Data Protection Policy

This Data Protection Policy refers to the nature, scope and purpose of personal data processing (hereinafter referred to as “data”) relating to our websites, features and content thereof, as well as the external presence such as our social media profiles (collectively referred to as “online offer”). With regard to the terminology used, e.g. “processing” and “controller”, we refer to the definitions stimulated in Article 4 of the General Data Protection Regulation (GDPR).

Types of Processed Data:

• Personal data (e.g. name, address).
• Contact data (e.g. email address, telephone number).
• Content data (e.g. text input, images, videos).
• Usage data (e.g. websites visited, interest in content, access time).
• Meta and communications data (e.g. device information, IP addresses)

Categories of Data Subjects

• Visitors and users of the online offer (hereinafter referred to as “user”).
• Customers utilising our website (hereinafter referred to as “user”).

Processing Purposes

• Provision of the online offer, its functions and content.
• Processing of all orders including the related physical processes, in particular, that of package dispatch and in respect to the possible reverse transaction in case of warranty.
• Responding to contact requests and communication with users.
• Security measures
• Audience measurement/marketing

Definitions

“Personal data” means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

“Processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

“Pseudonymisation” means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.

“Profiling” means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

“Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

“Processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

In accordance with Article 13 of the GDPR, we provide information in regard to the legal basis of our data processing. Provided the legal basis in the data protection statement is mentioned, the following applies: The legal basis for obtaining consent is Article 6 paragraph letter 1 and Article 7 of the GDPR, the legal basis for the processing for the fulfilment of our services and the execution of contractual measures as well as the answer to inquiries is Article 6 paragraph 1 letter b of the GDPR, the legal basis for the processing in order to fulfil our legal obligations is article 6 (1) letter c of the GDPR, and the legal basis for the processing in order to safeguard our legitimate interests is Article 6 (1) letter. f of the GDPR. Processing is necessary in order to protect the vital interests of the data subject or of another natural person as stated in Article 6 paragraph 1 letter d of the GDPR.

Supplement for payment data

Your payment data is encrypted during the ordering process and transmitted over the Internet. Due to a special integration into the ordering process, we do not have access to your payment data at any time and are therefore not processors of this data. These are processed exclusively by these payment service providers:

For credit card payments

stripe

510 Townsend Street

San Francisco, CA 94103, USA

Data protection responsibility available at [email protected]

For Paypal

PayPal (Europe) S.à.r.l. et Cie, S.C.A.

22-24 Boulevard Royal

L-2449, Luxembourg.

Data protection responsibility available at [email protected]

For immediate transfer from Klarna

Klarna Bank AB (publ)

Sveavägen 46

111 34 Stockholm

Sweden

Data protection responsibility can be reached at [email protected]

Purchase on account by Ratepay

RatePAY GmbH

Franklin Straße 28-29

10587 Berlin

Data protection responsibility can be reached at [email protected]

Addition for the Customer Support

In order to be able to offer our customers flawless customer support including a ticket system, we rely on a third party provider. Zendesk can be used to create customer support tickets and handle returnlabels. The data that the customer enters can be freely selected and the customer’s active action in the form of a tick mark indicates that he/she agrees to be allowed to view the data for problem solving.

Information about the third-party provider:

Zendesk International Ltd.

55 Charlemont Place, Saint Kevin’s, Dublin, D02 F985 Ireland

Responsibility for data protection accessible at [email protected]

Addition for shipping information

In order to provide our customers with a better delivery service, we work with a third party that processes the package tracking numbers and provides more accurate information about the package status to each customer. Third Party Information:

byrd technologies GmbH

Mariahilferstraße 117/2/23

1060 Wien

Austria

Data protection responsibility can be reached at [email protected] 

Hosting

This website is hosted by an external service provider (hoster). Personal data collected on this website is stored on the hoster’s servers. This may include IP addresses, contact requests, meta and communication data, contract data, contact data, names, website accesses and other data generated via a website.

The hoster is used for the purpose of fulfilling contracts with our potential and existing customers (Art. 6 para. 1 lit. b DSGVO) and in the interest of a secure, fast and efficient provision of our online offer by a professional provider (Art. 6 para. 1 lit. f DSGVO).

Our hoster will only process your data to the extent necessary to fulfill its service obligations and follow our instructions regarding this data.

DigitalOcean LLC

101 Avenue of the Americas, 10th Floor

New York, NY 10013

VAT ID: EU528002224

Our data is hosted on the European server in Frankfurt, Germany: Hanauer Landstrasse 302

Data transfer to third countries

If we process data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)) or if this is done in the context of the use of third-party services or disclosure or transfer of data to third parties, this will only occur if it is done to fulfil our (pre)contractual obligations, on the basis of your consent, a legal obligation or on the basis of our legitimate interests. Subject to legal or contractual permissions, we process or allow the data to be processed in a third country only if the special requirements of Art. 44 ff. of the German Data Protection Act are met. DSGVO. This means that the processing takes place, for example, on the basis of special guarantees, such as the officially recognised determination of a data protection level corresponding to the EU (e.g. for the USA by the “Privacy Shield”) or compliance with officially recognised special contractual obligations (so-called “standard contractual clauses”).

Rights of the Data Subject

The user shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the controller shall provide a copy of the personal data undergoing processing as in accordance with Article 15 of the GDPR.

The user shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data or incomplete personal data concerning him or her in accordance with Article 16 of the GDPR.

The user shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay in accordance with Article 17. The user shall have the right to obtain from the controller restriction of processing of personal data in accordance with Article 18 of the GDPR.

The user shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided in accordance with Article 20 of the GDPR.

The user shall have the right to lodge a complaint with a supervisory authority in accordance with Article 77 of the GDPR.

Data Usage for Advertising Purposes

Your personal data is used to improve your shopping experience and shape it to suit your requirements. The information used to achieve this is the data already available to us, e.g. via your internet connection, the chosen end device, the operating system, the date, the time at which our website was visited or the pages accessed as well as information that was provided to us by you. You may object to the use of your personal data for advertising purposes at any time. A notification via email, letter or fax would suffice. 

Newsletters

The following information is intended to inform you about the content of our newsletter, the subscription, shipping and statistical evaluation procedures, as well as your right of opting out. By subscribing to our newsletter, you agree to receive it and to the described procedures.

We send newsletters, emails and other electronic notifications with advertising information (hereinafter “newsletter”) only with the consent of the recipient or legal permission. Insofar as the content of the newsletter is concretely described as part of a subscription, it is relative for the consent of the users. Otherwise, our newsletters only contain information concerning our products and the relevant information thereof (e.g. safety instruction), special offers, promotions and information about our company.

Double opt-in and logging: Subscribing to our newsletter is part of a so-called double opt-in procedure. This means that you will receive an email after subscribing requesting you to confirm your subscription. This confirmation is necessary so that nobody can subscribe with an email address that is not their own. Subscription to the newsletter will be logged as proof of the subscription process in accordance with legal requirements. This includes the storage of the subscription and confirmation time as well as the IP address. Similarly, changes to your data stored with the emailing service provider will be logged.

Subscription details: To subscribe to the newsletter, all you have to do is enter your email address. Optionally, we ask that you provide your first and last name. These are only used to personalize the newsletter.

The dispatch of the newsletter and the associated performance measurement are based on a consent of the recipients according to Article 6 paragraph 1 letter a, Art. 7 GDPR in conjunction with section107 paragraph 2 of the Telecommunications Act, or if consent is not required, based on our legitimate interests in direct marketing according to Article 6 paragraph 1 letter f GDPR in conjunction with section 107 (2) and the like 3 of the Telecommunications Act.

The logging of the registration process is based on our legitimate interests in accordance with Article 6 paragraph 1 letter f of the GDPR. Our interest lies in the use of a user-friendly and secure newsletter system, which serves both our business interests and the expectations of the users and also allows us to prove our consent.

Termination/Cancellation

The user can terminate the receipt of our newsletter at any time, i.e. revoke your consent. The newsletter cancellation link can be found at the bottom of each newsletter. We may save the submitted email addresses for up to three years based on our legitimate interests before deletion thereof to provide prior consent. The processing of this data is limited to the purpose of a possible defense against claims. An individual request for cancellation is possible at any time, provided that at the same time the former existence of a consent is confirmed.

Email Marketing Service

The newsletter is distributed via the email service company, Active Campaign LLC. The service provider operates a data centre in Germany, which is used for dispatching emails. The privacy policy of the email service provider can be viewed here: 

Active Campaign LLC

1 North Dearborn Street, 5th floor
Chicago, IL 60602

[email protected] 

The email service provider is based on our legitimate interests in accordance to Article 6 paragraph 1 letter f of the GDPR and a contract processing agreement according to Article 28 paragraph 3 section 1 of the GDPR.

The claim is limited to the Amazon AWS product “Simple Email Service”. Consequently, only the actual dispatch of the newsletter is part of data processing. On the part of Amazon AWS, there is no structured archiving of personal data.

Cookies

Cookies are small text files that are stored on a user’s computers. Different types of information can be stored within the text files. A cookie is primarily used to store information about a user (i.e. the device on which the cookie is stored) during or after their visit on a website. Session cookies are cookies that are deleted after a user leaves a website and closes the browser. In the case of session cookies, the contents of a shopping cart in an online shop or a login status are saved. Persistent cookies remain stored even after the browser has been closed. Thus, a login status, for instance, will be saved if the user visits the website after several days. Likewise, user interests can be stored which as used for range measurement or marketing purposes. A third-party cookie refers to cookies that are offered by providers that do not manage the website that is being visited. Cookies offered by the person that manages the website are called first-party cookies.

We can use session or persistent cookies and clarify these in the context of our privacy policy.

The user is requested to disable the settings in their browser if they do not want any cookies stored, Saved cookies can be deleted in the system settings of the browser. The exclusion of cookies can lead to functional restrictions of the website being visited.

A general contradiction explaining the use of cookies used for online marketing purposes can be found in a variety of services, especially in the case of tracking, via the US website http://www.aboutads.info/choices/ or the EU site http://www.youronlinechoices.com/. Furthermore, the storage of cookie can be switched off in the browser settings. Please note that, once the settings have been changed, not all the features available on this website may be used.

Google Analytics with “Anonymize IP” Extention

Based on our legitimate interests (i.e. interest in the analysis, optimisation and economical operation of our online offering pursuant to Art. 6 (1), letter f. GDPR), we use Google Analytics, a web analysis service of Google LLC (“Google”). Google uses cookies. The information generated by the cookies regarding the use of the online offering by the user is generally transmitted to a Google server in the USA where it is stored.

Google is certified under the Privacy Shield agreement and thereby guarantees compliance with European data protection law (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active).

Google uses this information on our behalf in order to evaluate the use of our online offering by the users, compile reports about the activities within this online offering and provide us with additional services related to the use of this online offering and the internet. In doing so, pseudonymised usage profiles for the users may be prepared from the processed data.

We only use Google Analytics with activated IP anonymisation. This means that the IP address of users within member states of the European Union or other states in the European Economic Area is shortened by Google. Only in exceptional cases is the full IP address transferred to a Google server in the USA and shortened there.

The IP address transferred by the user’s browser is not combined with other data by Google. Users can prevent the storage of cookies by configuring the settings of their browser software accordingly. Furthermore, users can prevent the capture of data generated by the cookie and related to their use of the online offering by Google as well as the processing of these data by Google by downloading and installing the browser plug-in available under the following link: https://tools.google.com/dlpage/gaoptout?hl=en.

Further information about the use of data by Google, settings and rights to object is available in the Google data privacy statement (https://policies.google.com/technologies/ads) and the settings for the display of advertisements by Google (https://adssettings.google.com/authenticated).

The personal data of users are erased or anonymized after 14 months.

Google Analytics 4

We use Google Analytics in the “Google Analytics 4” version. This is a Google Analytics process that prepares the user analysis on the basis of a pseudonymised user ID and thereby creates a pseudonymised user profile with information from the use of various devices (known as cross-device tracking).

Formation of Target Groups with Google Analytics

We use Google Analytics in order to display the advertisements placed within advertising services of Google and its partners only to those users who have shown an interest in our online offering, or who exhibit certain characteristics (e.g. interest in certain topics or products determined based on the websites that are visited), which we transmit to Google (known as Remarketing Audiences or Google Analytics Audiences). With the help of Remarketing Audiences, we also want to ensure that our advertisements correspond to the potential interests of users.

Google Signals Data Collection

We use Google Signals Data Collection, which is a feature that associate the visitation information it collects from our site and apps with Google information from accounts of signed-in in users who have consented to this association for the purpose of ads personalization. This Google information may include end user location, search history, Youtube history and data from sites that partner with Google- and is used to provide aggregated and anonymized insights into our user’s cross device behaviours. The data may be accessed and can be deleted by the end user via “My Activity”. The data will be collected for a maximum of 14 months.

Google Remarketing & Conversion Measurements

We use the services of Google LLC, 1600 Amphitheater Parkway, Mountain View, CA 94043 on the basis of our legitimate interests (i.e. interest in the analysis, optimisation and economic operation of our online service within the scope of Article 6 (1) letter f of the GDPR, USA, (“Google”).

Google is certified under the Privacy Shield Agreement, which provides a guarantee to comply with European privacy legislation (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active).

We use Google’s online marketing tool, AdWords, to place ads on the Google advertising network (e.. in search results, in videos, on websites, etc.). This allows us to display ads for and within the scope of our website and online offer in order to only present ads to users that potentially match their interests. For instance, if a user is being presented with products that he/she has shown interest in on a different website, it is referred to as “remarketing”. When our or other websites are being accessed, whereby the Google advertising network is active, Google will immediately execute a Google code and so-called (re)marketing tags (invisible graphics or code also referred to as “web beacons”) are incorporated into the website. With the help of these tags an individual cookie, i.e. a small text file, is saved on the user’s device. Comparable technologies can also be used instead of cookies. The file records which websites the user has visited, or which content the user is interested in as well as technical information about the browser and operating system, referring websites, visiting times and other information regarding the use of the online offer.

Furthermore, we receive an individual “conversion cookie”. The information obtained is used by Google to generate conversion statistics on our behalf. However, we only receive the anonymous total number of users who clicked on our ad and were redirected to a conversion tracking tag page. We do not receive any information that personally identifies users.

The user data is processed within the Google advertising networking using a pseudonym. This means that Google does not store or process the user’s name or email address but rather the relevant, cookie-related data within pseudonymous user profiles. Thus, the ads are not displayed to a specific, identifiable person but rather to the owner of the cookie and not their personal identity. This does not apply if the user has explicitly allowed Google to process the data by other means. The user information collected is transmitted to Google and stored on Google servers in the United States.

For more information about Google’s data usage, settings and possibilities of revocation, please read Google’s Private Policy (https://policies.google.com/technologies/ads) as well as the settings regarding the display of ads via Google (https://adssettings.google.com/authenticated).

Affiliate WP

There is also an Affiliate Web-Plugin (Affiliate WP) on our own website. Here name, e-mail address and affiliate link are stored by us to guarantee the payout. This is only done in the course of the cooperation with the affiliate, who enters this voluntarily and after acceptance of the corresponding terms and conditions. Upon request, this data and the tracking will be deleted again. (https://affiliatewp.com/privacy-policy/)

Facebook Pixel, Custom Audiences and Facebook Conversion

Based on our legitimate interests in the analysis, optimisation and economical operation of our online offering and for these purposes, our online offering uses what is called the “Facebook pixel” of the social network Facebook operated by Facebook Inc., 1 Hacker Way, Menlo Park, CA 94025, USA or, if you are resident in the EU, by Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Facebook”).

Facebook is certified under the Privacy Shield agreement and thereby guarantees compliance with European data protection law (https://www.privacyshield.gov/participant?id=a2zt0000000GnywAAC&status=Active).

The Facebook pixel allows Facebook to identify the visitors to our online offering as a target group for this display of advertisements (known as Facebook ads). Accordingly we use the Facebook pixel in order to display the Facebook ads placed by us only to those Facebook users who have shown an interest in our online offering, or who exhibit certain characteristics (e.g. interest in certain topics or products determined based on the websites that are visited), which we transmit to Facebook (known as Custom Audiences). We also use the Facebook pixel to ensure that our Facebook ads correspond to the potential interests of users and are not perceived as bothersome. With the help of the Facebook pixel, we are also able to understand the effectiveness of Facebook ads for statistical and market research purposes by seeing whether users were forwarded to our website after clicking a Facebook advertisement (known as conversion).

Facebook processes the data according to Facebook’s data usage guideline. Corresponding general information about the display of Facebook ads in Facebook’s data usage guideline: https://www.facebook.com/about/privacy/. Specific information and details about the Facebook pixel and its functionality is available in the Facebook help section: https://www.facebook.com/business/help/651294705016616.

You can object to the recording of data by the Facebook pixel and their use for the display of Facebook ads. To choose what types of advertisements are displayed to you on Facebook, you can call up the page set up by Facebook and follow the instructions for configuring usage-based advertising settings: https://www.facebook.com/settings?tab=ads. The settings are platform-independent, meaning they apply to all devices including desktop computers and mobile devices.

You can also object to the use of cookies for the purpose of measuring coverage and for promotional purposes on the deactivation page of the network advertising initiative (http://optout.networkadvertising.org/) and on the US website (http://www.aboutads.info/choices) or the European website (http://www.youronlinechoices.com/uk/your-ad-choices/).

intelliAD

Our website uses the services of intelliAd Media GmbH, Sendlinger Str. 7, 80331 Munich. Anonymised data is captured and aggregated for the design and optimisation of this website and user profiles are created from the data using pseudonyms. intelliAD tracking stores cookies offline. Anonymized usage data and profiles can be used by the website operator as well as other intelliAd customers for the identification of user interests without any conclusion as to your identity as a website visitor. You have the right to object to the data storage of your (anonymized) data for future use by selecting the intelliAd opt-out function.

Product & Order Reviews

Once you have received the ordered merchandise you have the option of reviewing the goods received as well as the order process. We have partnered up with Echte Bewertungen (Net Reviews) to provide this feature. 

The reviewing process is voluntary and all reviews are published on our website. The reviews are marked with your first name and the first letter of your surname. In this case, however, the data volume that is transmitted is limited to the minimum that is required. 

Further information about the company Echte Bewertungen can be found here: http://www.verified-reviews.co.uk/

Webgains

We work with Webgains, an affiliate marketing network. Webgains uses so-called tracking cookies which recognise if the user was referred to an advertiser by a publisher. These cookies contain no personally identifiable information.

1. Consent

By applying for or registering with Carbomed Medical Solutions GmbH, you consent to the processing of your personal data in connection with a job application. Your data is stored and processed on BambooHR partner software system.

2. Data protection and data confidentiality

Data protection is important to us. Carbomed Medical Solutions GmbH has taken the necessary organisational and technical measures to ensure the confidentiality of your application.

3. Use of your personal data

During the application process, the contact details such as postal address, e-mail address and telephone numbers are stored in the applicant’s database, along with their title, surname and first name. In addition, application documents such as the cover letter, curriculum vitae, vocational training certificates, theoretical and work certificates are captured and saved.

The data will be stored, evaluated, processed or transferred internally only as part of your application process. The data is accessible to employees of the Carbomed Medical Solutions GmbH Human Resources Department and to those responsible for the selection of new Carbomed Medical Solutions GmbH staff only. Your data will not be transmitted to companies or persons outside Carbomed Medical Solutions GmbH, nor used for other purposes.

4. Right of Access to Personal Data

Upon request, we would be happy to provide you with information about the personal data saved. Please contact our Human Resources Department for more information.

5. Storage and Deletion of Data

Your data will be kept for the duration of the application process, during the corresponding legal retention period. If you are employed by Carbomed Medical Solutions GmbH, your personal data or excerpt thereof will be added to your personal file.

If you have applied but we unable to offer you an appropriate position, we reserve the right to reserve your application. You will be notified if this is the case. If you do not agree or are no longer interested, you have the option of having your data deleted by the Human Resources Department at any time.

Contact Details

For questions concerning the collection, processing or use of your personal data, for information, rectification, blocking or deletion of data as well as the revocation of consent, please contact: [email protected]

Banner Ads

When the user visits, we used data collected to display banner ads. This refers to web banners that are served by ad networks. 

The banner ads display products that the user has previously seen on our website or products that are similar to those seen (retargeting). We only use anonymous data in this case. The user’s name or email address is not stored by cookies. 

Our Partner: 
Criteo CIL, 32 Rue Blanche, 75009 Paris, France.
Criteo generates an individual code (“hash”) with the email address used to create a customer account on our website in order to identify users across all devices. Information about their data protection policy can be found here: http://www.criteo.com/privacy/corporate-privacy-policy/
Information on our to deactivate this service can also be found here. 

Hotjar

When the user visits, we used data collected to Hotjar to track the user’s journey. More information can be found here: https://www.hotjar.com/legal/policies/privacy/

Hotjar Ltd, Level 2
St Julians Business Centre,
3, Elia Zammit Street
St Julians STJ 3155, Malta, Europa

[email protected]

MemberPress

Our packages are made available through the plugin MemberPress. This is to provide a portal with content for our customers. The data is not collected if the customer completes the package via our store and also consents to the data being processed for the purpose of performing the service, the data will only be processed and stored via WooCommerce.

Google Firebase

We use Google Firebase in our app, an analysis and monitoring tool from Google Inc. In the European area, the company is responsible for all Google services through Google Ireland Limited (Gordon House, Barrow Street Dublin 4, Ireland).

Google also processes data from you in the USA, among other places. Google uses so-called standard contractual clauses of the GDPR as the basis for data processing for recipients based in third countries or a transfer of data there. The standard contractual clauses are provided by the EU Commission and relate to Art. 46 (2) & (3) DSGVO.

These ensure that your data complies with European data protection standards even if it is transferred and stored in third countries (outside the EU). Through these clauses, Google Inc is obliged to comply with the EU data protection level. You can find the EU Commission’s decision at https://eur-lex.europa.eu/eli/dec_impl/2021/914

You can learn more about the data processed through the use of Firebase in the Privacy Policy: https://policies.google.com/privacy?hl=de

Use of YouTube Plugins

Our website embeds videos from the YouTube portal a company of Google Inc. (1600 Amphitheater Parkway, Mountain View, CA 94043, USA). When viewing a YouTube video that is embedded in our website, a connection is established between the YouTube and Google servers. The connection is used to communicate to these servers which of our website pages you have visited. If you are logged into your YouTube account, YouTube assigns this information to your personal user account. The purpose and scope of the data collection and the further processing and use of the data by Google or YouTube, as well as your rights and settings for the protection of your privacy, can be viewed in Google’s privacy policy: www.google.com/intl/en/policies/privacy/ . If you do not wish Google or YouTube to assign the data collected through our website directly to your profile with another Google services, you can prevent Google Plugins by uploading add-ons for your browser, such as the script blocker “NoScript” (http://noscript.net/).

Processing Sensitive Data

We, Carbomed Medical Solutions GmbH, of New Stiftingtalstraße 2/2 OG, 8010 Graz, are responsible for processing your data. We comply with all the requirements of the General Data Protection Regulation (GDPR) and the Data Protection Amendment Act when processing your data and endeavor to do so using the best possible transparency.

1. Purpose, Legality and Consent

The personal data that we collect or generate in connection with our business relationship with you will be carefully processed. Any data provided to us for the purpose of using our contractual services (Art. 6 (1) lit. b DSGVO), is only used in relation to the use of our products.

The following types of personal data are processed:

• Master data from your user profile: your e-mail address, year of birth, and place of residence
• The data measured when using our product: CO2 measurement data, cycle data (in particular regarding menstruation: the beginning, length of the cycle, cycle symptoms and complaints)

Since the data generated by use of the app falls into a special category of personal data use within the scope of Art. 9 of the GDPR, it is necessary to receive your consent to use it (Art. 6 (1) (a) GDPR). Your consent can be revoked at any time, which means that the conclusion of your contract or the use of our products may be impossible. The revocation of consent does not affect the legality of the processing of your personal data until the revocation. In the case of consent, your data will only be used exclusively for the stated purpose.

Legal obligations may also require the processing of personal data (Art. 6 (1) lit. c DSGVO). For example, we are subject to the accounting requirements of the Federal Tax Code (BAO), which obliges us to store billing data for a period of 7 years.

1. Receivers

The data collected or generated will not be sold or passed on to uninvolved third parties without justification.

When selecting our processors, we ensure that they comply with data protection regulations. Additionally, we have an agreement with our processors to ensure that your personal information is processed confidentially and with care.

1. Time Limit of Storage

Personal data may be stored for the duration of the business relationship and beyond according to the legal retention period.

The metrics of your user profile will also be made available until you explicitly request that the data protection officer deletes your data, via email.

1. Your Rights & Contact Information

You have a right to information regarding the personal data we use. You have the right to correct, delete and limit the processing of your data unless legal or contractual provisions preclude these rights.

If you have any questions regarding the processing of your personal data, object to the processing of your data or wish to revoke your consent, or if you feel that your data protection rights have been violated, please contact:

Carbomed Medical Solutions GmbH

New Stiftingtalstraße 2/2 OG, 8010 Graz

[email protected]

Data Protection Officer: Andreas Nagler-Ruhry; +43 660 52 59 695

In addition, you have the right to appeal to the following supervisory authority: Austrian Data Protection Authority, Wickenburggasse 8-10, 1080 Vienna, Mail: [email protected].

5. Data Security and Confidentiality

Data security is very important to us. We have taken all necessary technical and organizational measures to ensure the security of our data processing. We will process your personal data in a way that it is protected from access by unauthorized third parties. Our IT infrastructure complies with common security requirements and is regularly reviewed.

Employees who have access to your personal data have been subject to confidentiality regarding the information disclosed.