1. information on the collection of personal data and contact details of the person responsible.

1.1 We are pleased that you are visiting our website and thank you for your interest. In the following, we inform you about the handling of your personal data when using our website. Personal data is any data that can be used to identify you personally.

1.2 The controller of data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is refine tech GmbH, Kaiser-Wilhelm-Ring 3-5, 50672 Cologne, Germany, Tel.: +49 221 99994600, e-mail: hello@refinemate.de. The controller of personal data is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.

1.3 This website uses SSL or TLS encryption for security reasons and to protect the transmission of personal data and other confidential content (e.g. orders or inquiries to the person responsible). You can recognize an encrypted connection by the string "https://" and the lock symbol in your browser line.

‍

2. data collection when visiting our website

During the mere informational use of our website, i.e. if you do not register or otherwise transmit information to us, we only collect data that your browser transmits to our server (so-called "server log files"). When you call up our website, we collect the following data, which is technically necessary for us to display the website to you:

• Our visited website
• Date and time at the time of access
• Amount of data sent in bytes
• Source/reference from which you reached the page
• Browser used
• Operating system used
• IP address used (if applicable: in anonymized form)

‍

The processing is carried out in accordance with Art. 6 para. 1 lit. f DSGVO on the basis of our legitimate interest in improving the stability and functionality of our website. A transfer or other use of the data does not take place. However, we reserve the right to check the server log files retrospectively if there are concrete indications of illegal use.

3. hosting & content delivery network

3.1 Hosting by Webflow

We use the website building system of Webflow, Inc, 398 11th Street, 2nd Floor, San Francisco, CA 94103, USA ("Webflow"), for the purpose of hosting and displaying the site content on the basis of processing on our behalf.

All data collected on our website is processed on Webflow's servers. Within the scope of the aforementioned services of Webflow, data may also be transmitted to Webflow servers in the USA. For further information on Webflow's data protection, please visit the following website: https://webflow.com/legal/privacy.

Further processing on other servers than the aforementioned ones of Webflow will only take place within the framework communicated below.

3.2 Cloudflare

On our website, we use a so-called Content Delivery Network ("CDN") of the technology service provider Cloudflare Inc, 101 Townsend St. San Francisco, CA 94107, USA ("Cloudflare"). A content delivery network is an online service that is used in particular to deliver large media files (such as graphics, page content or scripts) through a network of regionally distributed servers connected via the Internet. The use of Cloudflare's Content Delivery Network helps us optimize the loading speeds of our website.

The processing is carried out pursuant to Art. 6 para. 1 lit. f DSGVO on the basis of our legitimate interest in a secure and efficient provision, as well as improvement of the stability and functionality of our website.

We have concluded an order processing agreement with Cloudfare (Data Processing Addendum, available at

https://www.cloudflare.com/media/pdf/cloudflare-customer-dpa.pdf), with which Cloudfare is obligated to protect the data of our site visitors and not to pass it on to third parties. For the transfer of data from the EU to the USA, Cloudfare relies on so-called standard data protection clauses of the European Commission, which are intended to ensure compliance with the European level of data protection in the USA.

For more information, please see Cloudflare's privacy policy at: https://www.cloudflare.com/privacypolicy/

‍

4. cookies

In order to make visiting our website more attractive and to enable the use of certain functions, we use so-called cookies on various pages. These are small text files that are stored on your terminal device. Some of the cookies we use are deleted after the end of the

browser session, i.e. after closing your browser, is deleted again (so-called.

Session cookies). Other cookies remain on your terminal device and enable us or our partner companies (third-party cookies) to recognize your browser on your next visit (persistent cookies). Are cookies set,

collect and process certain user information to an individual extent, such as browser and location data as well as IP address values. Persistent cookies are automatically deleted after a specified period of time, which may differ depending on the cookie.

If personal data is also processed by individual cookies implemented by us, the processing is carried out in accordance with Art. 6 (1) lit. b DSGVO either for the execution of the contract or in accordance with Art. 6 (1) lit. f DSGVO to protect our legitimate interests in the best possible functionality of the website as well as a customer-friendly and effective design of the page visit.

We may work with advertising partners who help us to make our website more interesting for you. For this purpose, cookies from partner companies are also stored on your hard drive when you visit our website (third-party cookies). If we cooperate with aforementioned advertising partners, you will be informed individually and separately about the use of such cookies and the scope of the information collected in each case within the following paragraphs.

Please note that you can set your browser so that you are informed about the setting of cookies and can decide individually about their acceptance or exclude the acceptance of cookies for certain cases or in general. Each browser differs in the way it manages cookie settings. This is described in the help menu of each browser, which explains how you can change your cookie settings. You can find these for the respective browsers under the following links:

Microsoft Edge:

https://support.microsoft.com/de-de/microsoft-edge/temporäres-zulassen-von-cookies-u  nd-website-daten-in-microsoft-edge-597f04f2-c0ce-f08c-7c2b-541086362bd2

Firefox: https://support.mozilla.org/de/kb/cookies-erlauben-und-ablehnen Chrome:

http://support.google.com/chrome/bin/answer.py?hl=de&hlrm=en&answer=95647 Safari: https://support.apple.com/de-de/guide/safari/sfri11471/mac

Opera: http://help.opera.com/Windows/10.20/de/cookies.html

‍

Please note that if you do not accept cookies, the functionality of our website may be limited.

‍

5. contact

5.1 Calendly

This website uses the "Calendly" software of the provider Calendly, LLC, BB&T Tower, 271 17th St NW, Atlanta, GA 30363, USA to provide an online appointment booking function.

For the purpose of assigning appointments, first and last name as well as e-mail address (and telephone number, if applicable, if a telephone appointment has been made) are recorded in accordance with Art. 6 Para. 1 lit. b DSGVO.

appointment is desired) and transmitted to Calendly pursuant to Art. 6 para. 1 lit. f DSGVO on the basis of our legitimate interest in effective customer management and efficient appointment management and stored there for the appointment organization. After the appointment has been held or after the agreed appointment period has expired, your data will be deleted by Calendly. We have concluded an order processing agreement with Calendly ("Data Processing Addendum", available at https://calendly.com/pages/dpa), in which we oblige Calendly to protect the data of our customers in accordance with the legal requirements. Calendly generally transfers collected information outside the European Economic Area and relies on so-called standard data protection clauses of the European Commission, which are intended to ensure compliance with the European level of data protection.

Details of Calendly's privacy policy can be found here: https://calendly.com/de/pages/privacy

5.2 Personal data is collected when contacting us (e.g. via contact form or e-mail). Which data is collected when using a contact form can be seen from the respective contact form. This data is stored and used exclusively for the purpose of responding to your request or for contacting you and the associated technical administration. The legal basis for the processing of this data is our legitimate interest in responding to your request in accordance with Art. 6 (1) lit. f DSGVO. If your contact aims at the conclusion of a contract, the additional legal basis for the processing is Art. 6 (1) lit. b DSGVO. Your data will be deleted after final processing of your request. This is the case when the circumstances indicate that the matter in question has been conclusively clarified and provided that there are no statutory retention obligations to the contrary.

‍

6. use of customer data for direct advertising

6.1 Sending the e-mail newsletter to existing customers

‍

If you have provided us with your e-mail address when purchasing goods or services, we reserve the right to regularly send you offers for similar goods or services, such as those already purchased, from our range by e-mail. In accordance with Section 7 (3) of the German Unfair Competition Act (UWG), we do not need to obtain your separate consent for this. In this respect, the data processing is carried out solely on the basis of our legitimate interest in personalized direct advertising in accordance with Art. 6 Para. 1 lit. f DSGVO. If you have initially objected to the use of your e-mail address for this purpose, no e-mails will be sent by us. You are entitled to object to the use of your e-mail address for the aforementioned advertising purpose at any time with effect for the future by notifying the responsible person named at the beginning. For this, you will only incur transmission costs according to the prime rates. After receipt of your objection, the use of your

E-mail address for advertising purposes immediately discontinued.

‍

6.2 Newsletter dispatch via Klaviyo

The dispatch of our e-mail newsletter is carried out by the technical service provider

"Klaviyo", 225 Franklin St, Boston, MA 02110, USA https://www.klaviyo.com, to whom we pass on the data you provided when registering for the newsletter. This transfer takes place in accordance with Art. 6 para. 1 lit. f GDPR and serves our legitimate interest in using an effective, secure and user-friendly newsletter system. Please note that your data is usually transferred to a Klaviyo server in the USA and stored there.

Klaviyo uses this information to send the newsletter on our behalf. Klaviyo does not use the data of our newsletter recipients to write to them itself or to pass it on to third parties.

To protect your data in the U.S., we have a data processing agreement with Klaviyo ("Data Processing Agreement"), in which Klaviyo undertakes to protect the data of our users, to process it on our behalf in accordance with its data protection provisions and, in particular, not to pass it on to third parties.

You can view Klaviyo's privacy policy here: https://www.klaviyo.com/privacy

‍

7. web analytics services

7.1 Google Analytics 4

This website uses Google Analytics 4, a service provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"), to analyze the use of websites.

When using Google Analytics 4, so-called "cookies" are used by default. Cookies are text files that are stored on your terminal device and enable an analysis of your use of a website. The information collected by cookies about your use of the website (including the IP address transmitted by your terminal device, shortened by the last digits, see below) is usually transmitted to a Google server and stored and processed there.

This may also result in the transmission of information to the servers of the company Google LLC, which is based in the USA, and further processing of the information there.

When using Google Analytics 4, the IP address transmitted by your terminal device when you use the website is always collected and processed by default and automatically only in an anonymized manner, so that a direct personal reference of the collected information is excluded. This automatic anonymization is carried out by Google shortening the IP address transmitted by your terminal device within member states of the European Union (EU) or other contracting states of the Agreement on the European Economic Area (EEA) by the last digits.

On our behalf, Google uses this and other information to evaluate your use of the website, to compile reports about your website activities and usage behavior, and to provide us with other services related to your website and internet usage. In doing so

the shortened IP address transmitted by your terminal device as part of Google Analytics 4 will not be merged with other Google data. The data collected in the context of the use of Google Analytics 4 will be retained for 2 months and then deleted.

Google Analytics 4 also enables the creation of statistics with statements about the age, gender and interests of website users on the basis of an evaluation of interest-based advertising and with the involvement of third-party information via a special function, the so-called "demographic characteristics". This makes it possible to determine and distinguish user groups of the website for the purpose of targeting marketing measures.

However, data collected via the "demographic characteristics" cannot be assigned to a specific person and thus also not to you personally. This data collected via the "demographic characteristics" function is retained for two months and then deleted.

All processing described above, in particular the setting of Google Analytics cookies for the storage and reading of information on the terminal device used by you for the use of the website, will only take place if you have given us your express consent for this in accordance with Art. 6 (1) lit. a DSGVO. Without your consent, Google Analytics 4 will not be used during your use of the website. You can revoke your consent once given at any time with effect for the future. To exercise your revocation, please deactivate this service via the "cookie consent tool" provided on the website.

In connection with this website, the "UserIDs" function is also used as an extension of Google Analytics 4. By assigning individual UserIDs, we can have Google create cross-device reports (so-called "cross-device tracking"). This means that your usage behavior can also be analyzed across devices if you have given your corresponding consent to the use of Google Analytics 4 in accordance with Art. 6 (1) lit. a DSGVO, if you have set up a personal account by registering on this website and are logged into your personal account on different end devices with your relevant login data. The data collected in this way shows, among other things, on which end device you clicked on an ad for the first time and on which end device the relevant conversion took place.

In connection with this website, the Google Signals service is also used as an extension of Google Analytics 4. With Google Signals, we can have Google create cross-device reports (so-called "cross-device tracking"). Provided that in your settings in your Google account you have enabled the

If you have activated "personalized ads" and linked your Internet-enabled end devices to your Google account, Google may analyze usage behavior across devices and create database models based on this if you have given your consent to the use of Google Analytics 4 in accordance with Art. 6 (1) a DSGVO. The logins and device types of all website users who were logged into a Google account and executed a conversion are taken into account. The data shows, among other things, on which device you clicked on an ad for the first time and on which device the relevant conversion takes place.

is. We do not receive any personal data from Google in this context, but only statistics compiled on the basis of Google Signals. You have the option of deactivating the "personalized ads" function in the settings of your Google account and thus turning off the cross-device analysis in connection with Google Signals. To do this, follow the instructions on this page: https://support.google.com/ads/answer/2662922?hl=de

Further information about Google Signals can be found at the following link: https://support.google.com/analytics/answer/7532985?hl=de

We have concluded a so-called order processing agreement with Google for our use of Google Analytics 4, which obliges Google to protect the data of our website users and not to pass it on to third parties.

To ensure compliance with the European level of data protection also in the event of any transfer of data from the EU or the EEA to the USA and the possible further processing there, Google invokes the so-called "data protection laws".

Standard Contractual Clauses of the European Commission, which we have contractually agreed with Google.

Further legal information on Google Analytics 4, including a copy of the aforementioned standard contractual clauses, can be found at the following link: https://policies.google.com/privacy?hl=de&gl=de

Details about the processing triggered by Google Analytics 4 and Google's handling of data from websites can be found here: https://policies.google.com/technologies/partner-sites

7.hotjar (hotjar Ltd.)

This website uses the web analytics service Hotjar provided by Hotjar Ltd. Hotjar Ltd is a European company based in Malta (Hotjar Ltd, Level 2, St Julians Business Centre, 3, Elia Zammit Street, St Julians STJ 1000, Malta, Europe Tel: +1 (855)

464-6788).

This tool can be used to track movements on the websites on which Hotjar is used (so-called heat maps). For example, it is possible to see how far users scroll and how often they click on which buttons. Furthermore, with the help of the tool it is also possible to obtain feedback directly from the users of the website. In this way, we obtain valuable information to make our websites even faster and more customer-friendly. We pay particular attention to the protection of your personal data when using this tool. For example, we can only track which buttons you click and how far you scroll. Areas of the websites in which personal data of you or third parties are displayed are automatically hidden by Hotjar and are therefore not traceable at any time.

All processing described above, in particular the reading of information on the end device used, is only carried out if you have given us your express consent to do so in accordance with Art. 6 (1) a DSGVO. Without this consent, Hotjar will not be used during your visit to the site. You can revoke your consent at any time with effect for the future.

In order to exercise your revocation, please deactivate this service in the on the

Website provided "Cookie Consent Tool".

Alternatively, Hotjar offers every user the possibility to delete a file with the help of a "Do Not

Track-Headers" to prevent the use of the Hotjar tool, so that no data about the visit to the respective website is recorded. This is a setting that supports all common browsers in the respective current version. For this purpose, your browser sends a request to Hotjar with the instruction to deactivate the tracking of the respective user. If you use our website with different browsers/computers, you must set up the "Do Not Track header" separately for each of these browsers/computers.

Detailed instructions with information about your browser can be found at: https://www.hotjar.com/de/legal/policies/do-not-track/

For more information about Hotjar Ltd. and about the Hotjar tool, please visit: https://www.hotjar.com

The privacy policy of Hotjar Ltd. can be found at: https://www.hotjar.com/privacy

‍

8. tools and other

Cookie Consent Tool

‍

This website uses a so-called "cookie" to obtain effective user consent for cookies and cookie-based applications that require consent.

"Cookie Consent Tool. The "Cookie Consent Tool" is displayed to users in the form of an interactive user interface when they call up the page, on which consent for certain cookies and/or cookie-based applications can be given by setting a check mark. By using the tool, all cookies/services requiring consent are only loaded if the respective user grants the corresponding consent by setting a check mark. This ensures that such cookies are only set on the respective user's end device if consent has been granted.

The tool sets technically necessary cookies to save your cookie preferences. Personal user data is not processed in this process.

If, in individual cases, personal data (such as the IP address) is processed for the purpose of storing, assigning or logging cookie settings, this is done in accordance with Art. 6 (1) f DSGVO on the basis of our legitimate interest in legally compliant, user-specific and user-friendly consent management for cookies and thus in a legally compliant design of our website.

Further legal basis for the processing is Art. 6 para. 1 lit. c DSGVO. As the responsible party, we are subject to the legal obligation to make the use of technically unnecessary cookies dependent on the respective user consent. Further information about the operator and the setting options of the

Cookie consent tools can be found directly in the corresponding user interface on our website.

9. rights of the data subject

9.1 The applicable data protection law grants you the following data subject rights (rights of information and intervention) vis-à-vis the controller with regard to the processing of your personal data, whereby reference is made to the stated legal basis for the respective exercise prerequisites:

• Right to information according to Art. 15 DSGVO;
• Right to rectification pursuant to Art. 16 DSGVO;
• Right to erasure pursuant to Art. 17 DSGVO;
• Right to restriction of processing pursuant to Art. 18 DSGVO;
• Right to information pursuant to Art. 19 GDPR;
• Right to data portability according to Art. 20 DSGVO;
• Right to revoke consent given in accordance with Art. 7 (3) DSGVO;
• Right to lodge a complaint pursuant to Art. 77 GDPR.

‍

9.2 RIGHT OF OBJECTION

‍

IF WE PROCESS YOUR PERSONAL DATA IN THE CONTEXT OF A BALANCING OF INTERESTS ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTEREST, YOU HAVE THE RIGHT TO OBJECT TO THIS PROCESSING WITH EFFECT FOR THE FUTURE AT ANY TIME ON GROUNDS ARISING FROM YOUR PARTICULAR SITUATION.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED. HOWEVER, WE RESERVE THE RIGHT TO CONTINUE PROCESSING IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR PROCESSING THAT OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FREEDOMS, OR IF THE PROCESSING IS FOR THE PURPOSE OF ASSERTING, EXERCISING OR DEFENDING LEGAL CLAIMS.

IF WE PROCESS YOUR PERSONAL DATA FOR THE PURPOSE OF DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF YOUR PERSONAL DATA FOR THE PURPOSE OF SUCH MARKETING. YOU MAY EXERCISE THE OBJECTION AS DESCRIBED ABOVE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED FOR DIRECT MARKETING PURPOSES.

‍

10. duration of the storage of personal data

The duration of the storage of personal data is determined on the basis of the respective legal basis, the purpose of processing and - if relevant - additionally on the basis of the respective statutory retention period (e.g. retention periods under commercial and tax law).

When processing personal data on the basis of explicit consent pursuant to Art. 6 (1) a DSGVO, this data is stored until the data subject revokes his/her consent.

If there are statutory retention periods for data that is processed within the scope of legal or quasi-legal obligations on the basis of Art. 6 Para. 1 lit. b DSGVO, this data will be routinely deleted after expiry of the retention periods, insofar as it is no longer required for the fulfillment or initiation of a contract and/or we do not have a legitimate interest in continuing to store it.

When processing personal data on the basis of Art. 6(1)(f) DSGVO, this data is stored until the data subject exercises his or her right to object pursuant to Art. 21(1) DSGVO, unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or the processing serves to assert, exercise or defend legal claims.

When processing personal data for the purpose of direct marketing on the basis of Art. 6 (1) lit. f DSGVO, this data is stored until the data subject exercises his or her right to object pursuant to Art. 21 (2) DSGVO.

Unless otherwise stated in the other information in this statement about specific processing situations, stored personal data will otherwise be deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.

‍