3. Processing of personal data

While browsing and using our website information will be temporary saved on a so-called log file on our server. The browser of your (end-) device will send following information automatically:

• IP-address of the contacting device
• Date and time of server request
• Name and URL of the accessed pages
• Referrer-URL
• Browser type and version and other information of your device, such as the operating system of your computer, the name of your access provider, geographical origin, language setting etc.

The above-mentioned data will be processed by the controller for the following purposes:

• Comfortable and smooth connection set-ups of the websites
• Comfortable use of our websites
• Evaluation of system security and stability
• To evaluate and optimize our content for you

The legal basis for data processing is legitimate interest according to art. 13 FADP and art. 6 para. 1 lit. f GDPR. Our legitimate interest follows from the purposes listed above for data collection. Under no circumstances, we do use the data collected for the purpose of drawing conclusions about you personally.

4. Cookies

We use cookies on our website. Cookies are small text files that your browser automatically creates and stores on your device when you visit or use our website. A cookie does not mean that we can identify you in any case.

The use of cookies serves on the one hand to record the frequency of use, number of users and behavior on our website, to increase the security of website use and to make our information offer user-friendly.

We use session cookies on our website. Session cookies are temporary cookies that remain in the cookie file of your browser until you leave our website. Session cookies are used for the optimal functioning of our website.

Furthermore, we use persistent cookies to improve the user friendliness of our website. Persistent cookies remain in the cookie file of your browser for a much longer period. This time-period will depend on the choice you make in the settings of your internet browser. Persistent cookies allow information to be passed to a web server each time someone visits the site. We use persistent cookies to remember your preferences and various settings.

The data processed by cookies is required for the aforementioned purposes in order to protect our legitimate interests and interests of third parties pursuant to art. 6 para. 1 p. 1 lit. f GDPR.

5. Google Analytics

Our website uses the web analytics service Google Analytics of Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. The operator of the Google Analytics component is Google Ireland Limited, Gordon House, Barrow Street, Dublin, D04 E5W5, Ireland.

Google Analytics uses cookies. The definition of cookies is explained above in section 4. Cookies.

The purpose of the Google Analytics component is to analyse the traffic (including IP addresses) on our website by Google in the USA.

For the web analytics through Google Analytics the controller uses the application “gat._anonymizeIp();” to ensure the anonymized collection of IP addresses (IP-masking). By means of this application the IP address of the internet connection of the data subject is abridged by Google and anonymised when accessing our websites from a member state of the European Union or another contracting state to the Agreement on the European Economic Area and thereby does not permit any conclusion about your identity.

Only in exceptional cases will the full IP address be transmitted to one of Google's servers in the USA and shortened there. Google observes the Swiss-USA Privacy Shield framework and thereby has the required level of data protection.

Google uses the collected data and information, inter alia, to evaluate the use of our website and to provide online reports, which show the activities on our websites, and to provide other services concerning the use of our website for us.

For more information about the web analytics service used, please visit the Google website at https://policies.google.com/ or https://support.google.com/analytics/answer/6004245?hl=de. For an introduction to how you can prevent your data from being processed by the Google Analytics, please visit https://tools.google.com/dlpage/gaoptout?hl=enLink.

Furthermore using tracking methods, we want to ensure a customised design and the continuous improvement of our website. Moreover, we use tracking measures to statistically record and analyse the use of our website for the purpose of optimizing our service for you. By using targeted advertising, we want to ensure, that you receive targeted advertisements only.

We use Google Analytics to safeguard our legitimate interests according to art. 13 FADP and art. 6 para. 1 lit. f GDPR.

6. Social Media

We use plugins of social networks and platforms on our website.

We would like to point out that user data can be processed outside the European Union and/or Switzerland. This can pose risks for users because, for example, the enforcement of user rights could be made more difficult.

Furthermore, user data is usually processed for market research and advertising purposes. Thus, for example, user profiles can be created from the user behavior and the resulting interests of the users. The usage profiles can in turn be used, for example, to place advertisements inside and outside the platforms that presumably correspond to the interests of the users. For these purposes, cookies are usually stored on the user's computer, in which the user's usage behavior and interests are stored. Furthermore, data can also be stored in the user profiles independently of the devices used by the users (especially if the users are members of the respective platforms and are logged in to these). The responsibility for the compliance of the data processing on those platforms with the respective data protection laws bears the respective social network or platform. Your use of the plugins shall be deemed your acceptance of the corresponding data processing.

For a detailed description of the respective processing and the possibilities of objection (opt-out), we refer to the information provided by the providers linked below.

• Facebook (Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland)

Privacy Policy: https://www.facebook.com/about/privacy/

• Google / YouTube (Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA/Google Ireland Limited, Gordon House, Barrow Street, Dublin, D04 E5W5, Ireland/ YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA)

Privacy Policy: https://policies.google.com/privacy

• Google Maps (Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA/ Google Ireland Limited, Gordon House, Barrow Street, Dublin, D04 E5W5, Ireland)

Privacy Policy: https://policies.google.com/privacy

• Instagram (Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025, USA)

Privacy Policy: http://instagram.com/about/legal/privacy/

• Twitter (Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA)

Privacy Policy: https://twitter.com/de/privacy

• LinkedIn (LinkedIn Corporation, 2029 Stierlin Court, Mountain View, CA 94043, USA/LinkedIn Ireland Unlimited Company Wilton Place, Dublin 2, Ireland)

Privacy Policy: https://www.linkedin.com/legal/privacy-policy

• Xing (XING AG, Dammtorstraße 29-32, 20354 Hamburg, Deutschland)

Privacy Policy: https://privacy.xing.com/en/privacy-policy.

Art. 6 Para. 1 lit. f GDPR serves as the legal basis for our aforementioned processing operations. Our legitimate interest lies in providing our services.

7. Provision of data to third parties

Your personal data will not be transmitted to third parties for purposes other than those listed as part of the processing of personal data when you visit our website.

Furthermore, your personal data will be transmitted to our hosting provider so that it can maintain our website for us and follow our instructions.

The access to your personal data by that third party is based on our legitimate interest pursuant to art. 13 FADP and art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in providing our services.

8. Cross-border disclosure to third countries without an adequate level of data protection

In connection with the processing activities related to our website, no processing takes place in or from a third country without an adequate level of data protection.

9. Your rights

Your rights as a data subject are:

• to request information about your personal data processed by us (art. 8 FADP). In particular, you may request information about the purposes of processing, the category of personal data, the categories of recipients to whom your data have been or will be disclosed, the planned storage period, the existence of a right to rectification, deletion, restriction of processing or objection, the existence of a right of appeal, the origin of your data, if these have not been collected by us, and the existence of automated decision-making including profiling and, if applicable, meaningful information on their details (art. 15 GDPR and art. 8 FADP). In the event of disproportionately high costs, we reserve the right to require you to provide us with an identification card and to assume the actual costs in advance.
• to obtain information on the legal basis of the processing (art. 8 para. 2 lit. b FADP).
• to demand immediately the correction of incorrect or complete personal data stored by us (art. 16 GDPR and art. 5 para. 2 FADP).
• to demand the deletion of your personal data stored by us, unless the processing is necessary to exercise the right to freedom of expression and information, to fulfil a legal obligation, for reasons of public interest or to assert, exercise or defend legal claims (art. 17 GDPR and art. 15 FADP).
• to demand the restriction of the processing of your personal data if you dispute the accuracy of the data, if the processing is unlawful, but you refuse to delete it and we no longer need the data, but if you need it to assert, exercise or defend legal claims or if you have filed an objection against the processing pursuant to art. 21 GDPR (art. 18 GDPR and art. 15 FADP).
• to receive your personal data that you have provided to us in a structured, current and machine-readable format or to request its transfer to another person responsible (art. 20 GDPR).
• to revoke your consent once given to us at any time. As a consequence in the future, we are no longer allowed to continue data processing based on this consent (art. 7 para. 3 GDPR).
• to complain to a supervisory authority (see above) (art. 77 GDPR).

10. Right to object

If your personal data will be on the basis of legitimate interests pursuant to art. 6 para. 1 lit. f GDPR, you have the right to object to the processing of your personal data pursuant to art. 21 GDPR provided that there are reasons for this arising from your particular situation or the objection to direct advertising. In the latter case, you have a general right of objection, which we will implement without specifying a particular situation.

11. Data security

We take appropriate measures to ensure that your personal data cannot be viewed or stolen by third parties without any permission. In particular by taking appropriate technical (e.g. firewall, password protection, etc.) and organizational (e.g. restriction of authorized persons, training of authorized persons, etc.) measures, we ensure that only authorized persons have access to this data.

However, you should always be aware that the transmission of information via internet and other electronic devices bears certain security risks and that we cannot guarantee the security of information transmitted in this way.

Your personal data in connection with our website will be transmitted to us SSL-encrypted from this website. We protect our website with technical and organisational measures against unauthorised access.

12. Data retention and deletion of personal data

We will record your data for the following period:

• We store data that we process by law during the statutory retention period, for example if required to do so by Labour Law, Social Security, Tax or Accounting Laws and Regulations.
• We keep the data for the performance of a contract at least for the duration of the contract and for a maximum of 10 (ten) years thereafter, unless we need the data to assert our rights.
• Data that we process to protect our legitimate interests will be kept for a maximum of 10 (ten) years after the end of the contractual relationship, unless we need the data to assert our rights.
• Application documents will be deleted or destroyed after six months.
• Data which were no longer needed will be deleted or destroyed when the purpose of processing and the basis for processing become invalid, unless there is a legal obligation to keep them.

13. Amendment of this Data Protection Declaration

We reserve the right to change this privacy statement at any time or to adapt it to new processing methods. The current Data Protection Declaration can be accessed at any time at https://www.tmh.international.

Zug, 18 October, 2019, Version 1.0