Data protection LANIUS Stores

I. Responsible body / contact persons

The responsible body within the meaning of the GDPR is:

Claudia Lanius GmbH, Rolandstr. 63, 50677 Cologne
Legal representative: Claudia Lanius (Managing Director)
Registration court: District Court of Cologne, HRB 113058

The LANIUS stores:

LANIUS Store Südstadt
Merowingerstrasse 7
50677 Cologne
Phone +49 (0) 2 21 - 93 290 52
TEAM-SUEDSTADT@LANIUS.COM

LANIUS Store Agnesviertel
Neusser Strasse 61
50670 Cologne
Tel. +49 (0) 2 21 – 78 900 86
TEAM-AGNESVIERTEL@LANIUS.COM

LANIUS Store Downtown
Apostelnstrasse 6
50667 Cologne
Tel. +49 (0) 2 21 – 25 09 97 66
TEAM-INNENSTADT@LANIUS.COM

If you have any questions about the processing of your personal data by us, about data protection in general and about asserting your rights as a data subject (e.g. requests for information, objections to advertising, revocation of consent), please contact the above address or the e-mail address datenschutz@lanius.com . If you require secure transmission, please contact us by post.

II. Your rights as a data subject:

As the person affected, you are entitled to the following rights in principle and, provided that contractual and legal obligations do not conflict with this:

• Right to information (Art. 15 GDPR) with the restrictions according to §§ 34, 35 BDSG;
• Right to rectification of inaccurate data (Article 16 GDPR);
• Right to erasure (Art. 17 GDPR) with the restrictions according to §§ 34, 35 BDSG;
• Right to restriction of processing of personal data (Article 18 GDPR);
• Right to data portability (Article 20 GDPR);
• Right to lodge a complaint with a data protection supervisory authority (Article 77 GDPR); the supervisory authority responsible for data protection for Claudia Lanius GmbH is the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia, Kavalleriestr. 2-4, 40213 Düsseldorf;
• Case-specific right of objection (Art. 21 (1) GDPR) for reasons arising from your particular situation and concerning data processing pursuant to Art. 6 (1) e) and Art. 6 (1) f) GDPR;
• Right to object to the processing of data for advertising purposes (Art. 21 (3) GDPR); You can object to the use of your data for advertising purposes at any time with effect for the future using the contact details provided above (see Section I).

If the data processing is based on consent, your consent can be revoked at any time with effect for the future.

To exercise your rights as a data subject, please use the contact details provided under Section I.

III. ON THE PROCESSING OF PERSONAL DATA BY LANIUS GMBH

Below we would like to give you an overview of how we ensure the protection of your personal data when you access our website and what types of personal data we process, for what purposes and to what extent.

1. Processing of data when accessing our website - log files

When you access our website, information of a general nature is automatically recorded. This information (server log files) includes the type of web browser, the operating system used, the domain name of your Internet service provider and similar. In addition, the IP address is transmitted and used to provide the service you have requested. This information is technically necessary in order to correctly deliver the content of websites you have requested and is mandatory when using the Internet.

We will anonymize or delete this log file data immediately after the end of the usage process. The legal basis for data processing is Art. 6 Para. 1 Clause 1 f) GDPR.

According to our IT security concept, the log file data is stored for a period of two weeks in order to detect and analyze any attacks against our website. The legal basis for data processing is Art. 6 Para. 1 Clause 1 f) GDPR].

The resulting log file data is stored under a pseudonym for a period of two years in order to optimize our website for marketing purposes and to suggest other products to website visitors that other customers have also shown interest in. The legal basis for data processing is Art. 6 Para. 1 Clause 1 f) GDPR].

2. Notes on ensuring data security

We take technical and operational security precautions on our website to protect the personal data stored by us from access by third parties, loss or misuse and to enable secure data transfer.

We must point out that the structure of the Internet can lead to unwanted access to data by third parties. It is therefore your responsibility to protect your data against misuse by encrypting it or by other means. Without appropriate protective measures, data transmitted unencrypted, even if sent by email, can be read by third parties.

III. End customers (consumers) and interested parties

No data collection or processing takes place in connection with cash purchases in the stores.

When using e-payment (e.g. EC, credit card), the personal data required for payment processing are processed. These include name, first name, IBAN, credit card number. The legal basis for this is the execution of the contract within the meaning of Art. 6 (1) b) GDPR.

If you wish to order and/or reserve certain goods, we will process the contact details you provide in order to inform you when the goods arrive. The legal basis for this is Art. 6 (1) b) GDPR. The data will be deleted after the goods have been picked up or purchased.

If you have decided to set up a customer account, LANIUS will process the data provided on the customer account application (name, email address, address, telephone number, date of birth) to inform you about special promotions and to send you invitations to events, birthday vouchers, bonus vouchers, etc. by post. You can also have your purchases posted to the customer account in order to receive a bonus voucher twice a year depending on your turnover. The legal basis for this is Art. 6 (1) f) GDPR and, in the case of your consent to receive the aforementioned promotions by email or to receive the newsletter with special offers, Art. 6 (1) a) GDPR.

Also within the framework of the balancing of interests pursuant to Art. 6 (1) f) GDPR to protect the legitimate interests of LANIUS, LANIUS processes your data, e.g. on the basis of existing contracts or requests for needs-based information on other services and goods (advertising) as part of postal advertising, provided that you have not objected to this processing. You can object to this advertising use at any time with effect for the future using the contact details above (see Section I.) (see Section II.).

IV. Contact requests

If you have any questions about Lanius, our products, projects or campaigns, you can contact us by email, letter or telephone. We will process your personal data depending on the subject of your inquiry. If necessary, we will also use personal data that has been stored in our systems as part of other data processing (e.g. data on previous inquiries or orders).

Depending on your request, the data will be processed for the purpose of initiating, executing or, if applicable, processing a contract with you on the basis of Art. 6 (1) b) GDPR, to fulfil our legal obligations towards you on the basis of Art. 6 (1) c) GDPR and/or due to our legitimate interest in answering your request on the basis of Art. 6 (1) f) GDPR.

The data will be deleted once your request/inquiry has been processed and no other retention obligations (e.g. according to the German Civil Code or the German Commercial Code) exist.

V. Recipients and categories of recipients of the data

Within LANIUS, only those departments that need your data to fulfill our contractual and legal obligations will have access to it. Service providers employed by LANIUS may also receive data for these purposes if they are commissioned as data processors in accordance with Art. 28 GDPR.

Possible recipients of personal data are, for example:

• public bodies and institutions (e.g. tax authorities, Federal Central Tax Office) if there is a legal or official obligation;
• other credit and financial services institutions;
• Contract processors for the support/maintenance of computer/IT applications, archiving, document processing, email sending, controlling, data screening in accordance with legal requirements, data destruction, auditing services and payment transactions;
• Postal and shipping service providers;
• Credit agencies in the context of a credit inquiry;
• other data recipients based on your consent.

VI. Transfer of data to a third country or an international organisation

Data will only be transferred to countries outside the EU or EEA (so-called third countries) if this is necessary to carry out your orders, is required by law (e.g. tax reporting obligations), you have given us your consent or as part of order data processing. If service providers are used in a third country, which is not currently the case, they are obliged to comply with the data protection level in Europe by taking appropriate measures (e.g. agreeing to the EU standard contractual clauses) in addition to written instructions.

VII. Duration of data storage

LANIUS processes and stores your personal data as long as it is necessary to fulfil our contractual and legal obligations and on the basis of the balance of interests. If the data is no longer required for this purpose, it is regularly deleted, unless its - limited - further processing is necessary for the following purposes:

• Compliance with retention periods under commercial and tax law (e.g. Commercial Code, Tax Code and Money Laundering Act with the periods specified therein for storage or documentation for a period of two to ten years, e.g. for business letters, contracts, orders);
• Preservation of evidence for a period of 30 years in accordance with Section 197 of the German Civil Code (BGB), e.g. in the context of legally established claims, claims arising from enforceable settlements or enforceable documents;
• Preservation of evidence for a period of 3 years in accordance with Section 195 of the German Civil Code (BGB) for verification purposes and any necessary clarification of judicial or extrajudicial claims (e.g. correspondence in the context of processing the rights of those affected).

VIII. Obligation to provide data

As part of our business relationship, you must provide the personal data that is necessary for establishing and conducting a business relationship and fulfilling the associated contractual obligations or that we are legally obliged to collect. Without this data, we will generally have to refuse to conclude the contract or execute the order or will no longer be able to execute an existing contract and may have to terminate it.

IX. Changes or additions to the information on data processing

LANIUS reserves the right to change or add to this information on data processing at any time in compliance with legal requirements. This may be the case, for example, to comply with new legal provisions or to take new services into account. We therefore recommend that you regularly inform yourself about our current data processing practices.

Status: January 2023