Privacy policy

Provision of the website and creation of log files 

Description and scope of data processing

Each time you visit our website, access data from the requesting computer is stored in an electronic log file, the server log. The data record stored in this process contains, among other things, the following data:

• IP address of the accessing computer,
• the date and time of access,
• Browser version and operating system of your device. 

The data is also stored in our system's log files. This data is not stored together with other personal data of the user.

Legal basis for data processing

The legal basis for the temporary storage of data and log files is Art. 6 (1) (f) GDPR.

Purpose of data processing

This data is collected exclusively for statistical purposes with the aim of continuously improving the attractiveness, functionality, and content of our website as well as the security of our information technology systems. The data is not passed on to third parties, in particular for marketing purposes. These purposes also constitute our legitimate interest in data processing pursuant to Art. 6 (1) (f) GDPR.

Duration of storage

If the data is stored in log files, it will be deleted after seven days at the latest.

Right to object

The collection of data for the provision of the website and the storage of data in log files is essential for the operation of the website. You therefore have no right to object.

Press distribution list

Description and scope of data processing

Our website verbio.de offers the option of registering for a press distribution list. If you take advantage of this option, the data entered in the input mask will be transmitted to us and stored.

The following data may be collected when using the registration form for the press distribution list:

• IP address of the accessing computer,
• Date and time of registration,
• Title,
• First name,
• Last name,
• Company
• Email address,
• Freelance editor yes/no,
• Publisher / Editorial office,
• Media,
• all information provided in the message field ("Comment").

In order to operate the press distribution list, your personal data will be transferred in particular to the press agency commissioned by us, WeichertMehner Unternehmensberatung für Kommunikation GmbH & Co KG, An der Dreikönigskirche 5, 01097 Dresden. Our service provider processes your data for this purpose on the basis of a data processing agreement in accordance with Art. 28 GDPR. The data will be used exclusively for the purpose of the press distribution list and as proof of legitimacy as a press representative.

Legal basis for data processing

The legal basis for the processing of the data is your consent, Art. 6 (1) (a) GDPR. 

Purpose of data processing

Your data is processed so that we can add you to the press distribution list. The other personal data processed during the mailing process serves to prevent misuse of the registration form and to ensure the security of our information technology systems.

Duration of storage

After you have been added to the press distribution list, your data will be stored at  until you revoke your consent. After you unsubscribe from the press distribution list your email address will be deleted from the distribution list.

Option to withdraw consent

You can withdraw your consent to the processing of your personal data at any time and unsubscribe from the press distribution list. In this case, all personal data stored during your inclusion in the press distribution list will be deleted.

IR distribution list

Description and scope of data processing 

On our website verbio.de, in the Investor Relations section, we offer the option of subscribing to information on current developments at our company as part of the "IR distribution list." 

The following data may be collected when accessing and using the registration form for the IR distribution list:

• IP address of the accessing computer,
• Date and time of registration,
• Title,
• First name,
• Last name,
• Company
• Email address,
• Information about financial analyst, investor, or other characteristics,
• reCaptcha data.

Your email address and first and last name are required to receive the newsletter. Providing additional data is voluntary. This data is used, for example, to address you personally. 

The registration form on our website and the distribution of the IR mailing list are provided by our service provider, EQS Group GmbH, Karlstraße 47, 80333 Munich ("EQS"). This is done on the basis of a data processing agreement with EQS in accordance with Art. 28 GDPR. 

Registration for our IR mailing list is carried out using a double opt-in procedure. This means that after registering, you will receive an email asking you to confirm your registration. This confirmation is necessary to prevent anyone from registering with someone else's email address. Registrations for the IR distribution list are logged by EQS in order to be able to verify the registration process in accordance with legal requirements. This includes storing the time of registration and confirmation, as well as the IP address. Changes to your stored data are also logged.

Even without directly registering for the IR distribution list, communication data between you and EQS is exchanged for technical reasons when you visit the website and view this service.

Legal basis for data processing 

Data processing is based on your consent in accordance with Art. 6 (1) (a) GDPR.

Purpose of data processing

We use the IR mailing list to inform you about business developments and capital market-related publications. Your email address and name are collected for the purpose of delivering the newsletter. Other personal data collected during the registration process is used to prevent misuse of the services or the email address used.

Duration of storage

The data will be deleted as soon as it is no longer required for the purpose for which it was collected. The user's email address will therefore be stored for as long as the subscription to the IR distribution list is active. Once you have revoked your consent, you will no longer receive the IR distribution list.

Option to withdraw consent

You have the option to withdraw your consent with effect for the future by using the consent tool ("Privacy Settings") at the bottom of the website (footer) and changing your settings under " External Media -> iframes".

You can also unsubscribe from the IR mailing list at any time. There is a link for this purpose in every IR email. This also allows you to revoke your consent to the storage of personal data collected during the registration process.

Further information on options for objecting to and removing data from EQS, as well as on data protection, can be found at: https://www.eqs.com/ir-services/ and https://www.eqs.com/about-eqs/data-protection/. 

Integration of the share price

Description and scope of data processing 

To display our share price visually, we use an external service provided by Deutsche Börse AG (Cash Market), Mergenthalerallee 61, 65760 Eschborn, Germany, in the Investor Relations section of our website verbio.de. When you visit the website, communication data is exchanged between you and our service provider for technical reasons when you view this service. The share price is supplied directly by Deutsche Börse. Therefore, when you visit the page, your IP address is transmitted to the Deutsche Börse server.

Legal basis for data processing 

Data processing is based on your consent in accordance with Art. 6 (1) (a) GDPR.

Purpose of data processing

We display our share price on Deutsche Börse to inform you about the current status of our shares.

Duration of storage

The data logged on the Deutsche Börse server when you visit the site is deleted after 30 days. See also the Deutsche Börse privacy policy: https://www.boerse-frankfurt.de/en/privacy. 

Option to withdraw consent

You have the option to withdraw your consent with future effect by using the consent tool ("Privacy Settings") at the bottom of the website (footer) and changing your settings under "External Media -> iframes  ".

Further information on options for objection and removal vis-à-vis Deutsche Börse can be found at: https://www.boerse-frankfurt.de/en/privacy.

Newsletter 

Description and scope of data processing 

Our website strohklug.de offers the option of subscribing to a newsletter. If you take advantage of this option, the data entered in the input mask will be transmitted to us and stored. The newsletter will only be sent after you have expressly confirmed your subscription by clicking on a link in the confirmation email (known as double opt-in). 

The following data, among other things, may be collected when you subscribe to the newsletter:

• IP address of the accessing computer,
• Date and time of registration ,
• Title,
• First name,
• Last name,
• Company
• Email address,
• all information provided in the comment field,
• Captcha data.

In this context, no data is passed on to third parties. The data is used exclusively for registration and sending the newsletter.

Legal basis for data processing 

The legal basis for data processing is your consent, Art. 6 (1) (a) GDPR. 

Purpose of data processing

Your email address and name are collected and stored so that we can send you the newsletter. The other personal data processed during the sending process serves to prevent misuse of the registration form and to ensure the security of our information technology systems.

Duration of storage

After subscribing to the newsletter, your email address will be stored in our newsletter distribution list until you unsubscribe. After unsubscribing from the newsletter , your email address will be deleted from the distribution list.

Right of withdrawal

You can withdraw your consent to the processing of your personal data at any time and unsubscribe from the newsletter. For this purpose, there is a corresponding link in every newsletter email. All personal data stored in the course of registering for the newsletter will be deleted in this case.

Contact form or contact by email

Description and scope of data processing 

Our websites verbio.de and verbiogas.de feature a contact form that can be used to contact us electronically. If you use this option, the data entered in the input mask will be transmitted to us and stored.

We also collect personal data if you provide it to us voluntarily, for example when you contact us by email. 

The following data may be collected when using the contact form and email contact:

• IP address of the calling computer,
• Date and time of registration,
• Title,
• first name,
• Last name,
• Company,
• Address,
• Postal code, City,
• Phone number,
• Subject,
• Email address,
• all information provided in the message field or sent by email.

In this context, the data will not be passed on to third parties. The data will be used exclusively for processing the conversation and, if necessary, forwarded internally to other organizational units and departments in order to respond to your inquiry.

Legal basis for data processing 

The legal basis for the processing of data transmitted in the course of sending a contact request via the form provided or by email is Art. 6 (1) (f) GDPR. If the purpose of the contact is to fulfill a contract, the additional legal basis for the processing is Art. 6 (1) (b) GDPR.

Purpose of data processing

The purpose of processing your data is to handle and respond to your request. The legitimate interest in processing also lies in the purposes described. The other personal data processed during the sending process serves to prevent misuse of the contact form and to ensure the security of our information technology systems. 

Duration of storage

We will delete your data that we have received in the course of contacting you as soon as it is no longer required for the purpose for which it was collected, i.e. once your request has been fully processed and no further communication with you is necessary or desired by you, or we will limit the processing to compliance with the existing legally binding retention obligations.

Right to object

You may object to the processing of your personal data at any time. You may contact our data protection officer at any time to request the deletion of your data.

Cookies and similar technologies for usage analysis and online advertising, as well as services from external third parties

In order to improve the presentation of content on our websites, we use cookies and similar technologies (e.g., Local Storage ) for statistical collection and analysis of general usage behavior based on access data. In addition, we use services from external service providers that process the access data generated when using our website in order to enable the display of interest-based advertising, for example in the context of search queries.

Cookies

A cookie is a file that is downloaded to your device when you access certain websites or electronic communications. Among other things, cookies enable a website to obtain and store information about the number of visits and the surfing behavior of users or their devices.

Cookies are used to make websites functional and more efficient, as well as to provide information to the website operator.

There are different types of cookies: Necessary cookies are essential for the website to function as intended. Non-necessary cookies are those that do not fall into the previous category, including analytical cookies. These cookies are only installed on your device with your express consent.

Necessary and non-necessary cookies can be specified in more detail as follows: Session cookies are temporary cookies that are stored in the user's internet browser until the browser window is closed and the session cookies are deleted. Permanent or persistent cookies are used for repeat visits and are stored in the user's browser for a predefined period of time. First-party cookies are set by the website that the user visits. Only this website may read information from the cookies. Third-party cookies are set by organizations that are not operators of the website that the user visits. These cookies are used, for example, by marketing companies. 

You can find more information about the cookies used on our websites in the consent tool ("Privacy Settings") at the bottom of each website (footer).

The legal basis for the use of cookies that are not technically necessary is your consent in accordance with Section 25 (1) TDDDG, Art. 6 (1) (a) GDPR. If the use of cookies is absolutely necessary, this is done on the basis of Section 25 (2) TDDDG and further data processing in accordance with Art. 6 (1) (c) or (f) GDPR.

You can revoke your consent to technically non-essential cookies at any time with future effect or adjust the selection of cookies by using the consent tool ("Privacy Settings") at the bottom of the website (footer). 

Google Tag Manager / Google Ads

We use the Google Tag Manager service provided by Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA. The provider of the service for users in the EU, the EEA, and Switzerland is Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland.

Google Tag Manager makes it easier for us to integrate, centrally manage, and control the timing of our tags. Tags are script codes or code snippets that can trigger various functions, such as measuring the success of our advertisements (Google Ads). Google Tag Manager does not collect any personal data itself, but may transmit the IP address to Google. 

We use Google Ads Conversion Tracking (visit action evaluation) for our website verbio.de. Google Ads Conversion Tracking creates a Google Ads cookie that collects the following data: IP address, timestamp, page activity, demographic data. We process your data to evaluate campaigns and collect information about website users who may have reached us through our campaigns with Google Ads Tracking.

The legal basis for this data processing is your consent in accordance with Section 25 (1) TDDDG and Art. 6 (1) (a) GDPR.

You have the option to revoke your consent with effect for the future by using the consent tool ("Privacy Settings") at the bottom of the website (footer) and changing your settings. 

For more information about Google Tag Manager, see: https://marketingplatform.google.com/intl/de/about/analytics/tag-manager/use-policy/.

Google Maps / Static

We use the "Google Maps" and "Google Static" services on our website verbiogas.de to display maps. This service is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

The integration of maps requires the technical processing of your IP address so that the content can be sent to your browser. Your IP address is therefore transmitted to Google Ireland Limited. The programming language JavaScript is used for integration. You can therefore object to data processing by deactivating JavaScript in your browser or installing a JavaScript blocker. Please note that this may result in functional restrictions on our website.

The legal basis for this data processing is your consent in accordance with Art. 6 (1) (a) GDPR and § 25 (1) TDDDG.

You have the option of revoking your consent with effect for the future by using the consent tool ("Privacy Settings") at the bottom of the website (footer) and changing your settings.

Google's privacy policy can be found here: https://policies.google.com/privacy?hl=en-US. 

YouTube

We use plug-ins from the video platform YouTube.com on our websites, a service operated by YouTube LLC (headquartered at 901 Cherry Avenue, San Bruno, CA 94066, USA) on behalf of Google. These plug-ins allow us to embed videos that we have published on YouTube.com on our website.

Your consent is required to play YouTube videos on our website. With your consent, YouTube receives the information that you have accessed the corresponding subpage of our website. Playing the video may trigger further data processing operations over which we have no control. This occurs regardless of whether YouTube provides a user account that you are logged in to or whether no user account exists. If you are logged in to Google, your data will be directly associated with your account. If you do not want this association with your YouTube profile, you must log out before activating the button. YouTube stores your data as usage profiles and processes it for the purposes of advertising, market research, and/or the needs-based design of its website. Such evaluation is carried out in particular (even for users who are not logged in) to provide needs-based advertising and to inform other users of the social network about your activities on our website. By integrating YouTube videos, YouTube may also set cookies. No data will be transferred to YouTube unless you give your prior consent.

The legal basis for processing is Art. 6 (1) (a) GDPR and § 25 (1) TDDDG. 

You have the option to revoke your consent with effect for the future by using the consent tool ("Privacy Settings") at the bottom of each website (footer) and changing your settings.

We have no knowledge of the storage period at YouTube and have no influence over it.

For more information on the purpose and scope of processing by YouTube, please refer to the privacy policy at https://policies.google.com/privacy?hl=en-US. 

Matomo 

We use the Matomo tool on our websites, which processes information about the user's visit to the website and the user's origin. When individual pages of our website are accessed, the following data in particular is collected:

• Website accessed,
• Website from which you accessed the website you visited,
• Length of time spent on the website,
• Time of access,
• Information about your browser, operating system, and device. 

The data will not be passed on to third parties.

We use the collected data for statistical analysis of user behavior for the purpose of optimizing the functionality and stability of the website and for marketing purposes.

The legal basis for the use of Matomo is your consent in accordance with Section 25 (1) TDDDG, Art. 6 (1) (a) GDPR.

You have the option of revoking your consent with effect for the future by using the consent tool ("Privacy Settings") at the bottom of each website (footer) and changing your settings.

LinkedIn

Our website verbio.de uses the LinkedIn Insight Tag service provided by LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland ("LinkedIn"). This enables us to collect and evaluate statistical data about your visit and use of our website. This makes it possible to display interest-based and relevant offers, recommendations, and advertising on LinkedIn (retargeting). In addition, the effectiveness of advertisements is analyzed (conversion tracking). LinkedIn uses cookies, pixels, and JavaScript for this purpose.

For more information about LinkedIn cookies, please visit: https://www.linkedin.com/legal/l/cookie-table. 

If you are logged into LinkedIn while visiting our website, LinkedIn can link the information collected to your member account and use it for targeted advertising on LinkedIn. You can view your privacy settings on LinkedIn at the following link: https://www.linkedin.com/psettings/enhanced-advertising.

The legal basis for this data processing is your consent in accordance with Art. 6 (1) (a) GDPR and § 25 (1) TDDDG.

You have the option to revoke your consent with future effect by using the consent tool ("PrivacySettings") at the bottom of the website (footer) and changing your settings.

For further information, please refer to LinkedIn's privacy policy: https://de.linkedin.com/legal/privacy-policy.

Podcast hosting

We use at strohklug.de the podcast hosting service www.podcastproduzenten.de provided by BEBE Medien GmbH, Erich-Zeigner-Allee 69-73, 04229 Leipzig. The podcast is loaded from www.podcastproduzenten.de or transmitted to other streaming platforms via www.podcastproduzenten.de.

www.podcastproduzenten.de processes IP addresses and device information (operating systems and applications such as Safari, Firefox, Chrome, etc.) to enable podcast downloads/playback and to determine statistical data such as retrieval figures. Further information is available at https://podcastproduzenten.de/datenschutz.

The legal basis for this data processing is your consent in accordance with Art. 6 (1) (a) GDPR and § 25 (1) TDDDG.

You have the option of revoking your consent with effect for the future by using the consent tool ("Privacy Settings") at the bottom of the website (footer) and changing your settings.

Our podcast is made available on other streaming platforms. These external providers process personal data. For more information, please refer to the privacy policies of the respective providers:

Deezer (Deezer S.A., 24 rue de Calais 75009 Paris, France): https://www.deezer.com/legal/personal-datas.

Apple Podcast (Apple Inc. One Apple Park Way, Cupertino, California, USA, 95014): https://www.apple.com/legal/privacy/data/en/apple-podcasts-web/. 

Spotify (Spotify AB, Regeringsgatan 19, 11153 Stockholm, Sweden): https://www.spotify.com/us/safetyandprivacy. 

We maintain various online presences on social networks in order to communicate with interested parties and provide information about our products and services, among other things.

Facebook 

You can find us on Facebook. When you visit our Facebook page, we process certain data about you when you interact with our page, "like" or comment on a post, or provide other content. The relevant data processing is regularly based on your consent (Art. 6 (1) (a) GDPR). You can revoke your consent at any time, e.g. by deleting the relevant content. This does not affect the lawfulness of the processing that has taken place so far. Further data processing may take place in order to receive and process an inquiry or message (Art. 6 (1) (b) GDPR). Furthermore, we may process your publicly disclosed profile data if we have a legitimate interest in doing so (Art. 6 (1) (f) GDPR), such as pursuing economic interests, and your interests do not outweigh ours.  

In addition, we are jointly responsible with Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland ("Meta") for the processing of so-called Insights data when you visit our Facebook page. Meta uses this insights data to analyze behavior on our Facebook page. For this purpose, we have entered into a joint controller agreement with Meta, which you can view here. In this agreement, Meta undertakes, among other things, to assume primary responsibility under the GDPR for the processing of insights data and to fulfill all obligations under the GDPR with regard to the processing of insights data. The processing serves our legitimate economic interests in optimizing and designing our Facebook page in line with user needs, Art. 6 (1) (f) GDPR.

When you visit our Facebook page as a registered Facebook user, Meta collects personal data from you. If you are not registered with Facebook and visit the Facebook page, Meta may collect pseudonymous usage data from you.

For more information about how Meta uses your data when you visit or like our Facebook page, click here.

Instagram

We use the technical platform and services of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.

When you visit our Instagram page, Meta collects your IP address and other information stored on your PC in the form of cookies. This information is used to provide us, as the operator of the Instagram pages, with anonymous statistical information about the use of the Instagram page.

The data collected about you in this context is processed by Meta and may be transferred to countries outside the European Union. Meta describes what information it receives and how it is used and stored in its privacy policy. The privacy policy is available at the following link: https://privacycenter.instagram.com/policy.

Meta provides information about the use of cookies in its cookie policy for the Instagram service: https://privacycenter.instagram.com/policies/cookies/.

Please note that Meta is able to track your user behavior (across devices for logged-in users) beyond the Instagram service on other websites using the cookies it employs. This applies to both users registered with the Instagram service and those who are not registered there.

Information about privacy-friendly profile settings for Instagram profiles can be found here: https://help.instagram.com/811572406418223/?helpref=hc_fnav.

YouTube

We operate our own YouTube channel (YouTube LLC, 901 Cherry Avenue, San Bruno, CA 94066, USA, represented by Google Inc. with headquarters at 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA).

If you are logged in to YouTube as a member, YouTube assigns this information to your personal user account. When you use the service, such as clicking the start button of a video, this information is also assigned to your user account. You can prevent this assignment by logging out of your YouTube user account and other user accounts of YouTube LLC and Google Inc. before using our website and deleting the corresponding cookies of the companies. Further information on data processing and information on data protection by YouTube can be found at https://policies.google.com/privacy?hl=en-US. 

LinkedIn

Our LinkedIn pages are provided by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. 

When you visit a LinkedIn page, LinkedIn Page Analytics data is collected. This data enables us to view statistical evaluations of the use of the LinkedIn page.

When this Page Analytics data is collected, personal data is also processed. LinkedIn and we are jointly responsible for this processing. The agreement concluded between LinkedIn and us for this purpose can be found here. The underlying LinkedIn user agreement can be found here: https://de.linkedin.com/legal/user-agreement.

Further information about Page Analytics can be found here: https://www.linkedin.com/help/linkedin/answer/a547077.

Please note that the Page Analytics feature may also collect personal data from individuals who do not have a LinkedIn profile.

We use Page Analytics data to optimize our LinkedIn presence and to understand the usage behavior of the LinkedIn presence. Insofar as we process personal data in this context, the permissibility of this processing is based on our legitimate interest pursuant to Art. 6 (1) (f) GDPR.

If you are logged in with your personal LinkedIn profile, you can interact with us on our LinkedIn presence (e.g., like or comment on a post). In doing so, we process the associated data (e.g., your username and profile picture). We use this data to optimize the content offered and its presentation and to adapt it to the respective user interests. This data processing is carried out in accordance with Art. 6 (1) (f) GDPR. The legitimate interest arises from the purpose of optimizing our LinkedIn page and the content published there.

During your visit to the LinkedIn page, LinkedIn collects various personal data. This includes, among other things, your IP address and other information stored on your device in the form of cookies. LinkedIn uses this information to collect statistical information about the use of the LinkedIn presence.

The data collected about you in this context is processed by LinkedIn and may be transferred to countries outside the European Union. For more information about LinkedIn's data processing, please refer to LinkedIn's privacy policy at the following link: https://www.linkedin.com/legal/privacy-policy.

We have no influence on the transfer of data by LinkedIn. We ourselves do not pass on any data that we have received via our LinkedIn presence. LinkedIn transfers data to LinkedIn Corporation, 1000 W Maude Ave, Sunnyvale, CA, US, on the basis of the LinkedIn Data Processing Agreement: https://www.linkedin.com/legal/l/dpa.

TikTok

You can find us on TikTok. Please carefully consider what personal data you share with us via TikTok (TikTok Technology Limited, Ropemaker Place Dublin 2, Dublin, D02 HD23, Ireland). 

We expressly point out that TikTok stores the data of users of its services (e.g., personal information such as IP addresses) and may also use this data for business purposes. For more information on TikTok's data processing, please refer to TikTok's privacy policy at https://www.tiktok.com/legal/page/eea/privacy-policy/en. 

We have no influence on the collection and further processing of data by TikTok. Furthermore, we have no knowledge of the extent, location, and duration of data storage, the extent to which TikTok complies with existing deletion obligations, the evaluations and links made with the data, or to whom the data is passed on.

Information on the available personalization and privacy settings can be found here: https://support.tiktok.com/en/account-and-privacy/account-privacy-settings.

TikTok provides us with so-called page insights (analytics) for our TikTok page: https://www.tiktok.com/analytics. This is summarized data that allows us to gain insight into how people interact with our page. Page Insights may be based on personal data collected in connection with a visit or interaction by individuals on or with our page and its content. This is done in accordance with Art. 6 (1) (f) GDPR in order to ensure an optimized presentation of our offering and effective communication with interested parties.

You can object to the processing of your data for the aforementioned purposes at any time by changing your ad settings in your TikTok user account accordingly, by adjusting "personalized advertising" in the settings under "Settings and Privacy."

XING

XING is a social network operated by New Work SE, based in Hamburg. On XING, members can primarily manage their professional and private contacts and establish new contacts. Organizations can set up a page with their logo and a short profile, post news, and initiate discussion groups.

The focus is on professional exchange on specialist topics with people who have the same professional interests. In addition, XING is often used by companies and other organizations to recruit personnel and present themselves as attractive employers. For this purpose, XING is linked to the employer review platform kununu.

Further information is available from XING: https://www.new-work.se/en/about-new-work-se. 

You can read the latest information on data protection at https://www.new-work.se/en/privacy-notice. 

We do not process any personal data via XING.

Description and scope of data processing

We process personal data as part of your application. We process your personal data to the extent necessary to carry out the application process. This includes the following data in particular: 

• Name, address, and contact details,
• Data on your education, professional training, and career history, e.g., references, certificates, and qualifications, previous activities, resume, cover letter,
• other information provided voluntarily as part of the application, e.g., application photo, information on severe disability status.

In some cases, we also receive your personal data from service providers for applicant placement. Furthermore, we may process personal data from publicly available sources, e.g., from social and professional online networks, which we use permissibly and only for the respective purpose.

Purposes and legal bases for data processing

Personal data of applicants may be processed for the purposes of the application process if this is necessary for the decision on the establishment of an employment relationship, i.e., for the conclusion of an employment contract with us. In this case, the legal basis for the processing of your data is Art. 6 (1) (b) GDPR. This includes, in particular, communication with you and conducting job interviews. The necessity and scope of data collection are assessed, among other things, on the basis of the position to be filled. If your desired position involves particularly confidential tasks or increased personnel and/or financial responsibility, more extensive data collection may be necessary. In individual cases, we may therefore ask our applicants to provide us with a police clearance certificate. 

If you have given us your consent to be included in the applicant pool, we will store your data beyond the current application process for consideration in future application processes. In this case, the legal basis for the processing of your data is Art. 6 (1) (a) GDPR.

In certain cases, we also process your data to protect our legitimate interests or those of third parties in accordance with Art. 6 (1) (f) GDPR: In the event of a legal dispute, we have a legitimate interest in processing the data for evidence purposes in order to defend legal claims in proceedings under the General Equal Treatment Act (AGG).

The legal basis for processing your data is also the fulfillment of a legal obligation pursuant to Art. 6 (1) (c) GDPR, as we are legally obliged to carry out so-called sanctions list screenings, including EU sanctions lists and sanctions lists of countries with which Verbio has business connections. 

Transfer of data

Your data will mainly be processed by our human resources department and the manager responsible for filling your position. However, other internal and external departments, such as the executive board and IT service providers, may also be involved in processing your data. Our recruiting software is provided by our service provider HRworks GmbH, Waldkircher Str. 28, 79106 Freiburg. HRworks GmbH is our processor within the meaning of Art. 28 GDPR. 

Duration of storage

We store your personal data for as long as is necessary to make a decision about your application. 

If an employment relationship between you and us is not established, your data will generally be deleted within 6 months of the end of the application process. For internal statistical evaluations until the end of the first quarter of the following year, the storage period may, in individual cases, be longer than 6 months until this point in time. If you have given us your consent to further process your data, we will store your data until you revoke your consent. 

If an employment relationship is established between you and us, we will store your data permanently and add your application documents to your personnel file. 

Right of withdrawal and objection

You can withdraw your consent to the processing of personal data at any time. Please note that the withdrawal only applies to the future. You can also object to the processing of personal data concerning you at any time.

Obligation to provide data

The provision of your personal data is neither required by law nor contractually stipulated, nor are you obliged to provide personal data. However, the provision of your data is necessary for the application process to be carried out. This means that if you do not provide us with personal data when applying, we will not be able to carry out the application process.

Description and scope of data processing

When you contact us, request a quote from us, or enter into a contract with us, we process your personal data. In addition, we also process your personal data to fulfill legal obligations, to protect a legitimate interest, or on the basis of your consent.

Depending on the legal basis and the contractual relationship with us, this includes the following personal data in particular:

• First name, last name, job description, company (employer),
• Business address, and business contact details (telephone, email address).

We process personal data that we receive from you in the course of our business relationship. If publicly available, personal data also comes from public sources, such as debtor directories, land registers, commercial and association registers, the press, and the Internet. We also use personal data that comes from our affiliated companies. We use Microsoft Teams to conduct online meetings. This involves the processing of personal data such as name, email address, IP address, and audio and video data.

Legal basis and purposes of data processing

The processing of personal data is necessary for the initiation and execution of contracts (establishment, implementation, and termination) and associated communication. The legal basis for data processing in this respect is Art. 6 (1) (b) GDPR. The processing of your personal data also serves to fulfill a variety of legal obligations, such as sanctions list screening or statutory retention obligations. The legal basis for data processing in this respect is Art. 6 (1) (c) GDPR. In addition, we process your personal data to protect our legitimate interests pursuant to Art. 6 (1) (f) GDPR, for example when we verify the identity of new and existing customers or process data for evidentiary purposes in the event of a legal dispute. 

Transfer of data

Depending on their responsibilities, your data may be processed internally by various departments and their employees. These are usually employees in the legal, finance, compliance, IT, executive board, engineering, trade, logistics, quality management, team assistance, etc. departments. In some cases, external parties such as IT, communications, or waste disposal service providers, or lawyers and tax advisors are also involved in the processing of your data. 

Duration of storage

Personal data is deleted when the business relationship has ended, all mutual claims have been fulfilled, and there are no other legal retention obligations or legal justifications for storage. These may include retention obligations under the German Commercial Code and the German Fiscal Code. As a rule, the deletion period is up to 11 years, depending on when the period begins.

Obligation to provide

Within the framework of business relationships, personal data must be provided that is necessary for the initiation, execution, and follow-up of contracts, or that is necessary for processing in the overriding interest, or that we are legally obliged to collect. The provision of this data is therefore mandatory for this relationship.

Description and scope of data processing

In connection with the Annual General Meeting, we process the following data from our shareholders or their proxies:

• First and last name, title,
• Private or business contact details and addresses,
• Information on share ownership, share class, type of share ownership, number of shares,
• Information on the manner in which the shareholder participates in the Annual General Meeting,
• Communication data and content,
• Professional data,
• Access data for the InvestorPortal,
• Access card number,
• Other data provided when registering for the Annual General Meeting (e.g., email address or cell phone number).

At https://www.verbio.de/en/investor-relations/annual-general-meeting/ we maintain a password-protected online portal (InvestorPortal), which we provide through our service provider Computershare Deutschland GmbH & Co. KG, Elsenheimerstraße 61, 80687 Munich. This portal allows duly registered shareholders (and, where applicable, their proxies) to exercise their voting rights and issue proxies, among other things. When using the InvestorPortal, we also collect data about access to the InvestorPortal. The following data and device information is logged in the web server log files:

• Login information for the shareholder portal,
• IP address,
• Session data,
• Server log files,
• Access card number.

We also process information relating to questions, motions, or election proposals and other requests from shareholders or their proxies submitted in connection with the Annual General Meeting, as well as your voting behavior.

If shareholders or their proxies contact us, we also process the personal data necessary to respond to the respective request, such as the email address or telephone number.

If personal data has not been provided to us by shareholders or shareholder representatives, their personal data will be transmitted to us by the respective custodian bank.

Legal basis and purposes of data processing

Personal data is processed for the purpose of properly preparing, conducting, and following up on the Annual General Meeting (in particular for registering for the Annual General Meeting, using proxy forms, enabling the exercise of voting rights, enabling the exercise of your other shareholder rights, including the right to speak, obtain information, and ask questions, as well as the right to to object to a resolution of the Annual General Meeting, to prepare the minutes of the Annual General Meeting, and to fulfill the company's obligations under stock corporation law during and after the Annual General Meeting) and, in this respect, only to the extent necessary to achieve this purpose. The legal basis for the processing is the relevant provisions of the German Stock Corporation Act in conjunction with Art. 6 (1) (c) GDPR. 

When using the InvestorPortal, personal data is also processed for the purpose of providing the portal technically and ensuring the smooth running of the Annual General Meeting. The legal basis for the processing is the respective statutory provisions in conjunction with Art. 6 (1) (c) and (f) GDPR. 

If you participate in the Annual General Meeting, we are obliged under Section 129 (1) sentence 2 AktG to enter you in the list of participants, stating your name, place of residence, number of shares and type of ownership. This data can be viewed by shareholders present at the meeting at the registration desk or, in the case of virtual Annual General Meetings, by other shareholders registered on the InvestorPortal. In addition, pursuant to Section 129 (4) sentence 2 AktG, every shareholder shall be granted access to the list of participants upon request for up to two years after the Annual General Meeting. The legal basis for the processing is therefore Section 129 AktG in conjunction with Article 6 (1) (c) GDPR. 

If you, as a shareholder, exercise your right to speak or ask questions, this will generally be done by stating your name. This may be noted by other participants in the Annual General Meeting. The legal basis for the processing is Art. 6 (1) (1) (f) GDPR.

In addition, we may also process personal data of shareholders or shareholder representatives in order to comply with other legal obligations (e.g., in accordance with regulatory requirements or due to retention obligations under stock corporation, commercial, and tax law). In order to comply with stock corporation law provisions, for example, when authorizing the proxies appointed by the company for the Annual General Meeting, we must verifiably record the data serving as proof of authorization and store it in an access-protected manner for three years (see Section 134 (3) sentence 5 AktG). In this case, the legal basis for processing is the respective statutory provisions in conjunction with Art. 6 (1) sentence 1 lit. c GDPR. 

If a shareholder requests that items be added to the agenda and announced, we will announce these items, stating the name of the shareholder, provided that the requirements under stock corporation law are met. We will also publish counter-motions and election proposals from shareholders on the company's website, stating the name of the shareholder, in accordance with the provisions of stock corporation law, provided that the requirements are met (Sections 122 (2), 126 (1), 127 AktG). The legal basis for the processing of personal data in these cases is Art. 6 (1) (c) GDPR.

Transfer of data

We have entrusted Computershare Deutschland GmbH & Co. KG, Elsenheimerstraße 61, 80687 Munich, with various tasks relating to the preparation, implementation, and follow-up of our Annual General Meetings. Computershare Deutschland GmbH & Co. KG acts on our behalf as a processor within the meaning of Art. 28 GDPR and processes the data exclusively in accordance with our instructions. Additional information on data protection at Computershare can be found here: https://www.computershare.com/de/datenschutzerklaerung. 

In addition, personal data is made available to shareholders and shareholder representatives in connection with the Annual General Meeting and, if necessary, afterwards, in accordance with the statutory provisions.

Duration of storage

All documents and information, including your personal data, will be stored by us for documentation purposes and, in particular, as evidence of the proper preparation, execution, and follow-up of this Annual General Meeting, and will be deleted after expir of the statutory retention obligations (e.g., in the German Stock Corporation Act (AktG), the German Commercial Code (HGB), or the German Fiscal Code (Abgabenordnung). The storage period for data collected in connection with Annual General Meetings is generally up to three years (subject to specific legal requirements), but may be up to 10 years after the year of the Annual General Meeting in individual cases.

Obligation to provide

Participation in the Annual General Meeting is subject to proper registration in accordance with the German Stock Corporation Act (AktG). Proper registration requires the processing of personal data.