Data Protection Declaration

General Information1. Contact details of the controllerHenze-Harvestore GmbH Schmelzerstr. 17 59425 Unna Tel.: +49(0)2303-96123-0 Fax: +49(0)2303-96123-23 Email: info(at)harvestore.de

2. Contact details of our Data Protection OfficerEmail: datenschutzbeauftragter@harvestore.de II. Specific information regarding the collection of personal data1. Visiting the websitea) Purpose of data processingEach time a user accesses a page of our website and each time a file stored on the website is retrieved, access data relating to this process are stored in a log file. Each data record comprises: (1) page from which the file was requested, (2) name of the file, (3) date and time of the request, (4) volume of data transferred, (5) access status (file transferred, file not found etc.), (6) a description of the type of operating system and web browser used, (7) host name of the accessing computer, (8) client IP address. We use these data to operate our website, in particular to determine levels of website traffic as well as malfunctions of the website and to implement adjustments or improvements. The client IP address is used for the purpose of transmitting the requested data; it is anonymised by deleting the last block of digits (Ipv4) or the last octet (Ipv6) after the technical requirement has ceased to exist . b) Duration of storageData are stored each time a user accesses a page of our website and each time our website is called up, and are erased as soon as they are no longer required for the purpose for which they were collected, in any case no later than three months after the visit to the website. c) Legal basisThe legal basis for the temporary storage of the aforementioned data is Article 6 para. 1 lit. f of the EU General Data Protection Regulation (hereinafter "GDPR"). The legitimate interest concerns the availability of our website and the investigation of abusive use. d) Possibility to object and have data removedThe data subject may object to the processing by refraining from using our website and, subject to the conditions described in more detail in the "Rights" section below, request erasure of the data collected from him or her in this way by means of an informal declaration. 2. Cookiesa) Purpose of data processingTo make visits to our website and the ordering process technically possible, we transfer so-called cookies to the end device of the data subject. Cookies are small text files by which the end device of the data subject can be identified, usually by recording the name of the domain from which cookie data were sent, information about the age of the cookie and an alphanumeric identifier. By storing the cookie on the end device used – without interfering with the operating system – it is recognised again and allows us to immediately make available any preferences. We use this information to adapt our website and services offered to suit your requirements and to speed up retrieval of our website. b) Duration of storageThe storage period of different cookies varies but is two years at the longest. Cookies are stored on your local end device and not on our server; thus the actual length of the period prior to deletion depends on the configurations of your browser software. Please refer to the operating instructions of your browser software to find out how cookies set by us can be deleted on an ad hoc basis or automatically. c) Legal basisThe legal basis for the storage of the aforementioned data is Article 6 para. 1 lit. f GDPR. The legitimate interest for setting cookies is, on the one hand, to facilitate optimisation of the quality of our website by means of analysis and, on the other hand, to render visits to our website possible; in particular, some functions on our website cannot be used without cookies, as the user and the settings he or she has already chosen would otherwise not be recognised when changing pages, language settings would be lost and searches could not be carried out. Furthermore, storage in connection with fulfilment of a contract takes place pursuant to the legal provisions of Article 6 para. 1 lit. b GDPR. d) Possibility to object and have data removedThe data subject may block the use of cookies in the end device used or delete them after use. Under certain circumstances, however, individual functions of our offer may not be usable. Information on how to block cookies and delete already stored cookies can be found in the instructions of the browser software. 3. Contact form, email, telefax or telephone contacta) Purpose of data processingWe provide a contact form on the website. The data subject may use this to contact us electronically, and we can process the enquiry. The following data is collected and stored: Company, name, address, email address, telephone number, call-back request, date and time of the enquiry and the description of the request and, if the enquiry is made in the context of entering into or processing a contract, contract data. A user can contact us by email, fax or telephone. We store the data transmitted to us in this way and provided by the data subject in order to process the enquiry. These data are name, address, email address, telephone and/or fax number, date and time of enquiry, the description of the request and, if the enquiry is made in the context of entering into or processing a contract, contract data. Data will not be passed on to third parties. They are used to process the contact request of the data subject. b) Duration of storageData are erased as soon as they are no longer necessary to achieve the purpose for which they were collected, which is the case when the conversation has been concluded and facts have been clarified and there are no contractual or tax retention periods to the contrary. This period amounts to five years for personal data pursuant to Section 147 AO (German Fiscal Code) and ten years for personal data pursuant to Section 257 HGB (German Commercial Code). Periods begin at the end of the calendar year in which data were collected. c) Legal basisThe legal basis for storage of the aforementioned data is Article 6 para. 1 lit. b GDPR within the scope of initiation or fulfilment of a contract or according to Article 6 para. 1 lit. f GDPR. The legitimate interest of the controller concerns the ability to process the contact request and prevent misuse of the contact request. d) Possibility to object and have data removedThe data subject has the option to object to the storage at any time. In this case, the data stored for the transaction will be erased. If a contract has been concluded, the above explanations regarding "initiation or fulfilment of a contract" apply. 4. Google Analyticsa) Purpose of data processingThe client IP address is collected for the use of the Google Analytics service. This website uses Google Analytics, a web analysis service of Google Inc. ("Google"). Google Analytics uses so-called "cookies", text files which are stored on the device of the data subject and which make it possible to analyse the way the website is used. The information generated by the cookie relating to the use of this website is usually transmitted to a Google server in the USA and stored there. Due to the activation of IP anonymisation on this website, however, the IP address of the data subject is abbreviated in advance by Google within member states of the European Union or in other contractual states of the Treaty on the European Economic Area. Only in exceptional cases is the complete IP address transmitted to a Google server in the USA and abbreviated there. Google, commissioned by the operators of this website, will use this information in order to evaluate the use of the website, to compile reports about the website activities and to provide further services linked to use of the website and use of the internet vis-à-vis the website operator. The IP address sent from your browser in within the scope of Google Analytics will not be linked up with other Google data. b) Duration of storageData are erased as soon as they are no longer necessary to achieve the purpose for which they were collected; this is the case when anonymisation – which takes place within the European Union – is complete. This takes less than one second. Data that are sent by us and are linked to cookies, login details (e.g. user ID) or advertising IDs are automatically erased after 14 months. The erasure of data with an expired retention period takes place automatically once per month. More information can be found at www.google.com/analytics/terms/de.html and policies.google.com. c) Legal basisThe legal basis for the storage of the aforementioned data is Article 6 para. 1 lit. f GDPR. The legitimate interest concerns the fact that it is possible for us to analyse the use of the website by all users in its entirety without drawing conclusions about the behaviour of identifiable persons; this enables us to optimise our website and our offers. d) Possibility to object and have data removedThe data subject can prevent the storage of cookies by selecting the appropriate settings in the browser; however, please note that doing this may prevent use of the full functionality of this website. The data subject can furthermore prevent Google from collecting data generated by cookies and data related to the use of the website (incl. IP address) as well as the processing of this data by Google by downloading and installing the browser plug-in available via the link below [http://tools.google.com/dlpage/gaoptout?hl=de]. 5. Google Fontsa) Purpose of data collection and processingOn our website, we use fonts from the Google Fonts service of Google LLC (https://fonts.google.com/). The use of this service means fonts are loaded onto the website from the Google server. We use Google Fonts to display fonts on our website. Information of the third-party supplier: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043,USA., policies.google.com/privacy. b) Duration of storageThe duration of storage is regulated by the policies of Google. c) Legal basisThe legal basis for the use of Google Fonts is Article 6 para. 1 sentence 1 lit. f GDPR. d) Possibility to object and have data removedThe data subject may object to the use: https://adssettings.google.com/authenticated6. Applicationsa) Purpose of data collection and processingWe process data from applications that are provided to us only for the purpose of the application and an application procedure. b) Duration of storageData of applicants may be further processed by us for the purposes of the employment relationship in the event of a successful application. In the event of an unsuccessful application, the data of applicants will be erased after completion of the application procedure, unless we are entitled to store the data for a period of six months for the purpose of answering any follow-up questions concerning the application and for the fulfilment of any obligations to provide evidence under the German Equal Treatment Act. If an applicant withdraws his or her application, the data will also be erased. c) Legal basisThe aforementioned data is stored for the purpose of fulfilling our pre-contractual obligations within the scope of the application procedure as defined in Article 6 para. 1 lit. b. and lit. f. GDPR and, if applicable, for the purposes of the employment relationship in accordance with Section 26 BDSG (German Federal Data Protection Act). Insofar as special categories of personal data within the meaning of Article 9 para. 1 GDPR are voluntarily disclosed, their processing is additionally carried out in accordance with Article 9 para. 2 lit. b GDPR (e.g. health data such as severe handicap status). Insofar as special categories of personal data within the meaning of Article 9 para. 1 GDPR are requested from applicants as part of the application process, their processing is additionally carried out in accordance with Article 9 para. 2 lit. a GDPR (e.g. health data, if this is necessary for the exercise of the profession). d) Possibility to object and have data removedPossibilities to object to and remove data exist to the extent described above. 7. Google Maps

a) Purpose of data collection and processingOn our website, we use maps from the Google Maps service of Google LLC (https://www.google.de/maps). The use of this service means data are transferred; in particular, this may include the IP address and location data of the user. Information of the third-party supplier: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043,USA., https://policies.google.com/privacy?hl=de.

b) Duration of storageThe duration of storage is regulated by the policies of Google.c) Legal basisThe legal basis for the use of Google Analytics is Article 6, paragraph 1, p. 1 lit. f GDPR.d) Possibility to object and have data removedThe data subject may object to the use: https://adssettings.google.com/authenticatedIII. Rights of the data subjectInsofar as the personal data of users of our website will be processed, the person concerned (data subject) has the following rights vis-à-vis the controller pursuant to the GDPR. 1. Right to information pursuant to Article 15 GDPRThe data subject has the right to the following information: (a) the purposes of the processing; (b) the categories of personal data concerned; (c) the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations; (d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period; (e) the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing; (f) the right to lodge a complaint with a supervisory authority; (g) where the personal data are not collected from the data subject, any available information as to their source; (h) the existence of automated decision-making, including profiling, referred to in Article 22 paras. 1 and 4 GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject; i) where personal data are transferred to a third country or to an international organisation, the data subject has the right to be informed of the appropriate safeguards pursuant to Article 46 relating to the transfer. We will provide the data subject with a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. 2. Right to rectification pursuant to Article 16 GDPRThe data subject has the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject has the right to have incomplete personal data completed, including by means of providing a supplementary statement. 3. Right to erasure pursuant to Article 17 GDPRThe data subject has the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller is obliged to erase personal data without undue delay where one of the following grounds applies: a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; b) the data subject withdraws consent on which the processing is based pursuant to Article 6 para. 1 lit. a or Article 9 para. 2 lit. a GDPR and where there is no other legal ground for the processing; c) the data subject objects to the processing pursuant to Article 21 para. 1 GDPR and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21 para. 2 GDPR; d) the personal data have been unlawfully processed; e) the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject; f) the personal data have been collected in relation to the offer of information society services referred to in Article 8 para. 1 GDPR. 4. Right to restriction of processing pursuant to Article 18 GDPRThe data subject has the right to obtain from the controller restriction of processing where one of the following applies: a) the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data; b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead; c) the controller no longer needs the personal data for the purposes of processing, but they are required by the data subject for the establishment, exercise or defence of legal claims, or; d) the data subject has objected to processing pursuant to Article 21 para. 1 GDPR pending verification whether the legitimate grounds of the controller override those of the data subject. 5. Right to information pursuant to Article 19 GDPRIf the data subject, in relation to his or her personal data, has demanded vis-à-vis the controller rectification pursuant to Article 16 GDPR, erasure pursuant to Article 17 para. 1 GDPR or restriction of processing pursuant to Article 18 GDPR, and if the controller has conveyed the demands of the data subject to all recipients to whom the personal data of the data subject have been disclosed (insofar as this was not impossible or associated with disproportionate effort), the data subject has the right to be informed by the controller about the recipients. 6. Right to data portability pursuant to Article 20 GDPRThe data subject has the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and has the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where: a) the processing is based on consent pursuant to Article 6 para. 1 lit. a or Article 9 para. 2 lit. a or on a contract pursuant to Article 6 para. 1 lit. b GDPR, and; b) the processing is carried out by automated means. The right referred to above must not adversely affect the rights and freedoms of others. In exercising his or her right to data portability pursuant to paragraph 1, the data subject has the right to have the personal data transmitted directly from us to another controller, where technically feasible. The exercise of the right to data portability shall be without prejudice to the right to erasure pursuant to Article 17 GDPR. The right to data portability does not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. 7. Right to object pursuant to Article 21 GDPRThe data subject has the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on Article 6 para. 1 lit. e or lit. f GDPR, including profiling based on those provisions. We will then no longer process the personal data unless we are able to demonstrate compelling and legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims. Where personal data are processed for direct marketing purposes, the data subject has the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing. Where the data subject objects to processing for direct marketing purposes, the personal data is to no longer be processed for such purposes. Consent granted by the data subject may be revoked at any time. However, the collection and processing carried out until such revocation of consent remains lawful. 8. Automated individual decision-making incl. profiling pursuant to Article 22 GDPRThe data subject has the right not to be subjected to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her. This does not apply if the decision a) is necessary for entering into, or performance of, a contract between the data subject and us; b) is authorised by Union or Member State law to which we are subject and which also lays down suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests, or; c) is based on the explicit consent of the data subject. These decisions must not be based on special categories of personal data referred to in Article 9 para. 1, unless Article 9 para. 2 lit. a or lit. g applies and suitable measures to safeguard the rights, freedoms and legitimate interests of the data subject are in place. In the cases referred to in points a) and c), we will implement suitable measures to safeguard the rights, freedoms and legitimate interests of the data subject, at least the right to obtain human intervention on our part, to express his or her point of view and to contest the decision. 9. Right to lodge a complaint with a supervisory authority pursuant to Article 77 GDPRWithout prejudice to any other administrative or judicial remedy, every data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes the GDPR. The supervisory authority to whom the complaint was submitted shall advise the complainant on the status and the results of the complaint including the possibility of judicial remedy according to Article 78 GDPR. 10. Right to an effective judicial remedy pursuant to Article 79 GDPRWithout prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to Article 77 GDPR, each data subject has the right to an effective judicial remedy where he or she considers that his or her rights according to the GDPR have been infringed as a result of the processing of his or her personal data in non-compliance with the GDPR. Proceedings against us or a processor shall be brought before the courts of the Member State where we have or the processor has an establishment. Alternatively, such proceedings may be brought before the courts of the Member State where the data subject has his or her habitual residence, unless we are or the processor is a public authority of a Member State acting in the exercise of its public powers.