Privacy policy

(as of 03.07.2024)

Thank you for visiting our website and for your interest in our company. The protection of your personal data is important to us. Below we inform you in accordance with Art. 12, 13, 14 and 21 of the General Data Protection Regulation (GDPR) about the handling of your personal data when using our website www.gs1-germany.de and when establishing, executing and terminating a contract or event with us.
Personal data is individual information about personal or factual circumstances of an identified or identifiable natural person. This includes information such as civil name, address, telephone number and date of birth.

Table of contents

• I. Controller
• II Purposes and legal bases of data processing

1. Informational use of the website
2. Active use of the website and conclusion of contract, data processing outside the website
3. Data processing during the execution of the contract
4. Compliance with legal requirements
5. Law enforcement

• III Categories of recipients
• IV. Third country transfer
• V. Duration of storage

1. Informational use of the website
2. Active use of the website as well as contact requests, conclusion of contracts and registration for events outside the website

• VI Your rights as a data subject
• VII Scope of your obligations to provide data
• VIII. Automated decision making / profiling
• Information about your right to object Art. 21 GDPR

Controller for the purposes of the General Data Protection Regulation
GS1 Germany GmbH
Stolberger Straße 108 a
50933 Cologne
E-mail: info(at)gs1-germany.de
Fax: +49 221 94714-990

Contact details of our data protection officer:
Thomas Happel
Maarweg 133
50825 Cologne
E-mail: datenschutz(at)gs1-germany.de
Fax: +49 221 94714-990

1. informational use of the website

You can visit our website without providing any personal data. If you only use our website for informational purposes, i.e. if you do not log in, register, place an order or otherwise provide us with information about yourself, we do not process any personal data, with the exception of the data that your browser transmits to enable you to visit the website and information that is transmitted to us in the context of cookies used for statistical analysis of the use of our website.

The scope of the following table is limited to resources loaded from https://serviceplattform.gs1.de.

Status: March 20, 2024

i. Purpose

For the purpose of the technical provision of the website, it is necessary for us to process certain automatically transmitted information from you so that your browser can display our website and you can use the website. This information is automatically collected each time our website is accessed and stored in our server log files. This information relates to the computer system of the accessing computer. The following information is collected:

• Host,
• IP address of the user,
• (if applicable) auth name,
• Date and time of access,
• method of access (Get/Post),
• Request,
• Protocol (e.g. http),
• Status (e.g. error messages),
• amount of data retrieved,
• referrer,
• browser and operating system of the user.

We also use cookies to make our website available for you to use. Cookies are text files that are stored in the Internet browser or by the Internet browser on your computer system when you access a website. A cookie contains a characteristic string of characters that enables the browser to be uniquely identified when the website is called up again. We use these cookies exclusively to make our website and its technical functions available to you. Some functions of our website cannot be offered without the use of cookies. We use cookies with different storage durations. Among other things, we use so-called session cookies, which are deleted when you leave the website. Other cookies are stored for longer. For example, log-in cookies, which store your access authorization, are automatically deleted after a period of 24 hours and cookies for our consent management (i.e. regarding your decisions for or against the use of cookies) are stored for up to one year.

ii. Legal basis

We process your personal data for the technical provision of our website on the basis of the following legal grounds

• for the performance of a contract or for the implementation of pre-contractual measures pursuant to Art. 6 para. 1 lit. b GDPR, insofar as you visit our website to find out about our products or services and our events; and
• for the use of consent management to fulfill a legal obligation to which we as the controller are subject pursuant to Art. 6 para. 1 lit. c GDPR. The legal obligation lies in informing you about the cookies we use and obtaining and documenting your consent to data processing; and
• to safeguard our legitimate interests in accordance with Art. 6 para. 1 lit. f GDPR in order to make the website technically available to you. Our legitimate interest is to be able to provide you with an attractive, technically functioning and user-friendly website and to take measures to protect our website from cyber risks and to prevent our website from posing cyber risks to third parties.

b. Statistical analysis of the use of the website and range increase as well as advertising/tracking

i. Purpose

For the purpose of statistical analysis of the use of our website, we use various applications such as Google Analytics and thus cookies, which enable an analysis of your surfing behavior. This enables us to improve the quality of our website and its content. We learn how the website is used and can thus constantly optimize our offer.

The information obtained as part of the statistical analysis of our website is not merged with your other data collected on the website.

In addition, we use applications such as Facebook Pixel and the cookies associated with the respective application to display and optimize advertising and any associated tracking.

Google Ads

We use the online advertising program "Google Ads" and, as part of Google Ads, conversion tracking as well as Google Dynamic Remarketing and Google Doubleclick. Google Conversion Tracking is an analysis service of Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland (subsidiary of Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; "Google"). When you click on an advertisement placed by Google, a cookie for conversion tracking is stored on your computer. These cookies are stored for the storage period specified above (see table), do not contain any personal data and are therefore not used for personal identification. Google Dynamic Remarketing is an application for optimizing the ads displayed to you based on the analysis of your interests, which are compared with your data collected by Google (e.g. demographic characteristics). DoubleClick is used to register and report your actions on the website after viewing or clicking on one of the advertisements of a provider in order to measure the effectiveness of an advertisement and the display of targeted advertising.

If you visit certain web pages on our website and the cookie has not yet expired, Google and we can recognize that you have clicked on the ad and have been redirected to this page. Each Google Ads customer receives a different cookie. It is therefore not possible for cookies to be tracked via the websites of Ads customers.

The information collected using the conversion cookie is used to generate conversion statistics for Ads customers who have opted for conversion tracking. This tells customers the total number of users who clicked on their ad and were redirected to a page with a conversion tracking tag. However, they do not receive any information with which users can be personally identified.

If you do not wish to participate in tracking, you can object to this use by preventing the installation of cookies by setting your browser software accordingly (deactivation option). You will then not be included in the conversion tracking statistics. In addition, you can also refuse or revoke your consent to the use of cookies via our consent management (see above). Further information and Google's privacy policy can be found at

http://www.google.com/policies/technologies/ads/
http://www.google.de/policies/privacy/

Google Tag Manager

We use Google Tag Manager from Google on our website. Google Tag Manager is a solution that allows marketers to manage website tags via an interface. The Google Tag Manager service itself (which implements the tags) is a cookie-less domain and does not collect any personal data. The Google Tag Manager service triggers other tags, which in turn may collect data. Google Tag Manager does not access this data. If deactivation has been carried out at domain or cookie level, this remains in place for all tracking tags that are implemented with Google Tag Manager.

Google Analytics and Google Optimize

On our website, we use Google Analytics, a web analysis service of Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland (subsidiary of Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; "Google") as well as the Google Optimize extension, with which we can test website optimizations in so-called A/B procedures. Google Analytics uses "cookies", which are text files placed on your computer, to help the website analyze how users use the site. The information generated by the cookie about your use of our website is usually transmitted to a Google server in the USA and stored there. However, if IP anonymization is activated on our website, your IP address will be shortened by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there. Google will use this information on our behalf to evaluate your use of the website, to compile reports on website activity and to provide other services relating to website activity and internet usage to the website operator. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data.

On our website, we use Google Analytics with the extension "_anonymizeIp()". This means that IP addresses are further processed in abbreviated form, so that they cannot be directly linked to individuals.

You can prevent the storage of cookies by setting your browser software accordingly or refuse or revoke your consent to the use of cookies via our consent management (see above); however, we would like to point out that in this case you may not be able to use all functions of our website to their full extent.

You can prevent Google from collecting the data generated by the cookie and relating to your use of our website (including your IP address) and from processing this data by Google by downloading and installing the browser plug-in available at the following link: http://tools.google.com/dlpage/gaoptout?hl=de

As an alternative to the browser plugin, you can click the following link to prevent Google Analytics from collecting data on our website in the future. An opt-out cookie will be stored on your device. If you delete your cookies, you must click the link again.

You can find more information on the terms of use and data protection of Google Analytics at http://www.google.com/analytics/terms/de.html or at https://www.google.de/intl/de/policies/

Hotjar
Hotjar is a service that analyzes the behavior and feedback of users on websites through a combination of analysis and feedback tools. The use of Hotjar gives us an "overall picture" of how the end user experience and website performance can be improved. For this purpose, we have integrated a tracking code that transfers data to servers located in Ireland (EU).

The tracking code contacts Hotjar's servers and sends a script to the computer or device you use to access our website. The script collects certain data relating to the user's interaction with the website. This data is then sent to Hotjar's servers for processing. You can find more details on this under Technical Information. The sole purpose of this data collection is to improve your user experience on our website. Hotjar-based websites use cookies to collect non-personal data including standard internet log data and information on behavioral patterns when visiting a Hotjar-based website. This is done so that we can provide you with a better user experience, identify preferences, diagnose technical problems, analyze trends and generally optimize a website. In particular, the following data is collected and processed

• IP address of the end device (it is collected and stored in anonymized form)
• Resolution of the screen/display of the end device screen;
• type of terminal device (individual terminal device identifiers, operating system and browser type)
• Geographical location (country only)
• preferred language when displaying the Hotjar-based website.

The following information is collected in relation to user interactions

• Mouse events (movements, position and clicks)
• Keystrokes.

Log data
Hotjar servers automatically record information collected from customer websites on a random basis. Among other things, the following data is recorded

• referring URL and domain
• pages visited
• geographical location (country only)
• preferred language used to display the website
• Date and time when the website pages were accessed

Login
Hotjar also uses cookies to record login data on your end device or computer. Cookies can be used to recognize whether a particular device has already visited a Hotjar-based website so that you do not have to re-enter the login data when you visit the same Hotjar-based website again. Most browsers allow you to choose whether or not to accept cookies. If you do not want cookies to be stored on your computer, please set your browser preferences to reject all cookies before accessing a Hotjar-based website. For more information about cookies and how to check which cookies are stored, how to manage and delete them, please visit https://help.hotjar.com/hc/en-us/articles/115011789248-Hotjar-Cookies.

The latest version of Hotjar's privacy policy is available at www.hotjar.com/privacy.

Microsoft Advertising
We use Microsoft Advertising on our website to track the completion of our website. This is a service of Microsoft Corporation, One Microsoft Way, Redmond, WA 98052 - 6399, USA, hereinafter referred to as "Microsoft", which uses the so-called Universal Event Tracking (UEN).

If you click on an advertisement placed by us on the Internet search engine "Bing", Microsoft will store a cookie for tracking functionality on your end device via your Internet browser. This tracking cookie is stored for the storage period specified above (see table) and is not used to identify you personally. If you visit certain pages of our website and the cookie has not yet expired, both Microsoft and we can recognize that you have clicked on an advertisement placed by us on Bing and have been redirected from there to our website.

Microsoft uses the information collected by the tracking cookie to compile visit statistics for us. This provides us with information about the number of hits on the advertisements placed by us on Bing and about the web pages of our website that were subsequently accessed. However, we do not receive any information that would allow us to identify you personally.

In addition, Microsoft may be able to track your user behavior across several of your end devices via cross-device tracking. This enables Microsoft to show you personalized advertising across devices.

If you do not agree to this processing, you have the option of preventing the installation of cookies by making the appropriate settings in your Internet browser or refusing or revoking your consent to the use of cookies via our Consent Management (see above).

If you have a Microsoft account, you can also change the settings for personalized advertising at account.microsoft.com/privacy/ad-settings/signedout.

Microsoft also offers further information on Microsoft Advertising and the collection and use of data as well as your rights and options for protecting your privacy at https://help.ads.microsoft.com/#apex/3/de/53056/2 and https://privacy.microsoft.com/de-de/privacystatement.

LinkedIn Insight Tag, LinkedIn Analytics
Our website uses the "LinkedIn Insight Tag" conversion tool and LinkedIn Analytics from LinkedIn Ireland Unlimited Company. These tools create cookies in your web browser, which enable the collection of the following data, among others: IP address, device and browser properties and page events (e.g. page views). This data is encrypted, anonymized within seven days and the anonymized data is deleted within the storage period specified above (see table). LinkedIn does not share any personal data with GS1 Germany, but offers anonymized reports on the website target group and display performance. In addition, LinkedIn offers the possibility of retargeting via the Insight Tag. GS1 Germany can use this data to display targeted advertising outside its website without identifying you as a website visitor. You can find more information on data protection at LinkedIn in the LinkedIn privacy policy https://www.linkedin.com/legal/privacy-policy.

LinkedIn members can control the use of their personal data for advertising purposes in their account settings, to deactivate the Insight tag on our website ("opt-out") click here(https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out). If you are logged in to LinkedIn, you can deactivate data collection at any time by clicking on the following link: https://www.linkedin.com/psettings/enhanced-advertising.

In addition, you can also refuse or revoke your consent to the use of cookies via our consent management (see above).

Facebook applications (Pixel, Custom Audiences, Connect)
On our website we use the so-called "Facebook Pixel" as well as the applications "Facebook Custom Audiences" and "Facebook Connect" of the company "Facebook" (Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2 Ireland). The "Facebook pixel" is used to classify visitors to our website into specific target groups in order to display personalized, interest-based advertisements ("ads") on Facebook, Instagram and the Facebook advertising network. The data collected (e.g. IP addresses, information about the web browser, the location of the website, buttons clicked on, pixel IDs and other features) can only be used in the context of displaying certain advertisements and cannot be viewed by us. Using Facebook Custom Audiences, we are able to track your activities on our website if you have reached our website via Facebook ads, for example. This is used to measure the effectiveness of advertising, analyze visitor behavior and display targeted advertising to you (e.g. by creating target groups). For this purpose, Facebook sets cookies when you visit our website. In this case, the cookie automatically enables interest-based advertising by means of a pseudonymous cookie ID and on the basis of the pages you visit. However, the data collected is anonymous to us as the operator of this website, so we cannot draw any conclusions about the identity of the user. In addition, we offer the option of logging in to our website via your Facebook user account using Facebook Connect to make it easier for you to log in.

If you have a Facebook and/or Instagram account and are logged in, your visit to this website will be assigned to your Facebook and/or Instagram user account.

For more information on the collection and use of data by Facebook, your rights in this regard and options for protecting your privacy, please refer to the data protection information ("Privacy") on the Facebook website.

Walls.io
Our website uses social media plugins or widgets from Walls.io. When these plugins are called up, the IP address and cookie information are transmitted to Walls.io. Walls.io is operated by "Walls.io GmbH" in Vienna, Austria.

Userlike
Our website uses chat software from the company Userlike UG (haftungsbeschränkt), Probsteigasse 44-46, 50670 Cologne, Germany. You can use the chat like a contact form to chat with our employees almost in real time. When you start the chat, the following personal data is collected:

• Date and time of the call,
• Browser type/version,
• IP address,
• operating system used,
• URL of the previously visited website,
• Amount of data sent.
• And if specified: First name, surname and e-mail address.

Depending on the course of the conversation with our employees, further personal data may be collected in the chat and entered by you. The nature of this data depends largely on your request or the problem you describe to us. The purpose of processing all this data is to provide you with a quick and efficient means of contact and thus improve our customer service.

All our employees have been and will continue to be trained in data protection and how to handle customer data securely and confidentially. All of our employees are obliged to maintain confidentiality and have signed an addendum in their employee contracts to the obligation to maintain confidentiality and to observe data protection.

By accessing our website, the chat widget is loaded in the form of a JavaScript file from AWS Cloudfront. The chat widget technically represents the source code that is executed on your computer and enables the chat.

In addition, GS1 Germany stores the chat history for a period of 3 months. This serves the purpose of sparing you extensive explanations of the history of your request and for the constant quality control of our chat offer. Processing is therefore permitted in accordance with Art. 6 para. 1 letter f GDPR. If you do not wish this, you are welcome to inform us using the contact details below. We will then delete saved chats immediately.

The storage of chat data also serves the purpose of ensuring the security of our information technology systems. This is also our legitimate interest, which is why processing is permitted in accordance with Art. 6 para. 1 letter f GDPR.

Further information can be found in the privacy policy of Userlike UG(haftungsbeschränkt).

Podigee podcast hosting
We use the podcast hosting service Podigee from the provider Podigee GmbH, Schlesische Straße 20, 10997 Berlin, Germany. The podcasts are loaded by Podigee or transmitted via Podigee.

The use is based on our legitimate interests, i.e. interest in a secure and efficient provision, analysis and optimization of our podcast offer in accordance with Art. 6 para. 1 lit. f. GDPR. GDPR.

Podigee processes IP addresses and device information in order to enable podcast downloads/playbacks and to determine statistical data, such as call-up figures. This data is anonymized or pseudonymized before being stored in Podigee's database, unless it is necessary for the provision of the podcasts.

Further information and objection options can be found in Podigee's privacy policy: https://www.podigee.com/de/about/privacy/.

We process your personal data to statistically analyze the use of our website on the following legal basis:

• With your consent pursuant to Art. 6 para. 1 lit. a GDPR in conjunction with Section 15 para. 3 TMG.

In addition to the purely informational use of our website, you can also actively use our website to order one of our products or services, to register for an event, to register for our newsletter or to contact us. In addition to the processing of your personal data described above for purely informational use, we will then also process other personal data from you that we require to process your order or to process and respond to your inquiry.

With the exception of section 2.e "Newsletter, advertising emails and press distribution lists", the following statements also apply in the event that you wish to contact us or establish a business relationship with us via other communication channels (e.g. email, telephone, in person). In special cases, however, we may also provide you with separate data protection information.

a. Contact requests

In order to be able to process and respond to your inquiries to us, e.g. via the contact form or to our email address, we process the personal data you provide in this context. This always includes your name and email address in order to send you a reply, as well as any other information that you send us as part of your message.
We process your personal data to respond to user inquiries on the following legal bases:

• if your contact is made in the context of a contract to which you are a party or for the implementation of pre-contractual measures, pursuant to Art. 6 para. 1 lit. b GDPR,
• to safeguard our legitimate interests in accordance with Art. 6 para. 1 lit. f GDPR; our legitimate interest lies in the appropriate response to contact inquiries.
  

b. Conclusion of a contract

If you order one of our paid or free products or services on our website, we process your personal data in order to accept and process the order and to provide you with the products or services ordered. In doing so, we process the information shown on the respective input forms (voluntary information is marked with the addition "if applicable"):

• E-mail address
• Salutation
• Position
• First name and surname
• Company name
• Branch
• Street/house number
• Postal code
• City/town
• Country
• Telephone number

We process your personal data for the establishment, performance and termination on the following legal basis:

• for the fulfillment of a contract or for the implementation of pre-contractual measures pursuant to Art. 6 para. 1 lit. b GDPR.
  

c. Registration for events

If you register for a paid or free physical or virtual event on our website, we process your personal data in order to accept your registration. In doing so, we process the information provided or requested in the respective input forms (voluntary information is marked with the addition "if applicable"):

Company details

• Company name
• Street
• PO no.
• Zip code
• Town
• Country
• Industry, if applicable

Details of the participant:

• Salutation
• Department
• Position
• First name and surname
• Title, if applicable
• Telephone number
• E-mail address

We process your personal data for the establishment, execution and termination of the event on the basis of the following legal bases

• for the performance of a contract or for the implementation of pre-contractual measures pursuant to Art. 6 para. 1 lit. b GDPR.

If we hold events virtually, it may be necessary for you to register with a third-party service (e.g. virtual conference services) in order to participate in the event. These are not services provided by GS1 itself. We have no control over, nor are we responsible for, how this third party processes your personal data. If you would like to know how this third-party provider processes your personal data, you must inform yourself accordingly in the data protection declarations of the third-party provider.

GS1 Germany events and the cooperation events offered are primarily intended for the purpose of networking and mutual exchange with the most important players in an industry, including after the event. Such networking can only take place if GS1 Germany makes available to other participants - including the participating GS1 Germany Solution Partners - the name of the respective participants, the name of the company for which the respective participants work, the name of the respective position and the contact details (e-mail address). This takes place in the form of publication of the data on a list of participants, which is sent to all participants.

We process your personal data for the establishment, implementation and termination of events as well as for networking during and after events on the basis of the following legal bases:

• To safeguard our legitimate interests of GS1 Germany or a third party, within the meaning of Art. 6 para. 1 sentence 1 lit. f GDPR. The legitimate interest of GS1 Germany is to offer participants the opportunity to make contact with other participants or through other participants. Furthermore, we would like to create the best possible conditions for networking for all participants.
  

d. Credit check

If we make advance payments, we reserve the right to obtain credit information based on mathematical-statistical procedures from the following company(ies) in order to safeguard our legitimate interests:
Creditreform Boniversum GmbH, Hellersbergstraße 11, 41460 Neuss(www.boniversum.de)
BID Bayerischer Inkasso Dienst AG, Weichengereuth 26, 96450 Coburg(www.bid-coburg.de)
For this purpose, we transmit the personal data required for a credit check and use the information received on the statistical probability of a payment default. The credit report may contain probability values (score values) that are calculated on the basis of scientifically recognized mathematical-statistical procedures. A large number of characteristics, such as income, address data, occupation, marital status and previous payment history, are used to determine the customer's future risk of non-payment. The result is expressed in the form of a payment value (so-called score). The information obtained in this way forms the basis of our decision on the establishment, execution or termination of the contractual relationship. However, the choice of one of the payment methods offered is not dependent on such information.

We process your personal data for the establishment, performance and termination of the contract on the basis of the following legal grounds:

• to fulfill a contract or to carry out pre-contractual measures in accordance with Art. 6 para. 1 lit. b GDPR,
• to safeguard our legitimate interests in accordance with Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in the financial security of our advance performance, to prevent fraud and to establish identity. Furthermore, the legitimate interests of third parties lie in the protection against payment default and the prevention of fraud.
  

e. Newsletter, advertising emails and press mailing list

Data processing when registering for the email newsletter
If you register for our newsletter, we process the data required for this or separately provided by you in order to regularly send you our email newsletter.

Data processing when registering for the press mailing list

If you register for our press mailing list, we will process the data required for this or separately provided by you in order to regularly send you our press releases. The following data is processed:

In doing so, we process the information shown or requested in the respective input forms (voluntary information is marked with the addition "if applicable"):

Editorial office details

• Publisher, if applicable
• Medium, if applicable
• Street, if applicable
• PO no., if applicable
• Zip code, if applicable
• City, if applicable
• Country, if applicable

Details of the participant:

• Salutation
• Department, if applicable
• Position, if applicable
• First name and surname
• Title, if applicable
• Telephone number, if applicable
• E-mail
  

Use of data for e-mail advertising
If we receive your e-mail address in connection with the conclusion of a contract and the provision of our products or services and you have not objected to this, we reserve the right to regularly send you offers for similar products or services from our range by e-mail. You can object to this use of your email address at any time by sending a message to the contact option specified above or via a link provided for this purpose in the advertising email, without incurring any costs other than the transmission costs according to the basic rates.
We process your personal data for sending our newsletter on the basis of the following legal bases:

• for sending the newsletter on the basis of your consent to the processing of personal data given via the double opt-in procedure in accordance with Art. 6 para. 1 lit. a GDPR; and
• for e-mail advertising in the cases mentioned to safeguard our legitimate interests in accordance with Art. 6 para. 1 lit. f GDPR in conjunction with § Section 7 (3) UWG; our legitimate interest lies in direct advertising for our products and services.

During the performance of the contract, we process your personal data as follows:

a. Provision of services

Insofar as this is necessary for the performance of the contract, we process your personal data for the provision of services, e.g. to contact you, to coordinate appointments, to clarify queries and to provide services.

We process your personal data for the establishment, performance and termination of the contract on the basis of the following legal grounds:

• To fulfill a contract or to carry out pre-contractual measures in accordance with Art. 6 para. 1 lit. b GDPR.
  

b. Payment

We use payment service providers and banks to process payments.
We process your personal data for the establishment, performance and termination of the contract on the basis of the following legal bases

• For the fulfillment of a contract or for the implementation of pre-contractual measures pursuant to Art. 6 para. 1 lit. b GDPR.
  

c. Customer survey

GS1 Germany collects feedback from its customers at regular intervals and on various occasions to update master data and total annual sales.

GS1 Germany uses the survey tool "Dynamics 365 Customer Voice" (operated by Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA) to conduct customer surveys. Dynamics 365 Customer Voice is a feedback management application that allows us to easily update our customer metrics and information. The insights gained can then be merged using the service. The personal data collected with Dynamics 365 Customer Voice is only processed within the European Union. The use of the Dynamics 365 Customer Voice service is in our legitimate interest (Art. 6 I p. 1 f GDPR), as we can use the service to optimize data quality and ensure the annual usage price according to the terms and conditions and price list. You can view Microsoft's privacy policy here: https://privacy.microsoft.com/de-de/privacystatement

We also process your personal data in order to fulfill other legal obligations that apply to us in connection with the execution of the contract. These include, in particular, retention periods under commercial, trade or tax law.

We process your personal data for the establishment, performance and termination of the contract on the basis of the following legal grounds

• to fulfill a legal obligation to which we are subject pursuant to Art. 6 para. 1 lit. c GDPR in connection with commercial, trade or tax law, insofar as we are obliged to record and store your data and in connection with other relevant regulations or official orders (e.g. in criminal law).

We also process your personal data in order to assert our rights and enforce our legal claims. We also process your personal data in order to be able to defend ourselves against legal claims. Finally, we process your personal data insofar as this is necessary to defend against or prosecute criminal offenses.
We process your personal data to enforce our rights:

• to safeguard our legitimate interests in accordance with Art. 6 para. 1 lit. f GDPR, insofar as we assert legal claims or defend ourselves in legal disputes or we prevent or investigate criminal offenses.

Initially, only our employees receive knowledge of your personal data. In addition, we share your personal data with other recipients who provide services for us in connection with our website or the data processing described above outside the website, insofar as this is permitted or required by law. We limit the disclosure of your personal data to what is necessary, in particular to process your order. In some cases, our service providers receive your personal data as processors and are then strictly bound by our instructions when handling your personal data. In some cases, the recipients act independently with your data that we transmit to them.

Below we list the categories of recipients of your personal data:

• Where applicable, payment service providers and banks, when processing payment, as well as credit agencies to check creditworthiness,
• IT service providers for the administration and hosting of our website or the operation of our apps
• IT service providers for sending press releases,
• IT service providers who provide software to conduct virtual conferences, meetings or similar communications,
• debt collection agencies and legal advisors in the assertion of our claims
• other event participants, including the participating GS1 Germany Solution Partners, for the possibility of establishing contact with other participants or through other participants,
• public bodies and institutions insofar as we are legally obliged to do so.

When using Google tools, we transfer your shortened IP address to the USA, among other things. In addition, data may also be transferred outside the EU/EEA when using tools from Microsoft, LinkedIn, Hotjar and Facebook.

If service providers are used outside the EU/EEA third country and there is no so-called "adequacy decision" of the EU Commission for this country, these service providers are obliged to comply with the level of data protection in Europe in addition to written instructions by agreeing the EU standard contractual clauses. Unfortunately, however, due to the laws of non-EU countries (e.g. under the so-called Cloud Act in the USA), even if appropriate agreements and regulations are concluded, there is a possibility that government agencies in particular may access your personal data without us or you being able to find out or prevent, stop or control this. For these reasons, your consent, e.g. for the use of cookies (e.g. for Google Analytics), also includes the purpose of data transfer to countries outside the EU. You can obtain further information from our data protection officer.

Otherwise, we do not transfer your personal data to countries outside the EU or the EEA or to international organizations.

1. informational use of the website

When you use our website purely for information purposes, we store your personal data on our servers for the duration of your visit to our website. After you have left our website, your personal data is usually deleted immediately. However, we store server log files for a period of 1 month.

The storage periods of the cookies we use may differ from this and can be up to 2 years. Please refer to the overview at the beginning of this privacy policy or our consent management/cookie banner for precise information on the storage periods of the cookies we use.

You have the option of deleting installed cookies yourself at any time or deactivating them via our Consent Management/Cookie Banner.

When you actively use our website, make contact inquiries, conclude contracts and register for events outside the website and when executing contracts, we initially store your personal data for as long as is necessary, for example, to answer your inquiry, execute the contract or maintain our business relationship. This also includes the initiation of a contract (pre-contractual legal relationship) and the execution of a contract.

In addition, we then store your personal data until any legal claims arising from the relationship with you become time-barred in order to use it as evidence if necessary. The limitation period is usually between 1 and 3 years, but can also be up to 30 years.

We delete your personal data when the limitation period expires, unless there is a statutory retention obligation, for example under the German Commercial Code (Sections 238, 257 (4) HGB) or the German Fiscal Code (Section 147 (3), (4) AO). These retention obligations can last from two to ten years.

You are entitled to the following rights as a data subject under the legal requirements, which you can assert against us:

Right of access: You are entitled to request confirmation from us at any time under Art. 15 GDPR as to whether we are processing personal data concerning you; if this is the case, you are also entitled under Art. 15 GDPR to receive information about this personal data and certain other information (including processing purposes, categories of personal data, categories of recipients, planned storage period, your rights, the origin of the data, the use of automated decision-making and, in the case of third country transfer, the appropriate guarantees) and a copy of your data.

Right to rectification: In accordance with Art. 16 GDPR, you are entitled to demand that we rectify the personal data stored about you if it is inaccurate or incorrect.

Right to erasure: You have the right, under the conditions of Art. 17 GDPR, to demand that we erase personal data concerning you without undue delay. The right to erasure does not exist, among other things, if the processing of personal data is necessary for (i) the exercise of the right to freedom of expression and information, (ii) for compliance with a legal obligation to which we are subject (e.g. statutory retention obligations) or (iii) for the establishment, exercise or defense of legal claims.

Right to restriction of processing: You are entitled to demand that we restrict the processing of your personal data under the conditions of Art. 18 GDPR.

Right to data portability: You have the right to request that we provide you with the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format in accordance with the requirements of Art. 20 GDPR.

Right of revocation: You have the right to revoke your consent to the processing of personal data at any time with effect for the future.

Right to object: You are entitled to object to the processing of your personal data under the conditions of Art. 21 GDPR, so that we must stop processing your personal data. The right to object exists only within the limits provided for in Art. 21 GDPR. In addition, our interests may conflict with the termination of processing, so that we are entitled to process your personal data despite your objection.

Right to lodge a complaint with a supervisory authority: You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes the GDPR, subject to the requirements of Art. 77 GDPR. The right to lodge a complaint is without prejudice to any other administrative or judicial remedy.

The supervisory authority responsible for us is:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-
Westfalen
Kavalleriestr. 2-4
40213 Düsseldorf
Phone: 0211/38424-0
Fax: 0211/38424-10
Email: poststelle@ldi.nrw.de

However, we recommend that you always address a complaint to our data protection officer first.

If possible, your requests to exercise your rights should be addressed in writing to the address given above or directly to our data protection officer.

In principle, you are not obliged to provide us with your personal data. However, if you do not do so, we will not be able to make our website available to you, answer your inquiries to us or enter into a contract with you. Personal data that we do not necessarily require for the above-mentioned processing purposes is marked as voluntary information with an "if applicable" or another symbol.

We do not use automated decision-making or profiling (an automated analysis of your personal circumstances).

I. You have the right to object at any time to the processing of your data on the basis of Art. 6 (1) f GDPR (data processing on the basis of a balancing of interests) or Art. 6 (1) e GDPR (data processing in the public interest) if there are reasons for this arising from your particular situation.

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims.

II. We also process your personal data in individual cases for the purpose of direct advertising. If you do not wish to receive advertising, you have the right to object to this at any time. We will observe this objection for the future. We will no longer process your data for direct marketing purposes if you object to processing for these purposes.

The objection can be made informally and should preferably be addressed to

GS1 Germany GmbH
Stolberger Straße 108 a
50933 Cologne
widerspruch(at)gs1-germany.de