Imprint & Data Protection

Contact

Tel: +49 (0) 221 139 522 0
E-mail: project@mup-group.com

Responsible for content according to 6 MDStV:

M&P Project GmbH is a company of the
MuP Verwaltungs- und Beteiligungs AG
c/o M&P Group
Schwaighofstr. 58
83684 Tegernsee
Tel.: +49 (0) 8022 188 088 0
E-mail: info@mup-group.com
Homepage: www.mup-group.com
Munich Local Court
Commercial register no.: HRB 211141

Responsible for content according to 6 MDStV:

Florian von Tucher

Dr Jürgen Margane

Liability for contents

As a service provider, we are responsible for our own content on these pages in accordance with general legislation pursuant to Section 7 (1) of the German Telemedia Act (TMG). However, according to §§ 8 to 10 TMG, we are not obliged as a service provider to monitor transmitted or stored third-party information or to investigate circumstances that indicate illegal activity.

Obligations to remove or block the use of information in accordance with general laws remain unaffected by this. However, liability in this regard is only possible from the time of knowledge of a concrete infringement. If we become aware of corresponding infringements, we will remove this content immediately.

External links

This website contains links to third-party websites ("external links"). These websites are subject to the liability of the respective operators. When the external links were first created, we checked the third-party content for any legal violations. At that time, no legal violations were apparent. We have no influence whatsoever on the current and future design and content of the linked pages. The inclusion of external links does not imply that we adopt the content behind the reference or link as our own. It is not reasonable for us to constantly monitor the external links without concrete indications of legal violations. However, if we become aware of any legal violations, such external links will be deleted immediately.

Copyright and ancillary copyright

The contents published on this website are subject to German copyright and ancillary copyright law. Any use not permitted by German copyright and ancillary copyright law requires our prior written consent from the operator or the respective rights holder. This applies in particular to the copying, editing, translation, storage, processing or reproduction of content in databases or other electronic media and systems. The unauthorised reproduction or transmission of individual contents or complete websites is not permitted and is punishable by law. Only the production of copies and downloads for personal, private and non-commercial use is permitted. The display of this website in external frames is only permitted with written permission. Insofar as the content on this site was not created by us, the copyrights of third parties are respected. In particular, third-party content and rights are identified as such. Should a visitor nevertheless become aware of a copyright infringement, we request that he or she be notified accordingly. If we become aware of any infringements, we will remove such content immediately.

Applicable law

The legal notices on this website as well as all questions and disputes in connection with our websites are subject to the laws of the Federal Republic of Germany.

Online privacy policy

• 1. general; what is it about? Who is responsible for data processing?

Us, the M&P Group, Prannerstr. 6, 80333 Munich, Germany, (hereinafter also "M&P Group", "we", "us"), the protection of your personal data is very important to us. It is therefore a matter of course for us to handle your personal data in compliance with the applicable statutory data protection regulations, in particular the EU General Data Protection Regulation ("GDPR") and the Federal Data Protection Act carefully and responsibly.

This online privacy policy applies both in the context of the use of the website www.mup-group.com (the "Website") as well as in the context of using the M&P Group careers page https://mup-group-karriere.career.softgarden.de/ and when using our social media presences (hereinafter summarised as "Online presences").

With this online privacy policy, we explain below how we, the M&P Group, as the data controller within the meaning of the GDPR, process your personal data in the context of your use of our online presence, for what purpose, on what legal basis and in what way this is done and what rights you are entitled to in this respect.

• 2 What personal data do we process and for what purposes?

• a) Visit to the website

If you only use the website for informational purposes, i.e. if you do not actively transmit information to us, we do not collect any personal data - subject to the other processing described in this data protection declaration, in particular with regard to cookies (section 2. e)) - with the exception of the data that your browser automatically transmits to enable you to visit the website (corresponding data may be temporarily stored in log files).

This includes, for example, the following data:

• IP address of the requesting computer
• Name and URL of the accessed file
• Date and time of access
• Transmitted data volume
• Message whether the retrieval was successful
• Recognition data of the browser and operating system used by the requesting computer.

This data cannot be assigned to specific persons. The aforementioned processing of data is essentially carried out for the purpose of enabling the use of the website (in particular connection establishment) and for internal system-related purposes (technical administration, system security). Insofar as the aforementioned data is personal data, the corresponding processing of this data is based on Art. 6 para. 1 sentence 1 lit. f GDPR (legitimate interest). The legitimate interest follows from the aforementioned purposes.

• b) Contact by e-mail, contact form, appointment form or callback form

You can contact us in various ways. We would like to answer every enquiry to your satisfaction and attach great importance to getting to know you - our customers and interested parties - personally. We therefore ask you to provide certain data depending on the form of contact (so-called "mandatory information"). In our experience, it is not possible to respond to your enquiry effectively and satisfactorily without this mandatory information. Therefore, when contacting us, please compare which form of contact best suits your enquiry. If no contact form is suitable, you can always simply send us an e-mail from your e-mail programme or call us directly. In all cases, we process your personal data listed below when you contact us solely for the purpose of processing and responding to your enquiry and any follow-up questions, as described in more detail below.aa) Contact form

A contact form is available on the website, which can be used to contact us electronically.

Data categoriesIf you send us an enquiry in this way, we process the following data: E-mail address, telephone number, form of address/title, surname, first name, log data such as the date and time of the enquiry and our corresponding correspondence. If you provide this data voluntarily, we will also process your message to us.

Purposes and legal basis:

(1)   Reply to your request: We process your above-mentioned personal data exclusively for the purpose of responding to your contact enquiry. We would like to contact you personally and in an individualised manner in order to be able to answer your enquiry satisfactorily. We will normally try to contact you by telephone to answer your contact enquiry. If we cannot reach you by telephone or if we send you material to answer your contact enquiry, we also need your e-mail address.

The legal basis for the processing of your personal data is Art. 6 para. 1 sentence 1 lit. b GDPR (fulfilment of contract).

If no contract is concluded, the processing of your data is based on our legitimate interest (Art. 6 para. 1 sentence 1 lit. f GDPR). The legitimate interest arises from the fact that we can only answer your enquiry adequately by processing your data accordingly; You can object to this at any time for reasons arising from your particular situation.

(2)   IT security and abuse prevention: We also process the aforementioned data to prevent misuse of the contact form and to ensure the security of our systems, e.g. by filtering duplicates (this is our legitimate interest).

The legal basis for this processing of your personal data is Art. 6 para. 1 sentence 1 lit. f GDPR. You can object to this at any time for reasons arising from your particular situation.bb) Recall form

A callback form is available on the website, if applicable.

Data categories: If you contact us in this way, we process the following data: Salutation/title, surname, first name telephone number, log data such as date and time of the enquiry and our corresponding correspondence. If you provide this information voluntarily, we will also process: your message, e-mail address, preferred date and time.

Purposes and legal basis:

(1)   Answering your enquiry: We process your above-mentioned personal data exclusively for the purpose of responding to your callback request. If you provide us with your e-mail address, we can contact you by e-mail if we are unable to keep the appointment you have suggested or if we cannot reach you by telephone.

The legal basis for this data processing is Art. 6 para. 1 p. 1 lit. b DSGVO (contract performance).

If no contract is concluded, the processing of your data is based on our legitimate interest (Art. 6 para. 1 sentence 1 lit. f GDPR). The legitimate interest arises from the fact that we can only adequately respond to your enquiry by processing your data accordingly; You can object to this at any time for reasons arising from your particular situation.

(2)   IT security and abuse prevention: We also process the aforementioned data to prevent misuse of the callback form and to ensure the security of our systems, e.g. by filtering duplicates (this is our legitimate interest).

The legal basis for this processing of your personal data is Art. 6 para. 1 sentence 1 lit. f GDPR. You can object to this at any time for reasons arising from your particular situation.cc) Appointment form

If necessary, a form for making an appointment is available on the website.

Data categories: If you contact us in this way, we process the following data: Salutation/title, surname, first name, telephone number, log data such as the date and time of the enquiry and our corresponding correspondence. If you provide additional information voluntarily: your message, e-mail address, preferred date and time.

Purposes and legal basis:

(1)   Answering your enquiry: We process your above-mentioned personal data exclusively for the purpose of responding to your enquiry about making an appointment. We will normally try to contact you by telephone. If you provide us with your e-mail address, we can contact you by e-mail if we are unable to keep the appointment you have suggested or if we cannot reach you by telephone.

The legal basis for the processing of your personal data is Art. 6 para. 1 sentence 1 lit. b GDPR (fulfilment of contract).

If no contract is concluded, the processing of your data is based on our legitimate interest (Art. 6 para. 1 sentence 1 lit. f GDPR). The legitimate interest arises from the fact that we can only adequately respond to your enquiry by processing your data accordingly; You can object to this at any time for reasons arising from your particular situation.

(2)   IT security and abuse prevention: We also process the aforementioned data to prevent misuse of the form for making appointments and to ensure the security of our systems, e.g. by filtering duplicates (this is our legitimate interest).

The legal basis for this processing of your personal data is Art. 6 para. 1 p. 1 lit. f DSGVO. You can object to this at any time for reasons arising from your particular situation.dd) Contact by e-mail or telephone

As an alternative to our contact forms, you can contact us via the e-mail address provided or by phone.

Data categories: In this case, we process the personal data that you provide to us when you contact us, log data such as the date and time of the enquiry, as well as our corresponding correspondence.

Purposes and legal basis:

(1)   Providing alternative contact options and responding to your enquiry: We process your above-mentioned personal data to respond to your enquiry. We will communicate with you via the contact channel you have chosen for your enquiry.

The legal basis for the processing of your personal data is Art. 6 para. 1 sentence 1 lit. b GDPR (fulfilment of contract).

If no contract is concluded, the processing of your data is based on our legitimate interest (Art. 6 para. 1 sentence 1 lit. f GDPR). The legitimate interest arises from the fact that we can only adequately respond to your enquiry by processing your data accordingly; You can object to this at any time for reasons arising from your particular situation.

(2)   IT security: We also process the aforementioned data to ensure the security of our systems (this is our legitimate interest).

The legal basis for this processing of your personal data is Art. 6 para. 1 p. 1 lit. f DSGVO. You can object to this at any time for reasons arising from your particular situation.

• c) Newsletter and other information by e-mail

You can register on our website to receive our newsletter and other similar information by e-mail.

Data categories: We process the following data for sending the newsletter and other information: Salutation/title, surname, first name, email address, information for verifying the email address and for sending the newsletter.

If optional, also: telephone number.

Purposes and legal basis:

(1)   Newsletter: The purpose of processing your e-mail address is to send you the corresponding e-mail. We also collect your first name and surname in this context in order to address you personally in the newsletter. You can also provide your telephone number on a voluntary basis in order to receive news from us by telephone in addition to the newsletter.

The legal basis for the processing of your personal data is Art. 6 para. 1 sentence 1 lit. a GDPR (consent).You can revoke your consent to receive such messages at any time with effect for the future.You will find a corresponding "Unsubscribe" link in every newsletter. You can also inform us of your cancellation via the contact option provided at the end of this privacy policy, see section 6.

(2)   Verification of your e-mail address: We require a valid e-mail address from you for effective registration. In order to check whether the registration actually comes from you and whether you have given your consent, we generally use the so-called "double opt-in" procedure as a consent procedure. With the double opt-in procedure, the initial registration must be confirmed in a second step. For this purpose, you will receive an e-mail message (confirmation e-mail) asking you to confirm the contact e-mail address you have entered.

The legal basis for the processing of your personal data is Art. 6 para. 1 sentence 1 lit. c GDPR (our legal obligation to verify and document the consent of the owner of the registered e-mail address).

(3)   IT security and abuse prevention: We also process the aforementioned data to prevent misuse of the newsletter form and to ensure the security of our systems, e.g. by filtering duplicates (this is our legitimate interest).

The legal basis for this processing of your personal data is Art. 6 para. 1 sentence 1 lit. f GDPR. You can object to this at any time for reasons arising from your particular situation.

• d) Request for studies

On our website it is possible to request various documents / information / studies on the topics of the EU Tech Chamber (e.g. white papers, position papers, etc.; together "Studies").

Data categories: If you send us a request to receive these studies using the corresponding request form, we will process the following data: Salutation/title, surname, first name, e-mail address, postal address, telephone number, log data such as date and time of the enquiry, other information provided by you and our corresponding correspondence.

Purposes and legal basis:

(1)   Studies: The purpose of processing your e-mail address is to send you the corresponding e-mail with the download link. We also collect your first and last name in this context in order to address you personally in the e-mail with which we send you the download link for the study and the verification request.

The legal basis for the processing of your e-mail address and your first and last name in order to send you the requested studies is Art. 6 para. 1 sentence 1 lit. b GDPR (fulfilment of your request).

(2)   News, service offers, information material and market information by telephone, e-mail and post: The studies are an ad-financed offer from the M&P GROUP. This means that you can only download the studies if you agree to receive advertising communication (by post, e-mail and telephone) from the M&P GROUP. We therefore process your personal data beyond the dispatch of the studies in order to inform you about our services by e-mail, telephone and/or post, to enable contact with our contractually bound brokers or to send you further information material or market information. We address you personally in our communications and process your first name and surname for this purpose.

The legal basis for the processing of your salutation, title, e-mail address and postal address in order to inform you about our services, to enable contact with our contractually bound agents or to send you further material is Art. 6 para. 1 sentence 1 lit. a GDPR (consent). You can revoke your consent given in this context at any time for the future. You may continue to keep and use studies you have already received.

(3)   Verification of your e-mail address: For an effective registration for our e-mail offers (as described under (2)), we require a valid e-mail address from you. In order to check whether the registration actually comes from you and whether you have given your consent, we generally use the so-called "double opt-in" procedure as a consent procedure. With the double opt-in procedure, the initial registration must be confirmed in a second step. For this purpose, you will receive an e-mail message (confirmation e-mail) asking you to confirm the contact e-mail address you have entered. This confirmation e-mail also contains the link to download the study.

The legal basis for the processing of your personal data is Art. 6 para. 1 sentence 1 lit. c GDPR (our legal obligation to verify and document the consent of the owner of the registered e-mail address).

(4)   IT security and abuse prevention: We also process the aforementioned data to prevent misuse of the study request form and to ensure the security of our systems, e.g. by filtering duplicates (this is our legitimate interest).

The legal basis for this processing of your personal data is Art. 6 para. 1 sentence 1 lit. f GDPR. You can object to this at any time for reasons arising from your particular situation.

• (e) processing time

We will only process the personal data we receive from you until we have finally answered your enquiry, sent you other information or sent you the requested studies. If you have requested the newsletter but have not confirmed your e-mail address in the double opt-in procedure, we will process your personal data for a period of 6 months. In order to inform you about our services on the basis of your consent, to send you the newsletter and to send you material, we will only process your personal data for as long as you do not revoke your consent. For IT security purposes, we will only process your data for as long as is necessary to protect our systems or until you object to the data processing. If you object, we will no longer process your personal data for the purposes in question unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. In addition, we only store personal data to the extent permitted by law for the assertion of or defence against legal claims or as long as there are legal obligations to store it.

• f) Use of cookies

aa) General

We use so-called cookies and similar technologies such as pixels on our website (hereinafter collectively referred to as "Cookies"). Cookies are small text files that are stored in your browser's memory and enable us to technically display the website, offer certain functions and improve our website. You can configure your browser so that no cookies are stored or a message always appears before a new cookie is created. However, the (complete) deactivation of cookies may mean that you cannot (fully) use all the functions of our website. The legal basis for the processing of personal data (insofar as this is personal data at all in individual cases) by technically necessary cookies is Art. 6 para. 1 sentence 1 lit. b GDPR (fulfilment of contract).bb) Cookies used on the website

In addition, data is processed in connection with the following third-party tools:

• (1) Google

• i. Google Analytics

We use Google Analytics on the website, a web analysis service from Google (Google Ireland Limited Gordon House, Barrow Street, Dublin 4 Ireland). If you do not consent to the use of this tool when you (first) access the website, no personal data about you will be processed with the help of this tool. Google Analytics uses so-called "cookies", which enable your use of the website to be analysed. The information generated by the cookie about your use of the website may be transmitted to a Google server in the USA and stored there. We have activated IP anonymisation on the website so that your IP address will be shortened by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there. Google processes the following personal data collected via cookies to analyse your use of the website, to compile reports on website activity and to provide the website operator with other services relating to website activity and internet usage:

The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data.

The aforementioned personal data will be stored for 14 months.

Google processes the aforementioned data for us as a processor (see also section 3 below). We have concluded a corresponding contract with Google for order processing.

To ensure an adequate level of data protection, Google uses so-called standard data protection clauses within the meaning of Art. 46 para. 2 lit. c) GDPR (corresponding documentation on the standard data protection clauses can be found here: (https://policies.google.com/privacy?hl=de)).

You can find more information about Google Analytics here: http://www.google.com/analytics/terms/de.html, http://www.google.com/intl/de/analytics/learn/privacy.html, http://www.google.de/intl/de/policies/privacy/.

• ii. Google Tag Manager

We use the so-called Google Tag Manager from Google (Google Ireland Limited Gordon House, Barrow Street, Dublin 4 Ireland) on the website. Google Tag Manager is a solution that allows marketers to manage website tags via an interface. The tool itself (which implements the tags) is a cookie-less domain and does not process any personal data. The tool is used for the purpose of triggering other tags, which in turn may collect data. Google Tag Manager does not access this data. If a deactivation has been made at domain or cookie level, this remains in place for all tracking tags that are implemented with Google Tag Manager.Hotjar

We use the web analysis service Hotjar from Hotjar Ltd (Hotjar Ltd, Level 2, St Julians Business Centre, 3, Elia Zammit Street, St Julians STJ 1000, Malta) on the website. If you do not consent to the use of this tool when you (first) access the website, no personal data will be processed by you with the help of this tool.

We use this tool primarily to gain a better understanding of what content on our website is used, how it is used and to what extent. With this tool, movements on the website can be tracked (so-called

heatmaps). This makes it possible to recognise how far users scroll and which buttons users click and how often. The tool also makes it possible to obtain feedback from website visitors.

We take care to protect your personal data when using this tool. As a rule, we can only track and process your personal data as follows:

• which buttons are clicked,
• the course of the mouse,
• how far to scroll,
• the screen size of the device,
• Device type and browser information,
• Geographical location (in relation to the country), and
• the preferred language.

IP addresses are only stored and processed in anonymised form in order to exclude direct personal references as far as possible. However, Hotjar uses various third-party services, such as Google Analytics. It is therefore possible that these services collect data that is transmitted by your browser

Insofar as your personal data is processed when using this tool, the processing is carried out on the basis of Art. 6 para. 1 sentence 1 lit. a GDPR (consent). You can also subsequently prevent the use of this tool in connection with our website with regard to your personal data (i.e. after initially granting consent) for the future by deactivating the corresponding use with regard to your data in the consent management tool contained on our website (deactivation of the "preference cookies"). You can also deactivate the use of the tool by adjusting the cookie settings of your browser accordingly.

For more information about Hotjar Ltd. and about the Hotjar tool, see https://www.hotjar.com/ and under https://www.hotjar.com/privacy/.

• (2)  Taboola

We use the Taboola technology (from Taboola, Inc. or Taboola Europe Limited, Oneustonsq, 40 Melton Street, 13th Floor, London, NW1 2FD) on our website. If you do not consent to the use of this tool when you (first) access the website, no personal data will be processed by you with the help of this tool.

This tool is used to recommend content that matches your personal interests and thus customise our offer for you. Taboola uses cookies to determine which websites you visit frequently and how you navigate our website. We process the following data for this purpose:

• device-related data,
• Protocol data.

From this, Taboola creates user profiles for us on the basis of pseudonyms. These usage profiles are not merged with data about the bearer of the pseudonym and do not allow any conclusions to be drawn about your personal data. Your IP address is only transmitted to Taboola in abbreviated form.

Insofar as your personal data is processed when using this tool, the processing is carried out on the basis of Art. 6 para. 1 sentence 1 lit. a GDPR (consent). You can also subsequently prevent the use of this tool in connection with our website with regard to your personal data (i.e. after initially granting consent) for the future by deactivating the corresponding use with regard to your data in the consent management tool contained on our website (deactivation of "marketing cookies"). You can also deactivate the use of the tool by adjusting the cookie settings of your browser accordingly.

In this context, Taboola may also process data in third countries outside the EU (in Israel, Hong Kong or the USA). With regard to Israel, there is an adequacy decision by the EU Commission to the effect that Israel ensures an adequate level of data protection. In addition, Taboola uses so-called standard data protection clauses for other data transfers to third countries to ensure an adequate level of data protection in relation to the corresponding data processing (for details, see https://www.taboola.com/privacy-policy).

• (3)  Facebook Pixel

We use the visitor action pixel from Facebook on the website for conversion measurement. The provider of this service is Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. We and Facebook Ireland Limited are so-called "joint controllers" for data processing in connection with the pixel. Facebook and we therefore jointly determine the purposes and means of data processing. For this purpose, we have concluded a joint responsibility agreement, which you can access here: https://www.facebook.com/legal/controller_addendum. If you do not consent to the use of this tool when (first) accessing the website, no personal data from you will be processed using this tool.

With this tool, the behaviour of page visitors can be tracked. This makes it possible to evaluate the effectiveness of Facebook ads for statistical and market research purposes and to optimise future advertising measures.

Your following data will be processed via the Facebook Pixel:

• IP address (shortened)
• Cookie ID
• Pixel ID
• Website usage data
• Information about the browsing session
• Site location
• URL of the website visited by the user
• Further surfing behaviour (i.e. websites that the user visits after this website)
• Referrer URL (i.e. the URL from which the user reached this website)
• User agent (e.g. browser, e-mail or newsreader)
• Operating system

As the operator of this website, we generally only receive aggregated, i.e. summarised, data via the Facebook pixel and cannot draw any conclusions about the identity of the users.

The use of Facebook pixel technology by us with regard to your data is based on Art. 6 para. 1 p. 1 lit. a DSGVO (consent). You can also subsequently (i.e. after initially granting consent) prevent the execution of this tool in connection with our website with regard to your personal data for the future by deactivating a corresponding use with regard to your data again in the consent management tool contained on our website (deactivation of the "marketing cookies").

You can also deactivate the use of the tool by adjusting the cookie settings of your browser accordingly.

The data processed via the Facebook Pixel is stored for 180 days.

Your personal data may be processed by Facebook in third countries (in particular the USA). As a guarantee to ensure a sufficient level of data protection, Facebook uses so-called standard data protection clauses within the meaning of Article 46 (2) (c) of the GDPR (Facebook can provide you with the corresponding documentation on the standard data protection clauses).

You can find more information about protecting your privacy in Facebook's privacy policy: https://de-de.facebook.com/about/privacy/.

• (4)  Dianomi

Some advertising material is displayed on our website. In this context, we use the tool Dianomi from the provider Dianomi Ltd, 84 Eccleston Square, London, SW1V 1PX, in order to present you with suitable content. If you do not consent to the use of this tool when (first) accessing the website, no personal data from you will be processed with the help of this tool.

Dianomi plays content for visitors to the website either on the basis of their interests or on the basis of the interests of similar users or content that has previously been viewed on other websites by the respective visitor. This requires that the interests of visitors to the website can be analysed and that visitors can be distinguished from each other individually. This is done through the use of cookies, which are set in connection with the tool Dianomi. Each time our website is called up, the visitor's behaviour is analysed in this way. For this purpose, the following data is processed via the Dianomi cookies:

Insofar as your personal data is processed when using this tool, the processing is carried out on the basis of Art. 6 (1) sentence 1 lit. a DSGVO (consent). You can also subsequently (i.e. after initially granting consent) prevent the use of this tool in connection with our website with regard to your personal data for the future by deactivating the corresponding use with regard to your data on the consent management tool contained on our website (deactivation of the "marketing cookies"). You can also deactivate the use of the tool by adjusting the cookie settings of your browser accordingly. Further information on this tool can be found at https://www.dianomi.com/cms/.

• (5)  Outbrain

On our website, we use the tool Outbrain, from the provider Outbrain UK Ltd (175 High Holborn, West End, WC1V 7AA, London), in order to refer our users to further content within our website and on third-party websites that may also be of interest to them. If you do not consent to the use of this tool when (first) accessing the website, no personal data about you will be processed using this tool.

When using the tool, for example, further reading recommendations are integrated below an article, which are determined on the basis of the previous content read by the user. For the display of this interest-related advanced content, Outbrain uses cookies that are stored on the user's computer/end device. The content displayed in the Outbrain widget is automatically controlled and delivered by Outbrain in terms of content and technology. The display of reading recommendations by Outbrain using cookies takes place on a pseudonymous basis. The data collected by Outbrain are:

• Device source,
• Browser type and
• the anonymised IP address of the user.

Insofar as your personal data is processed when using this tool, the processing is carried out on the basis of Art. 6 (1) sentence 1 lit. a DSGVO (consent). You can also subsequently (i.e. after initially granting consent) prevent the use of this tool in connection with our website with regard to your personal data for the future by deactivating the corresponding use with regard to your data in the consent management tool contained on our website (deactivation of the "marketing cookies"). You can also deactivate the use of the tool by adjusting the cookie settings of your browser accordingly.

Where Outbrain processes personal data outside the EU, Outbrain ensures that this is done on the basis of appropriate safeguards to ensure an adequate level of data protection. You can find more information at http://www.outbrain.com/de/legal/privacy.

• (6)  Optimizely

In order to continuously improve our web offers, we carry out tests on individual pages - for example, to find out the optimal placement of programme references. For such testing purposes, we also collect statistical data and use cookies from the web analysis service "Optimizely" from Optimizely, Inc. 631 Howard Street, Suite 100 San Francisco, CA 94105 (www.optimizely.com/de/).

We process the following personal data via the Optimizely cookie:

• shortened IP address,
• Date and time of the request,
• Website from which the request comes,
• Browser, operating system. (including the shortened IP address of the user).

This personal data is transferred to a server of Optimizely in the USA and stored there. We use Optimizely exclusively with anonymised IPs; this means that your IP address is still shortened by Optimizely within member states of the European Union or in other contracting states of the Agreement on the European Economic Area (EEA) before being transmitted to the USA. Only in exceptional cases will the full IP address be transmitted to a server of Optimizely in the USA and shortened there.

Insofar as your personal data is processed when using this tool, the processing is carried out on the basis of Art. 6 (1) sentence 1 lit. a DSGVO (consent). You can also subsequently (i.e. after initially giving your consent) prevent the use of this tool in connection with our website with regard to your personal data for the future by deactivating the corresponding use with regard to your data on the consent management tool contained on our website (deactivation of the "preference cookies"). You can also deactivate the use of the tool by adjusting the cookie settings of your browser accordingly.

• (7)  AppNexus

For the display of usage-based advertising, Media Impact uses AppNexus, an advertising service provider and operator of an intermediary platform (AppNexus Inc., 28 W. 23rd Street, New York, New York, 10010, USA). AppNexus processes information about your activities for the purpose of analysing user behaviour. These profiles are used to display targeted, interest-based advertising and to make our websites more interesting for you as a user.

For the provision of the advertisements, statistical information about you is collected, which is processed by our advertising partners. By visiting the website, AppNexus receives the information that you have accessed the corresponding page of our website. For this purpose, AppNexus determines your needs and sets a cookie on your computer. The data mentioned under "Logfiles" of this statement are transmitted. According to AppNexus, the data is stored in non-aggregated form for up to 18 months from the date of its collection. Aggregated data is used for reporting and analysis and may be stored for a further 2 years.

For more information about AppNexus' data processing, please see AppNexus' privacy policy at. https://www.appnexus.com/en/company/platform-privacy-policy.

Insofar as your personal data is affected by the use of this tool, the processing is carried out on the basis of Art. 6 (1) sentence 1 lit. a DSGVO (consent). You can also subsequently (i.e. after initially giving your consent) prevent the use of this tool in connection with our website with regard to your personal data for the future by deactivating the corresponding use with regard to your data in the consent management tool contained on our website (deactivation of the "marketing cookies").

• (8)  Plista

We use a function on our website with plista to provide a recommendation technology. We are supported in this by plista GmbH, Torstraße 33, 10119 Berlin, Germany.

plista compares the interests of website visitors with each other and recommends the favourites of similar visitors in each case (Art. 6 para. 1 lit. f DSGVO). For this purpose, it is necessary that plista a.) evaluates the interests and b.) can distinguish individual website visitors from each other without knowing their identity. plista compares the reading behaviour (including clicks, visits, date) of different visitors with each other. This only happens on pages on which plista is activated. Recommendations are generally made anonymously - i.e. ratings and click data are used in the algorithm, while it is not possible for third parties to see or read the data basis. In order for plista to be able to deliver the corresponding recommendations to the website visitor, which fall within his or her area of interest, plista combines this rating and click data into a usage profile and evaluates it. To provide this service, plista requires anonymous data.

Anonymous usage data provide information about website visits, clicks of a website visitor and his or her reading behaviour without any personal reference. When collecting anonymous data, it is not possible to draw any conclusions about your identity in any respect. All data is collected anonymously and protected by plista's terms of use and data protection regulations. This enables us to increase the attractiveness of our website for you and to offer you products for purchase that may interest you (our legitimate interest).

We process the data until the end of the evaluation. The provision of the data by you is neither legally nor contractually required nor necessary for the conclusion of a contract. You can find further information on plista's data protection here: http://www.plista.com/infos/privacy.

• (9)   Yahoo

We use Verizon Media - Yahoo's "content discovery technology" on this website to recommend other online content that you may be interested in. To make these recommendations, Verizon Media - Yahoo collects information about your device and your behaviour on this website (and other partner websites) using cookies and similar technologies.

Insofar as your personal data is processed when using this tool, the processing is carried out on the basis of Art. 6 (1) sentence 1 lit. a DSGVO (consent). You can also subsequently (i.e. after initially granting consent) prevent the execution of this tool in connection with our website with regard to your personal data for the future by deactivating a corresponding use with regard to your data again in the consent management tool contained on our website (deactivation of the "marketing cookies").

• (10) Tealium

On our website we use Tealium iQ Tag Management, from Tealium Inc, 11085 Torreyana Road, San Diego, CA, 92121 USA, email: privacy@tealium.com. Tealium iQ Tag Management is a solution that allows us to assign a tag to each of our pages and manage them. With the help of the tags, the Tealium Tag Manager can use analysis and tracking tools for us only where they make sense.

The tag management itself does not store any personal data from you. Only anonymised data is generated, which is stored locally in the browser in the cookie "utag_main".

• 3. do third parties receive your personal data?

The personal data processed in the context of the use of the website will not be passed on to third parties or transferred in any other way, subject to other cases described in this data protection declaration, and if necessary only with your consent.

We may use (technical) service providers (e.g. IT service providers) who process personal data on our behalf. These service providers process the corresponding personal data exclusively according to our instructions (order processor; Art. 28 DSGVO).

We transmit personal data to state institutions and authorities if we are legally obliged to do so (for example, in the case of a request from a court). The legal basis for this processing of your personal data is Art. 6 para. 1 p. 1 lit. c DSGVO (fulfilment of a legal obligation).

• 4. what rights do you have?

Insofar as the legal requirements are met, you have the right,

• request information from us at any time about the personal data we hold about you,
• on rectification,
• on deletion,
• to restrict the processing of the relevant personal data,
• The right to object to the processing of your personal Data through us to disagree, and
• to receive from us the personal data concerned that you have provided to us in a structured, commonly used and machine-readable format (you may transfer this data or have it transferred to other bodies).

If you have given your consent to the use of personal data, you can revoke this consent at any time for the future.

If you believe that our processing of personal data relating to you is in breach of applicable data protection law, you may lodge a complaint with a data protection supervisory authority.

• How can I get in touch? Who can I contact? How do I reach the Data Protection Officer?

You can contact us at the address given in section 1 and by e-mail at
info@mup-group.com,
Telephone: +49 89 550 521 40 Contact us.

For all questions relating to data protection (including the assertion of your rights under section 5)
you can also contact our data protection officer directly:

Dr Igor Gladkov
Sanktjohanerstraße 45
83707 Bad Wiessee
Telephone: +49 8022 18808806
E-mail: datenschutz@mup-group.com

• 6. amendment of the privacy policy

From time to time, it may be necessary to change this privacy policy, for example due to further developments of our website or legal changes. We therefore reserve the right to change the data protection declaration at any time with effect for the future. We therefore recommend that you read this data protection declaration again at regular intervals. We will actively inform you of any significant changes. (Status of this data protection declaration October 2020)

• 7. online presence in social media

We maintain online presences within the so-called social media in order to communicate with the customers, interested parties and users active there and to be able to inform them about our services there. This includes both classic social media platforms such as Facebook and Instagram as well as professional networks such as LinkedIn and XING. When accessing the respective networks and platforms, the terms and conditions and data protection declarations of the respective operators apply.

Specifically, the M&P GROUP operates corresponding social media pages on:

Instagram: https://www.instagram.com/mup_group/
Facebook: https://www.facebook.com/mullundpartnergruppe
LinkedIn: https://www.linkedin.com/company/mup-group/mycompany
XING: https://www.xing.com/companies/m%26pgroup
Twitter: https://twitter.com/MuP_Group
Website: www.mup-group.com

You can find our contact details in our imprint. In addition to us, there is also the operator of the social media platform itself. This operator is also a further controller (so-called joint controllership / joint responsibility) who carries out data processing over which we have only limited influence. At the points where we can exert influence and parameterise data processing, we work towards data protection-compliant handling by the operator of the social media platform within the scope of the possibilities available to us. In many places, however, we cannot influence the data processing by the operator of the social media platform.

• a) Data processing by us:

The data you enter on our social media pages, such as comments, videos, pictures, likes, public messages, etc., are published by the social media platform and are not used or processed by us for any other purpose at any time. We only reserve the right to delete content if this should be necessary. We may share your content on our site if this is a feature of the social media platform and communicate with you through the social media platform. If you perform an action on our social media pages (e.g. comments, posts, likes, etc.), you may make personal data (e.g. user name or photo of your user profile) public.

The legal basis is Art. 6 para. 1 p. 1 lit. f) DSGVO. Data processing is carried out in the interest of our public relations/PR, communication and information.

If you wish to object to certain data processing over which we have control, please contact us using the contact details provided in the imprint.

If you send us a request on the social media platform, we may also refer you to other secure communication channels that guarantee confidentiality, depending on the required response. You always have the option of sending us confidential enquiries to our address given in the imprint.

As already explained, where the provider of the social media platform gives us the opportunity, we make sure that our social media pages are designed to be as data protection-compliant as possible. With regard to statistics provided by the social media platform provider, we can only influence these to a limited extent and cannot switch them off. However, we make sure that no additional optional statistics are made available to us.

• b) Data processing by the social media operator Platform

The operator of the social media platform uses web tracking methods. The web tracking can also take place regardless of whether you are logged in or registered with the social media platform. As already mentioned, we can unfortunately hardly influence the web tracking methods of the social media platform. We cannot, for example, switch this off.

Please be aware: It cannot be ruled out that the provider of the social media platform uses your profile and behavioural data, for example to evaluate your habits, personal relationships, preferences, etc. We have no influence on the processing of your data by the provider of the social media platform. In this respect, we have no influence on the processing of your data by the provider of the social media platform.

Instagram

The M&P GROUP uses an Instagram business profile with the Insights function. The M&P GROUP uses the information on impressions, reach and interaction provided by the analysis tool to improve its communication measures. In order to fulfil its editorial tasks on Instagram, the M&P GROUP processes data from people who actively approach the M&P GROUP on Instagram: by asking questions or making comments in the comment function under M&P GROUP posts. M&P GROUP subscribers (followers) will see your user name next to the relevant comment on the M&P GROUP page and can access your profile by clicking on it. As a user, you have the option of setting your account to private so that your user profile and your posts are not visible to the public. Further information and explanations on data protection can be found at https://help.instagram.com/519522125107875

Facebook

The M&P GROUP has its own company page on Facebook, Facebook Ireland Ltd, 4 Grand Canal Square Grand Canal Harbour, Dublin 2, Ireland. We would like to point out that you use this Facebook page and its functions on your own responsibility. This applies in particular to the use of the interactive functions (e.g. commenting, sharing, rating). Alternatively, you can also access the information offered via this page on our website at www.mup-group.com/news retrieve.

When you visit our Facebook page, Facebook collects, among other things, your IP address and other information that is present on your PC in the form of cookies. This information is used to provide us, as operators of the Facebook pages, with statistical information about the use of the Facebook page. Facebook provides more detailed information on this under the following link: http://de-de.facebook.com/help/pages/insights.

The data collected about you in this context is processed by Facebook Ltd. and may be transferred to countries outside the European Union. Facebook describes in general terms what information it receives and how it is used in its data usage guidelines. There you will also find information on how to contact Facebook and on the settings for advertisements. The data usage guidelines are available at the following link: http://de- en.facebook.com/about/privacy

Facebook's full data policy can be found here: https://de- en.facebook.com/full_data_use_policy

In what way Facebook uses the data from visits to Facebook pages for its own purposes, to what extent activities on the Facebook page are assigned to individual users, how long Facebook stores this data and whether data from a visit to the Facebook page is passed on to third parties, is not conclusively and clearly stated by Facebook and is not known to us. When you access a Facebook page, the IP address assigned to your terminal device is transmitted to Facebook. According to Facebook, this IP address is anonymised (for "German" IP addresses). Facebook also stores information about the end devices of its users (e.g. as part of the "registration notification" function); this may enable Facebook to assign IP addresses to individual users.

If you are currently logged in to Facebook as a user, there is a cookie with your Facebook ID on your end device. This enables Facebook to track that you have visited this page and how you have used it. This also applies to all other Facebook pages. Facebook buttons embedded in websites enable Facebook to record your visits to these website pages and assign them to your Facebook profile. This data can be used to offer content or advertising tailored to you.

If you want to avoid this, you should log out of Facebook or deactivate the "stay logged in" function, delete the cookies present on your device and close and restart your browser. In this way, Facebook information that can directly identify you will be deleted. This allows you to use our Facebook page without revealing your Facebook identifier. When you access interactive features of the site (Like, Comment, Share, Message, etc.), a Facebook login screen will appear. Once you have logged in, you will again be recognisable to Facebook as a specific user. Information on how to manage or delete information about you can be found on the following Facebook support pages:

https://de-de.facebook.com/about/privacy#

You can find the current version of this data protection declaration under "Data protection" on our Facebook page.YouTube

On our website, we embed YouTube videos of the provider Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland into our website. We use the so-called "extended data protection mode" of the provider YouTube to embed videos. This mode prevents YouTube from storing cookies for a user who is viewing a website with an embedded YouTube video player with extended data protection, but does not click on the video to start playback. Only when the video is played can YouTube store cookies on your computer. However, according to YouTube, no personal cookie information is stored for playbacks of embedded videos with enhanced privacy. In principle, we have no influence on the further processing by YouTube.

Google itself is legally responsible for this. If you are logged into your YouTube account, you enable YouTube to associate your surfing behaviour directly with your personal profile.

You can find more information about YouTube's data protection here: www.youtube.com/privacy. The legal basis for the processing of your personal data is our legitimate interest pursuant to Art. 6 para. 1 lit. f) DSGVO for the purpose of presenting our company in an appealing manner.

In addition, we use the possibility of company presences on professionally oriented networks. We maintain a company presence on the following professional networks:LinkedIn, XING and Twitter

LinkedIn, Unlimited Company Wilton Place, Dublin 2, Ireland

XING SE, Dammtorstraße 30, 20354 Hamburg, Germany

Twitter, Inc. 1355 Market Street, Suite 900, San Francisco, CA 94103

On the corresponding pages, we provide information and offer users the opportunity to communicate. The company website is used for applications, information/PR and active sourcing. We do not have any information on the processing of your personal data by the companies jointly responsible for the company website. For more information, please see the privacy policy of:

LinkedIn: https://linkedin.com/legal/privacy-policy

XING: https://privacy.xing.com/de/datenschutzerklaerung

Twitter: https://twitter.com/de/privacy

M&P Group website: https://www.mup-group.com/impressum/

• c) Your rights as a User

When processing your personal data, the GDPR grants you certain rights as a website user:

• aa) Right of access (Art. 15 GDPR):

You have the right to request confirmation as to whether personal data concerning you are being processed; if this is the case, you have the right to be informed about these personal data and to receive the information listed in detail in Article 15 of the GDPR.

• bb) Right to rectification and erasure (Art. 16 and 17 GDPR):

You have the right to request without delay the rectification of any inaccurate personal data concerning you and, where applicable, the completion of any incomplete personal data.

You also have the right to request that personal data concerning you be deleted without delay, provided that one of the reasons listed in detail in Article 17 of the GDPR applies, e.g. if the data is no longer required for the purposes pursued.

• cc) Right to restriction of processing (Art. 18 GDPR):

You have the right to request the restriction of processing if one of the conditions listed in Art. 18 DSGVO applies, e.g. if you have objected to the processing, for the duration of any review.

• dd) Right to data portability (Art. 20 GDPR):

In certain cases, which are detailed in Art. 20 GDPR, you have the right to receive the personal data concerning you in a structured, common and machine-readable format or to request the transfer of this data to a third party.

• ee) Right to object (Art. 21 GDPR):

If data is processed on the basis of Art. 6 (1) p. 1 lit. f) DSGVO (data processing for the protection of legitimate interests), you have the right to object to the processing at any time for reasons arising from your particular situation. We will then no longer process the personal data unless there are demonstrably compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or the processing serves to assert, exercise or defend legal claims.

• ff) Right of appeal to a supervisory authority

Pursuant to Art. 77 DSGVO, you have the right to lodge a complaint with a supervisory authority if you are of the opinion that the processing of data concerning you violates data protection provisions. The right of complaint may in particular be asserted before a supervisory authority in the member state of your place of residence, your place of work or the place of the alleged infringement.