdatenschutzgesetz or BDSG) , the German Telemedia Act (hereinafter referred to as Telemediengesetz or TTDSG) or other more specific laws on data protection.

4.    Purpose and legal basis of the processing of personal data.
We always process your personal data for a specific purpose. In summary, we process your personal data for the following purposes:

• To be able to process your request with you in case of contact inquiries (e.g. e-mail address, first name, last name);
• To be able to send you an offer following your request for an offer.
• For the technical realization of our website and to be able to provide you with our information on this website (e.g. IP address, cookies, browser information).
• To be able to receive and process an application from you for one of our job offers.

Regarding the legal basis for processing your personal data:
We process personal data that is required for the justification, implementation or processing of our service scope (contract processing) on the legal basis of Art. 6 (1) lit. b GDPR. Insofar as we obtain consent from you for the processing of your personal data, the consent forms the legal basis for data processing in accordance with Art. 6 (1) lit. a GDPR. Data processing is also permissible if we process your data to protect our legitimate interests and your interests or fundamental rights and freedoms with regard to the processing of personal data are not overridden. (Art. 6 para. 1 lit. f GDPR). Insofar as we use external service providers within the scope of data processing, the data processing is carried out on the legal basis of Art. 28 GDPR.

5.    Collection of personal data when visiting our website
In the case of merely informational use of the website, i.e. if you do not register or otherwise transmit information to us, we only collect the personal data that your browser transmits to our server. If you wish to view our website, we collect the following data, which is technically necessary for us to display our website to you and to ensure its stability and security (legal basis is Art. 6 para. 1 p. 1 lit. f GDPR):

• IP address
• Date and time of the request
• Time zone difference to Greenwich Mean Time (GMT)
• Content of the request (specific page)
• Access status/HTTP status code
• Amount of data transferred in each case
• Website from which the request comes
• Browser
• Operating system and its interface
• Language and version of the browser software.

In addition to the aforementioned data, cookies are stored on your computer when you use our website. You can find more information in section "Cookies" of this Data Privacy Statement and in the applied Consent Management Tool.

6.    Integration of services of other providers
Our website uses content, services and other performances of third party providers. These are, for example, services for statistical evaluation of use and visit of our website. To call up and to display the data user's browser, it is necessary to transmit user's IP address to the respective third-party provider.
Even though we strive to use only third-party providers that only require the IP address to deliver content or even work with anonymized IP addresses, we have no influence on whether the IP address is stored. Information regarding third-party providers used can be found below in this Data Privacy Statement.

Facebook Pixel
Nature and scope of processing
We use Facebook Pixel from Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, to create so-called Custom Audiences, i.e. to segment visitor groups of our services offered online, to determine conversion rates and to subsequently optimize them. This happens in particular when you interact with advertisements that we have placed with Meta Platforms Ireland Limited.
Purpose and legal basis
The use of Facebook Pixel is based on your consent pursuant to Art. 6 para. 1 lit. a. GDPR and § 25 para. 1 TTDSG.
Data retention period
The concrete retention period of the processed data cannot be influenced by us, but is determined by Meta Platforms Ireland Limited. Further information can be found in the privacy policy for Facebook Pixel: https://www.facebook.com/privacy/explanation

Google Maps
Nature and scope of processing
We use the map service Google Maps to create directions. Google Maps is a service of Google Ireland Limited, which displays a map on our website.
When you access this content on our website, you establish a connection to servers of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, whereby your IP address and, if applicable, browser data such as your user agent are transmitted. This data is processed exclusively for the above-mentioned purposes and to maintain the security and functionality of Google Maps.
Purpose and legal basis
The use of Google Maps is based on your consent pursuant to Art. 6 para. 1 lit. a. DSGVO and § 25 para. 1 TTDSG.
Data retention period
The concrete retention period of the processed data cannot be influenced by us, but is determined by Google Ireland Limited. Further information can be found in the privacy policy for Google Maps: https://policies.google.com/privacy.

Salesviewer
Nature and scope of processing
We have integrated SalesViewer on our website. SalesViewer is a service of SalesViewer GmbH, Bongardstraße 29, 44787 Bochum, Germany, which identifies anonymous website visitors, provides full contact details and insights into the visit history.
SalesViewer uses cookies and other browser technologies to evaluate user behavior and recognize users.
Among other things, SalesViewer tells us which companies have visited our website, tracks your visit history, including all the pages you have visited and viewed, and the length of time you have spent on this website.
SalesViewer collects and processes data about companies such as company name, phone number, address, web address, industry, company profile, sales, and key people on LinkedIn.
Purpose and legal basis
The use of SalesViewer is based on your consent pursuant to Art. 6 para. 1 lit. a. DSGVO and § 25 para. 1 TTDSG.
Data retention period
The concrete retention period of the processed data cannot be influenced by us, but is determined by SalesViewer GmbH. Further information can be found in the privacy policy for SalesViewer: www.salesviewer.com/datenschutz.

Google Analytics 4
Nature and scope of processing
We use Google Analytics 4 from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as an analysis service for the statistical evaluation of our online offer. This includes, for example, the number of views of our online offer, the time spent on the website, subpages visited or the browser used. Google Analytics 4 uses cookies, scripts and pixels to evaluate user behavior, as well as algorithms based on machine learning that automatically evaluate event data such as scrolling movements. This information is used, among other things, to compile reports on website activity.
Purpose and legal basis
The use of Google Analytics 4 is based on your consent pursuant to Art. 6 para. 1 lit. a. DSGVO and § 25 para. 1 TTDSG.
Data retention period
The concrete retention period of the processed data cannot be influenced by us, but is determined by Google Ireland Limited. Further information can be found in the privacy policy for Google: https://policies.google.com/privacy?hl=en

Google DoubleClick
Nature and scope of processing
We have integrated components of DoubleClick by Google on our website. DoubleClick is a brand of Google, under which mainly special online marketing solutions are marketed to advertising agencies and publishers. DoubleClick by Google transfers data to the DoubleClick server with each impression as well as with clicks or other activities.
Each of these data transfers triggers a cookie request to the browser of the data subject. If the browser accepts this request, DoubleClick sets a cookie in your browser.
DoubleClick uses a cookie ID, which is required to handle the technical process. The cookie ID is required, for example, to display an advertisement in a browser. DoubleClick can also use the cookie ID to record which advertisements have already been displayed in a browser in order to avoid duplicate placements. Furthermore, the cookie ID enables DoubleClick to record conversions. Conversions are recorded, for example, if a DoubleClick ad was previously displayed to a user and the user subsequently makes a purchase on the advertiser's website using the same internet browser.
A DoubleClick cookie does not contain personal data, but may contain additional campaign identifiers. A campaign identifier serves to identify the campaigns with which you have already been in contact on other websites. As part of this service, Google obtains knowledge of data that Google also uses to generate commission statements. Among other things, Google can track that you have clicked on certain links on our website. In this case, your data is passed on to the operator of DoubleClick, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Further information and the applicable privacy policy of DoubleClick by Google can be found at policies.google.com/privacy.
Purpose and legal basis
We process your data with the help of the Double-Click cookie for the purpose of optimizing and displaying advertising based on your consent pursuant to Art. 6 Para. 1 lit. a DSGVO and § 25 Para. 1 TTDSG. You give your consent by setting the use of cookies (cookie banner / Consent Manager), with which you can also declare your revocation at any time with effect for the future pursuant to Art. 7 para. 3 DSGVO. The cookie is used, among other things, to place and display user-relevant advertising and to create reports on advertising campaigns or to improve them. Furthermore, the cookie is used to avoid multiple displays of the same advertising. Each time you call up one of the individual pages of our website on which a DoubleClick component has been integrated, your browser is automatically prompted by the respective DoubleClick component to transmit data to Google for the purpose of online advertising and the settlement of commissions. There is no legal or contractual obligation to provide your data. If you do not give us your consent, a visit to our website is possible without restriction, but not all functions may be fully available.
Data retention period
The concrete retention period of the processed data cannot be influenced by us, but is determined by Google Ireland Limited. Further information can be found in the privacy policy for Google DoubleClick: https://policies.google.com/privacy.

Google Tag Manager
Nature and scope of processing
We use the Google Tag Manager of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Tag Manager is used to manage website tags through one interface and allows us to control the exact integration of services on our website
This allows us to flexibly integrate additional services to evaluate user access to our website.
Purpose and legal basis
The use of Google Tag Manager is based on your consent pursuant to Art. 6 para. 1 lit. a. DSGVO and § 25 para. 1 TTDSG.
Data retention period
The concrete retention period of the processed data cannot be influenced by us, but is determined by Google Ireland Limited. Further information can be found in the privacy policy for Google Tag Manager: marketingplatform.google.com/about/analytics/tag-manager/use-policy/.

Google reCAPTCHA
Nature and scope of processing
We have integrated components of Google reCAPTCHA on our website. Google reCAPTCHA is a service of Google Ireland Limited and enables us to distinguish whether a contact request originates from a natural person or is automated by means of a program. When you access this content, you establish a connection to servers of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, whereby your IP address and possibly browser data such as your user agent are transmitted. Furthermore, Google reCAPTCHA records the user's browsing time and mouse movements in order to distinguish automated requests from human ones. This data is processed exclusively for the purposes mentioned above and to maintain the security and functionality of Google reCAPTCHA.
Purpose and legal basis
The use of the service is based on your consent pursuant to Art. 6 para. 1 lit. a. DSGVO.
Data retention period
The concrete retention period of the processed data cannot be influenced by us, but is determined by Google Ireland Limited. Further information can be found in the privacy policy for Google reCAPTCHA: https://policies.google.com/privacy?hl=en-US.

Google Fonts
Nature and scope of processing
We use Google Fonts from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as a service to provide fonts for our online offer. To obtain these fonts, you connect to servers of Google Ireland Limited, whereby your IP address is transmitted.
Purpose and legal basis
The use of Google Fonts is based on your consent pursuant to Art. 6 para. 1 lit. a. DSGVO and § 25 para. 1 TTDSG.
Data retention period
The concrete retention period of the processed data cannot be influenced by us, but is determined by Google Ireland Limited. Further information can be found in the privacy policy for Google Fonts: policies.google.com/privacy.

Google CDN
Nature and scope of processing
We use Google CDN to properly deliver the content of our website. Google CDN is a service of Google Ireland Limited, which acts as a content delivery network (CDN) on our website.
A CDN helps to provide content of our online offer, especially files such as graphics or scripts, faster with the help of regionally or internationally distributed servers. When you access this content, you establish a connection to servers of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, whereby your IP address and possibly browser data such as your user agent are transmitted. This data is processed exclusively for the purposes mentioned above and to maintain the security and functionality of Google CDN.
Purpose and legal basis
The use of the Content Delivery Network is based on our legitimate interests, i.e. interest in a secure and efficient provision and optimization of our online offer pursuant to Art. 6 para. 1 lit. f. DSGVO.
Data retention period
The concrete retention period of the processed data cannot be influenced by us, but is determined by Google Ireland Limited. Further information can be found in the privacy policy for Google CDN: https://policies.google.com/privacy.

Hotjar
Nature and scope of processing
We have integrated Hotjar on our website. Hotjar is a service of Hotjar Ltd. and provides optimization tools that analyze the behavior and feedback of users of our website through analytics and feedback tools.
Hotjar uses cookies and other browser technologies to analyze user behavior and recognize users.
This information is used, among other things, to compile reports on website activity and to statistically analyze visitor data. Furthermore, Hotjar records clicks, mouse movements and scroll heights in order to create so-called heat maps and session replays.
In this case, your data will be passed on to the operator of Hotjar, Hotjar Ltd, Hotjar Ltd, Level 2, St Julians Business Centre 3 Elia Zammit Street St Julians STJ 3155 Malta.
Purpose and legal basis
The use of Hotjar is based on your consent pursuant to Art. 6 para. 1 lit. a. DSGVO and § 25 para. 1 TTDSG.
Data retention period
The specific retention period of the processed data cannot be influenced by us, but is determined by Hotjar Ltd. Further information can be found in the privacy policy for Hotjar: https://www.hotjar.com/privacy/.

Investis
Nature and scope of processing
To display the performance of shares and bonds, we have integrated the Investis Share Chart service via iFrame and other plug-ins from the provider Investis Ltd, 53 Tooley Street, London SE1 2QN, United Kingdom (hereinafter "Investis"). When you call up one of our websites on which a plugin or an iFrame from Investis is integrated, the Internet browser used on your terminal device will establish a connection to Investis in order to download a representation of the desired content (share chart, tables, price trends).
For the transmission of the content, your IP address is transmitted to the Investis servers during the active session. Investis itself does not collect any personal data, but requires technical session cookies AWSELB and AWSELBCORS to display the content. Both cookies are set on your end device via your browser and are only valid within the respective session. The cookies are so-called load-balancer cookies, which do not collect any personal data. Investis uses an anonymous user ID to determine the number of times the content is accessed.
Purpose and legal basis
The purpose of the integration is our legitimate interest in being able to present stock charts and stock market data to you on our website. The aforementioned processing purposes and the integration of Investis services are therefore in our legitimate interest (Art. 6 para. 1 lit. f DSGVO).
Data retention period
For more information about Investis' privacy policy and terms of use, please visit https://www.investisdigital.com/privacy-policy or https://www.investisdigital.com/terms-of-use.

Lead Gen Forms
Nature and scope of processing
We use Lead Gen Forms in the context of new customer acquisition. If you contact us via LinkedIn forms for lead generation, personal data (e.g. name, e-mail address) is stored by LinkedIn and transmitted to us. We use the data to contact you and send you targeted information about services and products. If you are a member of the LinkedIn platform, LinkedIn can assign the call of the above-mentioned content and functions to the profiles of the users there. For more information, please see LinkedIn's privacy policy at: https://www.linkedin.com/legal/privacy-policy.
Purpose and legal basis
The use of Lead Gen Forms serves to acquire new customers and to communicate with interested parties. The legal basis for the evaluation of the LinkedIn Lead Forms is your consent given with the sending of the forms. (Art. 6 para. 1 lit. a DSGVO). You can revoke your consent for the future at any time using the contact details provided on our website.
Data retention period
We store the data you send us via Lead Gen Forms for 2 years from receipt of the completed form. After this period, the personal data will be deleted, unless we are legally obliged to store it for a longer period or we still need your personal data for the implementation or processing of an existing contractual relationship or for verification purposes. In such cases, we will delete the relevant data after the statutory retention period has expired or as soon as we no longer need the data for the implementation or processing of an existing contractual relationship or for verification purposes.

YouTube
Nature and scope of processing
We have integrated YouTube Video on our website. YouTube Video is a component of the video platform of YouTube, LLC, on which users can upload content, share it over the Internet and receive detailed statistics. YouTube Video allows us to integrate content from the platform into our website. YouTube Video uses cookies and other browser technologies to evaluate user behavior, recognize users and create user profiles. This information is used, among other things, to analyze the activity of the content listened to and to generate reports. If a user is registered with YouTube, LLC, YouTube Video can associate the videos played with the profile. When you access this content, you connect to servers of YouTube, LLC, Google Ireland Limited, Gordon House, Barrow Street Dublin 4 Ireland, where your IP address and possibly browser data such as your user agent are transmitted.
Purpose and legal basis
The use of the service is based on your consent pursuant to Art. 6 para. 1 lit. a. DSGVO and § 25 para. 1 TTDSG.
Data retention period
The concrete retention period of the processed data cannot be influenced by us, but is determined by YouTube, LLC. Further information can be found in the privacy policy for YouTube Video: https://policies.google.com/privacy.

Ve Ads
Nature and scope of processing
We have integrated Ve Ads on our website. Ve Ads is a service of Ve Global UK Limited that displays targeted advertising to users. Ve Ads uses cookies and other browser technologies to analyze user behavior and recognize users. Ve Ads collects information about visitor behavior on various websites. This information is used to optimize the relevance of advertising. Furthermore, Ve Ads delivers targeted advertising based on behavioral profiles and geographic location. Your IP address and other identifiers such as your user agent are transmitted to the provider. In this case, your data is passed on to the operator of Ve Ads, Ve Global UK Limited, WeWork, 77 Leadenhall Street, London, EC3A 3DE, United Kingdom.
Web tracking technologies are used to create pseudonymized user profiles. These profiles cannot be linked to you as a natural person, but are used, for example, for segmentation when displaying advertisements.
Purpose and legal basis
The use of Ve Ads is based on your consent pursuant to Art. 6 para. 1 lit. a. DSGVO and § 25 para. 1 TTDSG.
Data retention period
The specific retention period of the processed data cannot be influenced by us, but is determined by Ve Global UK Limited. Further information can be found in the privacy policy for Ve Ads: https://www.ve.com/privacy-policy.

7.    Cookies
Cookies are small text files that are stored on your data carrier and save certain settings and data for exchange with our system via your browser. A cookie usually contains the name of the domain from which the cookie data was sent, information about the age of the cookie and an alphanumeric identifier.
Cookies enable our systems to recognize the user's device and make any preferences immediately available. As soon as a user accesses the platform, a cookie is transferred to the hard drive of the respective user's computer. Cookies help us to improve our website and provide you with a better and more customized service.
They allow us to recognize your computer, or your (mobile) device when you return to our website and thereby:

• store information about your preferred activities on the website and thus tailor our website to your individual interests.
• To accelerate the speed of processing your requests.

We cooperate with third-party services that help us to make the Internet offer and the website more interesting for you. Therefore, cookies from these partner companies (third-party providers) are also stored on your hard drive when you visit the website. These are cookies that are automatically deleted after the specified time.
For more information on the individual third-party providers, please refer to the Cookie Consent Tool and the privacy notices stored therein.
If you do not wish to use browser cookies, you can set your browser so that cookies are not accepted. Please note that in this case you may only be able to use our website to a limited extent or not at all. If you only want to accept our own cookies, but not the cookies of our service providers and partners, you can select the setting in your browser "Block third-party cookies". We assume no responsibility for the use of third-party cookies.

8.    Contacting (contact forms, offer forms, etc.)
You can contact us by e-mail or via our contact form. In this case, we store the personal data you provide in order to process your request and to contact you to handle your request. If we request information via our contact form, we have marked the mandatory fields required for contacting us accordingly (asterisk/*). The voluntary information is used to specify your request and to improve the processing of your request. The requested data is transmitted to us by you on a purely voluntary basis.
Depending on the type of request, the legal basis for this processing is Art. 6 (1) lit. b DSGVO for requests that you yourself make as part of a pre-contractual measure or Art. 6 (1) p. 1 lit. f DSGVO if your request is of a different nature. The legitimate interest follows from the purposes mentioned under point 4 a.). If personal data is requested that we do not need for the fulfillment of a contract or for the protection of legitimate interests, the transfer to us will be based on your consent pursuant to Art. 6 para. 1 lit. a DSGVO.

9.    Newsletter
With your consent, you can subscribe to our newsletter, with which we inform you about our current interesting offers. The advertised goods and services are named in the consent form.
For the registration to our newsletter we use the so-called double-opt-in procedure. This means that after your registration we send you an e-mail to the specified e-mail address, in which we ask you to confirm that you wish to receive the newsletter. In addition, we store your IP addresses and the times of registration and confirmation. The purpose of this procedure is to be able to prove your registration and, if necessary, to clarify a possible misuse of your personal data.
The only mandatory data for sending the newsletter is your e-mail address. The provision of otherwise marked data is voluntary and will be used to address you personally. After your confirmation, we store your e-mail address for the purpose of sending the newsletter. The legal basis is Art. 6 para. 1 p. 1 lit. a DS-GVO.
Your personal data is processed on our behalf on the basis of data processing agreements in accordance with Art. 28 DSGVO. In these cases, we ensure that the processing of personal data is carried out in accordance with the General Data Protection Regulation.
You can revoke your consent to the sending of the newsletter at any time and unsubscribe from the newsletter. You can declare the revocation by clicking on the link provided in every newsletter e-mail, by e-mail to datenschutz@varta-ag.com or by sending a message to the contact details given in the imprint.

10.    Application procedure
On our website, we publish job offers to which you can apply. If you decide to apply, we will process the personal data you provide on our website solely for the purpose of carrying out the application process.
The legal basis for processing your personal data as part of the application process is § 26 (1) in conjunction with (2) BDSG.
In the event of a rejection of you application, we will delete your data as soon as a retention period of 6 months as required by mandatory labor law has expired. The period begins with the dispatch of the rejection. If you have expressly consented to the further use of your data for subsequent contact regarding positions that may be of interest to you, we will continue to store your data in accordance with your consent.
If an employment relationship is established following the application process, the data will for the first instance continue to be stored to the extent necessary and permissible and then transferred to the personnel file.
Your personal data may be processed on our behalf on the basis of data processing agremments pursuant to Art. 28 DSGVO. In these cases, we ensure that the processing of personal data is carried out in accordance with the General Data Protection Regulation.
Otherwise, personal data will only be transferred to recipients outside the company if this is permitted or required by law, if the transfer is necessary to fulfill legal obligations, or if you have consented to it. A transfer to a third country is not intended.
The provision of personal data in the context of application processes is neither legally nor contractually required. You are therefore not obliged to provide the personal data. However, the provision of personal data is necessary for the decision on an application or the conclusion of a contract for employment with us. However, in the context of your application, you may only provide personal data that is required for the acceptance and execution of the application. If you do not provide us with any personal data in an application, we will not be able to make a decision on the establishment of an employment relationship.
Please note that applications that you send to us by e-mail are transmitted unencrypted. In this respect, there is a risk that unauthorized persons can intercept and use this data.

11.    Social media presence
In order to be able to present our company in the best possible way and to communicate with you as a user, customer or interested party and to inform you about our offered services, we make use of our presence in social networks. When using social networks, data is processed outside the European Union (EU) and the European Economic Area (EEA). An equivalent level of data protection as exists in the EU cannot be guaranteed in all countries outside the EU.
In this context, it may lead to risks for you as a user if the transmitted data is processed in so-called third countries with an inadequate level of data protection.
This makes it more difficult to enforce known user rights. In addition, your data may not be processed in your interest by the provider in the third country. 
We only transfer personal data to third countries for which an adequate level of protection has been confirmed or if the transfer of personal data can be ensured by contractual agreements or other suitable guarantees.
In addition to the respective provider of a social network, we also collect and process personal user data on so-called "fan pages". With this notice, we inform you about which data we collect from you on our social media sites, how we use it and how you can object to the use of the data. The respective data processing purposes and data categories   are detailed below.
The social media activities operated by us and detailed below are carried out on the basis of a balancing of interests pursuant to Art. 6 (1) lit. f) DSGVO.
To achieve this, cookies are used, which record user behavior and enable profiling of the user.
A concrete list of the purposes for which the user data is processed can be found in the data protection notices of the respective providers. By making the appropriate settings in your user account, you can limit the profiling, at least to a certain extent. For the exact procedure, please read the corresponding data protection information of the respective provider.

The relevant platforms are:

VARTA AG operates profiles on the listed platforms in order to draw attention to products and service offers and to interact with customers, interested parties and other users of the platform. In this context, the platform operators also use certain data that they have collected from users of the platform (e.g., whether a photo on a profile was marked with "Like" or commented on) to create aggregated usage statistics and make them available to the respective operators of the profile (so-called "Insights" or "Analytics"). We as profile operators also receive such usage statistics. The information that we receive as profile operators does not allow any conclusions to be drawn about individual users. The profile operator itself has no access to personal data that the platform operators process for the creation of usage statistics. The respective platform operator alone determines which data is processed for these purposes, and in what manner. As the profile operator, VARTA AG can neither legally nor actually influence the processing by the platform operators.

For processing in connection with the compilation of usage statistics, VARTA AG and the respective platform operator shall be deemed joint controllers within the meaning of Art. 26 DSGVO.
Where possible, joint responsibility agreements are in place with the respective platform operators.
Beyond that, data processing by VARTA AG as profile operator only takes place to a very limited extent:

• Processing of usernames and comments that are deleted due to violation of netiquette. These will be kept on file for possible proof in the event of legal disputes within the statute of limitations.
• Processing of usernames and individual messages when you contact us via messenger service
• Processing of user names when participating in competitions. The relevant conditions of participation apply in this regard.
• Processing of usernames and postings in the context of inquiries and, if necessary, obtaining consent to re-post images

For these purposes, we generally only process your name, message content, comment content, and the profile information you "publicly" provide.

12.    Energy Storage caluclation tool
Nature and scope of processing
On our website, we offer you to receive a recommendation for a suitable VARTA product via a provided calculation tool by providing certain consumption data and other information. The information includes electricity demand, electric car, heat pump, electricity price, EEG compensation, photovoltaic output, roof pitch and roof orientation. As a result of your input, in addition to the product recommendation, you will also receive certain other estimated values, e.g. on self-consumption percentage, degree of autarky and savings potential. You can use this functionality without providing any personal data.
As a further function, you can request a non-binding offer for the recommended VARTA product based on the calculation result and receive the calculation by e-mail; furthermore, it is possible to receive information on grants and subsidized loans in your region in this context. For this purpose, we require title, first and last name, address, country, telephone number and e-mail address. In addition, we need the year of construction of the object in order to be able to provide information on grants and development loans.
Your data will be forwarded to a suitable certified installer in your region. The installer will contact you with an offer.
Purpose and legal basis
We process your data for the purpose of forwarding for the preparation of offers by the installer as well as for the transmission of information to you on the basis of your consent pursuant to Art. 6 para. 1 lit. a DSGVO. You can declare your revocation at any time with effect for the future pursuant to Art. 7 para. 3 DSGVO. There is no legal or contractual obligation to provide your data, but it is not possible to send the offer or information without providing your data.
Data retention period
If you use the contact form on the basis of your consent, we store the collected data of each request for a period of three years, starting with the completion of your request or until you revoke your consent.

13.    VARTA Microbattery B2B Portal
Nature and scope of processing
On our website, we offer our business contacts access to our B2B portal. The B2B portal contains further information about our VARTA products. We manually set up a login for you as a customer with a user ID and initial password, which you should change the first time you access the portal. First and last name, company name, country and e-mail address are required for this. We save the date of the last login to your account.
Purpose and legal basis
The processing is carried out in order to make the login and access to the information stored in the B2B portal available to you as requested, thus for the purpose of fulfilling the contract on the basis of Art. 6 (1) lit. b DSGVO.
Data retention period
The e-mail address is required for the login; the e-mail address and the other information serve to clearly assign the login data to the respective user and the company behind it. We store the last login date in each case in order to be able to feasible monitor the rentention period described below.

14.    Rights of the data subject
You have the right:

• in accordance with Art. 15 DSGVO to request information about your personal data processed by us. In particular, you can request information about the processing purposes, the category of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned  retention period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right of complaint, the origin of your data if it has not been collected by us, as well as the existence of automated decision-making including profiling and, if applicable, meaningful information about its details;
• in accordance with Art. 16 DSGVO to immediately demand the correction of incorrect or completion of your personal data stored by us;
• pursuant to Art. 17 DSGVO to request the deletion of your personal data stored by us, unless the processing is necessary for the exercise of the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defense of legal claims;
• to request the restriction of the processing of your personal data in accordance with Art. 18 DSGVO, insofar as the accuracy of the data is disputed by you, the processing is unlawful, but you object to its deletion and we no longer require the data, but you need it for the assertion, exercise or defense of legal claims or you have objected to the processing in accordance with Art. 21 DSGVO;
• pursuant to Art. 20 DSGVO to receive your personal data that you have provided to us in a structured, common and machine-readable format or to request the transfer to another controller (data portability);
• to revoke your consent at any time in accordance with Art. 7 (3) DSGVO. This has the consequence that we are no longer allowed to continue the data processing based on this consent for the future and
• to complain to an authority in accordance with Art. 77 DSGVO. As a rule, you can contact the supervisory authority of your usual place of residence or workplace or our company headquarters.

15.    Right of Withdrawal
If your personal data is processed on the basis of legitimate interests pursuant to Art. 6 (1) p. 1 lit. f DSGVO, you have the right to object the processing of your personal data pursuant to Art. 21 DSGVO, provided that there are grounds for doing so that arise from your particular situation or the objection is directed against direct advertising. In the latter case, you have a general right of withdrawal, which is implemented by us without specifying a particular situation.
If you wish to exercise your right of revocation or withdrawal, simply send an e-mail to Datenschutz@varta-ag.com.

15.    Transmission of your personal data
The transmission of your personal data takes place as described below.
Personal Data is transmitted if we are entitled or obliged to disclose data due to statutory provisions and/or official or court orders. In particular, this may involve the transmission of information for the purposes of criminal prosecution, the prevention of danger or the enforcement of intellectual property rights.
Insofar as your data is passed on to service providers to the extent necessary, they will only have access to your personal data to the extent necessary to fulfill their tasks. These service providers are obliged to treat your personal data in accordance with the applicable data protection laws, in particular the DSGVO. Insofar as your personal data is processed on our behalf on the basis of order processing contracts pursuant to Art. 28 DSGVO, we ensure that the processing of personal data is carried out in accordance with the General Data Protection Regulation.
We make a point of processing your data within the EU / EEA. However, we may use service providers that process data outside the EU / EEA. In these cases, we ensure that an appropriate level of data protection comparable to the standards within the EU is established at the recipient before transferring your personal data. This can be achieved, for example, via EU standard contracts or Binding Corporate Rules or special agreements to whose regulations the company may be subject.

16.    Data security
We secure our website by technical and organizational measures against loss, destruction, access, modification or distribution of your data by unauthorized persons.
In particular, your personal data is transmitted encrypted with us. We use the SSL/TLS (Secure Sockets Layer/Transport Layer Security) coding system for this. Our security measures are continuously improved in line with technological developments.

17.    Retention period for the personal data
With regard to the retention period, we delete personal data as soon as their storage/retention is no longer necessary for the fulfillment of the original purpose and there are no longer any legal retention periods. The statutory retention periods form the criterion for the final duration of the retention of personal data. After expiry of the period, the corresponding data is routinely deleted. In the case of the existence of retention periods, a restriction of the processing takes place in the form of blocking the data.

18.    References and links
When calling up Internet pages referred to within the framework of our website, information such as name, address, e-mail address, browser properties, etc. may be requested again. This privacy policy does not regulate the collection, disclosure or handling of personal data by third parties.

Third party service providers may have different and their own rules for handling the collection, processing and use of personal data. It is therefore advisable to inform yourself on the websites of third parties about their practices regarding the handling of personal data before entering personal data.

_{VARTA AG - Data Privacy Statement Version Sept-2023_EN}