Privacy Policy

I. Scope of the processing of personal data

You can rely on the protection and security of your personal data. Protecting your privacy when processing personal data is an important concern for The Super Patch Company Ltd ("we" or "us"), which we take into account in all our business processes. With this data privacy notice, we would like to take the opportunity to explain to you how we process personal data - which of course takes place in compliance with the applicable European and national data privacy regulations. We collect and use our users' personal data only to the extent necessary to provide a functional website and our content and services.

This data privacy notice applies to all English-language pages of the superpatch.com domain.

II. Name and address of the controller

The controller within the meaning of the General Data Protection Regulation ("GDPR") and other national data protection laws of the member states as well as other data protection regulations is the:

The Super Patch Company Ltd
3rd Floor Kilmore House, Park Lane, Spencer Dock, Dublin 1, Dublin,
D01YE64, Ireland

Email: opportunity@superpatch.com

III. Name and address of the data protection officer

The controller's data protection officer is:

Data Protection Officer
Super Patch Company Address: 350 Britannia Road East, Unit # 1, Mississauga
L4Z 1X9, Ontario, Canada

Email: DPO@superpatch.com

IV. Legal basis for the processing of personal data

Insofar as we obtain the consent of the data subject for the processing of personal data, Article 6(1)(a) GDPR serves as the legal basis for the processing of personal data.

In the case of the processing of personal data required for the fulfilment of an agreement with the data subject, Article 6(1)(b) GDPR serves as the legal basis. This also applies to processing operations that are necessary for the performance of pre-contractual measures.

If the processing of personal data must be carried out to fulfil a legal obligation to which our company is subject, Article 6(1)(c) GDPR serves as the legal basis.

Whether the processing of personal data is necessary to protect the vital interests of the data subject or another natural person is determined by Article 6(1)(d) GDPR as the legal basis. This enables the processing of data in emergency situations that affect the life or health safety of a person.

According to Article 6(1)(f) GDPR, processing may also be necessary for the purposes of the legitimate interests pursued by our company or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

With regard to the initial storage and extraction of data Section 25 TDDDG (Telecommunications Digital Services Data Protection Act / Gesetz über den Datenschutz und den Schutz der Privatsphäre in der Telekommunikation und bei digitalen Diensten) serves as legal basis.

V. Purpose of the data processing activity

When you visit our website, your browser transmits certain data to our web server for technical reasons. We use this technical access information to constantly improve the attractiveness and usability of our website and its content and to recognise possible technical problems with our website. In addition, we store this data for a limited period of time to protect our legitimate interests in order to be able to trace it back to personal data in the event of unauthorised access or attempted access to our servers. You can find out what information this is in detail on the following pages.

We use so-called "cookies" on our website. You can find details about this in section VIII. below.

In addition to automatically collected data, we also process data that you have voluntarily provided to us, e.g. by contacting us or using other online forms.

VI. Description and scope of data processing activities

Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing computer. This data is recorded in the form of logs.

The following data is collected:

• Visited website
• Time at the time of access
• Amount of data sent in bytes
• Source/reference from which you reached the page
• Browser used
• Operating system used
• IP address used

This data is not merged with other data sources.

We use the logs to make the website and its functions available to you. We use the collected data to optimise our website and to ensure the security of our IT systems. We use logs as part of our legitimate interest in the provision and ongoing development of our website. The legal basis is Article 6(1)(f) GDPR.

1. Shop

When you use our shop system at shop.superpatch.com, the following additional personal data may be processed in the course of creating a customer account and ordering goods:

• Name
• Email address
• Personal address
• Phone number
• Payment details (e.g., credit card information)

Legal basis for processing this data is Article 6(1)(b) GDPR. To operate the shop, we use the shop system of ByDesign Technologies, 3922 Coconut Palm Dr Suite 105, Tampa, FL 33619, United States (“ByDesign”) and ByDesign is our data processor for this purpose. All data collected on our website is processed on ByDesign's servers. Further information on ByDesign’s data protection can be found on the following website: https://bydesign.com/privacy-policy/.

2. Google Analytics

This website uses Google Analytics 4, a web analytics service provided by Google Ireland Ltd, 4 Barrow St, Grand Canal Dock, Dublin 4, D04 V4X7, Ireland, ("Google"). Google Analytics 4 uses "cookies", which are text files placed on your computer, to help the website analyse how users use the site. The following data is processed for this purpose:

• Pages accessed
• Your behaviour on the pages (e.g. length of stay, clicks, scrolling behaviour)
• Your approximate location (country and city)
• Your IP address (in a shortened form, so that no clear assignment is possible)
• Technical information such as browser, internet provider, end device and screen resolution
• Source of origin of your visit (i.e. via which website or advertising medium you came to us)

In principle, your data will be processed in the EU if it is still personal. For the exceptional cases in which personal data is transferred to the USA, Google has submitted to the EU-US Data Privacy Framework, https://www.dataprivacyframework.gov/s/. The personal data transmitted by your browser as part of Google Analytics will not be merged with other Google data.

We use Google Analytics to analyse and regularly improve the use of our website. We can use the statistics obtained to improve our offering and make it more interesting for you as a user. The legal basis for the processing of your data and the storage of cookies by Google Analytics 4 is your consent in accordance with Article 6(1)(a) GDPR and in accordance with Section 25 (1) TDDDG with regard to the initial storage and extraction of data.

You can withdraw or change this consent at any time by clicking on the “Manage Cookies” link in the footer of the website. You can also prevent Google from collecting the data generated by the cookie and relating to your use of the website (including your IP address) and from processing this data by Google by downloading and installing the following browser plug-in: http://tools.google.com/dlpage/gaoptout?hl=de.

3. Google Tag Manager

This website uses Google Tag Manager, an application of Google Ireland Ltd, 4 Barrow St, Grand Canal Dock, Dublin 4, D04 V4X7, Ireland, ("Google"). This application is used to manage JavaScript tags and HTML tags that are used to implement tracking and analysis tools in particular. The Google Tag Manager itself does not store cookies or process personal data. However, it enables the triggering of other tags that can collect and process personal data.

The data processing activity serves the purpose of designing and optimising our website in line with requirements. For the exceptional cases in which personal data is transferred to the USA, Google has submitted to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework. The legal basis for the use of Google Tag Manager, where necessary, is Article 6(1)(a) GDPR and Section 25 (1) TDDDG with regard to the initial storage and extraction of data.

4. Microsoft Clarity

This website uses Microsoft Clarity, an application of Microsoft Corporation, One Microsoft Way, Redmond, WA 98052 USA ("Microsoft"). Microsoft Clarity collects and stores various user information for statistical analysis of user behaviour and for optimisation and marketing purposes. The following data is processed for this purpose:

• Pages accessed
• Your behaviour on the pages (e.g. length of stay, clicks, scrolling behaviour)
• Your approximate location (country and city)
• Your IP address (in a shortened form, so that no clear assignment is possible)
• Technical information such as browser, internet provider, end device and screen resolution
• Source of origin of your visit (i.e. via which website or advertising medium you came to us)

Pseudonymised user profiles can be created and evaluated from this data for the same purpose. The data collected using Microsoft technologies will not be used to personally identify the visitor to this website without the separate consent of the person concerned and will not be merged with personal data about the bearer of the pseudonym.

In principle, your data will be processed in the EU if it is still personal. For the exceptional cases in which personal data is transferred to the USA, Microsoft Clarity has submitted to the EU-US Data Privacy Framework, https://www.dataprivacyframework.gov/s/.

The legal basis for the processing of your data and the storage of cookies by Clarity is your consent in accordance with Article 6(1)(a) GDPR and Section 25 (1) TDDDG with regard to the initial storage and extraction of data. You can withdraw or change this consent at any time by clicking on the “Manage Cookies” link in the footer of the website.

5. YouTube

We use the YouTube.com platform to post our own videos and make them publicly accessible. YouTube is a service provided by a third party not affiliated with us, namely Google Ireland Limited, Gordon House, Barrow Street, Dublin, D04 E5W5, Ireland ("YouTube").

Some of our Internet pages contain links or links to YouTube content. In general, we are not responsible for the content of linked websites. However, in the event that you follow a link to YouTube, we would like to report that YouTube stores the data of its users (e.g. personal information, IP address) in accordance with its own data usage guidelines and uses it for business purposes.

We also directly integrate videos stored on YouTube on some of our websites. With this integration, content from the YouTube website is displayed in parts of a browser window. However, the YouTube videos are only called up by clicking on them separately. This technique is also known as "framing". When you call up a (sub)page of our website on which YouTube videos are integrated in this form, a connection to the YouTube servers is established and the content is displayed on the website by notifying your browser.

The integration of YouTube content only takes place in "extended data protection mode". This is provided by YouTube itself and ensures that YouTube does not initially store any cookies on your device. However, when the relevant pages are accessed, the IP address and the other data mentioned in this section are transmitted and thus, in particular, which of our Internet pages you have visited. However, this information cannot be attributed to you unless you are logged in to YouTube or another Google service (e.g. Gmail) while accessing the page. In case you are logged in, YouTube will also store a unique cookie. Otherwise, only cookies without personal information are stored on your device.

In principle, your data will be processed in the EU if it is still personal. For the exceptional cases in which personal data is transferred to the USA, Google has submitted to the EU-US Data Privacy Framework, https://www.dataprivacyframework.gov/s/. The personal data transmitted by your browser to Google will not be merged with other Google data.

The legal basis for the processing of personal data is your consent in accordance with Article 6(1)(a) GDPR and Section 25 (1) TDDDG with regard to the initial storage and extraction of data, which you have given on our website. You can withdraw or change this consent at any time by clicking on the “Manage Cookies” link in the footer of the website. Further information on the processing of personal data by YouTube can be found at https://www.youtube.com/static?gl=EN&template=terms&hl=en

6. StackAdapt

This site uses the services of the demand-side platform StackAdapt Inc, 500 - 210 King St. East, Toronto, ON, Canada, M5A 1J7 ("StackAdapt") to collect and process data for the following purposes: Advertising and ad optimisation, retargeting, performance measurement and analytics. The following data is processed for this purpose:

• IP address,
• browser information,
• cookie ID,
• user agent URL and referral page.

Based on this user behaviour and preference information, StackAdapt Inc. attempts to classify you into certain categories and thus present you with the most relevant ads for these categories. StackAdapt also collects third party IDs (such as Google advertising IDs) that are assigned to your browser or device. This information is used as part of StackAdapt Inc.'s internal processing operations and to serve ads.

We use StackAdapt to analyse and regularly improve the use of our website. We can use the statistics obtained to improve our offer and make it more interesting for you as a user. The legal basis for the processing of your data and the storage of cookies by StackAdapt is your consent in accordance with Article 6(1)(a) GDPR and Section 25 (1) TDDDG with regard to the initial storage and extraction of data. You can withdraw or change this consent at any time by clicking on the “Manage Cookies” link in the footer of the website.

7. TikTok Pixel

In our shop we use the TikTok Pixel. The TikTok Pixel is a TikTok advertiser tool from TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland ("TikTok"). The TikTok Pixel is a code that enables us to understand and track the activities of visitors to our website. The TikTok pixel collects and processes information about visitors to our website or the devices they use. The data collected via the TikTok Pixel is used to target our advertisements and to improve ad delivery and personalised advertising. For this purpose, the data collected on our website using the TikTok pixel is transmitted to TikTok. Some of this data is information that is stored on the device you are using. In addition, the TikTok Pixel also uses cookies to store information on the device you are using. Such storage of information by the TikTok pixel or access to information that is already stored on your device only takes place with your consent.

The legal basis for the processing of personal data is therefore your consent pursuant to Article 6(1)(a) GDPR and Section 25 (1) TDDDG with regard to the initial storage and extraction of data. You can withdraw or change this consent at any time by clicking on the “Manage Cookies” link in the footer of the website. You can find more information on data privacy by TikTok in TikTok's data privacy notice at https://www.tiktok.com/legal/privacy-policy.

8. Consent management platform Consentmanager

We use the cookie consent bar provided by BrightEdge platform to collect the consent at the root domain level and Google Tag Manager to load & unload the pixels and scripts on all our websites based on the consent collected.

9. Newsletter

You can register for a newsletter on our website. We use the platform of our processor Klaviyo, 225 Frankling St, Boston, MA 02110, USA, (“Klaviyo”) to send our e-mail newsletter. The data provided when registering for the newsletter will be passed on to Klaviyo. The only mandatory information for sending the newsletter is your e-mail address. The provision of further data is voluntary and is used to address you personally. We use the so-called double opt-in procedure for sending the newsletter. This means that we will only send you an e-mail newsletter if you have expressly confirmed to us that you consent to receiving the newsletter. We will then send you a confirmation e-mail asking you to confirm that you wish to receive the newsletter in future by clicking on a corresponding link.

By clicking on the confirmation link, you give us your consent to use your personal data in accordance with Article 6(1)(a) GDPR. When you register for the newsletter, we store your IP address as well as the date and time of registration in order to be able to trace any possible misuse of your e-mail address at a later date. We collect the data exclusively for the purpose of advertising by means of the newsletter. You can unsubscribe from the newsletter at any time via the link provided in the newsletter or by sending us an email. Once you have unsubscribed, your e-mail address will not be used for any further newsletters. Please note that it can take up to 48 hours for it to take effect. With Klaviyo we also track your interaction with the newsletter based on our legitimate interest pursuant to Article 6(1)(f) GDPR.

VII. Online presence in social media

We maintain online presences within social networks in order to communicate with the interested parties and users active there and to inform them about our events and news. In this context, we integrate external services or content by linking them to our website. If you use such a service (click on the link and open the platform) or if third-party content is displayed to you, communication data (such as IP addresses or general device information) will be exchanged between you and the respective provider for technical reasons.

In addition, it is possible that the provider of the respective external services or content collects personal data about you - for example by means of corresponding cookies - and then processes it for its own purposes. We have configured services or content from providers that are known to process data for their own purposes to the best of our knowledge and belief so that either communication for purposes other than displaying the content or services on our website does not take place or communication only takes place when you actively decide to use the external service. However, as we generally or to a large extent have no influence on the data collected by third parties and its processing by them, we cannot provide any binding information on the purpose and scope of the processing of your data. Further information on the purpose and scope of the collection and processing of your data by the providers of the corresponding external services as well as information on the data protection notices of the respective providers of the external services or content integrated by us can be found via the following links:

1. Facebook fan page

SuperPatch operates an online presence on Facebook, a so-called Facebook fan page of Meta Platforms Inc. When visiting our fan page, the following additional reports on data processing activities apply.

We are jointly responsible with Meta for the operation of our Facebook fan page in accordance with Article 26 GDPR. For this purpose, Meta has concluded an agreement with us to determine who fulfils which obligations with regard to data privacy. This agreement can be accessed here. According to this agreement, Meta is primarily responsible for providing the data subject with information about the joint processing and enabling them to exercise their data protection rights. Irrespective of this, we hereby inform you about your visit to our fan page and thus provide you with the information required under data protection law. Information on data privacy at Meta in general can be found here. The Meta company responsible for us is the:

Facebook Ireland Ltd. 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland

You can reach Meta online here. You can contact Meta's data protection officer at https://www.facebook.com/help/contact/540977946302970.

Collection and storage of personal data as well as type and purpose and their use:

a) Data collected by Meta on Facebook:

If you are a Facebook user, Meta collects the data described in the Facebook data policy under "What types of information do we collect?". If you are not a Facebook user, cookies with identifiers, small text files, may still be stored in your browser, which enable your user behaviour to be tracked.

As a rule, Meta also processes user data for market research and advertising purposes when users visit Facebook. Complex user profiles are created based on user behaviour (including when visiting our fan page), which Meta can use to display personalised advertisements to visitors inside and outside Facebook. You can also find more information on this in the Facebook data policy.

If you do not agree to this, you can object here (opt-out).

b) Data used by us ("Page Insights") and legal basis:

Meta provides us with statistics and usage data that we can use to analyse the use of our fan page (so-called "page insights"). This enables us to continuously improve our offer on Facebook. As the operator, we do not make any decisions regarding the processing of Insights data and all other information resulting from Article 13 GDPR, such as the storage duration of cookies on user end devices. The primary controller under the GDPR for the processing of Insights data is Meta. In this regard, we also refer to the joint controllership agreement pursuant to Article 26 GDPR that Meta has concluded with us and to the obligations assumed by Meta under this agreement.

As the page administrator, we have no other way of evaluating user behaviour on our fan page, not even via user tracking. It is also generally not possible for us to identify visitors to our fan page on the basis of page insights. In particular, in accordance with the agreement with Meta, we have no right to demand that Meta disclose individual visitor data. Identification is only possible for us if we can assign individual profile pictures to "Like" information for the page; however, this is only possible if our fan page has been marked with "Like" by the corresponding visitor and the "Like" information is set to "public".

You can find out what information Meta uses to create the Page Insights here. The operation of the Facebook fan page and the use of page insights serves our legitimate interest in an effective external presentation and communication with our interested parties. This interest justifies the operation of the page both in relation to the legitimate interests of Facebook users and in relation to visitors to our fan page who do not have a Facebook account. The legal basis is Article 6(1)(f) GDPR.

2. Instagram

We have an online presence on Instagram. Instagram is an audio-visual platform from Meta that allows users to share photos and videos and also distribute them on other social networks. We are jointly responsible with Meta for the operation of our presence on Instagram in accordance with Article 26 GDPR. For this purpose, Meta has concluded an agreement with us to determine who fulfils which obligations with regard to data privacy. This agreement can be accessed here. According to this agreement, Meta is primarily responsible for providing the data subject with information about the joint processing and enabling them to exercise their data protection rights. Irrespective of this, we hereby inform you about your visit to our fan page and thus provide you with the information required under data protection law. Information on data privacy at Meta in general can be found here. The Meta company responsible for us is the:

Facebook Ireland Ltd. 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland

You can reach Meta online here. You can contact Meta's data protection officer at https://www.facebook.com/help/contact/540977946302970. Further information and the applicable data protection provisions of Instagram can be found at https://help.instagram.com/155833707900388 and https://www.instagram.com/about/legal/privacy/.

a) Data collected by Meta on Instagram:

If you are an Instagram user, Meta collects the data described in the Instagram Data Policy under "What types of information do we collect?". If you are not an Instagram user, cookies with identifiers, small text files, may still be stored in your browser, which enable your user behaviour to be tracked.

As a rule, Meta also processes user data for market research and advertising purposes when you visit Instagram. Complex user profiles are created based on user behaviour (including when visiting our Instagram), which Meta can use to display personalised advertisements to the visitor within and outside from Instagram. You can also find more information on this in the Instagram Data Policy.

b) Data used by us ("Page Insights") and legal basis:

Meta provides us with statistics and usage data that we can use to analyse the use of our Instagram page (so-called "page insights"). This enables us to continuously improve our offer on Instagram. As the operator, we do not make any decisions regarding the processing of Insights data and all other information resulting from Article 13 GDPR, such as the storage duration of cookies on user end devices. The primary controller under the GDPR for the processing of Insights data is Meta.

As the site administrator, we have no other way of evaluating user behaviour on our Instagram page, not even via user tracking. It is also generally not possible for us to identify visitors to our Instagram page based on the page insights. In particular, in accordance with the agreement with Meta, we have no right to demand that Meta disclose individual visitor data. In addition to any personal data transmitted directly to us by users, we can also see information about the user's profile, likes and posts, depending on the user's privacy settings.

Operation of the Instagram page serves our legitimate interest in an effective external presentation and communication with our interested parties. This interest justifies the operation of the page both in relation to the legitimate interests of Instagram users and in relation to visitors to our fan page who do not have an Instagram account. The legal basis is Article 6(1)(f) GDPR.

3. TikTok

We have an online presence on TikTok. TikTok is a social media platform that allows users to share short-form videos and distribute them on other social networks. We are jointly responsible with TikTok for the operation of our presence on TikTok in accordance with Article 26 GDPR. For this purpose, TikTok has concluded an agreement with us to determine who fulfills which obligations with regard to data privacy. This agreement can be accessed here https://www.tiktok.com/legal/page/global/tiktok-analytics-joint-controller-addendum/en. According to this agreement, TikTok is primarily responsible for providing the data subject with information about the joint processing and enabling them to exercise their data protection rights. Irrespective of this, we hereby inform you about your visit to our fan page and thus provide you with the information required under data protection law. Information on data privacy at TikTok in general can be found here: https://www.tiktok.com/legal/privacy-policy.

The TikTok company responsible for us is:

TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland

You can reach TikTok online here: https://www.tiktok.com/about/contact. You can contact TikTok's data protection officer here: https://www.tiktok.com/legal/report/privacy. Further information and the applicable data protection provisions of TikTok can be found at https://www.tiktok.com/legal/privacy-policy.

a) Data collected by TikTok:

If you are a TikTok user, TikTok collects the data described in the TikTok Data Policy under "What types of information do we collect?". If you are not a TikTok user, cookies with identifiers, small text files, may still be stored in your browser, which enable your user behavior to be tracked.

As a rule, TikTok also processes user data for market research and advertising purposes when you visit TikTok. Complex user profiles are created based on user behavior (including when visiting our TikTok), which TikTok can use to display personalized advertisements to the visitor within and outside from TikTok. You can also find more information on this in the TikTok data policy.

b) Data used by us and legal basis:

TikTok provides us with statistics and usage data that we can use to analyse the use of our TikTok page. This enables us to continuously improve our offer on TikTok. As the operator, we do not make any decisions regarding the processing of Insights data and all other information resulting from Article 13 GDPR, such as the storage duration of cookies on user end devices. The primary controller under the GDPR for the processing of Insights data is TikTok.

As the site administrator, we have no other way of evaluating user behavior on our TikTok page, not even via user tracking. It is also generally not possible for us to identify visitors to our TikTok page based on the page insights. In particular, in accordance with the agreement with TikTok, we have no right to demand that TikTok disclose individual visitor data. In addition to any personal data transmitted directly to us by users, we can also see information about the user's profile, likes and posts, depending on the user's privacy settings.

Operation of the TikTok page serves our legitimate interest in an effective external presentation and communication with our interested parties. This interest justifies the operation of the page both in relation to the legitimate interests of TikTok users and in relation to visitors to our fan page who do not have a TikTok account. The legal basis is Article 6(1)(f) GDPR.

4. YouTube

We have a profile on YouTube. YouTube is a video platform of Google Ireland Limited ("Google").

You can reach Google at: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland

You can contact Google's data protection officer at https://support.google.com/policies/answer/9581826?p=privpol_privts&hl=en&visit_id=637054532384299914-2421490167&rd=1

Further information and the applicable data protection provisions of Google may be retrieved under https://policies.google.com/privacy?hl=en

a) Data collected by Google on YouTube

By using YouTube, your personal data will be collected, transferred, stored, disclosed and used by Google and transferred to, stored and used in the United States, Ireland and any other country in which Google does business, regardless of your place of residence. It is transferred to companies affiliated with Google and to other trustworthy companies or persons who process it on behalf of Google.

Google processes your voluntarily entered data such as name and user name, email address and telephone number. Google also processes the content that you create, upload or receive from others when using the services. This includes, for example, photos and videos that you save, documents and spreadsheets that you create and comments that you write on YouTube videos.

On the other hand, Google also analyzes the content you share to determine which topics you are interested in, stores and processes confidential messages that you send directly to other users and can determine your location using GPS data, information on wireless networks or your IP address in order to send you advertising or other content.

Google may use analysis tools such as Google Analytics for evaluation purposes. We have no influence on the use of such tools by Google and have not been informed of such potential use. If tools of this type are used by Google for our YouTube channel, we have neither commissioned this nor supported it in any other way. The data obtained from the analysis is also not made available. Only certain subscriber profiles can be viewed by us via our account. Furthermore, we have no way of preventing or disabling the use of such tools on your YouTube channel.

Finally, Google also receives information when you view content, for example, even if you have not created an account. This so-called "log data" may include the IP address, the browser type, the operating system, information about the previously accessed website and the pages you accessed, your location, your mobile phone provider, the end device you use (including device ID and application ID), the search terms you used and cookie information.

You have the option of restricting the processing of your data in the general settings of your Google account. In addition to these tools, Google also offers specific data protection settings for YouTube. You can find out more about this in Google's guide to data protection in Google products: https://policies.google.com/technologies/product-privacy?hl=en&gl=en.

b) Data used by us and legal basis

Google provides us with statistics and usage data that we can use to analyse the use of our YouTube channel (so-called "channel analytics"). This enables us to continuously improve our offering on YouTube. As the operator, we do not make any decisions regarding the processing of analytics data and all other information resulting from Article 13 GDPR, such as the storage duration of cookies on user end devices. The primary controller under the GDPR for the processing of analytics data is Google.

As the site administrator, we have no other way of evaluating user behavior on our YouTube channel, not even via user tracking. It is also generally not possible for us to identify visitors to our YouTube channel using channel analytics. In addition to any personal data transmitted directly to us by users, depending on the user's privacy settings, we can see information about their profile, their interaction (e.g. likes or dislikes), their saved and shared videos, their comments and their own videos.

The operation of the YouTube channel and the use of channel analytics serve our legitimate interest in an effective external presentation and communication with our interested parties. This interest justifies the operation of the site both in relation to the legitimate interests of YouTube and Google users and in relation to visitors to our profile who do not have a YouTube or Google account. The legal basis is therefore Article 6 (1) (f) GDPR.

5. X (formerly Twitter)

We have an online presence on X (formerly known as Twitter), a social media platform operated by X Corp., a wholly owned subsidiary of X Holdings Corp. When visiting our account on X, the following additional information on data processing activities applies.

The European subsidiary of X Corp. responsible for processing personal data in the EU is Twitter International Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland

You can reach X online via https://support.twitter.com/forms. You can contact the Data Protection Officer at https://help.x.com/en/forms/privacy

Information about Collection and Storage of Personal Data, Type and Purpose of Processing, and Use:

a) Data Collected by X

When using X, X collects personal data as described in its privacy policy under the section "Information We Collect." This includes data collected from users of the platform and visitors to our X account. Even if you are not a registered user of X, X may store cookies with unique identifiers in your browser, which allow tracking of your user behavior. Generally, X processes personal data for purposes such as market research and advertising when users interact with its platform, including visits to our X account. Based on this data, X creates detailed user profiles, which may be used to deliver personalized advertising to users both on and off the platform. Additional details can be found in X privacy policy.

b) Data Used by Us ("Analytics") and Legal Basis

X provides us with aggregated data and insights (referred to as "Analytics") on the interactions with our X account. These analytics enable us to better understand the usage patterns and interests of users, which helps us improve our presence on the platform. We do not control or decide upon the processing of personal data for these insights, nor do we determine the storage duration of cookies on user devices. The controller responsible for processing this data under the GDPR is X.

As account administrators, we do not have access to personal data that would allow us to directly identify individual visitors to our X account. We receive only anonymized data from X. Identification is only possible if a user has interacted with our account in a publicly visible manner, such as by liking or retweeting our posts, and only if such interaction settings are set to public by the user.

You can find out more about the data X uses to create Analytics at https://business.x.com/de/analytics.html. The operation of our X account and the use of Analytics serve our legitimate interest in effectively presenting ourselves to the public and communicating with interested parties. This interest is considered legitimate within the meaning of Article 6(1)(f) GDPR, balancing the interests of X users and those of visitors to our X account who do not have an account.

VIII. Cookies and similar technologies

Cookies and similar technologies are used when you visit our website. Cookies are small files that your browser automatically creates and that are stored on your end device (laptop, tablet, smartphone, etc.) when you visit our website and you consent to the cookies in accordance with our cookie banner, or they are technically necessary cookies. Information is stored in a cookie that results in each case in connection with the specific end device used. However, this does not mean that we gain knowledge of your identity. We use the following types of cookies:

1. Essential cookies

Essential cookies are required for the basic functionality of the website. They only contain technically necessary services. You cannot object to these services. We use the following essential cookies are used:

The data processed by essential cookies are necessary for the functioning of our website, i.e. our legitimate interests pursuant to Article 6(1)(f) GDPR and Section 25 (2)(2) TDDDG with regard to the initial storage and extraction of data.

2. Statistical cookies

We also use statistical cookies from Google Analytics to record and analyse the use of our website. Details on the processed data can be found in section 4 of this data privacy notice. The following performance cookies may be set for the functions of Google Analytics and builder.io:

Statistical cookies are only set if you have consented to their storage, Article 6(1)(a) GDPR and Section 25 (1) TDDDG with regard to the initial storage and extraction of data. You can withdraw or change the cookies set on our site with your consent at any time by click on the “Manage Cookies” link in the footer of the website and have the option to change the acceptance or rejection of cookies. The changes will take effect immediately. If you change your settings and reject cookies, certain functions and features of our website may not work as intended.

IX. Data erasure and storage duration

Personal data will be deleted or blocked as soon as the purpose of storage no longer applies. Storage may also be necessary if this has been provided for by the European or national legislator in EU regulations, laws or other provisions to which the controller is subject. The data will also be blocked or deleted if a storage period prescribed by the aforementioned standards expires, unless there is a need for further storage of the data for the conclusion or fulfilment of a contract. We anonymise data stored for technical reasons after 24 hours and delete it after 7 days at the latest.

X. Complying with legal requirements

We will further process your personal data to comply with any other legal obligations to which we are subject in connection with the processing of your order. This particularly includes any retention periods under commercial, trade or tax law. We will process your personal data for compliance with a legal obligation to which we are subject according to Article 6(1)(c) GDPR in conjunction with commercial, trade or tax law, to the extent we are obliged to gather, record and keep your data.

XI. Enforcing rights

We will furthermore process your personal data to be able to assert our rights and enforce our legal claims. We will also process your personal data to be able to defend against legal claims. Finally, we will process your personal data to the extent necessary for the prevention or prosecution of criminal offences. We will process your personal data for the purposes of our legitimate interests according to Article 6(1)(f) GDPR, to the extent that we assert legal claims or defend ourselves in legal disputes or that we prevent or clarify criminal offences.

XII. Company sale/merger, etc.

We may process your personal data in order to complete a (partial) sale of the company or a merger (or similar transactions such as a takeover in the context of liquidation, insolvency, dissolution, etc.) with another company. In the event that another company acquires or intends to acquire the assets/capital, which may include your personal data, of The Super Patch Company Ltd, or The Super Patch Company Ltd enters into or seeks to enter into a merger with another company, we may need to grant that company access to or transfer your personal data stored with us for the purpose of reviewing and implementing the company sale/merger (e.g. to determine the value of the company, business risks, etc.). We process your personal data for the purposes of our legitimate interests according to Article 6(1)(f) GDPR in order to plan and implement a planned sale of the company or a planned merger.

XIII. Categories of recipients

Initially, only our employees receive knowledge of your personal data.

Your data will only be passed on to third parties if this is permitted or required by law or if you have given your consent. We also share your data to the extent necessary with the service providers we use in order to provide our services. We limit the transfer of data to what is necessary to provide our services to you. In some cases, our service providers receive your data as processors and are then strictly bound by our instructions when handling your data. In some cases, the recipients act independently with your data that we transmit to them.

The categories of recipients of your data are listed below

• affiliated companies within The Super Patch Company Ltd, insofar as they work for us as processors or independently and provide IT services, for example, or insofar as this is necessary for the provision of our services,
• payment service providers and banks, for the purposes of processing payments,
• call center and complaint processor to receive and process your inquiries and complaints,
• agencies, printers and lettershops that support us in the implementation of advertising measures, competitions, promotions, etc,
• IT service providers who store data, support the administration and maintenance of systems, as well as file archivists and shredders;
• logistics service providers to deliver goods etc,
• credit agencies when calling up a credit report,
• companies that acquire assets/capital from The Super Patch Company Ltd (e.g. in the event of a company acquisition, merger, liquidation/insolvency/dissolution, etc.),
• collection agencies and legal advisors in the assertion of our claims,
• public bodies and institutions insofar as we are legally obliged to do so.

In addition, we may share your personal data within our global group of companies, e.g. with subsidiaries that require this data to fulfill our and/or their own contractual and legal obligations or on the basis of legitimate interests. This may be for economic, administrative or other internal business purposes; this only applies if your interests or fundamental rights and freedoms, which require the protection of personal data, do not outweigh these. Beyond this, we do not pass on your data to third parties.

XIV. Transfer to a third country

We do business globally. Therefore, your personal data may be transferred to other parts of our company in countries outside the European Union (EU). Data will only be transferred to countries outside the EU or the EEA (so-called third countries) if this is necessary in the context of processing our contractual relationships or is required by law (e.g. reporting obligations under tax law), if you have given us your consent or in the context of order processing.

When transferring data to third countries, we ensure that a level of data protection within the meaning of Art. 44 et seq. GDPR is complied with.

If service providers are used in a third country for which there is no decision by the European Commission confirming an adequate level of data protection and we can influence this, they are obliged to comply with the level of data protection in Europe in addition to written instructions by agreeing the EU standard contractual clauses. Alternatively, we transmit the data on the basis of Binding Corporate Rules. Further information can be obtained from our data protection officer.

Otherwise, we do not transfer your personal data to countries outside the EU or the EEA or to international organizations.

XV. Rights of the data subjects

If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis the controller:

• Right to withdraw your consent to the processing of personal data at any time (Article 7 GDPR);
• Right to information about your personal data stored by us (Article 15 GDPR);
• Right to rectification, erasure or restriction of processing of your personal data (Article 16 - 18 GDPR);
• Right to object to processing that serves our legitimate interest, a public interest or profiling, unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims (Article 21 GDPR);
• Right to data portability (Article 20 GDPR);
• Right to lodge a complaint with a supervisory authority (Article 77 GDPR);
• You have the right to withdraw your consent to the collection, processing and use of your personal data at any time with effect for the future. You can find more information on this in the respective sections above, where data processing activities based on your consent are described (Article 7(3) GDPR).

If you wish to exercise your rights, you can, for example, address your request to the data protection officer named above or send an e-mail to opportunity@superpatch.com.

XVI. Scope of your obligations to provide data

You are not generally obliged to disclose your personal data to us. However, if you do not do so, we will be unable to make our website available to you, answer the requests that you address to us and enter into a contract with you. All personal data that is not absolutely needed by us for the aforesaid processing purposes is marked as voluntary by the addition “if applicable” or otherwise.

XVII. Profiling / automated decision-making

Due to legal requirements, we are obliged to combat money laundering and fraud. Data is also analyzed in this process. These measures also serve to protect you. Otherwise, we do not use any profiling and do not use any purely automated decision-making processes in accordance with Article 22 GDPR. Should we use further procedures in individual cases in the future, we will inform separately.

XVIII. Changes

We reserve the right to change this privacy policy at any time. Any changes will be notified by posting the revised privacy policy on our website. Unless otherwise specified, such changes will be effective immediately. Therefore, please check this privacy policy periodically to read the most current version.

Last updated in November 2024