Data Protection Information

Opinionsltd.com

1. Name and Contact Details of the Data Controller

This data protection notice applies to data processing by OG Opinions Germany GmbH.

The data controller pursuant to Article 4 (7) of the EU General Data Protection Regulation (GDPR) is OG Opinions Germany GmbH, represented by the Managing Director Mark Kikel, Zeil 79, 60313 Frankfurt am Main, Germany, e-mail: [email protected], telephone: +49 (0)69 667 736 431.

The establishment of a company data protection officer is not necessary due to the number of persons processing the data.

2. Collection and Storage of Personal Data as Well as Type and Purpose and Use Thereof

When you enter into or initiate a business relationship with OG Opinions Germany GmbH, we collect the following information:

• Name

• If applicable, the company you work for and your position there

• Your e-mail address

• Your address

• Your telephone number

• Information required for the performance of the contractual relationship and the assertion of claims arising from this contractual relationship.

This data is collected

• to be able to identify you

• to initiate a contract with you and, once concluded, to carry it out and fulfil contractual obligations

• for correspondence with you

• to issue invoices

• to process any liability claims and claims against you.

In addition, we process personal data that we have legitimately obtained from publicly accessible sources (e.g. the commercial register) and are permitted to process.

The data processing is carried out upon your request and is necessary according to Art. 6 para. 1, p. 1 lit. b), c), e) and f) DSGVO for the aforementioned purposes for the appropriate initiation and execution of the contract and for the mutual fulfilment of obligations arising from the contractual relationship.

The personal data collected by us for the initiation and performance of a contract will be stored until the expiry of the statutory retention obligations (six years after the end of the calendar year in which the contractual relationship was terminated or four further years in accordance with Section 199 (3) No. 1 of the German Civil Code (BGB)) and then deleted, unless we are required by Art. 6 para. 1, p. 1 lit. c) DSGVO, we are obliged to store data for a different period due to tax and commercial law retention and documentation obligations (from HGB, StGB or AO) or you have consented to storage beyond this period in accordance with Art. 6, para. 1 p. 1 lit. a) DSGVO.

Data processing is also carried out on the basis of legal requirements, e.g. for the prevention of fraud and money laundering, the fulfilment of control and reporting obligations under tax law and the assessment and management of risks. Such processing results from Art. 6 para. 1, sent. 1 lit. c) DSGVO, according to which the processing is necessary for the fulfilment of a legal obligation.

3. Transfer of Data to Third Parties

Your personal data will not be transferred to third parties for purposes other than those listed below. Insofar as this is necessary in accordance with Art. 6 Para. 1, S. 1 lit. b) DSGVO for the implementation of a contractual relationship with you, your personal data will be passed on to third parties. The data passed on may be used by the third parties exclusively for the purposes stated. In the context of a possible liability case, we will provide our liability insurance company with the information necessary to process the case. Furthermore, OG Opinions Germany GmbH has individual services carried out by carefully selected service providers who are based within the EU and who comply with data protection regulations. These include IT services and payment transactions.

4. Transfer of Data to a Third Country

Data is only transferred to third countries (countries outside the European Economic Area -EEA) if this is necessary for the fulfilment of the contractual relationship and/or is required by law or if you have given us your consent. For the transfer of data to third countries (countries outside the EU/EEA), the provisions of the DSGVO, the BDSG and other legal bases for cross-border data traffic apply.

5. Electronic Communication

Electronic communication that is not protected by appropriate encryption and signature involves the risk of data being intercepted and read by third parties. This poses a risk to the confidentiality of personal data, corporate data and data protection. We deviate from communication by unencrypted and unsigned e-mail if we consider encryption to be necessary. The security level of the encryption will be agreed with you.

6. Data Subject Rights

You have the right

• in accordance with Art. 7 (3) DSGVO, to revoke your consent once given to us at any time. This means that we may no longer process the data based on this consent in the future

• pursuant to Art. 15 DSGVO, request information about your personal data processed by us, in particular, you may request information about the processing purposes, the category of personal data, the categories of recipients to whom your data have been or will be disclosed, the planned storage period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right of complaint, the origin of your data if it has not been collected by us, as well as the existence of automated decision-making including profiling and, if applicable, meaningful information about its details;

• in accordance with Art. 16 DSGVO, to demand the immediate correction of inaccurate or incomplete personal data stored by us

• in accordance with Article 17 of the Regulation, to request the erasure of your personal data stored by us, unless the processing is necessary for the exercise of the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise or defense of legal claims

• in accordance with Art. 18 DSGVO, to request the restriction of the processing of your personal data, insofar as the accuracy of the data is disputed by you, the processing is unlawful, but you object to its erasure and we no longer require the data, but you need it for the assertion, exercise or defense of legal claims or you have objected to the processing in accordance with Art. 21 DSGVO

• pursuant to Art. 20 DSGVO, to receive your personal data that you have provided to us in a structured, common and machine-readable format or to request that it be transferred to another controller

• complain to a supervisory authority in accordance with Art. 77 DSGVO. As a rule, you can contact the supervisory authority of your usual place of residence or workplace or our registered office. The competent authority for the latter is:

The Hessian Commissioner for Data Protection and Freedom of Information

PO Box 3163

65021 Wiesbaden

Telephone +49(0)6111408-0

[email protected]

7. Right of Objection

If your personal data has been processed on the basis of legitimate interests pursuant to Art. 6 (1), sent. 1 lit. f) DSGVO, you have the right to object to the processing of your personal data pursuant to Art. 21 DSGVO, provided that there are grounds for doing so which arise from your particular situation. To exercise your right to object, please write a message to the address mentioned under point 1.