Avova GmbH with registered office at Blaubeurer Str. 71, 89077 Ulm, Germany, VAT ID DE 315 333 875 (hereinafter referred to as "Company" or "Data Controller"), as the controller for the processing of personal data, provides the following privacy policy in accordance with Article 13 of Regulation (EU) 2016/679 (hereinafter referred to as "GDPR") for the data subjects (hereinafter referred to as "Data Subjects").

As the data controller, the company is committed to protecting the confidentiality and rights of data subjects. The processing of the provided data is carried out in accordance with the principles of lawfulness, transparency, and fairness set out in the aforementioned regulation.

1. PURPOSE OF DATA PROCESSING

This privacy policy applies exclusively to the company's website and not to other websites that may be accessed via links. Data subjects may voluntarily provide their personal data, which will be processed and used by the company for the purposes related to the requested service and as described in the specific privacy notices on the respective pages of the website.

The company processes the personal data of the data subjects for purposes related to the provision of services in connection with the use of the website, in particular for:

• The provision of the services requested by the data subjects during navigation on the website, including the collection, storage and processing of data for the provision of the services and their subsequent operational and technical management.

This data, which is necessary for the provision of the service, is processed electronically, stored in specific databases and used exclusively in connection with the use of the website.

Since the provision of this personal data is necessary for the use of the services associated with the website, failure to provide the data will result in the respective services not being able to be provided.

The data controller may also process personal data of data subjects without their consent in the following cases:
a) For the aggregated and anonymous analysis of service usage to identify user habits and preferences, improve the services provided, and meet specific requirements of those affected.
b) To comply with legal regulations, national and international rules, or orders from judicial or other competent authorities.
c) To exercise the rights of the data controller, in particular with regard to the right to defend oneself in court.

The data processing is lawful because it serves to fulfill legal requirements and to exercise the rights of the data controller.

2. DATA PROCESSING METHOD

Data processing is carried out electronically and/or in paper form by recording, processing, archiving and transmitting the data, also using IT tools.

The tools and media used are suitable for ensuring the security and confidentiality of the data. The company commits to implementing the following measures within the framework of data processing:

• Ensuring the accuracy and updating of the processed data, as well as taking into account corrections and additions requested by the data subjects.
• Implementation of security measures to ensure adequate protection of data, particularly in view of potential impacts on the rights and freedoms of data subjects.
• Notification of affected individuals regarding potential data breaches, in accordance with legal requirements.
• Ensuring that data processing complies with applicable legal regulations.

3. TRANSMISSION AND DISCLOSURE OF INFORMATION

Without affecting the statutory notification obligations, the personal data of the data subjects may be processed by the following entities in addition to the data controller:

• Employees and agents of the data controller who are authorized to process personal data.
• National and international companies within the corporate group to which the data controller belongs.
• Authorities, public administrations and organizations, both national and international.
• Service provider.

The data is processed exclusively for the purposes mentioned above and in accordance with the consent given by the data subjects. Personal data will not be disclosed to the public.

4. TRANSFER OF DATA ABROAD

Personal data is stored and processed within the European Union.

In the event of processing outside the EU, this will only take place on the condition that appropriate safeguards have been put in place in accordance with the legal provisions.

5. DATA STORAGE PERIOD

The company stores personal data in such a way that the identification of the data subjects is possible, according to the following criteria:

• For a period that does not extend beyond the achievement of the processing purposes, unless other legal or contractual obligations exist.
• To comply with specific legal or contractual obligations.
• If applicable and legitimate, until a deletion request is made by the data subjects.

6. RIGHTS OF THE PERSONS AFFECTED

Data subjects may exercise their rights in accordance with applicable legislation, in particular Articles 15 to 22 of the GDPR, including:

• Right of access : Confirmation of the processing of personal data and access to information such as origin, purpose, recipients, etc.
• Right to rectification : Correction of inaccurate or completion of incomplete personal data.
• Right to erasure : Deletion of personal data if it is no longer necessary for the purposes of processing, consent has been withdrawn, the processing was unlawful, or legal obligations require erasure.
• Right to object : You have the right to object at any time to the processing of personal data based on the legitimate interests of the controller.
• Right to restriction of processing : In certain cases, e.g. in the case of disputed data or unlawful processing.
• Right to data portability : Transfer of personal data to another controller in a structured, machine-readable format.
• Right not to be subject to automated decisions : Protection against decisions based solely on automated processing, unless they are necessary for the performance of a contract or are based on consent.
• Right to lodge a complaint : You may lodge a complaint with a supervisory authority if there are violations of the GDPR.

To exercise their rights, affected individuals can:
(i) Submit requests to the data controller via the website or
(ii) contact the following address:

AVOVA GmbH
Blaubeurer Strasse 71
89077 Ulm
Commercial Register: HRB 736501
Commercial Register: Ulm
Represented by the Managing Director:
Joe Qiu

The subject line states "Data Protection".