The protection of your personal data is important to us. In the following sections we would like to inform you about the processing of personal data in the context of the use of our application (TetraPhos-app).

Controller

Controller in the sense of the GDPR for this application is

REMONDIS Aqua Stoffstrom GmbH & Co. KG
Brunnenstr. 138
44536 Lünen // Germany

Further company details, information about authorized representatives and additional contact information can be found in the imprint:
https://www.remondis-aqua.com/en/aq/imprint/

Purpose of data processing

As a basic principle we process your data only for the purpose that we received or collected it for. This may
be for the following purposes:

• Communication procedures
• Replying to inquiries
• Initiation and provision of services
• Initiation and processing of contracts
• Delivering videos

Processing of data for other purposes is only suitable if the legal requirements according to art. 6 para. 4 GDPR are existent. The obligation to inform according to art. 13 para. 13 and art. 14 para. 4 is taken into
account.

Legal foundation of data processing

As a basic principle the legal foundation of processing personal data is art. 6 GDPR, if there are no other specific legal provisions. If personal data is processed on the basis of your consent, you have the right to withdraw the consent at anytime with effect for the future. Especially the following comes into consideration:

• Art. 6 para. 1 p. 1 lit. a) GDPR
• Art. 6 para. 1 p. 1 lit. b) GDPR (contact form, provision of services and contracts)
• Art. 6 para. 1 p. 1 lit. c) GDPR
• Art. 6 para. 1 p. 1 lit. f) GDPR (contact form, delivering videos, IP-address)

If data is processed on the basis of art. 6 para. 1 lit. F) GDPR, the responsible party pursues the following legitimate interests: Communication procedures, if the concerned person is not a direct party of the initiated or existing contract. As a concerned person you have the right to object to the processing of your personal data under consideration of art. 21 GDPR, if we process data on the basis of weighing interests.

Categories of personal data

If the responsible party does not collect the data directly from communication with you, and therefore you know which data is concerned, please be advised that the responsible party regularly processes the following categories of personal data:

• Master data, such as company name, first and last name, professional qualification
• Contact details, such as address, phone- and fax number, e-mail address
• Contents of the communication
• Information about the involved parties, including details about legal representatives and beneficial owners
• Information about the case, including personal and financial details about the involved parties IP-
• IP-address of the device
• Position and motion of the device

Contact form/request for information

In the interest of communication with customers and interested parties, we offer a contact form in this application where you can request information about our products or contact us in general. In addition to the voluntary information (background (e.g. local authority, college, interested citizen), company name, street, house number, postal code, city, country, phone number) we require the following information from you:

• First name
• Last name
• E-Mail adress

We need this information to process your request, to contact you correctly and to send you an answer. Requests received via the contact form are stored as e-mails and regularly checked to see whether data can be deleted. Your data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected. For the personal data from the input mask of the contact form and those sent by e-mail, this is the case when the respective conversation with the user has ended. The conversation is ended when it is clear from the circumstances that the matter in question has been conclusively clarified. The legal basis for this data processing is Art. 6 para. 1 lit. f) GDPR. Insofar as contact is made to initiate contractual relations, the legal basis is Art. 6 para.1 lit. b) GDPR.

Collection of general information (server log files)

With each opening of a video in our application data and information from you are automatically stored in so called logfiles: These are set up according to a permanent pattern and contain the following general information:

Access-log

• IP-address
• Date and time of retrieval
• Request of the visitor (the http request method (GET), the requested file (robot.txt) and the version of the http protocol are shown)
• HTTP-status code, responded by the server
• File size of the response by the server in bytes
• HTTP-referrer, if set
• User–agent of the visitor
• Domain that the visitor called

Error-log

• Date and time of retrieval
• Web server module, where the error occurred
• Process id of the web server process
• IP-address
• Error code and error message

FTP-log

• FTP-commands
• FTP-user
• File size in bytes
• IP-address
• Date and time of retrieval
• File/directory that was edited

This data is not stored together with other personal data of the app user. The temporary storage of the IP- address is necessary to allow for delivering videos via our web server. The data is stored in logfiles to ensure the operability of the application. Furthermore the data helps us in optimizing and ensuring the security of our information technology. The data is not evaluated for marketing purposes in this context. The legal basis fort he temporary storage of data and logfiles is art. 6 para. 1 lit. f) GDPR. Collecting personal data and storing data in logfiles is essential for the operation of our application. Therefore users cannot object. If your data is stored in logfiles, we will delete it not later than after 14 days. Storing data beyond that is possible, however
the user’s IP-address will be deleted or renderes anonymous so the device cannot be identified.

Authorization

To activate the AR mode access to the camera is necessary. Camera access can only be activated after the privacy policy was confirmed. Furthermore the user has to allow read and write access in order to save user input (concerning accepting the privacy policy and choice of German or English language).

Recipient of personal data

• Responsible party, in particular the department’s staff
• Processors, i.e. companies which treat data according to the orders of the responsible party due to contractual obligation
• Hosting-provider (HostEurope), i.e. a provider of our web server
• E-mail provider (Google Gmail) for using the contact form

Data transfer to third parties and outside the EU

We only transfer your personal data to third parties if you have consented to the transfer, if the transfer is necessary for the execution of the offers or services that you wish to make use of, if the transfer is allowed on the basis of weighing interests according to art. 6 para. 1 lit f) GDPR or if a legal authority for transfer exists. If data is transferred to a third party state outside the EU, an adequate level of data protection is guaranteed by EU standard data protection clauses. Please be advised that individual service providers process your data in the USA. The European Court of Justice considers the USA a country with an unsufficient level of data protection according to EU standards. In particular there is a risk of US authorities processing your data for
controlling and monitoring purposes, potentially without means of redress.

Use of Gmail

To process contact inquiries via our contact form we use Gmail, the e-mail client from Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. No data from the contact form is stored on the device but directly sent through the Gmail API. Google does not have immediate access to the contents of the communication which are encrypted at transmission and reception.

The data entered in the contact form is stored in Gmail to process your inquiry and in case of follow-up requests. EU standard data protection clauses according to art. 46 para. 2 lit. c) GDRP were agreed upon by Google and the responsible party. Hereby Google guarantees for the compliance with EU data protection requirements when data is processed in the USA. These terms can be found here:

• https://workspace.google.com/terms/mcc_terms.html
• https://workspace.google.com/terms/dpa_terms.html

The legal basis for this processing is art. 6 para. 1 lit. f) GDPR. In this case our legitimate interest is the processing of your inquiries. If contact is established to initiate a contract, the legal basis is art. 6 para. 1 lit. b) GDPR.

Further information about data protection at Google can be found here: https://policies.google.com/privacy

Duration of data storage

Your data will be deleted as soon as it is no longer required for the purpose of ist collection. For personal data from the contact form or received via e-mail this is the case, when the conversation with the user has ended. A conversation has ended when it can be assumed that the matter was solved finally.

The data collected during transmission will be deleted no later than after seven days.

In concrete terms your data will be deleted after the following storage terms:

• Personal data in context of delivering videos will not be stored
• Access-logfiles 14 days
• Error-logfiles 7 days
• FTTP-logfiles 7 days
• Processing by e-mail client (Google Gmail) 30 days

Your rights as a data subject

Upon request, we will provide you with written or electronic information as to whether and which of your personal data is stored with us (art. 15 GDPR) and we will check your entries for deletion (art. 17 GDPR), correction (art. 16 GDPR), restriction of processing (art. 18 GDPR) and transfer (art. 20 GDPR) of your personal data and execute them if the conditions are met. For this purpose, please contact our data protection officer.

The same applies if you have given your consent to the collection or use of personal data and wish to revoke this consent. You can revoke such consent at any time with effect for the future by email or post.

In particular you have the right to object against the processing of your data in the context of advertisement according to art. 21 para. 1 and 2 GDPR.

We do not execute automated decision-making in the context of using the application.

Data protection officer

You can contact our data protection officer via:

REMONDIS Aqua Stoffstrom GmbH & Co. KG
- Data Protection Officer –
Brunnenstr. 138
44536 Lünen
datenschutz-aqua@remondis.de

Right to complain

If you believe that the processing of your personal data is unlawful, you can complain to a supervisory authority. The authority in charge is the Landesbeauftragte für Datenschutz und Informationsfreiheit in Nordrhein- Westfalen. The authority can ce contacted via:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Helga Block
Dienststelle
Kavalleriestraße 2-4
40213 Düsseldorf

Telefon: +49211 38424-0
Telefax: +49211 38424-10

E-Mail: poststelle@ldi.nrw.de
Web: https://www.ldi.nrw.de