Data protection

1 Introduction

Below, we provide information about the processing of personal data when using

• our website www.surein.de

• our profiles in social media.

Personal data includes all data that can be related to a specific natural person, such as their name or IP address.

1.1 Contact details

Controller according to Art. 4 para. 7 EU General Data Protection Regulation (GDPR) is SureIn GmbH (limited liability), Wattstrasse 11, 13355 Berlin, e-mail: info@surein.de. We are legally represented by Daniel Dierkes, David Schara, and Maximilian Geißinger. Our data protection officer is heyData GmbH, Kantstr. 99, 10627 Berlin, www.heydata.eu, e-mail: datenschutz@heydata.eu.

1.2 Scope of data processing

Purposes and legal bases as well as the scope of data processing, purposes and legal bases are detailed below. As a legal basis for data processing, the following generally apply:

• Art. 6 para. 1 sentence 1 lit. a GDPR serves as the legal basis for processing operations for which we obtain consent.

• Art. 6 para. 1 sentence 1 lit. b GDPR is the legal basis insofar as the processing of personal data is necessary for the performance of a contract, e.g. when a visitor to our site purchases a product from us or we provide a service for him. This legal basis also applies to processing that is necessary for pre-contractual measures, such as inquiries about our products or services.

• Art. 6 para. 1 sentence 1 lit. c GDPR applies when we fulfill a legal obligation by processing personal data, as may be the case, for example, in tax law.

• Art. 6 para. 1 sentence 1 lit. f GDPR serves as the legal basis when we can rely on legitimate interests for the processing of personal data, e.g. for cookies that are necessary for the technical operation of our website.

1.3 Data processing outside the EEA

To the extent that we transfer data to service providers or other third parties outside the EEA, we guarantee the security of the data when transferred, provided that (e.g. for Great Britain, Canada, and Israel) adequacy decisions of the EU Commission (Art. 45 para. 3 GDPR) exist. If there is no adequacy decision (e.g. for the USA), the legal basis for data transfer is usually, when we do not provide a different indication, standard contractual clauses. These are a set of contractual rules adopted by the EU Commission and a part of the contract with the respective third party. According to Art. 46 para. 2 lit. b GDPR, they ensure the security of the data transfer. Many of the providers have given contractual guarantees beyond the standard contractual clauses to protect the data beyond the standard contractual clauses. These are, for example, guarantees regarding the encryption of the data or regarding an obligation of third parties to notify the data subjects if law enforcement authorities want to access the data.

1.4 Storage period

Unless expressly stated in this data protection declaration, the data stored by us will be deleted as soon as it is no longer required for its intended purpose and there are no legal retention obligations preventing its deletion. If the data is not deleted because it is required for other legally permissible purposes, its processing will be restricted, i.e. the data will be blocked and not processed for other purposes. This applies, for example, to data that we are required to retain for commercial or tax law reasons.

1.5 Rights of the data subjects

Related persons have the following rights with regard to their personal data:

• Right to information,

• Right to correction or deletion,

• Right to restriction of processing,

• Right to object to processing,

• Right to data portability,

• Right to revoke consent at any time.

Related persons also have the right to complain to a data protection supervisory authority about the processing of their personal data.

1.6 Obligation to provide data

Customers, prospective customers, or third parties must provide us with only those personal data that are necessary for the establishment, implementation, and termination of the business relationship or other relationship, or for the collection of which we are legally obligated. Without this data, we will generally have to refuse to conclude a contract or provide a service or will no longer be able to carry out an existing contract or other relationship. Mandatory information is marked as such.

1.7 No automatic individual decision making

We generally do not use fully automated decision-making processes to establish and implement a business relationship or other relationship in accordance with Article 22 GDPR. If we use these procedures in individual cases, we will inform about it separately, if required by law.

1.8 Contact

When contacting us, e.g. by e-mail or telephone, the data provided to us (e.g. names and e-mail addresses) will be stored by us to answer questions. The legal basis for processing is our legitimate interest (Art. 6 para. 1 sentence 1 lit. f GDPR) in answering inquiries addressed to us. We delete the data that arise in this context as soon as storage is no longer necessary, or we restrict processing if there are legal retention obligations.

1.9 Customer surveys

From time to time, we conduct customer surveys to get to know our customers and their wishes better. In doing so, we collect the data that is queried. It is our legitimate interest to get to know our customers and their wishes better, so the legal basis for the associated data processing is Art. 6 para. 1 sentence 1 lit f GDPR. We delete the data when the results of the surveys have been evaluated.

2 Newsletter

We reserve the right to inform customers who have already used our services or purchased goods from us by e-mail or other electronic means about our offers from time to time, provided they have not objected to this. The legal basis for this data processing is Art. 6 para. 1 sentence 1 lit. f GDPR. Our legitimate interest lies in direct advertising (Recital 47 GDPR). Customers can object to the use of their e-mail address for advertising purposes at any time at no additional cost, for example, via the link at the end of each e-mail or by e-mail to our aforementioned e-mail address. Based on the consent of the recipients (Art. 6 para. 1 sentence 1 lit. a GDPR), we also measure the opening and click rates of our newsletters to understand which content is relevant to our recipients. We send newsletters with the following tools

• SendGrid and Twilio of the provider Twilio, Inc., 375 Beale Street, Suite 300, San Francisco, CA 94105, USA (Privacy Policy: https://www.twilio.com/legal/privacy)

• Mailchimp of the provider Rocket Science Group LLC, 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308, USA (Privacy Policy: https://mailchimp.com/legal/privacy/). The provider processes content, usage, meta/communication data, and contact data in the USA.

• Intercom of the provider R&D Unlimited Company 2nd Floor, Stephen Court, 18-21 St. Stephen's Green, Dublin 2, Ireland (Privacy Policy: https://www.intercom.com/legal/privacy).

The providers process content, usage, meta / communication data, and contact data in the USA.

3 Data processing on our website

3.1 Informational use of the website

When using the website for information purposes, i.e. when visitors do not separately provide us with information, we collect the personal data that the browser transmits to our server to ensure the stability and security of our website. This is our legitimate interest, so the legal basis is Art. 6 para. 1 sentence 1 lit. f GDPR. These data are:

• IP address

• Date and time of the request

• Time zone difference to Greenwich Mean Time (GMT)

• Content of the request (specific page)

• Access status/HTTP status code

• amount of data transmitted in each case

• Website from which the request comes

• Browser

• Operating system and its interface

• Language and version of browser software.

These data are also stored in log files. They are deleted as soon as their storage is no longer necessary, but at the latest after 14 days.

3.2 Web hosting and provision of the website

Our website is hosted by Bubble Group, Inc. 61 Regent Street, Cambridge CB2 1AB, UK. The provider processes the personal data transmitted via the website, such as content, usage, meta/communication data, or contact data. It is our legitimate interest to provide a website, so the legal basis for data processing is Art. 6 para. 1 sentence 1 lit. f GDPR.

3.3 Contact form

When contacting us via the contact form on our website, we store the data requested there and the content of the message. The legal basis for processing is our legitimate interest in answering inquiries addressed to us. The legal basis for processing is therefore Art. 6 para. 1 sentence 1 lit. f GDPR. We delete the data that arise in this context as soon as storage is no longer necessary, or we restrict processing if there are legal retention obligations.

3.4 Job advertisements

We publish job vacancies in our company on our website, on pages connected to the website, or on third-party websites. The processing of the data provided in the context of the application is carried out for the purpose of conducting the application process. Insofar as these data are necessary for our decision to establish an employment relationship, the legal basis is Art. 88 para. 1 GDPR in conjunction with § 26 para. 1 BDSG. We have marked or pointed out the data required for the application process. If applicants do not provide this data, we cannot process the application. Further data are voluntary and not necessary for an application. If applicants provide further information, their consent (Art. 6 para. 1 sentence 1 lit. a GDPR) is the basis. We ask applicants to refrain from providing information about political opinions, religious beliefs, and similarly sensitive data in their resumes and cover letters. This is not necessary for an application. If applicants nevertheless provide such information, we cannot prevent their processing within the framework of processing the resume or cover letter. Their processing is then also based on the consent of the applicants (Art. 9 para. 2 lit. a GDPR). Finally, we process the data of the applicants for further application processes if they have given us their consent to do so. In this case, the legal basis is Art. 6 para. 1 sentence 1 lit. a GDPR. We pass on the data of the applicants to the responsible employees of the HR department, to our processors in the area of recruiting, and to the other employees involved in the application process. If we enter an employment relationship with the applicant after the application process, we will only delete the data after the employment relationship has ended. Otherwise, we delete the data no later than six months after rejection of an applicant. If applicants have given us their consent to use their data for further application processes, we will only delete their data one year after receiving the application.

3.5 Booking of appointments

Visitors to our website can book appointments with us. We process meta- or communication data in addition to the entered data. We have a legitimate interest in offering interested parties a user-friendly way to make appointments, so the legal basis for data processing is Art. 6 para. 1 sentence 1 lit. f GDPR. If we use a third-party tool for the agreement, information about it can be found under 'Third-party providers'.

3.6 Single-Sign-On process

Visitors to our website can log in using the single sign-on process. They use the login data already created for another provider. The prerequisite is that the visitor has already registered with the respective provider. If a visitor logs in using the single sign-on process, we receive information from the provider that the visitor is logged in to the provider and the provider receives information that the visitor is using the single sign-on process on our website. Depending on the settings of the visitor in his account on the provider's page, it may be that the provider provides us with additional information. The legal basis of this agreement are the usage agreements between the visitors and the provider. The providers are:

• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Privacy Policy: https://policies.google.com/privacy).

• Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland (“Facebook“).

Visitors receive information about what data we receive from Facebook in the course of the registration process from Facebook. Information about Facebook and the contact details of the data protection officer as well as further information on how Facebook processes personal data, including the legal basis and the options for exercising rights as data subjects against Facebook, can be found at https://www.facebook.com/about/privacy. We are jointly responsible with Facebook for the data processing that takes place when using the process. We have concluded an agreement on joint responsibility (Art. 26 GDPR) with Facebook, in which we have defined the respective responsibilities for fulfilling the obligations under the GDPR regarding joint processing. We are obligated to provide the above information, and Facebook has assumed responsibility for the other data subject rights according to Art. 15-20 GDPR.

3.7 Data processing for insurance mediation

We mediate insurance for customers. To do this, we process the following data:Contact details: name, address, date of birth, age, telephone number, e-mail addressBank account dataData related to your company: date of establishmentnumber of employees (full-time and part-time)estimated earnings and salesSecurity of the location to be insured

Data related to insurance:Application data (data provided by you with the application for insurance)Contract data for a specific contract (such as insurance policy number, sum insured, term, premium, risk)Performance data (insurance cases, data in the event of the occurrence of damage or the need for performance)The described processing is necessary for the implementation of the brokerage contract. The legal basis is Art. 6 para. 1 sentence 1 lit. b GDPR.

3.8 Technically necessary cookies

Our website uses cookies. Cookies are small text files that are stored in the web browser on the end device of a visitor. Cookies help to make the offer more user-friendly, effective, and secure. Insofar as these cookies are necessary for the operation of our website or its functions (hereinafter referred to as “Technically necessary cookies”), the legal basis for the associated data processing is Art. 6 para. 1 sentence 1 lit. f GDPR. We have a legitimate interest in providing customers and other visitors with a functional website. In concrete terms, we use technically necessary cookies for the following purpose or purposes:Cookies that take over language settingsCookies that save log-in data

3.9 Third-party providers

3.9.1 Hotjar

We use Hotjar for analysis. The provider is Hotjar Ltd., Dragonara Business Centre, 5th Floor, Dragonara Road, Paceville St Julian's, STJ 3141, Malta. The provider processes usage data (e.g. visited web pages, interest in content, access times) and meta/communication data (e.g. device information, IP addresses) in the EU. The legal basis for processing is Art. 6 para. 1 sentence 1 lit. a GDPR. Processing is based on consents. Data subjects can revoke their consent at any time by contacting us, for example, using the contact details provided in our data protection declaration. The revocation does not affect the legality of the processing carried out until the revocation. We delete the data when the purpose of its collection ceases. Further information can be found in the provider's privacy policy at https://www.hotjar.com/legal/policies/privacy/.

3.9.2 Facebook Custom Audiences

We use Facebook Custom Audiences for advertising. The provider is Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. The provider processes usage data (e.g. visited web pages, interest in content, access times) in the USA.The legal basis for processing is Art. 6 para. 1 sentence 1 lit. a GDPR. The processing is based on consents. Data subjects can revoke their consent at any time by contacting us, for example, using the contact details provided in our data protection declaration. The revocation does not affect the legality of the processing carried out until the revocation.The legal basis for the transfer to a country outside the EEA is standard contractual clauses. The security of the data transmitted to a third country (i.e. a country outside the EEA) is guaranteed by standard data protection clauses issued in accordance with the examination procedure under Art. 93 para. 2 GDPR (Art. 46 para