Privacy Policy

1. Scope of the Privacy Policy

At Red Bull Hangar-7 GmbH (“Company” or “we” or “our”), we place the highest priority on respecting your data privacy. This privacy policy (“Policy”) describes how we collect and process information from which you can be directly or indirectly identified (“Personal Data”) when you interact with us through our digital offerings (including our websites and mobile applications (“apps”), social media channels, stores, events, or other products and services. It also describes how your Personal Data is used, shared, and protected, the choices you have regarding your Personal Data and how you can contact us.

For some of our products or services, the way in which we may use or collect your Personal Data may differ from what is set forth in this Policy; for such cases we will clearly link you to any dedicated policies within this Policy.

We may change this Policy from time to time. If we make any important changes to this Policy (for example changes that affect the Personal Data we collect, or how or why we use it), then we will inform you about those changes and the date of the changes at the top of this Policy.

2. Who is responsible for processing your Personal Data?

The respective Company responsible for the processing of your Personal Data (“Data Controller”) will depend on how you interact with us, and where you are located in the world. The respective Data Controller is included within each data processing activity in this Policy.

For certain products or services, two Companies or one Company and another third party may jointly determine how your Personal Data is used (“Joint Controllers”) for the purposes identified in this Policy. Whenever we act as a Joint Controller, we act based on a specific arrangement that sets out the distribution of agreed roles and responsibilities of each party for compliance with their obligations. Such joint controllership arrangements govern in particular:

• How and which Joint Controller shall provide the information to data subjects on the underlying data processing;
  
• Which Joint Controller shall be the designated point of contact for communication with data subjects and supervisory authorities; and,
  
• Which Joint Controller shall be responsible for the notification of a personal data breach to supervisory authorities and data subjects.
  

Further details regarding Joint Controllerships are provided in the specific section for the respective Personal Data processing activity.

3. How do we collect Personal Data from you?

There are several ways we may collect your Personal Data depending on how you interact with us. Below are several examples. However, for more detailed information on each category of Personal Data we collect, please visit the section “How and why do we use your Personal Data?”.

• Personal Data you provide us directly: You may provide us with your Personal Data directly, for example when you use our websites or apps, participate in our events or promotions, subscribe to our newsletters, purchase our products or services, create a user account, visit one of our restaurants, or communicate with us through one of our social media platforms.
  
• Personal Data we collect automatically: When you use our websites or apps, we may automatically collect certain types of information, such as information about your visit or page interactions.
  
• Personal Data we receive from other sources: We may also receive your information about you from other sources if you use any of our websites or apps, or services. We are also working closely with third parties (including for example sub-contractors in technical, payment and delivery services), credit agencies (for example, if you purchase from our online shops), business and sponsorship partners and may receive information about you from them (including information that is publicly available).
  

4. How and why do we use your Personal Data?

Here you will find detailed information about the different ways in which we process Personal Data when you use our products or services, in particular which categories of Personal Data we collect and with which third parties (if any) we share the Personal Data.

a) OUR WEBSITES

i. Provision of the Website (Creation of Log Files)

Purpose of Data Processing
You can visit or use our websites without having to create a user account and actively disclose your Personal Data. However, each time you visit one of our websites, your browser automatically transmits certain information to us. Such information is stored by us in so-called server log files (log files).

We may process your Personal Data for the following purposes, including to:

• Provide and deliver our websites and to guarantee the functionality of our websites;
  
• Optimize our websites (e.g., to improve loading times);
  
• Ensure the security and stability of our IT systems.
  

Legal Basis for Data Processing
The temporary storage and processing of this Personal Data is based on our legitimate interests to ensure the stability and functionality of our websites.

Categories of Personal Data
The following Personal Data may be collected:

• Browser information (e.g., IP address, browser type and version, operating system and interface used, language and version of the browser software, etc.);
  
• Date and time of access and time zone difference to Greenwich Mean Time (GMT);
  
• Volume of data transmitted in bytes;
  
• Websites from which the user's system accesses our websites;
  
• Websites accessed by the user's system via our websites;
  
• Access status / HTTP status code.
  

Data Recipient(s)
Your Personal Data may be transferred to:

• IT service providers (e.g., hosting providers, cloud service providers, etc.);
  
• Backup and disaster recovery specialists.
  

Data Controller
The Data Controller of the data processing is the company named in the imprint of the respective website.

Storage Duration
In as much as the Personal Data are stored in log files, these files will only be retained for as long as necessary for the respective data processing.

ii. Cookies and Similar Technologies

When you visit our websites, we process Personal Data using cookies and similar technologies (e.g., tags, web beacons, local/session storage, and JavaScript) (hereinafter collectively “Cookies”). Cookies are small text files that are stored on your end device (PC, laptop, tablet, or smartphone). These text files are downloaded by your browser when you visit our websites for the first time. When you visit a website again with the same device or browser, the Cookie and the information stored in it are either sent back to the website that created them (first party Cookie) or sent to another website to which it belongs (third-party Cookie). As a result, the website "recognizes" that it is the same user and adjusts the display of content on the website.

Our cookie settings automatically appear at the first visit of our websites. You can set your personal preferences within the cookie settings. Unless the use of a Cookie is absolutely necessary for example for technical reasons, you may accept or decline the use of such Cookies. You can change your cookie settings any time via the cookie settings in the footer of the respective website. Cookies already stored can be deleted at any time. If Cookies are deactivated for our website, it is possible that you will not be able to take full advantage of all the functions of the website.

We use Cookies for the following purposes:

• To provide basic functions of the websites and provide any services requested by you, e.g., to save your cookie settings or to offer secure areas for logged-in users (more on this in detail under “Absolutely Necessary Cookies”);
  
• For analysis of website usage ("web statistics"), so that we can continuously improve our digital offerings and better tailor them to our users’ needs and interests (for more information see " Performance Cookies");
  
• For the professional presentation of the content of our websites, e.g., by integrating map material video services (for more on this see " Third Party Service Embeds”);
  
• To personalize our offers, e.g., to display personalized advertising on the end device used, (for more information see “Marketing Cookies”).
  

a. Absolutely Necessary Cookies

Purpose of Data Processing
We use Absolutely Necessary Cookies to:

• Administer our websites for internal operations, including troubleshooting purposes and to understand any errors you may encounter on our websites;
  
• Provide basic functions for our websites. Without these Cookies, we cannot provide core services, such as shopping carts;
  
• Keep our websites safe and secure and to help manage and administer our IT systems; and,
  
• Improve use and content of our websites to ensure that the content is presented in the most effective way for you and your devices.
  

Legal Basis for Data Processing
The temporary storage and processing of Personal Data is based on our legitimate interests to:

• Provide our products or services to you, including fully functional websites and the services you require;
  
• Ensure that our websites and IT are secure and are being used in an appropriate manner.
  

Categories of Personal Data, Storage Duration and Categories of Data Recipient(s)
You can find further information about which Absolutely Necessary Cookies we use, as well as what categories of Personal Data we process, for how long we store and to which third parties we transfer them in the cookie settings on the respective website.

Data Recipients
Your Personal Data will be transferred to IT service providers (e.g., hosting providers, cloud service providers, consent management providers, log-in service providers).

Data Controller
The Data Controller for the Personal Data processing is the company named in the imprint of the respective website.

b. Performance Cookies

Purpose of Data Processing
Subject to your consent, we will process your information to measure and improve the performance of our websites (for example, by counting visits and traffic sources to help us understand which pages are the most and least popular and see how visitors move around the websites).

Should you not consent to such processing, this will not have a direct effect on the functioning of the websites, but without the information gained using the Performance Cookies it will be more difficult for us to further develop our websites.

You can find further information about which Performance Cookies we use, what purpose they serve and how long they are stored for in the cookie settings on the respective website.

Legal Basis for Data Processing
The collection and processing of this Personal Data is based on your consent, where applicable in conjunction with the provisions of the E-Privacy Directive or its national implementation. You can withdraw your consent at any time and without giving any reasons. However, the withdrawal of consent does not affect the lawfulness of the processing before the withdrawal.

Categories of Personal Data
The following Personal Data may be collected, for example Personal Data about:

• Your visit including the URL clickstream to, through and from our websites;
  
• The page views and the usage of the application within a session (e.g., number of clicks, length of visit to certain pages);
  
• The origin of the first request;
  
• Your device, operating system and browser;
  
• The device location;
  
• Videos you have viewed, searched for or accessed;
  
• Download or playback errors;
  
• Video player and the playing mode;
  
• Promotions placed on the websites.
  

Data Recipient(s)
Your Personal Data will be transferred to IT service providers (e.g., consent management providers, log-in service providers and cloud hosting providers).

Data Controller
The Data Controller for the data processing is the company named in the imprint of the respective website.

Storage Duration
Cookie data shall be stored for thirty (30) minutes after the last hit has been processed, but for a maximum of 3.5 hours after being set (browser session).

Your browser's "sessionStorage" and "localStorage" store data in the browser; "sessionStorage" is stored temporarily and session storage data are gone when you close the browser tab (also referred to as “browser session”). The ”localStorage“ is persistent, meaning it has no expiration date. You may erase them by deleting your browser's history or deleting the local storage (depending on the browser you used).

c. Third Party Service Embeds

On our websites, we integrate content from third-party providers to provide you with an engaging user experience. The following section provides you with information concerning the data processing activities resulting from the use of such embedded third-party content. In a first step, we provide you with general information on the use of third-party embeds applicable to several third-party embed providers. This is followed by more detailed information on the processing activities regarding specific third-party content, which is of particular importance to us.

i. General Information on Third-Party Service Embeds

Purpose of the Data Processing
On some of our websites, we integrate interactive third-party content, applications, or plug-ins (together “Content”) to provide an engaging user experience.

Examples of such Content include interactive maps, video players, social media plug-ins or interactive functions such as commenting or sharing. Subject to your consent, third parties who provide the Content may collect Personal Data about your use of such Content and may process information from you, which will be used by them in accordance with their own privacy policies. We therefore recommend that you also read the privacy notices and information of the respective third-party content provider as detailed below.

We process Personal Data in relation to the use of third party embeds for the following purposes, including to:

• Improve use and content of our websites, to ensure that the content is presented in the most effective way for you and your devices;
  
• Provide a consistent experience across devices and platforms.
  

The third-party providers of this Content collect the Personal Data mentioned for advertising, market research and/or needs-based design of its website. Such an evaluation is carried out (even for users who are not logged in or users without a corresponding account) to provide needs-based advertising and to inform other users of the social network about your activities on our websites. You have a right to object to the creation of these user profiles, although you must contact the respective third-party provider of the Content to exercise this right.

Legal Basis for Data Processing
The processing of this Personal Data is based on your consent. You can withdraw your consent at any time and without giving any reasons. However, the withdrawal of consent does not affect the lawfulness of the processing before the withdrawal.

Third-party embeds set Cookies on your browser to store Personal Data. We therefore recommend that you read the section about Cookies in this Policy as well as the cookie policy of the respective embed provider.

Categories of Personal Data
The Personal Data collected in relation to the use of third party embeds may include:

• IP address;
  
• Referrer URL (the webpage that sends visitors to our websites using a link);
  
• Information about the operating system and its interface;
  
• Cookie-based data (for example Cookies set to ensure the workability of social plugins);
  
• User device information (language settings, location, browser type and version);
  
• Date and time of the request;
  
• Time zone difference to Greenwich Mean Time (GMT);
  
• Content of the request (specific page);
  
• Access status/HTTP status code;
  
• Location.
  

Data Recipient(s)
If you consent to the use of our third-party embeds, your Personal Data may be shared with the third party providing the embed. For an overview of the third-party embeds in use, see cookie settings of the respective website.

Data Controller
Depending on the specific third-party embed, the company named in the imprint either:

• acts as a Joint Controller with the respective company providing the third-party content for the collection and disclosure by transmission to the company providing the third-party content of the Personal Data. Regarding the further processing activities both Data Controllers act as independent Data Controllers respectively. Concerning further processing activities performed by the company providing the third-party content, such as the potential processing for market research purposes, this company acts as an independent Data Controllers; for further information, please consult the privacy policy of the respective company; or,
  
• acts as an independent Data Controllers for the data processing activities. The respective company providing the third-party content shall act as independent Data Controllers for the data processing activities performed by the company. For further information, please consult the privacy policy of the respective company.
  

Storage Duration
As regards storage duration of any third-party cookies that are set within the third-party embed, please refer to the privacy policy of the respective company providing the third-party content.

ii. Specific Third-Party Service Embeds

This section provides you with information on third-party embeds of specific third-party providers. For further information, please consult the privacy policy of the third-party content provider as linked below.

Facebook (Privacy Policy of Facebook available here)

Purpose of the Data Processing
On our websites, we integrate interactive third-party content from Facebook to provide an engaging user experience. This includes the embedding of Facebook posts, Facebook photos, Facebook videos, Facebook Plugins (e.g., the “Like” or “Share” button) and Facebook Pixel.

We will process this information to:

• Improve use and content of our websites to ensure that the content is presented in the most effective way for you and your devices;
  
• Provide a consistent experience across devices and platforms.
  Subject to your consent, Facebook who is providing this content may collect data about your use of such Content and may process information from you which will be used in accordance with the Facebook Privacy Policy. We therefore recommend that you also read the privacy policy of Facebook.
  

Legal Basis for Data Processing
The data processing is based on your consent. You can withdraw the consent at any time and without giving reasons; however, the withdrawal of consent does not affect the lawfulness of the processing before the withdrawal.

Facebook also sets Cookies on your browser to store Personal Data, we therefore recommend you read our Policy carefully and to look at Facebook’s privacy policy.

Categories of Personal Data
The following Personal Data may be collected depending on the specific Facebook tool and if you have a Facebook Account or are logged in:

• Facebook Account data (Name, Preferences, Likes, etc);
  
• IP address;
  
• Information about the operating system and its interface;
  
• Cookie-based data (for Cookies set to ensure the workability of posts, photos, videos and plugins);
  
• Date and time of the request;
  
• Content of the request (the specific post, video, photo);
  
• Access status/HTTP status code.
  

Data Recipients
If you consent to the use of the respective Facebook embed, your Personal Data may be shared with Facebook Ireland Ltd., 4 Grand Canal Square Grand Canal Harbour, Dublin 2, Ireland.

Facebook operates data centers globally. Facebook uses Standard Contractual Clauses (SCCs) as adopted by the EU Commission as basis for data transfers to recipients outside the European Economic Area (EEA). These clauses oblige Facebook to comply with the EU‘s level of data protection when processing relevant data outside the EEA.

Data Controller
If your Personal Data is collected and forwarded via our embedded Facebook components, the Company named in the imprint of the respective website and Facebook Ireland Ltd. are Joint Controllers with respect to the data processing. Joint commitments were also set out in a publicly available agreement here. Among other things, it states that we must clearly inform you about the use of Facebook tools on our website. We are also responsible for ensuring that the tools are securely integrated into our websites and are in accordance with the applicable privacy laws.

Facebook, on the other hand, is for example responsible for the data security of Facebook’s products. If you have any questions about Facebook’s data collection and processing, you can contact Facebook directly. Should you direct the question to us, we are obliged to forward it to Facebook. However, should any further processing occur, then Facebook is solely responsible for this Personal Data. Data subjects may exercise their rights with respect to their Personal Data processed by Facebook Ireland directly against Facebook Ireland. For further information regarding the data processing performed by Facebook, including the legal basis and the possibilities to enforce data subject rights, consult the privacy policy by Facebook.

Storage Duration
As regards storage duration of Facebook, please refer to Facebook’s privacy policy.

Instagram (Privacy Policy of Instagram available here)

Purpose of the Data Processing
On our websites, we integrate interactive Instagram features such as content including photos and videos as well as plug-ins to provide an engaging user experience.

We will process this information to:

• Improve use and content of our websites to ensure that the content is presented in the most effective way for you and your devices;
  
• Provide a consistent experience across devices and platforms.
  

Legal Basis for Data Processing
The processing is based on your consent. You can withdraw the consent at any time and without giving reasons; however, the withdrawal of consent does not affect the lawfulness of the processing before its withdrawal.

Instagram also sets Cookies on your browser to store Personal Data, we therefore recommend you read our Policy carefully and look at the Instagram privacy policy.

Categories of Personal Data
The following Personal Data may be collected depending on if you have an Instagram account or are logged into your Instagram Account:

• Instagram Account data (e.g., name, addresses, phone numbers);
  
• IP address;
  
• Information about the operating system and its interface;
  
• Cookie-based data (for Cookies set to ensure the workability of posts, photos, videos and plugins);
  
• Date and time of the request;
  
• Content of the request (the specific post, video, photo);
  
• Access status/HTTP status code.
  

Data Recipients
Whenever you visit our websites that have Instagram functions (i.e., Instagram photos or plugins) integrated to them, your browser automatically connects with Instagram’s servers. Thereby, if you consent to the use of the respective Instagram embed, Personal Data is sent to, as well as saved and processed by Instagram. This always happens, whether you have an Instagram account or not. Instagram shares the information obtained within the Meta businesses.

Instagram is maintained by:

Meta Platforms, Inc.
1601 Willow Rd
Menlo Park
CA 94025
USA

Instagram operates data centers globally. Instagram uses standard contractual clauses adopted by the EU Commission as basis for Personal Data transfers to recipients outside the EEA. These clauses oblige Instagram to comply with the EU level of data protection when processing relevant data outside the EEA.

Data Controller
If your Personal Data is collected and forwarded via our embedded Instagram components, the Company named in the imprint of the respective website and Meta Platforms, Inc. are Joint Controllers with respect to the data processing. Joint commitments were also set out in a publicly available agreement here. Among other things, it states that we must clearly inform you about the use of Instagram tools on our website. We are also responsible for ensuring that the tools are securely integrated into our website and are in accordance with the applicable privacy laws. Instagram, on the other hand, is for example responsible for the data security of Instagram’s products. If you have any questions about Instagram’s Personal Data collection and processing, you can contact Instagram directly. Should you direct the question to us, we are obliged to forward it to Instagram. However, should any further processing occur, then Instagram is solely responsible for this Personal Data. Data subjects may exercise their rights with respect to their Personal Data processed by Instagram directly against Instagram. For further information regarding the data processing performed by Instagram, including the legal basis and the possibilities to enforce data subject rights, consult the privacy policy by Instagram.

Storage Duration
Company does not store any Personal Data collected via Instagram embeds. As regards storage duration of Instagram, please refer to Instagram’s privacy policy.

Google Maps (Privacy Policy of Google available here)

Purpose of the Data Processing
On our websites, we integrate Google Maps provided by Google LLC (1600 Amphitheatre Parkway Mountain View, CA 94043, USA) to allow for an engaging user experience. With the use of Google Maps, we can show you locations in a better way and can therefore adjust our service to your needs.

We will process this information to:
* Provide a useful and meaningful experience on our websites;
* Improve the use and content of our website by offering you essential information on various locations, e.g., for route planning.

Subject to your consent, Google LLC may collect Personal Data about your use of Google Maps and may process Personal Data from you which will be used by Google in accordance with their privacy policy.

Legal Basis for Data Processing
The processing of the Personal Data is based on your consent. If no consent has been given, Google Maps content is not loaded and thus no Personal Data is transmitted or retained. You can withdraw the consent at any time and without giving reasons; however, the withdrawal of consent does not affect the lawfulness of the processing before the withdrawal.

Google Maps also sets cookies on your browser to store Personal Data, we therefore recommend you read our Policy carefully and look at Google’s privacy policy.

Categories of Personal Data
The following Personal Data may be collected depending if you are signed into your Google Account on your device:

• IP address;
  
• Referrer URL;
  
• Longitude and latitude coordinates (location data);
  
• Entered start address when using the route planner function;
  
• Entered search terms;
  
• Cookie-based data;
  
• Date and time of the request;
  
• Google Account information.
  

Data Recipients
If you consent to the use of Google Maps, your Personal Data may be shared with:

Google LLC
1600 Amphitheatre Parkway Mountain View
CA 94043
USA

Google operates data centers globally.

Google uses standard contractual clauses adopted by the EU Commission as basis for data transfers to recipients outside the EEA. These clauses oblige Google to comply with the EU level of data protection when processing relevant data outside the EEA.

Data Controller
The Data Controller of the data processing is the company named in the imprint of the respective website.

If your Personal Data is collected and forwarded via the embedded Google Maps API, Google LLC acts as independent Data Controller for the subsequent data processing performed by Google. If you have any questions about Google’s data collection and processing, you can contact Google directly or consult Google’s privacy policy.

Storage Duration
As regards storage duration of the third parties, please refer to Google’s privacy policy.

Google reCAPTCHA (Privacy Policy of Google available here)

Purpose of the Data Processing
On our websites, we integrate Google reCAPTCHA of the company Google LLC (1600 Amphitheatre Parkway Mountain View, CA 94043, USA) to provide an experience as secure and protected as possible, and to avoid unwanted bots or spam software. Therefore, we are doing everything we can to stay protected and to offer you the highest possible user friendliness. Using reCAPTCHA, Personal Data is transmitted to Google to determine whether you genuinely are human. reCAPTCHA thus ensures our website’s and subsequently your security. Without reCAPTCHA it could happen for example that a bot would register as many email addresses as possible when registering, to subsequently “spam” forums or blogs with unwanted advertising content. With reCAPTCHA we can avoid such bot attacks.

We will process this information to provide a secure and protected user experience.

Legal Basis for Data Processing
The processing of this Personal Data is based on your consent. If no consent has been given, the Google reCAPTCHA content shall not be loaded and thus no Personal Data shall be transmitted or retained. You may withdraw the consent at any time and without giving reasons. However, the withdrawal of consent does not affect the lawfulness of the processing before its withdrawal.

Google reCAPTCHA also sets Cookies on your browser to store Personal Data, we therefore recommend you read our Policy carefully and to look at Google’s privacy policy.

Categories of Personal Data
The following Personal Data may be collected depending if you are signed into your Google Account on your device:

• IP address;
  
• Referrer URL;
  
• information on the operating system;
  
• mouse and keyboard behavior;
  
• Cookie-based data;
  
• Date and language settings;
  
• All JavaScript objects;
  
• Screen resolution.
  

Data Recipients
If you consent to the use of Google reCAPTCHA, your Personal Data may be shared with:

Google LLC
1600 Amphitheatre Parkway
Mountain View
CA 94043
USA

Google operates data centers globally.

Google uses standard contractual clauses adopted by the EU Commission as basis for data transfers outside the EEA. These clauses oblige Google to comply with the EU level of data protection when processing relevant data outside the EEA.

Data Controller
The Data Controller of the data processing is the company named in the imprint of the respective website.

If your Personal Data is collected and forwarded via the embedded Google reCAPTCHA API, Google acts as independent controller for the data processing performed by Google. If you have any questions about Google’s data collection and processing, you can contact the company directly or consult the privacy policy by Google.

Storage Duration
As regards storage duration of the third parties, please refer to Google’s privacy policy.

YouTube (Privacy Policy of Google available here)

Purpose of the Data Processing
On our websites, we integrate YouTube videos to provide an engaging user experience. With the help of our embedded videos, we can provide you helpful content in addition to our texts and images. YouTube is a video portal operated by Google LLC (1600 Amphitheatre Parkway Mountain View, CA 94043, USA). When you visit a page on our website that contains an embedded YouTube video, your browser automatically connects to the servers of YouTube/Google. Thereby, certain data are transferred (depending on the settings).

We will process this information to:

• Provide a useful and meaningful experience on our websites;
  
• Improve the use and quality on our websites.
  

Subject to your consent, Google LLC, which is providing this content, may collect and process personal data from you in accordance with their privacy policy.

Legal Basis for Data Processing
The processing of this Personal Data is based on your consent. You can withdraw the consent at any time and without giving reasons; however, the withdrawal of consent does not affect the lawfulness of the processing before the withdrawal.

YouTube also sets Cookies on your browser to store Personal Data, we therefore recommend you read our Policy carefully and look at Google’s privacy policy.

Categories of Personal Data
The following Personal Data may be collected depending on if you are logged into your YouTube account:

• IP address;
  
• Referrer URL;
  
• Date, time and language of the request;
  
• Access status/HTTP status code;
  
• YouTube account data (including session duration, approximate location, browser type).
  

Data Recipients
If you consent to the use of YouTube, your Personal Data may be shared with:

Google LLC
1600 Amphitheatre Parkway
Mountain View
CA 94043
USA

Google operates data centers globally.

Google uses standard contractual clauses adopted by the EU Commission as basis for data transfers to recipients outside the EEA. These clauses oblige Google to comply with the EU’s level of data protection when processing relevant data outside the EEA.

Data Controller
The Data Controller of the data processing is the company named in the imprint of the respective website.
If your Personal Data is collected and forwarded via the embedded YouTube content, Google LLC acts as independent Data Controller for the data processing performed by Google. If you have any questions about Google’s data collection and processing, you can contact the company directly or consult the privacy policy by Google available.

Storage Duration
As regards storage duration of the third parties, please refer to Google’s YouTube’s privacy policy.

Spotify (Privacy Policy of Spotify available here)

Purpose of the Data Processing
On our websites, we integrate Spotify embeds to provide an engaging user experience. With the help of our embedded Spotify podcasts, albums, artists, tracks and playlists, we can provide you helpful content in addition to our texts, images and videos. Spotify is an audio streaming and media services provider operated by Spotify AB, Regeringsgatan 19, 111 53 Stockholm, Sweden. When you visit a page on our websites that contain embedded Spotify content, you automatically connect to the servers of Spotify. Thereby, certain data are transferred (depending on the settings).

We will process this information to:

• Provide a useful and meaningful experience on our websites;
  
• Improve the use and quality on our websites.
  

Subject to your consent, Spotify AB who is providing this content may collect and process personal Data from you which will be used by Spotify in accordance with their privacy policy.

Legal Basis for Data Processing
The processing of this Personal Data is based on your consent. You can withdraw the consent at any time and without giving reasons. However, the withdrawal of consent does not affect the lawfulness of the processing before the withdrawal.

Spotify also sets Cookies on your browser to store Personal Data, we therefore recommend you read our Policy carefully and look at Spotify’s privacy policy.

Categories of Personal Data
The following Personal Data may be collected depending on if you have a Spotify Account or are logged in with your device:

• Spotify Account data (e.g., name, preferences);
  
• IP address;
  
• Information about the operating system and its interface;
  
• Cookie-based data (e.g., for Cookies set to ensure the workability);
  
• Date and time of the request;
  
• Content of the request (e.g., specific track, episode, playlist);
  
• Access status/HTTP status code.
  

Data Recipients
If you consent the use of the Spotify embed, your data may be shared with:

Spotify AB
Regeringsgatan 19
111 53 Stockholm
Sweden

Spotify operates data centers globally. Spotify uses standard contractual clauses approved by the EU Commission as basis for data transfers to recipients outside the EEA. These clauses oblige Spotify to comply with the EU level of data protection when processing relevant data outside the EEA. In addition to these clauses, Spotify implements additional technical measures such as encryption or pseudonymization.

Data Controller
The Data Controller is the company named in the imprint of the respective website.

If your Personal Data is collected and forwarded via the embedded Spotify API, Spotify AB acts as independent Data Controller for the data processing performed by Spotify. If you have any questions about Spotify’s data collection and processing, you can contact the company directly or consult the privacy policy by Spotify.

Storage Duration
As regards storage duration of the third parties, please refer to Spotify’s privacy policy.

Vimeo (Privacy Policy of Vimeo available here)

Purpose of the Data Processing
On our websites, we integrate Vimeo videos to provide an engaging user experience. With the help of our embedded videos, we can provide you helpful content in addition to our texts and images. Vimeo is a video portal operated by Vimeo.com Inc., 555 West 18th Street New York, NY 10011 USA. When you visit a page on our website that contains an embedded Vimeo video, your browser automatically connects to the servers of Vimeo. Thereby, certain Personal Data are transferred to Vimeo.

We will process this information to:

• Provide a useful and meaningful experience on our websites,
  
• Improve the use and quality on our website.
  

Subject to your consent, Vimeo.com Inc., who is providing this content may collect and process Personal Data from you which will be used by Vimeo.com in accordance with their privacy policy.

Legal Basis for Data Processing
The processing of this Personal Data is based on your consent. You can withdraw the consent at any time and without giving reasons. However, the withdrawal of consent does not affect the lawfulness of the processing before the withdrawal.

Vimeo also sets Cookies on your browser to store Personal Data, we therefore recommend you read our Policy and look at Vimeo’s privacy policy.

Categories of Personal Data
The following Personal Data may be collected depending on if you are logged into your Vimeo account:

• IP address;
  
• Referrer URL;
  
• Date, time and language of the request;
  
• Technical information about your browser type, operating system and device information;
  
• Access status/HTTP status code;
  
• Vimeo account data.
  

Data Recipients
If you consent to the use of Vimeo, your Personal Data may be shared with:

Vimeo.com Inc.
555 West 18th Street
New York,
NY 10011
USA

Vimeo operates data centers globally. Vimeo uses standard contractual clauses adopted by the EU Commission as basis for data transfers to recipients outside the EEA. These clauses oblige Vimeo to comply with the EU‘s level of data protection when processing relevant data outside the EEA.

Data Controller
The Data Controller is the company named in the imprint of the respective website.

If your Personal Data is collected and forwarded via the embedded Vimeo content, Vimeo.com acts as an independent Data Controller for the subsequent data processing performed by Vimeo. If you have any questions about Vimeo’s data collection and processing, you can contact the company directly or consult the privacy policy by Vimeo.

Storage Duration
As regards storage duration of the third parties, please refer to Vimeo’s privacy policy.

iii. User Accounts

Purpose of the Data Processing
If you are a regular user of our websites, you may wish to create a user account (hereinafter “Account”) with us. An Account enables you to access certain services and may offer further functionalities (such as managing marketing communications or modifying your user setting preferences). Some accounts enable you to access other Company platforms (“Participating Platforms”) and visualize information from those Participating Platforms in your Account profile. Your Personal Data will be processed to:

• Create and manage your account and manage our relationship with you. Also, to communicate with you regarding your Account and our services;
  
• Improve use and content of our websites to ensure that the content is presented in the most effective way for you and your devices;
  
• Communicate with you and keep you up to date with our activities and events (subject to your prior consent if legally required). For example, to inform you via email or social media about products and services that may interest you;
  
• Provide a consistent experience across devices and platforms.
  

Legal Basis for Data Processing
The temporary storage and processing of this Personal Data is based on legitimate interests to provide you with an engaging and fully functioning user account service.

Categories of Personal Data
The Personal Data you provide when setting up an Account include:

• First and last name;
  
• Email address;
  
• Social media credentials (if applicable).
  

Data Recipient(s)
Your Personal Data will be transferred to IT service providers (e.g., hosting providers, cloud service providers, customer identity and access management providers, customer relationship management providers etc.).

If you are using your Facebook, Google or Apple Account to log-in on our websites or services, please look at the respective section describing Social Log-in Function.

Data Controller
The Data Controller is the company named in the imprint of the respective website.

Storage Duration
We store your Account credentials until you terminate your Account or if you are inactive for three consecutive years. You can terminate your Account directly in your Account profile settings.

iv. Social Log-In Function

Purpose of the Data Processing
We offer you the option to use your existing social network credentials (for example Facebook, Twitter, or Google) for user authentication, to create or log into your user account or any mobile apps.

By authenticating your user credentials via your social media account, you authorize us to collect, store and use any log-in information that you grant permission to provide us, for example to pre-populate some data fields on your account and profile pages.

You can manage what Personal Data you would like to share with us through the privacy controls and settings on each third-party social-networking site, or via the access authorization screen of the respective social network provider. However, we have no control over how the respective social network provider processes your Personal Data in connection with the log-in. We therefore recommend that you carefully read the Privacy Policy of the respective provider.

Legal Basis for Data Processing
The data processing performed by Company is based on your consent. You can withdraw your consent at any time and without giving reasons; however, the withdrawal of consent does not affect the lawfulness of the processing before the withdrawal.

Depending on the social log-in of your choice, the data processing by the social log-in provider is either based on your consent (Facebook, Apple, LinkedIn, Twitter) or the legitimate interest in offering you a quick and easy registration process (Google).

Categories of Data
If you use a social network profile for user authentication, subject to your access permission, we may be provided access to the following categories of Personal Data, for example:
Facebook:

• First and last name;
  
• Email address;
  
• Age;
  
• Gender;
  
• Browser information (e.g., IP address, browser type and version, operating system, language).
  

Google:

• First and last name;
  
• Email address;
  
• Address;
  
• Browser information (e.g., IP address, browser type and version, operating system, language).
  

LinkedIn:

• First and last name;
  
• LinkedIn identity;
  
• Interests on LinkedIn;
  
• Browser information (e.g., IP address, browser type and version, operating system, language).
  

Twitter:

• Twitter name;
  
• Bio data;
  
• Profile photo;
  
• Preferred language;
  
• Browser information (e.g., IP address, browser type and version, operating system, language).
  

Apple:

• First and last name;
  
• Email;
  
• Browser information (e.g., IP address, browser type and version, operating system, language).
  

Furthermore, if you decide to log-in by using your social network credentials, the respective social network provider may set various Cookies in your browser to ensure that the social plug-in works on our websites or apps, for example by identifying log-in activity and to protect users.

Data Recipient(s)
In connection with a social log-in, your Personal Data may be shared with the following recipients:

Facebook: Your Personal Data will be transmitted to:

Facebook Ireland Ltd.,
4 Grand Canal Square Grand Canal Harbour,
Dublin 2,
Ireland

Meta Platforms, Inc.
1 Hacker Way,
Menlo Park,
California,
USA

Facebook Ireland will process this Personal Data as a Joint Controller. Details on how Facebook processes this data can be found in Facebook’s privacy policy.

Google: Your Personal Data will be transmitted to:

Google LLC
Amphitheater Parkway
Mountain View
CA 94043
USA

Google LLC will process this Personal Data as a Joint Controller. Details on how Google processes this Personal Data can be found in Google’s privacy policy.

LinkedIn: Your Personal Data will be transmitted to:

LinkedIn Corporation
1000 W Maude Ave
Sunnyvale
CA 94085
USA

Details on how LinkedIn processes this data can be found in LinkedIn’s privacy policy.

Twitter: Your Personal Data will be transmitted to:

Twitter Inc.
1355 Market Street
Suite 900
San Francisco
CA 94103
USA

Details on how Twitter processes this data can be found in Twitter’s privacy policy.

Apple: Your Personal Data will be transmitted to:

Apple Inc.
Apple Park Way
Cupertino
California
USA

Details on how Apple processes this data can be found in Apple’s privacy policy.

The recipients operate data centers globally. The recipients use standard contractual clauses adopted by the EU Commission as basis for data transfer to recipients outside of the EEA. These clauses oblige the respective recipient to comply with the EU‘s level of data protection when processing relevant Personal Data outside the EEA.

Data Controller
The Data Controller of the data processing is the company named in the imprint of the respective website or app.

This respective Company shall act as Joint Controller with Facebook for the collection and transfer of Personal Data to Facebook. Joint commitments were also set out in a publicly available agreement here. Among other things, it states that we must clearly inform you about the use of Facebook tools on our websites. We are also responsible for ensuring that the tools are securely integrated into our websites and are in accordance with the applicable privacy laws. Facebook, on the other hand, is for example responsible for the data security of Facebook’s products. If you have any questions about Facebook’s data collection and processing, you can contact Facebook directly. Should you direct the question to us, we are obliged to forward it to Facebook. However, should any further processing occur, then Facebook is solely responsible for this Personal Data. Data subjects may exercise their rights with respect to their data processed by Facebook Ireland directly against Facebook Ireland. For further information regarding the data processing performed by Facebook, including the legal basis and the possibilities to enforce data subject rights, consult the privacy policy by Facebook.

If your Personal Data is collected and forwarded to LinkedIn, Twitter, Google or Apple, these companies and their affiliates act as independent Data Controllers for the data processing they perform. If you have any questions regarding the data processing, please contact the companies directly or consult the respective privacy policy for further information.

Storage Duration
Company does not store any Personal Data collected via social log-ins. As regards storage duration of the third parties, please refer to their respective privacy policy.

v. Promotions and Sweepstakes

Purpose of the Data Processing
We offer you the opportunity to participate in our activations and/or promotions (hereinafter “Promotion(s)”). Such Promotions are organized either by us or through a third-party cooperation partner.

We process the Personal Data you provide to us when taking part in the Promotion for the following purposes, including to:

• Administer and carry out the Promotion, such as the drawing of winners and the sending of a prize, or the registration and participation in a Promotion;
  
• Communicate with you and keep you up to date about our activities and events (subject to your prior consent if legally required); for example, to inform you via email or social media about products and services that may interest you; and,
  
• Manage any concerns or requests on your behalf relating to the Promotion.
  

Participation in our Promotions is always voluntary. However, to participate in our Promotions, it is necessary that you provide us with a minimum of Personal Data and that we process this Personal Data.

This Personal Data may also include content that you generate (User-Generated Content). Depending upon what you decide to share with us, such Personal Data may include a photo or video of you and other people (subject to their consent) being part of the published content.

If we organize a Promotion through a third-party cooperation partner, we may also share your Personal Data with the cooperation partner, who may also process your Personal Data while administering and carrying out the Promotion. We therefore recommend that you also read the Privacy Policy of the respective cooperation partner.

Legal Basis for Data Processing
The data processing for the execution of the Promotion is carried out based on the necessity to perform the contract.

Categories of Data
The Personal Data we may process in connection with the participation in our Promotions may include:

• First and last name;
  
• Email address;
  
• Postal address (to send prizes);
  
• Phone number;
  
• User generated content, depending on what you decide to share with us (e.g., answer options you have chosen, uploaded photos, videos, contributions, texts, social media posts, audios, etc.);
  
• Any communication in connection with the Promotion.
  

Data Recipient(s)
Depending on the type of Promotion, your Personal Data may be shared with the following recipients:

• Cooperation partners (with whom we carry out joint Promotions or who provide us with prizes, so we recommend that you also read the privacy policies of the respective cooperation partner);
  
• IT service providers;
  
• Shipping providers.
  

Data Controller
The Data Controller is the company named in the Promotion terms and conditions. To the extent we act as a Joint Controller, we will inform you as part of the registration process.

Storage Duration
We only keep Personal Data for as long as needed to achieve the purposes of the data processing.

vi. Online Shops

Purpose of the Data Processing
We run various online shops in which you can buy a variety of different items (e.g., clothing, merchandise).

We process your Personal Data to:

• Provide and improve our products or services offered in our online shops, for example, to provide you with and manage the products or services that you have requested and/or purchased;
  
• Provide customer service and manage any concerns or requests, for example provide services to you after your order has been shipped (e.g., in the event of any cancellations, or refunds).
  

Legal Basis for Data Processing
The data processing for processing your order (this includes the conclusion of the contract, pre-contractual obligations and the immediate fulfillment of the contract) is carried out based on performing the contract.

The data processing in connection with a credit check or address verification is based on our legitimate interest. Our legitimate interest is to request information about your creditworthiness or address verification to better assess the risk associated with an advance performance on our part.

The data processing in the context of fiduciary collection is carried out for the purpose of performing the contract.

Categories of Data
The Personal Data we process in connection with our online shops includes:

• First name and last name;
  
• Postal address;
  
• Email address;
  
• Telephone number;
  
• Order information, for example content of the order, clothing size, proof of delivery etc.);
  
• Financial payment information;
  
• Any communication in connection with your purchase.
  

Data Recipient(s)
In connection with your order in our online shops, your Personal Data may be shared with the following recipients:

• IT service providers;
  
• Hosting service providers;
  
• Payment service providers;
  
• Shipping/logistics providers;
  
• Collection service providers;
  
• Credit agencies (e.g., for creditworthiness assessment);
  
• Debt collection service providers (in the event of non-payment).
  

Data Controller
The Data Controller is the company named in the imprint of the respective online shop in which you have made your purchase.

Please note that the respective payment service providers and logistic partners act as independent Data Controllers for any Personal Data provided and processed as part of the payment process. Therefore, please consult the privacy policies of the payment service provider and logistics partners, to find out the details of their data processing.

Storage Duration
The Personal Data regarding the individual orders and transactions are stored in accordance with the applicable tax and accounting retention obligations.

vii. Consumer Requests

a. Chatbots

Purpose of the Data Processing
We offer our Chatbot as a virtual assistance tool aiding consumers in submitting queries and/or feedback to us relating to our products, services and events.

We shall process your Personal Data to provide customer service and manage any concerns or requests, for example providing services to you after your order has been shipped, in the event of any cancellations, or refunds.

Legal Basis for Data Processing
The data processing in connection with our Chatbot tool is based on our legitimate interest. Our legitimate interest is to:

• Provide our products or services to you, including to ensure the highest possible functionality and usability of the Chatbot and the necessary interface software;
  
• Improve the functionality of our websites;
  
• Better understand how you use our products, services, websites and apps and to make improvements.
  

Categories of Data
In connection with our Chatbot service, we may process the following categories of Personal Data, including:

• First and last name;
  
• Email address;
  
• Postal address (depending on the nature of the request);
  
• Phone number (if this is the preferred channel of communication);
  
• Content of the request.
  

Data Recipient(s)
In connection with our Chatbot tool, your Personal Data will be transferred to:

• IT service providers (e.g., hosting providers, cloud service providers, customer identity and access management providers, customer relationship management providers etc.).
  

Data Controller
The Data Controller of the data processing is the company named in the imprint of the respective website. This company shall act as Joint Controllers with Red Bull Hangar-7 GmbH, Am Brunnen 1, 5330 Fuschl am See, AUSTRIA. The Joint Controllers have determined their respective responsibilities.

Storage Duration
We only keep Personal Data for as long as needed to achieve the purposes of the data processing.

b. Contact Us

Purpose of the Data Processing
Should you need to contact us, for example for information, to exercise your privacy rights or to submit a concern, we offer you various ways to get in touch such as via our website contact form, email, postal mail, or by telephone. Your request will be forwarded to the responsible department.

We shall process your Personal Data to:

• Provide an efficient customer care service and manage any concerns or requests on your behalf;
  
• Provide and improve our products and services you have requested.
  

Legal Basis for Data Processing
The data processing in connection with contacting us for information, disclosure or complaint purposes is based on our legitimate interest. Our legitimate interest is to:

• Process your requests in a customer-friendly and service-oriented manner;
  
• Provide our products and services to you;
  
• Better understand how you use our products, services, websites and apps and to make improvements;
  
• To make any necessary disclosures in response to requests which we are legally required to comply with to law enforcement or any regulatory authorities or bodies.
  

If you are contacting us in connection with the conclusion of a contract, in a pre-contractual context, or in connection with the direct fulfillment of a contract, the Personal Data will be processed for the purpose of performing the contract.

The data processing in connection with the exercise of your data subject rights is carried out for the compliance with a legal obligation.

Categories of Data
Contacting us is always voluntary. For us to properly process your request and thus be able to help you, you must provide us with a certain minimum of Personal Data, and we must process this Personal Data. Without this minimum required data processing, we are not able to process your request.

Depending on how you contact us, we process the following categories of Personal Data:

• First name and last name;
  
• Email address;
  
• Content of the message or reason for contacting.
  

Data Recipient(s)
Depending on how the contact is made and on what request you have, your Personal Data may be shared with the following recipients:

• IT service providers (e.g., hosting providers, cloud service providers);
  
• Social media networks;
  
• Shipping providers;
  
• Cooperation partners.
  

Data Controller
The Data Controller is the Company whom you contacted.

Storage Duration
We only keep your Personal Data for as long as needed to achieve the purposes of the data processing.

vii. Job Applications

You can find information on how we process your Personal Data within the respective recruitment policy here that will be provided to you as part of the job application process.

b) OUR APPS

i. Provision of apps, creation of log files and hosting

Purpose of the Data Processing
The purpose of the processing of Personal Data in this context is to ensure trouble-free operation of the app and to improve our offer. With this Personal Data, we ensure the permanent functionality of our information technology systems and technology. In addition, this Personal Data is evaluated by Company with the aim of increasing data security and data protection. In this way, we can ensure an optimal level of protection for your Personal Data.

Categories of Data
We process the Personal Data including:

• IP address;
  
• Date and time of access;
  
• Device information (Device Model, Browser Version, Operating System, Advertising IDs or Device IDs)
  
• Traffic source - internet page from which our app is accessed (in the case of a link).
  

Data Recipient(s)
In connection with the provision of our apps, we may share your Personal Data with the following recipients:

• IT service providers (e.g., hosting providers, cloud service providers);
  
• Backup and disaster recovery specialists.
  

Legal Basis for Data Processing
This data processing is carried out based on our legitimate interest to provide and optimize our online services and to improve data security.

Data Controller
The Data Controller is the Company named in the terms and conditions of the respective app.

Storage Duration
We only keep Personal Data for as long as needed to achieve the purposes of the data processing.

ii. Third Party Software and Software Development Kits (SDKs)

Our App make use of third-party software tools and SDKs. An SDK is a set of tools that provides a developer with the ability to integrate certain functionality to an app. Sometimes SDKs require that Personal Data is processed.

Absolutely Necessary SDKs

Purpose of the Data Processing
When using absolutely necessary SDKs, we use this information to:

• Administer our app for internal operations, including troubleshooting purposes and optimization of video delivery as well to understand any errors you may encounter on our apps;
  
• Provide basic functions of our apps. Without these SDKs, we cannot provide core services as mentioned in the terms and conditions of the apps;
  
• Keep our apps safe and secure and to help manage and administer our IT systems.
  

Categories of Data
The following Personal Data may be collected:

• Device information (Device model, browser version, operating system, advertising IDs or device IDs);
  
• Date and time of access;
  
• Information about the performance of the app, it’s content (e.g., video loading times) or crashes.
  

Data Recipient(s)
Your Personal Data may be transferred to:

• IT service providers (e.g., hosting providers, cloud service providers, video service providers);
  
• Backup and disaster recovery specialists.
  

Legal Basis for Data Processing
The temporary storage and processing of this data is based on legitimate interests including to provide basic functions for our apps and to keep our apps safe and secure.

Data Controller
The Data Controller for the data processing is the company named in the terms and conditions of the respective app.

Storage Duration
We only keep Personal Data for as long as needed to achieve the purposes of the data processing.

Performance SDKs

Purpose of the Data Processing
Subject to your consent, we will process your Personal Data to:

• Improve use and content of our apps to ensure that the content is presented in the most effective way for you and your devices;
  
• Measure and improve the performance of our app and its content (for example to identify the most visited sections of the app or popularity of certain content).
  

Should you not consent to such processing, this will not have a direct effect on the functioning of the apps, but without such statistical data it will be more difficult for us to troubleshoot and further develop the app.

Categories of Data
The following Personal Data may be collected, including:

• Usage of the application within a session (e.g., number of clicks, length of visit to certain sections);
  
• Device information (e.g., operating system, language settings, location);
  
• Content you see, browse or play;
  
• Where you navigate within the app.
  

Data Recipient(s)
Your Personal Data will be transferred to IT service providers (e.g., hosting providers, cloud service providers, consent management providers, analytics providers, log-in service providers).

Legal Basis for Data Processing
The temporary storage and processing of this data is based on your consent.

Data Controller
The Data Controller for the data processing is the company named in the terms and conditions of the respective app.

Storage Duration
We only keep Personal Data for as long as needed to achieve the purposes of the data processing.

Marketing SDKs

Purpose of the Data Processing
On some of our apps, we integrate interactive third-party content or third-party SDKs to provide an engaging user experience.

Examples of such Content include interactive maps, ads, social media plug-ins or interactive functions such as commenting or sharing. Subject to your consent, third parties who are providing this Content may collect Personal Data about your use of such Content and may process information from you which will be used by them in accordance with their Privacy Policy, which may differ from ours. Based on this data, content or advertising tailored to you can be offered. We therefore recommend that you also read the Privacy Policy of the respective third-party content provider.

We will process this Personal Data to:

• Improve use and content of our apps to ensure that the content is presented in the most effective way for you and your devices;
  
• Provide a consistent experience across devices and our platforms.
  

Categories of Data
The following Personal Data which may be collected by the third party, include:

• Device information (Device model, browser version, operating system, advertising IDs or device IDs);
  
• Content of the access (specific page);
  
• Location (if location services are activated).
  

The third-party providers of this Content collect the Personal Data mentioned for advertising, market research and/or needs-based design of its tools. Such an evaluation is carried out to provide needs-based advertising and to inform other users of the social network about your activities on our app. You have a right to object to the creation of these user profiles, although you must contact the respective third-party provider of the Content to exercise this right.

Data Recipient(s)
Your Personal Data will be transferred to IT service providers (e.g., advertising partners and service providers, analytics providers, social media services, communication service providers).

Legal Basis for Data Processing
The processing of this Personal Data is based on your consent.

Data Controller
The Data Controller for the data processing is the company named in the terms and conditions of the respective app.

Storage Duration
We only keep Personal Data for as long as needed to achieve the purposes of the data processing.

iii. In-App Store purchases and downloads

(Privacy Policy of Apple available here and the Google Play Store and Google available here)

In App Purchases

In-app purchases are additional services or content, such as upgrades or premium specials, that you can purchase in addition to the app's standard features. If we offer you the possibility of in-app purchases in our apps, the respective app store providers will be involved in connection with the purchase and payment processing.

We have no control over how your data is processed by these third parties in connection with purchase and payment processing. We therefore recommend you read the Privacy Policy of Apple, the Google Play Store and Google as linked above. The Data Controller for all processing activities in connection with the purchase and payment processing is therefore the respective app store provider.

App downloads

Our apps are available for download in so-called “app stores” (e.g., Apple App Store, Google Play Store, etc.). These app stores are operated by third parties. Therefore, to download our apps, you first need to register with the relevant app stores or provide your Personal Data during the download.

We have no control over how the respective app stores process your Personal Data in connection with any registration in the app store or the download of an app. We therefore recommend you read the Privacy Policy of Apple and the Google Play Store and Google.

iv. Push Notifications

Purpose of the Data Processing
Push notifications are a communication channel which we use to complement our other channels (for example email, and SMS) to distribute information (subject to your consent) regarding news and similar items. Push notifications are small pop-up messages that are sent to your user device by a mobile app that appear even when the app is not open. These notifications convey specific information, such as reminders to upcoming events, updates.

Subject to your consent, we process your Personal Data to:

• Communicate with you and keep you up to date with our activities and events and make recommendations to you about products or services that may interest you;
  
• Improve use and content of our apps to ensure that it is presented in the most effective manner for you;
  
• To manage our relationship with you and to communicate with you.
  

You must actively consent to receive push notifications. If you no longer wish to receive push notifications, you can disable this feature at any time. This can be done directly on the app that is distributing the push notifications or in the settings of your user device.

Legal Basis for Data Processing
The data processing is based on your consent.

Categories of Data
If you activate the sending of push notifications, we process the following categories of Personal Data:

• Device information (Device Model, Browser Version, Operating System, Advertising IDs or Device IDs);
  
• Preferences you may have stored, e.g., which events you want to be notified of.
  

Data Recipient(s)
Your Personal Data will be transferred to IT service providers (e.g., hosting providers, cloud service providers, customer identity and access management providers, customer relationship management providers etc.).

Data Controller
The Data Controller is the company named in the imprint of the respective app on which you have activated the sending of push notifications.

Storage Duration
We only keep Personal Data for as long as needed to achieve the purposes of the data processing.

c) SOCIAL MEDIA PLATFORMS

General Information

In addition to our websites and apps, we operate social media profiles on various social media platforms to familiarize you better with our products and services. Our social media profiles are operated on various social media platforms including, Facebook, YouTube, Twitter and Instagram.

Purpose of the Data Processing
To the extent that we process your Personal Data via our social media profiles, we process it to:

• Communicate with you and keep you up-to-date and make recommendations to you about products and services that may interest you;
  
• Improve use and content of our profiles to ensure that it is presented in the most effective manner for you;
  
• To manage our relationship with you and to communicate with you regarding our products and services;
  
• To provide a consistent experience across devices and platforms by matching information collected from you and provided by you on one device or platform with information collected from and provided by you on other devices and platforms;
  
• To understand the effectiveness of the advertising we serve to you and others and to deliver relevant advertising to you. Furthermore, we use your information when communicating with you through social media to build and maintain our social media profiles.
  

Further information regarding each respective social media platform, including any storage periods and whether Company acts a (joint) Data Controller with the third party operating the social media platform, is detailed below.

Company’s Facebook Social Media Profile

(Privacy Policy of Facebook available here and Cookie Policy of Facebook available here)

Purpose of the Data Processing
We operate social media profiles on Facebook for the various purposes listed above, to engage with you, inform you about our events and activities and improve your experience across devices and platforms.

If you want to know exactly how Facebook uses the data for its own purposes which it collects from your visit, how long Facebook stores this data and whether data from a visit to the Facebook page is passed onto third parties, please consult Facebook’s privacy policy.

Legal Basis for Data Processing
Our data processing is based on our legitimate interest to:

• Provide optimized and customer-orientated offerings to you on our operated social media profiles;
  
• Better understand how you use our products and services you want; and
  
• Effectively communicate and conduct social analytics and content performance;
  
• Remain aware of updated market practice to ensure that we are offering a service which is competitive and meets the expectations of our consumers.
  

If you want to learn about which legal basis Facebook uses, please consult Facebook’s privacy policy.

Categories of Data
We process the following Personal Data:

• Your Facebook username;
  
• Direct messages you send us through our Facebook pages;
  
• Your activity on our Facebook pages through Facebook Insights.
  Facebook processes Personal Data about your account, your IP address and the end devices you use. The Personal Data you enter on our Facebook profile page, such as comments, videos, pictures, likes, public messages, etc., are published by Facebook and are at no time used or processed by us for other purposes.
  Use of Insights and Cookies on Facebook
  In addition, we use the “Facebook Insights” function which shows statistical information (such as gender and age distribution) on the use of our Facebook profile. Facebook Insights refer to demographic data, for example, which target group interact most with our Facebook Page or which content on the Facebook Page was visited, shared or liked when and how often etc.  We have no control over the generation and presentation of Facebook Insights, but we receive the data in aggregated form and use it to improve our marketing activities and our external presence. We cannot draw any conclusions about individuals by using Facebook Insights.
  

Facebook uses cookies and storage technologies. If you are logged into Facebook as a user, there will be a cookie with your Facebook ID on your device. This enables Facebook to understand that you have visited this site and how you have used it. If you want to avoid this, you should log out of Facebook or deactivate the "remember me" function, delete the cookies on your device and exit and restart your browser. In this way, Facebook information that can be used to identify you directly is deleted. This allows you to use our Facebook page without revealing your Facebook ID. More information can be found in Facebook’s cookie guideline.

Data Recipient(s)
If you are in the EEA, your Personal Data will be processed by:

Facebook Ireland Ltd.
4 Grand Canal Square Grand Canal Harbour
Dublin 2
Ireland

However, please note that when using Facebook, Personal Data may also be processed outside the EEA and may be transferred to Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, US.

If the Personal Data is transferred to the USA, the data transfer is based on the existence of standard contractual clauses.

Data Controller
When you visit our Facebook social media page, Personal Data is processed by us and by Facebook. The respective Company operating the Facebook profile is a Joint Controller with Facebook for the data processing operations. To the extent possible, we have concluded agreements on Joint Controllership with Facebook.

Facebook assumes the data protection obligations towards you as the user, such as information on data processing, and is the contact person for your rights. This follows from the fact that Facebook has direct access to the relevant information on the social media profile and the processing of your Personal Data. However, you are also welcome to contact us via the contact details described in our Policy if this should become necessary and we will then forward the request to Facebook, if necessary.

Company’s Instagram Social Media Profile

(Privacy Policy of Instagram available here)

Purpose of the Data Processing
We operate Instagram social media profiles for the various purposes listed above, to engage with you, inform you about our events and activities and improve your experience across devices and platforms.

If you want to know exactly how Instagram uses the Personal Data for its own purposes which it collects from your visit, how long Instagram stores this Personal Data and whether Personal Data from a visit to the Instagram page is passed onto third parties, please consult Instagram’s privacy policy. There you will also find information about contact options for Instagram and the setting options for advertisements.

Legal Basis for Data Processing
Our data processing is based on our legitimate interest to:

• Provide optimized and customer-orientated offerings to you on our operated social media profiles;
  
• Better understand how you use our products and services you want; and
  
• Effectively communicate and conduct social analytics and content performance;
  
• Remain aware of updated market practice to ensure that we are offering a service which is competitive and meets the expectations of our consumers.
  

If you want to learn about which legal basis Instagram uses, please consult Instagram’s Privacy Policy.

Categories of Data
We process the following Personal Data:

• Your Instagram username;
  
• Direct messages you send us through our Instagram pages;
  
• Your activity on our Instagram pages through Instagram Insights.
  

Instagram processes Personal Data about your account, your IP address and the end devices you use. The Personal Data you enter on our Instagram profile page, such as comments, videos, pictures, likes, public messages, etc., are published by Instagram and are at no time used or processed by us for other purposes.

Use of Insights and Cookies on Instagram
In addition, we use the “Instagram Insights” function which shows statistical information (such as gender and age distribution) on the use of our Instagram profile. Instagram Insights refer to demographic data, for example, which target group interact most with our Instagram Page or which content on the Instagram Page was visited, shared or liked when and how often etc. We have no control over the generation and presentation of Instagram Insights, but we receive the data in aggregated form and use it to improve our marketing activities and our external presence. We cannot draw any conclusions about individuals by using Instagram Insights.

Instagram uses cookies and storage technologies. If you are logged into Instagram as a user, there will be a cookie with your Instagram ID on your device. This enables Instagram to understand that you have visited this site and how you have used it. If you want to avoid this, you should log out of Instagram or deactivate the "remember me" function, delete the cookies on your device and exit and restart your browser. In this way, Instagram information that can be used to identify you directly is deleted. This allows you to use our Instagram page without revealing your Instagram ID. More information can be found in Instagram’s privacy policy.

Data Recipient(s)
Your Personal Data will be processed by:

Instagram Inc. 1601
Willow Road, Menlo Park
CA, 94025
USA

If the Personal Data is transferred to the USA, the data transfer is based on the existence of standard contractual clauses.

Data Controller
When you visit our Instagram social media page, Personal Data is processed by us and by Instagram. The respective Company operating the Instagram profile is a Joint Controller with Instagram for the data processing operations. To the extent possible, we have concluded agreements on Joint Controllership with Instagram, in particular the Page Controller Addendum of Facebook Ireland Ltd which can be found here.

Instagram assumes the data protection obligations towards you as the user, such as information on data processing, and is the contact person for your rights. This follows from the fact that Instagram has direct access to the relevant information on the social media profile and the processing of your Personal Data. However, you are also welcome to contact us via the contact details described in our Policy if this should become necessary and we will then forward the request to Instagram, if necessary.

Company’s Twitter Social Media Profile

Privacy Policy of Twitter available here

Purpose of the Data Processing
We operate Twitter social media profiles for the various purposes listed above, to engage with you, inform you about our events and activities and improve your experience across devices and platforms.

If you want to know exactly how Twitter uses the Personal Data for its own purposes which it collects from your visit, how long Twitter stores this Personal Data and whether data from a visit to the Twitter page is passed onto third parties, please consult Twitter´s privacy policy. There you will also find information about contact options for Twitter and the setting options for advertisements.

Legal Basis for Data Processing
Our data processing is based on our legitimate interest to:

• Provide optimized and customer-orientated offerings to you on our operated social media profiles;
  
• Better understand how you use our products and services you want; and
  
• Effectively communicate and conduct social analytics and content performance;
  
• Remain aware of updated market practice to ensure that we are offering a service which is competitive and meets the expectations of our consumers.
  If you want to learn about which legal basis Twitter uses, please consult Twitter’s Privacy Policy.
  

Categories of Data
We process the following Personal Data:

• Your Twitter username;
  
• Direct messages you send us through our Twitter pages;
  
• Your activity on our Twitter pages through Twitter Analytics service.
  Twitter processes Personal Data about your account, your IP address and the end devices you use. The Personal Data you enter on our Twitter social media page, such as comments, videos, pictures, likes, public messages, etc., are published by Twitter and are at no time used or processed by us for other purposes.
  

Twitter Analytics and Cookies on Twitter
Twitter may use analysis tools such as Twitter or Google Analytics for evaluation, however we have no influence on the use of such tools by Twitter. Only certain, aggregated data about the tweet activity, such as the number of profile or link clicks through a specific tweet, can be viewed by us via our account.

In addition, Twitter receives information when you view content, for example, even if you have not created an account. This so-called "log data" can be the IP address, the browser type, the operating system, information about the previously accessed website and the pages you accessed, your location, your mobile phone provider, the end device you are using (including device ID and application ID), the search terms you use and cookie information.

You have options for restricting the processing of your Personal Data in the general settings of your Twitter account and under “Privacy and security”. In addition, you can restrict access from Twitter to contact and calendar data, photos, location data, etc. on mobile devices (smartphones, tablet computers) in the setting options there. However, this depends on the operating system used.

Data Recipient(s)
If you are in the EEA, your Personal Data will be processed by:

Twitter International Company
One Cumberland Place
Fenian Street
Dublin 2 D02 AX07
Ireland

However, please note that when using Twitter, Personal Data may also be processed outside the EEA and may be transferred to:

Twitter Inc.
1355 Market Street
Suite 900
San Francisco
CA 94103
USA

If the Personal Data is transferred to the USA, the data transfer is based on the existence of standard contractual clauses.

Data Controller
When you visit our Twitter social media page, Personal Data is processed by us and by Twitter.

Twitter has released Controller-Controller Terms which are available here and which state that Company and Twitter are independently responsible for dealing with any user-related requests or matters involving the data protection authorities.

Company’s LinkedIn Social Media Profile

Privacy Policy of LinkedIn available here

Purpose of the Data Processing
We operate LinkedIn social media profiles for the various purposes listed above, to engage with you, inform you about our events and activities and improve your experience across devices and platforms.

If you want to know exactly how LinkedIn uses the Personal Data for its own purposes which it collects from your visit, how long LinkedIn stores this Personal Data and whether data from a visit to the LinkedIn page is passed onto third parties, please consult LinkedIn´s privacy policy. There you will also find information about contact options for LinkedIn and the setting options for advertisements.

Legal Basis for Data Processing
Our data processing is based on our legitimate interest to:

• Provide optimized and customer-orientated offerings to you on our operated social media profiles;
  
• Better understand how you use our products and services you want; and
  
• Effectively communicate and conduct social analytics and content performance;
  
• Remain aware of updated market practice to ensure that we are offering a service which is competitive and meets the expectations of our consumers.
  If you want to learn about which legal basis LinkedIn uses, please consult LinkedIn’s privacy policy.
  

Categories of Data
We process the following Personal Data:

• Your LinkedIn username;
  
• Direct messages you send us through our Twitter pages.
  LinkedIn processes Personal Data about your account, your IP address and the end devices you use. The Personal Data you enter on our LinkedIn social media page, such as comments, public messages, etc., are published by Twitter and are at no time used or processed by us for other purposes.
  

Use of Insights and Cookies on LinkedIn
In addition, we use the “LinkedIn Insights” function which shows statistical information (such as gender and age distribution) on the use of our LinkedIn profile. LinkedIn Insights refer to demographic data, for example, which target group interact most with our LinkedIn Page or which content on the LinkedIn Page was visited, shared or liked when and how often etc. We have no control over the generation and presentation of LinkedIn Insights, but we receive the data in aggregated form and use it to improve our marketing activities and our external presence. We cannot draw any conclusions about individuals by using LinkedIn Insights. More information on LinkedIn Insights can be found in LinkedIn´s privacy policy.

LinkedIn uses cookies and storage technologies. If you are logged into LinkedIn as a user, there will be a cookie with your LinkedIn ID on your device. This enables LinkedIn to understand that you have visited this site and how you have used it. If you want to avoid this, you should log out of Instagram or deactivate the "remember me" function, delete the cookies on your device and exit and restart your browser. In this way, LinkedIn information that can be used to identify you directly is deleted. This allows you to use our LinkedIn page without revealing your LinkedIn ID. More information can be found in LinkedIn’s privacy policy.

Data Recipient(s)
If you are in the EEA, your Personal Data will be processed by:

LinkedIn Ireland Unlimited Company
Wilton Place
Dublin 2
Ireland

However, please note that when using LinkedIn, Personal Data may also be processed outside the EEA and may be transferred to:

LinkedIn Inc.
605 W Maude Ave
Sunnyvale
CA 94085
USA

If the Personal Data is transferred to the USA, the data transfer is based on the existence of standard contractual clauses.

Data Controller
When you visit our LinkedIn social media page, Personal Data is processed by us and by LinkedIn. The respective Company operating the LinkedIn profile is a Joint Controller with LinkedIn for the data processing operations. To the extent possible, we have concluded agreements on Joint Controllership with LinkedIn, in particular the LinkedIn Joint Controller Addendum of LinkedIn Ireland Unlimited Company which can be found here.

LinkedIn assumes the data protection obligations towards you as the user, such as information on data processing, and is the contact person for your rights. This follows from the fact that LinkedIn has direct access to the relevant information on the social media profile and the processing of your Personal Data. However, you are also welcome to contact us via the contact details described in our Policy if this should become necessary and we will then forward the request to LinkedIn, if necessary.

Company’s YouTube Social Media Profile

Privacy Policy of Google available here.

Purpose of the Data Processing
We operate YouTube social media profiles for the various purposes listed above, to engage with you, inform you about our events and activities and improve your experience across devices and platforms.

If you want to know exactly how YouTube uses the Personal Data for its own purposes which it collects from your visit, how long YouTube stores this Personal Data and whether data from a visit to the YouTube page is passed onto third parties, please consult Google´s privacy policy. There you will also find information about contact options for YouTube and the setting options for advertisements.

Legal Basis for Data Processing
Our data processing is based on our legitimate interest to:

• Provide optimized and customer-orientated offerings to you on our operated social media profiles;
  
• Better understand how you use our products and services you want; and
  
• Effectively communicate and conduct social analytics and content performance;
  
• Remain aware of updated market practice to ensure that we are offering a service which is competitive and meets the expectations of our consumers.
  

If you want to learn about which legal basis YouTube uses, please consult Google’s privacy policy.

Categories of Data
We process the following Personal Data:

• Your YouTube username;
  
• Direct messages you send us through our YouTube pages;
  
• Your activity on our YouTube pages through YouTube Analytics service.
  

YouTube processes Personal Data about your account, your IP address and the end devices you use. The Personal Data you enter on our YouTube social media page, such as comments, public messages, etc., are published by YouTube and are at no time used or processed by us for other purposes.

Use of Analytics and Cookies on YouTube
In addition, we use the “YouTube Analytics” function which shows statistical information (such as gender and age distribution) on the use of our YouTube profile. YouTube Analytics refer to demographic data, for example, the visits to our site, the reach of contributions, the average length of video views, information about the countries and cities our visitors come from and statistics about the gender ratios of our visitors etc. We have no control over the generation and presentation of YouTube Analytics, but we receive the data in aggregated form and use it to improve our marketing activities and our external presence. We cannot draw any conclusions about individuals by using YouTube Analytics. More information can be found in Google´s privacy policy.

YouTube uses cookies and storage technologies. If you are logged into YouTube as a user, there will be a cookie with your YouTube ID on your device. This enables YouTube to understand that you have visited this site and how you have used it. If you want to avoid this, you should log out of YouTube or deactivate the "remember me" function, delete the cookies on your device and exit and restart your browser. In this way, YouTube information that can be used to identify you directly is deleted. This allows you to use our YouTube page without revealing your YouTube ID. More information can be found in Google´s privacy policy.

Data Recipient(s)
If you are in the EEA, your Personal Data will be processed by:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

However, please note that when using YouTube, Personal Data may also be processed outside the EEA and may be transferred to:

Google LLC
1600 Amphitheater Parkway
Mountain View
CA94043
USA

If the Personal Data is transferred to the USA, the data transfer is based on the existence of standard contractual clauses.

Data Controller
When you visit our YouTube social media page, Personal Data is processed by us and by YouTube

YouTube has released Controller-Controller Terms which are available here and which state that Company and YouTube are independently responsible for dealing with any user-related requests or matters involving the data protection authorities.

d) EVENTS

i. Participant Registration for Events

You can find information on how we process your Personal Data for our participatory events in the respective privacy policy that will be provided to you as part of the registration process.

ii. Spectator Ticketing for Events

Purpose of the Data Processing
We organize various spectator events to provide an engaging experience and inspire our spectators. To effectively organize and provide the best possible experience, we work with selected ticketing partners.

Depending on the contractual set-up with the respective ticketing partner (e.g., whether we sell tickets directly or through a ticketing partner), we may process Personal Data for various purposes including to:

• Perform the sale of tickets;
  
• Conduct event management services (on the ground event management, send out transactional communications);
  
• Provide customer service and manage any concerns and requests, for example providing services to you after your ticket purchase in the event of any cancellations or refunds.
  

Categories of Data
Depending on the contractual set-up with the respective ticketing partner (e.g., whether we sell tickets directly or through a ticketing partner), we will process Personal Data including;

• First name;
  
• Last name;
  
• Email address;
  
• Postal address;
  
• Financial payment information;
  
• Any communication in connection with the purchase.
  

Data Recipient(s)
Depending on the contractual set-up with the respective ticketing partner (e.g., whether we sell tickets directly or through a ticketing partner), your Personal Data may be shared with the following recipients:

• Local / regional ticketing partner;
  
• Event agency;
  
• Local Company affiliate;
  
• Payment service provider.
  

Legal Basis for Data Processing
The data processing for managing your ticket order (this includes the conclusion of the contract, pre-contractual obligations and the fulfillment of the ticket contract) is carried out for the purpose of performing the contract.

The data processing for conducting event management is based on our legitimate interests to ensure that we offer you safe on the ground events.

Data Controller
The Data Controller is the company named in the imprint of the respective website in which you have made your ticket purchase.

We engage ticket partners to perform the ticket sale. Depending on the contractual agreement with the ticket partner, the ticket partner shall either act as an (joint) controller for any data provided and processed as part of the payment process or act as a processor, who is processing your Personal Data on behalf and on our instructions. For further information regarding the relationship, please consult the privacy policy of the ticket service provider or contact us directly. Any payment service providers that are contracted shall act as (joint)controllers for any data provided and processed as part of the payment process. If you decide to use a payment service provider, you are transferring the needed Personal Data for the purpose of the payment transaction to the provider. Please consult the privacy policy of the payment service provider, to find out the details of their data processing.

Storage Duration
The Personal Data regarding the individual orders and transactions are stored in accordance with the applicable tax and accounting retention obligations.

e) NEWSLETTERS AND OTHER PROMOTIONAL MESSAGES

Purpose of the Data Processing
We offer various promotional messages that contain news, offers and other information about our products, services, as well as suggestions for participation in events or promotions, such as sweepstakes or online surveys. You can subscribe to our newsletters free of charge at any time.

For the newsletter distribution, we use – where legally required – the so-called double opt-in procedure. This means that we will only send you the newsletter if you have previously given your consent to activate the sending of the newsletter. To do so, we will send you an email in which we ask you to confirm that you would like to receive our newsletter by clicking on a link. This procedure also serves to verify whether the email address submitted is yours.

We process your Personal Data to:

• Communicate with you and keep you up to date with our products or services and make recommendations that may interest you;
  
• Manage our relationship with you and to communicate with you regarding your user account and services;
  
• Perform tracking of the effectiveness of our newsletters, including the analysis of opening rates, click rates and bounce rates using aggregated and pseudonymized data.
  If you no longer wish to subscribe to our newsletters, you can unsubscribe at any time by clicking on the unsubscribe link that is included in every newsletter.
  

Legal Basis for Data Processing
The data processing is based on your consent. A given consent may be withdrawn at any time without giving reasons. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

Categories of Data
If you subscribe to one of our newsletters, we may process the following categories of Personal Data:

• First name and last name;
  
• Country of residence;
  
• Email address.
  

Data Recipient(s)
Your Personal Data may be shared with the following recipients:

• IT service providers (cloud hosting providers);
  
• Newsletter tool service provider.
  

Data Controller
The Data Controller is the company named in the imprint of the respective website or app on which you subscribe to the newsletter.

Storage Duration
We only keep Personal Data for as long as needed to achieve the purposes of the data processing.

f) MAGAZINE SUBSCRIPTIONS

Purpose of the Data Processing
We offer a wide range of magazines as part of our print offerings. You can purchase our magazines either individually or as a subscription basis.

We process the Personal Data to:

• Fulfil and process the order (e.g., payment, electronic confirmation of subscription, shipping, etc.);
  
• Provide and improve our products and services you have requested;
  
• Provide customer service and manage any concerns or requests to provide you with a more efficient customer care service.
  

Legal Basis for Data Processing
The data processing for managing the magazine subscription is carried out for the purpose of performing the contract.

Categories of Data
If you order a magazine subscription, we may process the following categories of Personal Data, including:
* First and last name;
* Email address;
* Payment data;
* Postal address.

Data Recipient(s)
In connection with your magazine subscription order, your Personal Data may be shared with:

• Shipping providers;
  
• IT service providers (e.g., hosting providers, cloud service providers, etc.);
  
• Print service providers;
  
• Payment service providers.
  

We have no control over how your Personal Data is processed by the payment service providers. We therefore recommend that you also read the Privacy Policy of the respective payment service provider.

Data Controller
The Data Controller is the company named in the imprint of the respective magazine to which you have subscribed.

Data Storage
If you do not wish to receive your magazine subscription any longer, you can cancel it, considering the periods specified in the terms of use of the respective magazine. Your Personal Data will no longer be processed by us after termination of the subscription unless there are legal retention obligations.

g) ONLINE SURVEY AND MARKET RESEARCH PROJECTS

Purpose of the Data Processing
To improve our products and services, we conduct internally or contract third parties to conduct on our behalf, online surveys or market research projects (hereinafter “Project(s)”) in which you may voluntarily participate.

We carry out Projects for specific purposes (e.g., surveys on the use of our products and services, and websites and apps, etc.) and to collect statistical data using a scientific and methodical approach. If you wish to participate in a Project, you will always receive detailed information about which Personal Data we process and how we process it in advance of the respective Project.

Legal Basis for Data Processing
The data processing is based your consent. As far as participants receive a compensation for the participation in a Project, the data processing in this context is carried out for the purpose of performing the contract. You can withdraw the consent at any time and without giving reasons. However, the withdrawal of consent does not affect the lawfulness of the processing before the withdrawal.

Categories of Data
Depending on the purpose, we may process Your Personal Data, including:

• First and last name (if internally run);
  
• Email address (if internally run);
  
• Age;
  
• Log-files;
  
• Cookie-based data;
  
• Gender;
  
• Aggregated survey results (if conducted by a contracted third party).
  

Data Recipient(s)
In connection with a Project, your Personal Data may be shared with the following recipients:

• Online survey service providers;
  
• Freelancers.
  

Data Controller
Depending on the individual case, the Data Controller is the company commissioning the online survey / market research project, or the respective market research institute.

The respective market research institute shall either act as an independent Data Controller for any Personal Data provided and processed as part of the survey / project or act as a processor on our behalf. If the market research institutes act independently, we have no influence on how they process your Personal Data.

For further information regarding the details of the data processing of the respective market research institute, please consult the privacy policy of the market research institute.

5. With whom do we share your Personal Data?

You can find detailed information on whom we may share your Personal Data under the respective data processing activity listed under section 4. Whenever we share your Personal Data with a supplier or service provider, these will be required to meet our standards on processing information and security. The information we provide them, including your Personal Data, will only be provided in connection with the performance of their function. They will not be permitted to use your Personal Data for any purposes other than those outlined in this Policy.

In addition to any listed data recipients, we may need to also share your Personal Data with the categories of data recipients listed below.

i. Within the Company Group
We may share and disclose your Personal Data within the Company Group (Affiliates) for the purposes outlined under each respective data processing activity at section 4 of this Policy, or as required (e.g., to fulfil any contractual or legal obligations). If we share your Personal Data, we shall ensure compliance with any applicable data privacy legislation and, wherever necessary, conclude appropriate contracts for such intercompany data transfers within the Company Group.

ii. Courts and Authorities
If we are required to do so by law or by enforceable governmental or court order, we may also disclose your information to governmental authorities (e.g., tax authorities, law enforcement agencies, regulatory agencies, etc.) or courts to the extent necessary.

6. How long do we keep your Personal Data?

We keep your Personal Data only for as long as necessary for our business purposes or for legal or regulatory requirements; but never longer than three years following a period of inactivity. How long we need your Personal Data depends on what we are using it for, as set out in this Policy.

For example, we will retain your information for as long as you have an Account with Company and for a period thereafter if it necessary to meet our legal obligations, such as retaining the information for tax and accounting purposes. We may also need to keep your Personal Data for a certain period for accounting purposes, for example, where you have bought a subscription.

If we no longer need your Personal Data, we will delete it or make it anonymous by removing all details that identify you. If we have asked for your permission to process your Personal Data and we have no other lawful grounds to continue with that processing, and you withdraw your permission, we will delete your Personal Data.

If you object or opt-out of receiving direct marketing communications from us, we will remove your contact details and marketing permissions to ensure that you do not receive any future marketing communications from us.

In all cases, we will continue to protect your Personal Data in accordance with this Policy and will routinely refresh our information to ensure that we keep it up to date.

7. International Data Transfers

Given that the internet is a global environment, using the internet to collect and process Personal Data often involves the transmission of data on an international basis. While we generally endeavor to store the Personal Data, we collect about you through our websites or apps in your region (for example for European visitors, in the EEA), it is possible that your Personal Data may be transferred to recipients outside your region (where data protection laws may be different for example in the USA), including within the Company Group (Affiliates).

If such an international data transfer takes place, we have implemented safeguards and data protection solutions (for example EU standard data protection clauses, plus supplementary measures) to ensure that your information is adequately protected in any third countries that do not have an adequate level of data protection as recognized by the European Commission. You can find the EU Commission’s decision and the standard contractual clauses here. If you want more information or a copy of the standard contractual clauses used in each specific situation listed above, please contact us at any time for this purpose, by emailing us at the addresses indicated at the bottom of this Policy.

For those third countries that have an assured adequate level of data protection in line with that of the EU, the European Commission has issued so-called adequacy decisions. This means that you have the same or similar legal remedies as in the EU.

8. Automated Decision-Making

On some of our e-commerce websites, we engage service providers who use automated decision making in order to verify your address and assess your creditworthiness. This allows us to ensure we use correct address data and to evaluate the risk of non-payment for our products and services. For more information, please consult the privacy policy of the respective service provider.

9. Data Subject Rights

As a data subject, you have certain data subject rights. Please note that you are not necessarily entitled to these rights without limitation, but only in accordance with applicable legal provisions. For example, your data subject rights may be limited if the rights and freedoms of others are affected. You can assert your data subject rights against the responsible Data Controller. You can contact us at any time for this purpose, by emailing us at the addresses indicated at the bottom of this Policy.

i. Right to Withdraw Consent
If we process your Personal Data based on your consent, you are entitled to withdraw your consent at any time. From receipt of your withdrawal, we will no longer process your Personal Data. However, the withdrawal of your consent does not affect the legitimacy of the processing that took place up to the time of the withdrawal.

ii. Right to Access Information
You can request information about whether we process your Personal Data. If you do so, you can obtain information about this Personal Data, in particular about the purpose of the processing, the categories of Personal Data being processed about you, the recipients, storage period and origin of this Personal Data, the rights to which you are entitled in relation to this Personal Data and, in the event of transfer to a third country, the appropriate safeguards we have put in place. Upon request, we will also provide you with a copy of the Personal Data we process from you.

iii. Right to Rectification
If we process Personal Data about you that is inaccurate or incomplete, you may request it to be corrected or completed.

iv. Right to Erasure
You can request that we delete your Personal Data. We will delete your Personal Data if:

• It is no longer necessary for the purposes for which it was collected or otherwise processed;
  
• The processing is based on your consent, you withdraw your consent and there is no other legal basis for the processing;
  
• You object to the processing and there are no overriding legitimate grounds for the processing, or if you object to the processing for direct marketing purposes;
  
• Your data has been processed unlawfully;
  
• The erasure of your Personal Data is necessary for us to comply with a legal obligation;
  Your right to erasure does not exist if, for example, we need to process the Personal Data to comply with a legal obligation or to establish, exercise or defend legal claims.
  

v. Right to Restriction of Processing
In certain cases, you may request that we restrict the processing of your Personal Data without deleting it. This means that we will continue to store this Personal Data, but we will only process it with your consent, for the establishment, exercise or defense of legal claims, for the protection of the rights of another natural or legal person or for reasons of important public interest of the EU or of a Member State.

You have the right to restrict processing if:

• You contest the accuracy of your Personal Data until we have been able to verify this;
  
• You have objected to the processing of your Personal Data until it is determined whether legitimate grounds for the processing prevail;
  
• The processing is unlawful, but you refuse to have your Personal Data deleted;
  
• We no longer need the Personal Data for the purpose of processing, but you need it to establish, exercise or defend legal claims.
  

vi. Right to Object
Even if your Personal Data is accurate and complete and is processed by us lawfully, you may object to the processing of your Personal Data at any time for reasons relating to your situation. You only have this right if we process this Personal Data based on our legitimate interests. In this case, we will no longer process your Personal Data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the purpose of establishing, exercising or defending legal claims.

In addition, you can object if you receive direct marketing from us and no longer wish to receive it in the future. In such case, we will no longer process your Personal Data for these purposes.

vii. Right to Data Portability
If we process your Personal Data based on your consent or a contract concluded with you and the processing is carried out by automated means, you can request that we send you the Personal Data you have provided to us in a structured, commonly used and machine-readable format. Likewise, you may request that we transfer this Personal Data directly to another Data Controller, if this is technically feasible.

viii. Right to Lodge a Complaint
Although we make every effort to protect the privacy and integrity of your Personal Data, disagreements about how we process your Personal Data cannot be completely excluded. If you believe that the processing of your Personal Data violates applicable data protection law, in addition to contacting us, you are free to lodge a complaint with the competent data protection authority. The competence of the data protection authority is generally based on the registered office of the Data Controller. Within the EU, however, you can turn to any data protection authority of an EU member state, which will then forward your complaint to the competent authority.

10. Use of this website or of our apps by minors

You should not use our website or app if you are younger than (16). If you are aged (16) or under, you must ask for your parent's or your guardian's permission before you use our website or app. If we find out that you are younger than (16) and have not got permission from your parent or guardian, we will stop using your Personal Data.

11. Questions, concerns and support – With whom and how can you get in touch?

If you have general questions relating to this Policy or about how we process your Personal Data, or if you would like to exercise any of your rights described in this Policy, you can contact us directly by emailing {{Automation – Privacy Email Address}}, or by writing to the postal address of the respective Data Controller. You can find the postal addresses of the Companies in the Affiliates List. If you would like to contact our appointed Data Protection Officer, please contact privacy-hangar7@redbull.com.