Stula²

We, Stula2 (hereinafter referred to as the “Company”), place great importance on the protection of personal data of third parties and inform you below about data protection in our company.

As part of our data protection responsibility, the General Data Protection Regulation (Regulation (EU) 2016/679; hereinafter referred to as the “GDPR”) has imposed additional obligations on our company in order to ensure the protection of personal data of the third party affected by processing (hereinafter referred to as the “Third Party” or “Data Subject”).

Insofar as our company either alone or jointly with others decides on the purposes and means of data processing, this includes above all the obligation to inform the third party transparently about the type, scope, purpose and legal basis of the processing (cf. Art. 13 and 14 GDPR). With this declaration (hereinafter referred to as the “Data Protection Notice”), we inform the data subject about how their personal data is processed by us.

Our data protection notice is modular in structure. It consists of a general part for all processing of personal data and processing situations that apply each time a website is accessed. (A. General) and a special part, the content of which each time only refers to the processing situation specified there with the name of the respective offer or product, in particular the visit to websites described in more detail here (B. Visit to websites).

In order to find the parts relevant to the third party, please refer to the following overview of the sub-sections of the data protection notice:

Part A General

This part is relevant for all users of our website.

Part B Website and social media

This part is relevant for those who use our German social media internet offering including the appearances in the social media presences.

A. General

(1) Definitions

Following the example of Art. 4 GDPR, this data protection notice is based on the following definitions:

• “Personal data” (Art. No. 1 GDPR) means any information relating to an identified or identifiable natural person (“data subject”). An identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, an online identifier, location data or by reference to physical, physiological, genetic, mental, economic, cultural or social identity characteristics. Identifiability can also be given by means of a combination of such information or other additional knowledge. The form or embodiment of the information is not relevant (photos, video or audio recordings can also contain personal data).
• “Processing” (Art. 4 No. 2 GDPR) means any operation or set of operations which is performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of personal data.
• “Controller” (Art. 4 No. 7 GDPR) means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
• “Third party” (Art. 4 No. 10 GDPR) means any natural or legal person, public authority, agency or body other than the data subject, the controller, the processor and the persons who, under the direct authority of the controller or processor, are authorised to process personal data.
• “Processor” (Art. 4 No. 8 GDPR) means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller, in particular in accordance with the controller’s instructions (e.g. IT service provider). In the sense of data protection law, a processor is in particular not a third party.
• “Consent” (Art. 4 No. 11 GDPR) of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

(2) Name and address of the controller for the processing

The body responsible for processing your personal data within the meaning of Art. 4 No. 7 GDPR is us:

Stula2 GbR

Friedelstrasse 59

12047 Berlin

+33 76 702 492 0

contact@stula2.com

Further information about our company can be found in the imprint on our website.

(3) Contact details of the data protection officer
For any questions and as a contact person regarding data protection with us, our company’s data protection officer is available to you at any time. His contact details are:

Stula² GbR

Friedelstrasse 59

12047 Berlin

contact@stula2.com

(4) Legal basis for data processing

By law, in principle, any processing of personal data is prohibited and only permitted if the data processing falls under one of the following justifications:

• Art. 6 para. 1 sentence 1 lit. a GDPR (“Consent”): If the data subject has voluntarily, in an informed manner, and unambiguously indicated by a statement or other clear affirmative action that they consent to the processing of their personal data for one or more specific purposes;
• Art. 6 para. 1 sentence 1 lit. b GDPR: If the processing is necessary for the performance of a contract to which the data subject is a party, or for the implementation of pre-contractual measures taken at the data subject’s request;
• Art. 6 para. 1 sentence 1 lit. c GDPR: If the processing is necessary for compliance with a legal obligation to which the controller is subject (e.g., a legal retention obligation);
• Art. 6 para. 1 sentence 1 lit. d GDPR: If the processing is necessary to protect the vital interests of the data subject or another natural person;
• Art. 6 para. 1 sentence 1 lit. e GDPR: If the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, or
• Art. 6 para. 1 sentence 1 lit. f GDPR (“Legitimate interests”): If the processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, in particular where the data subject is a child.
  The storage of information on the end user’s device or access to information already stored on the end user’s device is only permissible if covered by one of the following justifications:
• § 25 para. 1 TTDSG: If the end user has consented based on clear and comprehensive information. Consent must be given in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR;
• § 25 para. 2 No. 1 TTDSG: If the sole purpose is to carry out the transmission of a message over a public telecommunications network, or
• § 25 para. 2 No. 2 TTDSG: If storage or access is strictly necessary for the provider of a telemedia service to provide a telemedia service expressly requested by the user.

(5) Data deletion and storage period

For the processing operations we carry out, we will indicate below how long the data will be stored with us and when it will be deleted or blocked. If no specific storage period is specified below, your personal data will be deleted or blocked as soon as the purpose or legal basis for storage ceases to apply. Storage of your data generally only takes place on our servers in Germany, subject to any subsequent transfer in accordance with the provisions in A. (7) and A. (8).
However, storage may continue beyond the specified time in the event of actual or potential legal disputes with you or other legal proceedings, or if storage is required by legal provisions to which we, as the controller, are subject (e.g., § 257 of the German Commercial Code, § 147 of the German Fiscal Code). When the statutory storage period prescribed by law expires, the personal data will be blocked or deleted, unless further storage by us is necessary and there is a legal basis for it.

(6) Data security

We employ appropriate technical and organizational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction, or unauthorized access by third parties (e.g., TLS encryption for our website), taking into account the state of the art, implementation costs, and the nature, scope, context, and purposes of processing as well as the risks of data breach (including their likelihood and consequences) for the data subject. Our security measures are continuously improved in line with technological developments. Further information on this can be provided upon request. Please contact our data protection officer (see A. (3)) for this purpose.

(7) Collaboration with processors

Like any larger company, we also engage external domestic and foreign service providers to handle our business transactions (e.g., in the areas of IT, logistics, telecommunications, sales, and marketing). These service providers only act on our instructions and have contractually committed to comply with data protection regulations under Article 28 GDPR. If personal data is transferred by us to our subsidiaries or vice versa (e.g., for advertising purposes), this is done on the basis of existing data processing agreements.

(8) Preconditions for the transfer of personal data to third countries

In the course of our business relationships, your personal data may be transferred to third parties or disclosed. These may also be located outside the European Economic Area (EEA), i.e., in third countries. Such processing is carried out solely for the purpose of fulfilling contractual and business obligations and maintaining your business relationship with us (legal basis is Article 6 para. 1 lit b or lit. f respectively in conjunction with Article 44 et seq. GDPR). We will inform you about the specific details of the transfer at the relevant points below. The European Commission has issued adequacy decisions for some third countries, certifying a level of data protection comparable to that of the EEA (a list of these countries and copies of the adequacy decisions can be obtained here: [link provided]). However, in other third countries to which personal data may be transferred, there may not be a consistently high level of data protection due to the lack of legal provisions. If this is the case, we ensure that data protection is adequately guaranteed. This can be achieved through binding corporate rules, standard contractual clauses issued by the European Commission for the protection of personal data under Article 46 para. 1, 2 lit. c GDPR (the standard contractual clauses of 2021 are available at [link provided]), certificates, or recognized codes of conduct. Please contact our data protection officer (see A. (3)) if you would like more information on this.

(9) No automated decision-making (including profiling)

We do not intend to use personal data collected from you for automated decision-making processes (including profiling).

(10) No obligation to provide personal data

The conclusion of contracts with us is not conditional on you providing us with personal data beforehand. As a customer, you are generally not under any legal or contractual obligation to provide us with your personal data; however, certain offers may be restricted or unavailable if you do not provide the required data. If this should exceptionally be the case within the scope of the products offered by us as presented below, you will be separately notified.

(11) Legal obligation to transmit certain data

Under certain circumstances, we may be subject to a special legal or regulatory obligation to provide lawfully processed personal data to third parties, especially public authorities (Article 6 para. 1 sentence 1 lit. c GDPR).

(12) Your rights

You can assert your rights as a data subject regarding your processed personal data to us at any time using the contact details provided at the beginning under A. (2). As a data subject, you have the right to:

• request information about the personal data we process about you in accordance with Article 15 GDPR. In particular, you may request information about the processing purposes, the categories of data, the recipients or categories of recipients to whom your data has been or will be disclosed, the envisaged storage period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, the origin of your data if it was not collected from us, and the existence of automated decision-making, including profiling, and, if applicable, meaningful information about its details;
• request the immediate correction of incorrect or completion of incomplete data stored by us in accordance with Article 16 GDPR;
• request the deletion of your data stored by us in accordance with Article 17 GDPR, unless the processing is necessary for exercising the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise, or defense of legal claims;
• request the restriction of the processing of your data in accordance with Article 18 GDPR if the accuracy of the data is contested by you or the processing is unlawful;
• receive your data that you have provided to us in a structured, commonly used, and machine-readable format or to request the transmission of this data to another controller in accordance with Article 20 GDPR (“data portability”);
• object to the processing of your data in accordance with Article 21 GDPR if the processing is based on Article 6 para. 1 sentence 1 lit. e or lit. f GDPR. This is particularly the case if the processing is not necessary for the performance of a contract with you. If the objection is not directed against direct marketing, we ask you to provide reasons as to why we should not process your data as we have done. In the event of your justified objection, we will examine the situation and either stop or adjust the data processing or show you our compelling legitimate reasons for continuing the processing;
• revoke your consent given to us once (even before the GDPR came into effect, i.e., before May 25, 2018) at any time by informing us accordingly. This will result in us no longer being allowed to continue the data processing based on this consent in the future; and
• lodge a complaint with a supervisory authority about the processing of your personal data in our company, especially with the data protection supervisory authority responsible for us: Berliner Beauftragter für Datenschutz und Informationsfreiheit Friedrichstraße 219 10969 Berlin, Stula2 Friedelstrasse 59 12047 Berlin, Email: contact@stula2.com.

(13) Changes to the data protection notices

As part of the development of data protection law as well as technological or organizational changes, our data protection notices are regularly reviewed for any need for adaptation or supplementation. You will be informed about changes, in particular, on our website at https://stula2.com. These data protection notices are current as of April 2024.

B. Visiting websites

(1) Explanation of the function

Information about our company and the services we offer can be found, in particular, at https://stula2.com. When you visit our website, personal data may be processed.

(2) Processed personal data

When using the websites for informational purposes, the following categories of personal data are stored and processed:
“Log data”: When you visit our website, a so-called log data record (server log files) is temporarily and anonymized stored on our web server. This record includes:

• The page from which the page was requested (referrer URL)
• The name and URL of the requested page
• The date and time of the access
• Description of the type, language, and version of the web browser used
• The IP address of the requesting computer, which is shortened in such a way that it is no longer possible to establish a personal reference
• The amount of data transferred
• The operating system
• Notification of whether the access was successful (access status (HTTP status code))
• GMT time zone difference
  “Contact form data”: When using contact form data, the data transmitted through it is processed (e.g., gender, name and surname, address, company, email address, and time of transmission).

(3) Purpose and legal basis of data processing

We process the above-described personal data in accordance with the provisions of the GDPR, other relevant data protection regulations, and only to the extent necessary. If the processing of personal data is based on Art. 6 para. 1 sentence 1 lit. f GDPR, the purposes mentioned also represent our legitimate interests.
The processing of log data serves statistical purposes and to improve the quality of our website, especially the stability and security of the connection (legal basis is Art. 6 para. 1 sentence 1 lit. a or lit. f GDPR).
The processing of contact form data is carried out for processing customer inquiries (legal basis is Art. 6 para. 1 sentence 1 lit. b or lit. f GDPR).
The processing of newsletter data is for the purpose of sending the newsletter. By subscribing to our newsletter, you consent to the processing of your personal data (legal basis is Art. 6 para. 1 lit. a GDPR). For subscribing to our newsletter, we use the double opt-in procedure. This means that after registering, we will send you an email to the email address provided, in which we ask you to confirm that you wish to receive the newsletter. The purpose of this procedure is to confirm your registration and, if necessary, to investigate any potential misuse of your personal data. You can revoke your consent to receive the newsletter at any time and unsubscribe from the newsletter. You can revoke this by clicking on the link provided in each newsletter email, by email to contact@stula2.com , or by sending a message to the contact details provided in the imprint. If the processing of data requires storing information on your device or accessing information already stored on your device, § 25 para. 1, 2 TTDSG is the legal basis for this.

(4) Duration of Data Processing

Your data will only be processed for as long as necessary to achieve the processing purposes mentioned above; the legal bases specified within the scope of the processing purposes apply accordingly. Regarding the use and storage duration of cookies, please refer to Section A. (5) and the Cookie Policy.

Third parties employed by us will store your data on their systems for as long as necessary in connection with the provision of services to us in accordance with the respective order.

For further details on storage duration, please refer to Section A. (5) and the Cookie Policy.

(5) Transmission of Personal Data to Third Parties; Justification Basis

The following categories of recipients, who are usually processors (see Section A. (7) for details), may have access to your personal data:

• Service providers for the operation of our website and the processing of data stored or transmitted through the systems (e.g., for data center services, payment processing, IT security). The legal basis for disclosure is then Art. 6(1) sentence 1 lit. b or lit. f GDPR, unless they are processors;
• Government agencies/authorities, if necessary to fulfill a legal obligation. The legal basis for disclosure is then Art. 6(1) sentence 1 lit. c GDPR;
• Individuals employed for the conduct of our business operations (e.g., auditors, banks, insurance companies, legal advisors, supervisory authorities, parties involved in corporate acquisitions or the establishment of joint ventures). The legal basis for disclosure is then Art. 6(1) sentence 1 lit. b or lit. f GDPR.

See Section A. (8) for assurances of an adequate level of data protection when transferring data to third countries.

In addition, we only disclose your personal data to third parties if you have given explicit consent pursuant to Art. 6(1) sentence 1 lit. a GDPR.

(6) Use of Cookies, Plugins, and Other Services on Our Website

a) Cookies

We use cookies on our websites. Cookies are small text files that are assigned and stored on your hard drive by the browser you use, through a characteristic string, and through which certain information flows to the entity that sets the cookie. Cookies cannot execute programs or transmit viruses to your computers, thus they cannot cause any damage. They serve to make the overall Internet offer more user-friendly and effective, i.e., more pleasant for you.

Cookies may contain data that allows recognition of the device used. However, cookies may also contain only information about specific settings that are not personal. However, cookies cannot directly identify a user.

There are session cookies, which are deleted when you close your browser, and permanent cookies, which are stored beyond a single session. Regarding their function, there are:

• Technical Cookies: These are essential to navigate the website, use basic functions, and ensure the security of the website; they do not collect information about you for marketing purposes nor do they store which websites you have visited;
• Performance Cookies: These collect information about how you use our website, which pages you visit, and if errors occur during website use; they do not collect information that could identify you – all collected information is anonymous and is only used to improve our website and find out what interests our users;
• Advertising Cookies, Targeting Cookies: These are used to offer personalized advertising on the website or offers from third parties and to measure the effectiveness of these offers; Advertising and Targeting Cookies are stored for a maximum of 13 months;
• Sharing Cookies: These are used to improve the interactivity of our website with other services (e.g., social networks); Sharing Cookies are stored for a maximum of 13 months.

The legal basis for cookies that are absolutely necessary to provide you with the expressly desired service is § 25(2) No. 2 TTDSG. Any use of cookies that is not absolutely necessary for this purpose constitutes data processing, which is only permitted with your explicit and active consent pursuant to § 25(1) TTDSG in conjunction with Art. 6(1) sentence 1 lit. a GDPR. This particularly applies to the use of Performance, Advertising, Targeting, or Sharing Cookies. In addition, we only disclose your personal data processed by cookies to third parties if you have given explicit consent pursuant to Art. 6(1) sentence 1 lit. a GDPR.

b) Cookie Policy

For further information on which cookies we use and how to manage your cookie settings and deactivate certain types of tracking, please refer to our Cookie Policy.

c) Social Media Plugins

We do not use social media plugins on our websites. If our websites contain symbols of social media providers (e.g., Instagram, LinkedIn), we use them only for passive linking to the pages of the respective providers.

As of: April 2024