PRIVACY STATEMENT

Below, we would like to explain to you what data concerning your person we collect and what we do with these data. We also inform you of your data privacy rights and explain to whom you can turn with questions about the protection of your data. This privacy statement applies to the website lekkerland.com and all its subpages. It is aimed at the visitors to our website.

Referral links leading to the websites of other operators are offered on our pages; this privacy statement does not apply to these operators.

1. CONTROLLER RESPONSIBLE FOR THE PROCESSING OF YOUR DATA:

Lekkerland SE
Europaallee 57
50226 Frechen, Germany
Telephone +49 2234 1821-0
Email: info(at)lekkerland.com
Management Board: Hilmar Hübers (Chairman), Ulf Adebahr, Dirk Klein-Hietpas, Nils Klüssendorf, Philipp Pauly
Chairman of the Supervisory Board: Lionel Souque

If you have any questions relating to this privacy statement, the processing of your data, your rights or other concerns regarding data privacy, our data protection officer will be happy to help you.

Contact details of the data protection officer:

Lekkerland SE
Data Protection Officer
Europaallee 57 50226 Frechen, Germany
Email: datenschutz@lekkerland.com

2. DO I HAVE TO PROVIDE MY DATA?

User data are automatically stored when you visit our website. Some of the data recorded are necessary for the use of a website. Additionally, we process your data also on the basis of your consent. This enables us to constantly improve the services offered to you. On the following pages, you will find out the background to our interests and whether or how you can object to or even disable the use of your data.

In order to use the services offered by us or send an enquiry, you will be asked to provide your personal data. You can decide for yourself whether to take up these offers and provide your data for this purpose. Of course, we shall process your data only for the purpose for which you have made your data available to us. We also offer you services for which we process your data only with your consent. The granting of consent is always voluntary. Any consent previously granted may be withdrawn at any time with effect for the future.

Please note that if you provide information concerning other people, you must have obtained their consent thereto beforehand and informed them of the purposes of the disclosure as set out in this privacy statement.

We also ask you to pass on this information to those persons you involve in using our services, such as family members or authorised representatives.

3. DATA PROCESSED

We shall process your personal data when you visit the website lekkerland.com, provide us with information via a contact form on our website or contact us in any other way. Specifically, these data may include the following in particular:

• data that you make available to us via the contact form or in some other way when you contact our customer service;
• data that we generate on the basis of an evaluation of your data (e.g. user ID, customer segments, assumed product preferences);
• data relating to your location (if you have allowed the collection of location data in your device settings);
• server log-file data recorded when the website is accessed, e.g.: information on the type and version of the browser used, the page accessed, the page from which the website was accessed, the scope of the data transmitted, the user’s operating system, the user’s Internet service provider and IP address, the date and time of access;
• data that we – subject to your consent – may possibly transfer to our third-party providers (e.g. user data, IP addresses, browser information, operating system, limited usage and location data, possibly usage and behavioural data relating to website usage), to vendors;
• data that we need for rendering our services and enabling our website to be visited, e.g. IP number; website accessed; in the case of the mobile version or automated voice control the user agent sent by your browser; browser resolution or internal window size; cookie on/off; Java script on/off;
• data that we need for data security on our website, e.g. IP number; name of the file accessed; data volume transferred; referrer URL or the website visited beforehand; in the case of the mobile version or automated voice control the user agent sent by your browser; session cookie; date and time of access;
• data for optimising our Internet offering, e.g. the name of the file accessed; website accessed; referrer URL or the website visited beforehand; user agent; in the case of the mobile version or automated voice control the user agent sent by your browser; IDs for identifying the advertising partner and showing the advertising material; marketing channel; current time; time of clicking; keyword ID (external search term); visitor’s ID without any personal reference;
• data that we need for showing fonts and videos, e.g. IP number; name of the file accessed; data volume transferred; referrer URL or the website visited beforehand; in the case of the mobile version or automated voice control the user agent sent by your browser; session cookie; date and time of access;

We shall process the aforementioned data only insofar as we actually receive them, for example in the case of consent to our service for personalised advertising or use of our customer service.

4. IS THERE AN OBLIGATION TO PROVIDE THE DATA?

There is no legal requirement to provide your data. However, some of the data mentioned are essential for enabling the provision of our services on this website. The communication of other data is voluntary, but may be essential for the use of certain services. This concerns, for example, personalisation of the promotional approach for different channels.

We shall inform you when you enter data if the provision thereof is essential for the respective service or feature. These data are marked as mandatory fields. In the case of essential data, failure to provide these data will result in the relevant service or feature not being provided. In the case of optional data, failure to provide these data may result in our being unable to provide our services in the same form and to the same extent as usual.

5. FOR WHAT PURPOSES DO WE PROCESS YOUR DATA, AND ON WHAT LEGAL BASIS?

5.1. Contact form

You can contact us via our web form or by email, post or telephone. We shall process your data for answering your enquiry and, if applicable, for sending information material requested. Your data may be sent to the department responsible for your concern. The legal basis for the data processing described is Article 6 (1) b), f) of the General Data Protection Regulation (pre-contractual steps, performance of a contract or balancing of differing interests, based on Lekkerland’s interest in answering enquiries from customers and other persons).

5.2. Cookies and web tracking

We use cookies and other technologies in some areas of our website in order to, for example, identify visitor preferences and be able to optimally design the website accordingly. This facilitates navigation and allows for a high degree of user-friendliness. Cookies and other technologies help us to identify particularly popular areas of our Internet offering.

Cookies are small text files saved onto the hard drive of your terminal device. They allow information to be stored over a certain period and your terminal device to be identified. We use permanent cookies to improve user guidance and customise the presentation of our services. Furthermore, we use so-called session cookies, which are automatically deleted when you close your browser. You can set your browser to inform you of the placement of cookies. This makes the use of cookies transparent for you. Important: If you fully exclude the use of cookies, you may possibly not be able to use individual features of our website.

Depending upon the purpose of the cookies and the other technologies, we distinguish between necessary, statistical and marketing cookies.

The necessary cookies and other technologies are essential for ensuring key features of the website as well as performance of a contract in relation to customers and cooperation partners. The legal basis for their use is Section 25 (2) no. 2 of the

Act on the Regulation of Data Protection and Privacy in Telecommunications and Telemedia (Gesetz über den Datenschutz und den Schutz der Privatsphäre in der Telekommunikation und bei digitalen Diensten (TDDDG)) in conjunction with. Art. 6 (1) sentence 1 letter b) (initiation or performance of a contract), and letter f) General Data Protection Regulation (overriding legitimate interests). The last-mentioned interests include, in particular, monitoring of the website’s technical performance. Therefore, you as a website user cannot disable them via our consent management system.

All cookies and other technologies are described in detail in the so-called cookie banner under “Services”. You can view these in the “Privacy settings” in the footer of the website at any time or by clicking directly here.

Statistical cookies and other technologies are needed in order to understand how our visitors use our portal, to identify errors and to continuously improve the portal. The legal basis for their use is Section 25 (1) TDDDG (consent for the setting or reading of cookies) in conjunction with Article 6 (1) sentence 1 letter a) GDPR (consent for the data processing based on this). The data processing only begins when you have given the corresponding opt-in (consent). You can withdraw your consent to the data processing at any time with effect for the future. The withdrawal of consent shall not affect the lawfulness of the processing carried out prior to withdrawal.

All cookies and other technologies are described in detail in the so-called cookie banner under “Services”. You can view these in the “Privacy settings” in the footer of the website at any time or by clicking directly here.

You can also withdraw your consent at any time in the “Privacy settings”.

5.3. Optimisation of the Internet offering

We constantly improve our websites in order to offer you an optimum experience. To this end, the data provided concerning your visit are processed by our service providers in the context of commissioned processing. Neither we nor the service providers commissioned will combine your visit data with your name or other personal details that you have given to us. The IP number is anonymised before it is

used to generate statistics. It is in our legitimate interest (Art. 6 (1) f) GDPR) to optimise our Internet offering. For this purpose, service providers are used in the context of commissioned processing, cookies are set and visit data are transferred to a server of a service provider (here Google) in the USA.

5.4. Provision of services

In order to visit and use our website, the following data must be collected: IP number; website accessed; user agent sent by your browser; browser type; browser version; browser resolution (internal window size); browser language; cookie on/off; JavaScript on/off.

Every access to our website is stored in a log file. We collect and use this data solely for data security purposes. The following data is collected: IP number; name of the file accessed; amount of data transferred; referrer URL or the previously visited website; user agent sent by your browser; session cookie; date and time of access. The legal basis for the data processing described is Art. 6 (1) lit. f GDPR (balancing of interests, based on Lekkerland’s interest in ensuring the security of IT systems).

6. AUTOMATED DECISION-MAKING, INCLUDING PROFILING

The above data processing activities do not involve any so-called automated decision-making or profiling as set out in Art. 22 (1) and (4) GDPR.

7. TIME LIMITS FOR ERASURE (OR DURATION OF STORAGE)

As a rule, we shall store your data only for as long as we need your data for the purposes of the respective processing. If your data are no longer essential for the fulfilment of the processing purposes specified in this privacy notice, they will be erased unless their retention is still necessary for the fulfilment of retention duties under commercial or fiscal law. Ordinarily, we shall erase your data after these time limits or specify the time limit for erasure on the basis of these criteria:

• We erase the data for the processing of enquiries 1 year after completion of the process.
• The data used to optimise our Internet offering are erased after 26 months.
• Closing your browser automatically deletes the session cookie.
  We use cookies to distinguish your return visit from your first visit to our website. You can delete the cookie manually; otherwise, it will be automatically deleted 26 months after your last visit to our website and then reset with a new ID on your next visit.
  The server log files are deleted after 7 days by default.

8. ORIGIN OF THE DATA

No data are collected from third parties.

9. WHICH ENTITIES RECEIVE YOUR DATA

The following list shows which entities receive your data in which cases. You can read about the specific data concerned in the corresponding chapters of this statement. We use selected vicarious agents and service providers who act on our behalf as commissioned processors (in accordance with Art. 28 GDPR) and may obtain access to your data to the extent necessary in the respective case. Commissioned processors are subject to numerous contractual obligations and are, in particular, only permitted to process your personal data on our instruction and solely for the fulfilment of the orders received from us.

• Auditors
• Data protection officer
• The vendors/data recipients specified in this privacy statement, in the context of cookies and other technologies
• Service providers for showing fonts
• Service providers for optimising our Internet presence
• Service providers for destroying data carriers
• Printing and shipment service providers (in the case of written communication)
• The recipient’s email provider (in the case of communication by email)
• IT service providers
• Lawyers, law enforcement agencies, public prosecutor’s office, courts, opposing lawyers, state or federal criminal police (in the case of legal disputes or actual suspicion of a crime)
• Telecommunication service providers (in the case of telephone communication)

10. DATA PROCESSING OUTSIDE OF THE EUROPEAN UNION

For processing your data, we shall also use service providers located in third countries outside of the European Union. Countries outside of the European Union handle the protection of personal data differently to countries within the European Union. There is currently no resolution of the EU Commission according to which these third countries generally offer an appropriate level of protection. Therefore, we have taken particular measures to ensure that your data are processed in the third countries just as securely as within the European Union. Where we use third-country service providers, we conclude with these the data protection agreement (standard data protection clauses) provided by the European Union Commission for the processing of personal data in third countries. This agreement provides for suitable safeguards to protect your data with service providers in the third country. You can request a copy of these suitable safeguards using the contact details provided above.

11. YOUR RIGHTS

You have the statutory right:

• to access the personal data stored concerning you (Art. 15 GDPR)
• to rectification and completion of your data that we possess (Art. 16 GDPR)
• to erasure (Article 17 GDPR)
• to restriction of the processing (Article 18 GDPR)
• to data portability (Article 20 GDPR)
• to withdraw previously given consents at any time (Art. 7 GDPR) with effect for the future. This will not affect the lawfulness of the data processing carried out prior to withdrawal.
• You also have the right to express your point of view and to contest any decision based on automated processing (Article 22 GDPR).
• You have the right to object to your data being processed for the safeguarding of our legitimate interests or the legitimate interests of third parties (Art. 21 GDPR) – you have the right to object, on grounds relating to your particular situation, at any time to such processing, including profiling based on these provisions within the meaning of Art. 4 (4) GDPR.
• to object to direct marketing – you have the right to object, at any time and without giving reasons, to your data being processed for the purpose of direct marketing.

In order to exercise these rights, you can, in particular, contact us using the contact details provided above.

You likewise have the statutory right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).