Data protection

The person responsible within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws as well as other data protection regulations is:

classmarkets GmbH Ziegelstraße 29 D-10117 Berlin Phone:  49 (0)30 / 549 05 80 10 Fax:  49 (0)30 / 549 05 80 99 Email: info[at]classmarkets.com

Our data protection officer can be contacted by e-mail at privacy-contact[at]classmarkets.com or by post at our postal address. In the latter case, please mark the envelope "Attn: Data Protection Officer".

For reasons of better legibility, no distinction was made between male and female personal designations.

1. General information on data processing

1.1. Processing of personal data and its purpose

classmarkets GmbH (hereinafter "classmarkets GmbH" or "we") only processes personal data of users to the extent necessary to provide a functional website and our content and services. When you visit our website, the following data is processed:

• Referrer (previously visited website) Requested website or file Browser type and browser version Operating system used Device type used Time of access IP address in anonymous form (only used to determine the location of access)

The processing and temporary storage of the IP address is necessary to enable delivery of the website to the user's computer. The visitor's IP is transmitted when a page is called up, is anonymized immediately after transmission and is processed without personal reference. The data listed above is stored in log files to ensure the functionality of the website. In addition, the data (in the anonymized form described above) is used to optimize our websites and to ensure the security of our information technology systems. Any processing of personal data takes place exclusively for the stated purposes and to the extent necessary to achieve these purposes.

1.2. Legal bases for the processing of personal data

We process your personal data for the purpose of fulfilling a contract or initiating a contract if you use our services on the basis of a contract concluded with us or are interested in our services (Art. 6 Para. 1 lit. b DS-GVO ). The data and the log files are stored on the basis of Article 6 (1) (f) GDPR. The provisions in paragraph 6 of this data protection declaration also apply to applicants.

1.3. Data Erasure and Storage Duration

The personal data of the persons concerned will be deleted or blocked by us as soon as the purpose of storage no longer applies. In the case of data processing for the provision of the websites, deletion takes place when the respective session has ended. Storage beyond this is possible if the IP addresses of the users have been deleted or alienated beforehand, so that it is no longer possible to assign the calling client.

2. Contact form and email contact

There is a contact form on our website which can be used to contact us electronically. If a user takes advantage of this option, the data entered by him in the input mask will be transmitted to us and stored:

• Full NameEmail AddressPhone NumberMessageSent Date and Time

Alternatively, you can contact us via the email address provided. In this case, the user's personal data transmitted with the e-mail will be stored by us. The legal basis for processing the data is Art. 6 (1) (f) GDPR. If contact is aimed at concluding a contract, Article 6 (1) (b) GDPR is the legal basis. The data will only be used to process the contact and the subsequent communication. In this context, the data will not be passed on to third parties. The personal data from the input mask of the contact form and those sent by e-mail will be deleted when the respective communication with the user has ended, ie as soon as it can be inferred from the circumstances that the facts in question have been finally clarified.

3. Newsletter

On request, interested customers can order a customer newsletter from us by contacting us personally by e-mail or telephone. If you register for the newsletter, the following personal data will be processed by us:

• First Name, Last NameEmail AddressCompanyFunction

For the processing of the data, the user's consent is obtained during the registration process and reference is made to this data protection declaration. There is no transfer of data to third parties in connection with data processing for sending newsletters. The data will only be used to send the newsletter. The legal basis for the processing of personal data after registering for the newsletter is Article 6 (1) (a) GDPR. The user's e-mail address will be stored by us for as long as the subscription to the newsletter is active. The subscription can be canceled at any time by clicking on the corresponding link contained in each newsletter. The personal data will then be deleted immediately. The user can also unsubscribe from the newsletter by e-mail or telephone. We will then manually delete the personal data for the newsletter.

4. Data protection information for online meetings, telephone conferences and webinars via "Zoom" and "Google Meet"

We would like to inform you below about the processing of personal data in connection with the use of "Zoom" or "Google Meet".

purpose of processing

We use the tools "Zoom" or "Google Meet" to conduct telephone conferences, online meetings, video conferences and/or webinars (hereinafter: "online meetings"). This is particularly the case due to the pandemic or when discussions cannot be carried out on site due to great physical distance.

"Zoom" is a service of Zoom Video Communications, Inc., which is based in the United States.

"Google Meet" is a video conferencing service provided by Google Ltd, which is based in the USA.

Responsible

classmarkets GmbH is responsible for data processing directly related to the implementation of "online meetings".

Note: If you call up the "Zoom" or "Google Meet" websites, the respective providers of "Zoom" and "Google Meet" are responsible for data processing. However, calling up the website is only necessary to use “Zoom” or “Google Meet” in order to download the software for using “Zoom” or “Google Meet”.

You can also use "Zoom" if you enter the respective meeting ID and, if necessary, other access data for the meeting directly in the "Zoom" app.

If you do not want to or cannot use the apps, you can also use "Zoom" and "Google Meet" via a browser version, which you can also find on the respective websites.

Which data are processed?

Various types of data are processed when using “Zoom” and “Google Meet”. The scope of the data also depends on what information you provide before or when you participate in an "online meeting". Depending on the tool, not all information is always requested, so it may vary depending on the tool.

The following personal data are subject to processing:

User information: first name, last name, phone (optional), email address, password (if "single sign-on" is not used), profile picture (optional),

department (optional)

Meeting metadata: topic, description (optional), participant IP addresses, device/hardware information.

When dialing in with the telephone: information on the incoming and outgoing phone number, country name, start and end time. If necessary, further connection data such as the IP address of the device can be saved.

Text, audio and video data: You may have the option of using the chat, question or survey functions in an "online meeting". In this respect, the text you enter will be processed in order to display it in the "online meeting" and, if necessary, to log it. In order to enable the display of video and the playback of audio, the data from the microphone of your end device and from any video camera on the end device are processed accordingly for the duration of the meeting. You can switch off or mute the camera or microphone yourself at any time via “Zoom”/ “Google Meet”.

In order to take part in an "online meeting" or to enter the "meeting room", you may at least have to provide information about your name.

scope of processing

We use "Zoom" and "Google Meet" to conduct "online meetings". If we want to record "online meetings", we will inform you transparently in advance and - if necessary - ask for your consent. The fact of the recording will also be shown to you in the “Zoom” app and on “Google Meet”. The recording function for “Google Meet” has been deactivated.

If necessary for the purposes of logging results of an online meeting, we will log the chat content. However, this will usually not be the case.

In the case of webinars, we can also process the questions asked by webinar participants for the purpose of recording and following up on webinars.

If you are registered with "Zoom" as a user, reports on "online meetings" (meeting metadata, telephone dial-in data, questions and answers in webinars, survey function in webinars) can be stored on "Zoom" for up to one month.

If you are registered as a "Google Meet" user, reports about "online meetings" (meeting metadata, telephone dial-in data, questions and answers in webinars, polling function in webinars) can be uploaded to "Google Meet" for up to one month deletion are stored.

Automated decision-making within the meaning of Art. 22 GDPR is not used.

Legal bases of data processing

Insofar as personal data is processed by employees of classmarkets GmbH, Section 26 BDSG is the legal basis for data processing. If, in connection with the use of "Zoom" and "Google Meet", personal data is not required for the establishment, implementation or termination of the employment relationship, but is nevertheless an elementary part of the use of "Zoom" and "Google Meet", Art 6 Paragraph 1 lit. f) GDPR is the legal basis for data processing. In these cases, our interest is in the effective implementation of "online meetings".

Otherwise, the legal basis for data processing when conducting "online meetings" is Art. 6 (1) (b) GDPR, insofar as the meetings are held within the framework of contractual relationships.

If there is no contractual relationship, the legal basis is Article 6 Paragraph 1 Letter f) GDPR. Here, too, we are interested in the effective implementation of "online meetings".

Recipients / disclosure of data

Personal data processed in connection with participation in "online meetings" are generally not passed on to third parties unless they are intended to be passed on. Please note that content from "online meetings" as well as from face-to-face meetings is often used to communicate information with customers, interested parties or third parties and is therefore intended to be passed on.

Other recipients: The providers of "Zoom" and "Google Meet" necessarily receive knowledge of the above data, insofar as this is provided for in the context of our order processing contracts with "Zoom" and "Google".

Data processing outside the European Union

"Zoom" and "Google Meet" are services provided by a provider from the USA. Processing of the personal data also takes place in a third country. We have concluded an order processing contract with the provider of “Zoom” and “Google Meet”, which meets the requirements of Art. 28 GDPR.

An appropriate level of data protection is guaranteed by the conclusion of the so-called EU standard contractual clauses.

More information about all services can be found here:

Zoom: https://explore.zoom.us/de/privacy/

Google Meet: https://support.google.com/meet/answer/9852160?hl=de#zippy=

Data Protection Officer

Our data protection officer can be contacted by e-mail at privacy-contact[at]classmarkets.com or by post at our postal address. In the latter case, please mark the envelope "Attn: Data Protection Officer".

Your rights as a data subject

You have the right to information about the personal data concerning you. You can contact us at any time for information.

In the case of a request for information that is not made in writing, we ask for your understanding that we may require evidence from you that proves that you are the person you say you are.

Furthermore, you have the right to correction or deletion or to restriction of processing, insofar as you are legally entitled to this.

Finally, you have the right to object to the processing within the framework of the legal requirements.

A right to data portability also exists within the framework of data protection regulations.

deletion of data

We generally delete personal data when there is no need for further storage. A requirement can exist in particular if the data is still required in order to fulfill contractual services, to be able to check and grant or ward off warranty and, if necessary, guarantee claims. In the case of statutory storage obligations, deletion can only be considered after the respective storage obligation has expired.

Right to lodge a complaint with a supervisory authority

You have the right to complain to a data protection supervisory authority about the processing of personal data by us.

Changes to this privacy notice

We revise this data protection information in the event of changes in data processing or for other reasons that make this necessary. You can always find the current version on this website.

5. Privacy Policy for Applicants

On our websites, we offer applicants the opportunity to apply for advertised vacancies by providing personal data. The data is entered into an input mask and transmitted to classmarkets via the HR tool perbit (perbit GmbH) and saved. We only collect personal data that is required for the application process. In order to fully examine an application, it is necessary for us to have information on the previous professional career of the applicant. The following data is collected:

• Salutation, title (optional) First name, surname Email address Private telephone number (optional) Earliest possible starting date (optional) Application documents (curriculum vitae, cover letter (optional), certificates (optional)) IP address of the calling computer Date and time of registration.

The personal data provided by applicants as part of their application will be processed by us exclusively for the purpose of selecting applicants. When processing applications, we limit ourselves to the information provided directly by the applicants. This may also include information that applicants have stored in professional online networks or job exchanges. If, as part of the application process, we ask for the gender of the applicant in the form of the desired salutation, this is solely because we want to address or address the applicant in the correct manner. Applicants who have applied to a specific classmarkets job vacancy and whose application documents have been reviewed and show that they cannot be considered for this position, we offer the opportunity to review their application for other classmarkets vacancies. However, before we pass on the personal data to other areas within classmarkets, we contact the applicants so that they can decide whether they are interested in the procedure described. The processing of personal data in the context of the application form takes place on the basis of Article 6 Paragraph 1 lit. a GDPR or Article 88 Paragraph 1 GDPR in conjunction with Section 26 BDSG. The data will be deleted by us six months after an application has been rejected, unless the applicant has consented to his or her personal data being included in our pool of applicants.

Further data protection information for applicants can be found here.

6. Security

classmarkets uses technical and organizational security measures to protect users' personal data against accidental or intentional manipulation, loss, destruction or access by unauthorized persons. Our security measures are continuously improved in line with technological developments.

7. Rights of the data subject

If classmarkets GmbH processes your personal data, you are the data subject pursuant to Art. 4 No. 1 DS-GVO with the following rights towards classmarkets GmbH:

7.1. right of providing information

In accordance with Art. 15 GDPR, you can request confirmation from us as to whether personal data relating to you will be processed by us. If we process your personal data, you can request information from us about the following:

• the processing purposes; the categories of your personal data that we process; the recipients or categories of recipients to whom we have disclosed or will disclose your personal data; (where possible) the planned duration for which we will store your personal data or, if this is not possible, the criteria for determining the storage period; the existence of a right to rectification or erasure of personal data concerning you, a right to restriction of processing by us or a right to object to this processing; the existence of a right to lodge a complaint a supervisory authority; all available information about the origin of the data, provided that the personal data is not collected from the data subject; the existence of automated decision-making including profiling (Art. 22 Para. 1 and 4 DS-GVO) and - at least in these cases – meaningful information en about the logic involved and the scope and envisaged effects of such processing for you.

You have the right to request information as to whether your personal data is being transmitted to a third country or to an international organization. In this context, you can request to be informed of the appropriate guarantees pursuant to Article 46 GDPR in connection with the transmission.

7.2. Right to Rectification

In accordance with Art. 16 DS-GVO, you have the right to request us to correct and/or complete incorrect personal data concerning you.

7.3. Right to Erasure

According to Art. 17 DS-GVO, you can demand that your personal data be deleted immediately. We are obliged to delete your data immediately if one of the following reasons applies:

• Your personal data is no longer necessary for the purposes for which it was collected or otherwise processed. You revoke your consent to which we based the processing in accordance with Article 6 (1) (a) GDPR or Article 9 Paragraph 2 lit. a DS-GVO and there is no other legal basis for the processing. You object to the processing in accordance with Article 21 Paragraph 1 DS-GVO and there are no overriding legitimate reasons for the processing , or you object to the processing in accordance with Art. 21 Para Your personal data was collected in relation to information society services offered in accordance with Art. 8 Para. 1 GDPR.

If we have made your personal data public and are obliged to delete them in accordance with Art. 17 Para process the personal data that you, as the data subject, have requested them to delete all links to your personal data or copies or replications of your personal data.

The right to erasure does not exist if processing is necessary

• to exercise the right to freedom of expression and information; to comply with a legal obligation to which we are subject or to perform a task carried out in the public interest or in the exercise of official authority vested in us; for reasons of public interest in the area of public health (Art. 9 Para. 2 lit. h and i as well as Art. 9 Para. 3 DS-GVO); for archiving purposes in the public interest, scientific or historical research purposes or for statistical purposes in accordance with Art. 89 Para. 1 DS-GVO, insofar as the law mentioned makes it impossible or seriously impairs the achievement of the objectives of this processing, or to assert, exercise or defend legal claims.

7.4. Right to restriction of processing

Under the following conditions, you can request the restriction of the processing of your personal data in accordance with Art. 18 DS-GVO:

• if you contest the accuracy of your personal data for a period that enables us to verify the accuracy of the personal data; the processing is unlawful and you refuse to delete the personal data and instead request that the use of the personal data be restricted; we process your personal data You no longer need the data for the purposes of processing, but you need them to assert, exercise or defend legal claims, or if you have lodged an objection to the processing pursuant to Art. 21 Para. 1 DS-GVO and it is not yet clear whether our legitimate reasons outweigh your reasons.

If the processing of your personal data has been restricted, this data - apart from its storage - may only be used with your consent or to assert, exercise or defend legal claims or to protect the rights of another natural or legal person or for reasons of an important public interest of the Union or a Member State are processed. If the restriction of processing has been restricted according to the above conditions, you will be informed by us before the restriction is lifted.

7.5. right to information

If you have asserted the right to correction, deletion or restriction of processing against us, we are obliged under Art. 19 DS-GVO to inform all recipients to whom we have disclosed your personal data of this circumstance, unless this proves to be the case proves to be impossible or involves a disproportionate effort. You have the right to be informed about these recipients.

7.6. Right to data portability

In accordance with Art. 20 GDPR, you have the right to receive your personal data that you have provided to us in a structured, common and machine-readable format. You also have the right to transmit this data to another person responsible without hindrance from us, provided that

• the processing is based on consent (Art. 6 Para. 1 lit. a DS-GVO or Art. 9 Para. 2 lit. a DS-GVO) or on a contract in accordance with Art. 6 Para. 1 lit. b DS- GMO is based and the processing is carried out using automated procedures.

In exercising this right, you also have the right to have your personal data transmitted directly by us to another person responsible, insofar as this is technically feasible. The freedoms and rights of other people must not be impaired by this. The right to data portability does not apply to the processing of personal data that is required to perform a task that is in the public interest or in the exercise of official authority that has been delegated to us.

7.7. Right to object

Pursuant to Article 21 GDPR, you have the right, for reasons arising from your particular situation, to object at any time to the processing of your personal data, which is based on Article 6 Paragraph 1 lit. e or f GDPR to file an objection; this also applies to profiling based on these provisions. We will not subsequently process your personal data further unless we can demonstrate compelling legitimate grounds for our processing that outweigh your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

7.8. Right to revoke the declaration of consent under data protection law

You have the right to revoke your declaration of consent under data protection law at any time, for example by sending an email to privacy-contact@classmarkets.com. The revocation of the consent does not affect the legality of the processing carried out on the basis of the consent up to the point of revocation.

7.9. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your place of residence, your place of work or the place of the alleged infringement, if you believe that the processing of your personal data carried out by us violates the GDPR.

Stand: October 2022