Data privacy

Data Privacy Statement

Please find below our statement on the processing of personal data by our company in accordance with the legal requirements, especially with the EU General Data Protection Regulation (GDPR – available here).

Contents:
I. General information
1. Definition of main terms
2. Scope of validity
3. Controller
4. Data protection officer

II. Itemisation of data processing operations
1. General information about the data processing operations
2. Accessing our services
3. Data processing on our YouTube channel as joint controllers
4. Embedded content
5. General newsletter
6. Tracking & usage analysis

III. Rights of data subjects
1. Right to object
2. Right of access
3. Right to rectification
4. Right to erasure (“right to be forgotten”)
5. Right to restriction of processing
6. Right to data portability
7. Right to withdraw consent
8. Right to lodge a complaint
9. Option of preventing processing

I. General information

This section of the privacy statement contains information on the scope of validity, the person responsible for data processing, the data protec-tion officer and data security. It also begins with a list of definitions of important terms used in the data privacy statement.

1. Definition of main terms
Browser: Computer program used to display websites (e.g., Chrome, Firefox, Safari)

Cookies: Text files which the web server places on the user’s computer by means of the browser which is used. The stored cookie information may con-tain both an identifier (cookie ID) for recognition purposes and content data, such as login status or information about websites visited. The browser sends the cookie information back to the web server with each new request upon subsequent repeat visits to these sites. Most browsers accept cookies automatically. Cookies can be managed using the browser functions (usually under “Options” or “Settings”). The storage of cookies may be disabled in this way or it may be made dependent on the user’s approval in any given case or otherwise restricted. Cookies may also be deleted at any time.

Third countries: Countries outside the European Union (EU)

GDPR: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), available here.

Personal data: Any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more fac-tors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Profiling: Any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

Services: Our offers to which this data privacy statement applies (cf. Scope of validity).

Tracking: The collection of data and their evaluation regarding the behaviour of visitors in response to our services.

Tracking technologies: Actions can be tracked either via the activity records (log files) stored on our web servers or by collecting data from end devic-es via pixels, cookies or similar tracking technologies.

Processing: Any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissem-ination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Pixel: Pixels are also called tracking pixels, web beacons or web bugs. These are small, invisible graphics in HTML emails or on websites. When a doc-ument is opened, this small image is downloaded from a server on the Internet and the download is registered there. This allows the operator of the server to see if and when an email has been opened or a website has been visited. This function is usually carried out by calling up a small program (Ja-vaScript). Certain types of information can be detected on your computer system in this way and shared, such as the content of cookies, the time and date of the visit, and a description of the page on which the tracking pixel is located.

2. Scope of validity
This data privacy statement applies to our website www.burdaprincipalinvestments.com, hereinafter referred to as “services”.

3. Controller
The following party is responsible for the processing of data in relation to the services, i.e., this is the person who determines the purposes and means of processing personal data:

Burda Principal Investments GmbH & Co. KG
Arabellastraße 23
81925 München
Germany
Email: investments@burda.com

4. Data protection officer
Our data protection officer can be contacted under the data given in paragraph 3., for the attention of the data privacy department or via investments@burda.com.

II. Itemisation of data processing operations

This section of the data privacy statement contains detailed information about the processing of personal data in the context of our services. The information is subdivided for greater clarity into certain functions in connection with our services. In case of the normal use of the services, dif-ferent functions and therefore also different processing operations can be implemented consecutively or simultaneously.

1. General information about the data processing operations
The following applies to all the processing operations listed below, unless stated otherwise:

a. No obligation to provide personal data & consequences of failure to provide such data

The provision of personal data is not required by law or contract, and you are under no obligation to provide any data. We will inform you during the da-ta entry process when personal information needs to be provided for the relevant service (e.g., by indicating “mandatory fields”). In cases where the provision of data is required, the consequence of not providing data will be that the service in question cannot be provided. Otherwise, failure to provide data may result in our inability to provide our services in the same form and quality.

b. Transfer of personal data to third countries

When we send data to third countries, i.e., countries outside the European Union, the data are then transmitted strictly in compliance with the statutory conditions of admissibility.
If the transmission of the data to a third country does not serve the purpose of fulfilling our contract with you, if we do not have your consent, if the transmission is not required for the establishment, exercise or defence of legal claims, and if no other exemption applies under Art. 49 GDPR, we will only transmit your data to a third country if in possession of an adequacy decision pursuant to Art. 45 GDPR or appropriate safeguards under Art. 46 GDPR.
In order to ensure an adequate level of data protection, we provide appropriate safeguards pursuant to Art. 46 (2) c) GDPR by the conclusion of EU standard data protection clauses adopted by the European Commission with the receiving body. Copies of the standard EU data protection clauses are available on the website of the European Commission here.
Alternatively or additionally, safeguards under Art. 46 subs. 2 c) GDPR through the conclusion of the EU standard data protection clauses adopted by the European Commission with the receiving body provide appropriate safeguards and an adequate level of data protection. Copies of the standard EU data protection clauses are available on the website of the European Commission.

c. Hosting at external service providers

Our data processing work is carried out to a large extent with the involvement of hosting service providers who provide us with storage space and pro-cessing capacities at their data centres and who also process personal data on our behalf according to our instructions. It may be the case that person-al data are transmitted to hosting service providers in respect of all of the functions listed below. These service providers process data either exclusive-ly in the EU or subject to guaranteed levels of data protection which we have put in place based on the standard EU data protection clauses (cf. sub-section c.).

d. Transmission to government authorities

We send personal information to government authorities (including law enforcement agencies) when required to fulfil a legal obligation to which we are subject (legal basis: Art. 6, subs. 1 c), GDPR) or when it is necessary for the assertion, exercise or defence of legal claims (legal basis: Art. 6, subs. 1 f), GDPR).

e. Period of storage

The time specified in the “period of storage” paragraph indicates how long we use the data for the purposes in any given case. At the end of this peri-od, the data will no longer be processed by us but will be deleted at regular intervals, unless continued processing and storage are required by law (in particular, because it is necessary to fulfil a legal obligation or for the establishment, exercise or defence of legal claims) or unless you grant us extended consent.

f. Data categories

The category names listed below are used for specific types of data in the following sections:

Personal data: Title, salutation/gender, forename, surname
Contact data: Telephone number(s), fax number(s), email address(es)
Access data: Date and time of visit to our service; the page from which the system accessed our site; pages visited during the session; ses-sion identification data (session ID), as well as the following information relating to the computer system accessing the service: Internet Proto-col address used (IP address), browser type, browser version, device type, operating system and similar technical information.

2. Accessing our services
The passages below set out how your personal data are processed when you access our services (e.g., loading and viewing the website).

a. Purposes of data processing, legal basis, legitimate interests (where applicable), and period of storage

Screenshot 2020-11-02 at 12.55.08

b. Recipients of personal data

3. Data processing on our YouTube channel as joint controllers

To ensure an up-to-date, informative as well as appealing design of our online offer, we also make use of social media platforms. In this context, we operate a separate YouTube channel, operated by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (hereinafter “Google”). YouTube is a video platform where users can post videos and make them publicly available.

Below, we describe how we jointly process your personal data with Google when operating the YouTube platform:
The subject of the joint responsibility is the provision of our YouTube channel. Your personal data is processed predominantly for the purpose of ensuring an attractive, appealing, and user-friendly design of our YouTube channel. We process your personal data within our YouTube channel only to the extent necessary for the provision of the YouTube channel. In addition, we process personal data within the YouTube channel for the purpose of carrying out any communication processes with users and interested parties of our YouTube channel. In this case, the processing of your personal data takes place exclusively based on your voluntary declaration of consent.

Supplementary information on the processing of your personal data by Google can be found here:

https://policies.google.com/privacy?hl=de&gl=de#infocollect

You can view the general terms of use of the YouTube service here:

We have no direct influence on the type and scope of the processing of your personal data by Google within the framework of our YouTube channel. By using the YouTube channel, your personal data will also be processed by Google and, in doing so, may also be transferred to the United States, Ireland, and any other country in which Google operates ( regardless of your place of residence) and may be additionally processed there.

You may exercise your data protection rights requests against any of the involved parties. To make it easier for you to exercise your data protection claims and rights, we have set up a central contact point at the address given under I.3, which can be reached at investments@burda.com. Your inquiries will be processed centrally there. In addition, we inform each other about incoming inquiries so that we can always process them together in the best possible way.

a) Purpose of data processing and legal basis, and, if applicable, legitimate interests, storage period.

Data categories: Operating system; region and place of retrieval; age and gender of persons concerned; playlist; device type; YouTube product; live/on demand; subtitles; language settings as well as translations; item type; info card type; info card.

Purpose: Interest-based design of the offer; processing of customer inquiries.

The processing of your personal data serves predominantly the purpose of the demand-oriented, attractive, current and up-to-date design of our online offers, in particular our YouTube channel. In addition, your personal data is processed to be able to promptly process and respond to your inquiries via the YouTube channel. By doing so, we would like to expand and strengthen our relationship with customers and interested parties.

Legal basis: Art. 6 (1) (a) GDPR
Your consent in the context of the respective contact via our YouTube channel.

Art. 6 (1) (f) GDPR:
Our legitimate interest is justified predominantly by our interest in the provision, optimization, design as well as continuous updating of our YouTube channel. In this context, the processing of our users’ personal data is necessary predominantly to align the content of our YouTube channel with the interests and needs of our users.

Storage period: Personal data will be deleted as soon as their further processing is no longer necessary for the respective purpose and legal retention periods do not prevent deletion. This is regularly the case upon receipt of your revocation or objection. In addition, you have the option to restrict the processing of your personal data via the individual settings within your YouTube account. You can view more information about this option here:
https://support.google.com/accounts?hl=de#topic=3382296

b) Companies processing personal data as joint controllers

Participating Companies: The company indicated in I.3; Google Ireland Limited, Gordon House, Barrow St, Dublin, Ireland.

Data concerned: All data referred to in point a) of this section.

Legal basis: Art. 6 (1) (a) and (f) GDPR

c) Recipients of the personal data

Recipient category: Google Ireland Limited, Gordon House, Barrow St, Dublin, Ireland; the company indicated under I.3.

Data concerned: All data referred to in point a) of this section.

Legal basis: Art. 6 (1) (f) GDPR
Legitimate interest pursued by us: needs-based design as well as optimization of our YouTube channel.

4. Embedded content

Our website contains embedded content (e.g. content from social networks such as Vimeo and YouTube). An overview of the embedded content used can be found in the following list. This content is provided by third parties, whereby personal data can also be transmitted to the corresponding social network with the help of the respective embeddings. The transmission of personal data takes place for the purpose of displaying the content or to enable you to rate, recommend or share the respective material. In this way, we want to make our websites better known and enrich them with content relevant to the target group. We configure our websites in such a way that data is only transmitted when you interact with the respective embedded content (e.g. Like-button or video).

In this case, the legal basis for the data transfer is your voluntary consent pursuant to Art. 6 (1) (a) GDPR. We have no direct influence on the type and scope of the processing of your personal data by the respective social network. Insofar as you interact with the respective content, your personal data will also be processed by the operator of the social network and may also be transmitted to the USA (regardless of your place of residence) and may be additionally processed there.

YouTube
We embed videos from the online platform YouTube.com (“YouTube”). The YouTube platform is operated by the provider Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland. The integration of the YouTube service takes place by means of the so-called “extended data protection mode”. A transmission of personal data to YouTube or Google only takes place if you have agreed to the integration of corresponding videos from YouTube.

a) Purpose of data processing and legal basis, and, if applicable, legitimate interests, storage period

Data category
Device-specific information, in particular your IP-address (if you are logged in within your Google account while viewing the video, the information about viewed videos will be assigned to your member account).

Purpose
The integration of the videos from YouTube and the associated processing of your personal data serves the purpose of the demand-oriented, attractive and contemporary design of our websites.

Legal basis
Art. 6 (1) (a) GDPR: your consent in the context of interaction with the video from YouTube.

Period of storage
Personal data will be deleted as soon as their further processing is no longer necessary for the respective purpose and legal retention periods do not prevent deletion. This is regularly the case upon receipt of your revocation or objection.

You can view further information on the processing of your personal data by the service provider Google here: https://policies.google.com/privacy?hl=en&gl=en

Recipient of the personal data
Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland

5. General newsletter

In addition to the purely informational use of our website, we offer you the opportunity to register for our newsletter. In case you register for our free newsletter, we will regularly inform you about our venture capital activities, news, as well as valuable tips.

When you register for the newsletter, you will receive an additional confirmation message containing a link for final registration (double opt-in process). This ensures that the newsletter was ordered by you and not by a third party. When you register, your data is first stored on our servers, or the servers of the service providers used and a confirmation message with a link to the final registration is generated and sent to the email address provided. If you do not confirm the registration by clicking on the link in this e-mail, the data will be deleted after 30 days. Your data will only be permanently stored for the purpose of sending the newsletter once you have confirmed the link. If you no longer agree to the storage of your data for this purpose and therefore no longer wish to use our services, you can unsubscribe from our newsletter at any time. There is a corresponding link in every newsletter for this purpose.

We would like to point out that your interactions with the newsletter are measured (opening and click behaviour). For this measurement, the emails sent contain tracking pixels or corresponding links that can measure the opening and click rates within the newsletter for the purpose of optimising our future newsletters. In addition, based on your consent, we can link the click behaviour with an individual ID in order to be able to clearly assign your clicks. This link is made for the purpose of individualised, interest-based adaptation of the newsletter.

a) Purpose of data processing and legal basis as well as any legitimate interests, storage period
Data category: Personal master data; registration data; newsletter user profile data; access data; contact data, in particular your email address
Purpose: Verification of the registration process (double opt-in) including traceability of subscriptions and unsubscriptions (logging); sending and interest-based design of the newsletter; measurement of opening and click rates for the purpose of optimising our newsletter offering
Legal basis: Art. 6 (1) (a) and (f) GDPR
Legitimate interest pursued by us: Logging the subscription and unsubscription process for our newsletter and analysing the sending and design of our newsletter by means of additional performance measurements
Storage period: Personal data will be deleted as soon as their further processing is no longer necessary for the respective purpose and statutory retention periods do not prevent deletion. This is regularly the case upon receipt of your cancellation. Due to technical circumstances, it may take up to 48 hours for the cancellation to be operationally implemented. In the event of your cancellation, we also reserve the right to store your e-mail address for the purpose of providing proof of consent previously granted. The data will be stored exclusively for the purpose of defence against possible legal claims.

b) Recipients of the personal data
Recipient category: Service providers for sending newsletters; companies within the group of companies, insofar as this is necessary for the purpose of sending and optimising the newsletter
Data concerned: all data mentioned under point a) of this section
Legal basis: Art. 6 (1) (f) GDPR and Art. 28 GDPR
Legitimate interest pursued by us: Internal administrative purposes, in particular in the context of the proper sending of the newsletter

Burda Principal Investments GmbH & Co. KG observes the requirements of the IAB Europe Transparency & Consent Framework and complies with its specifications and guidelines.

Usage analysis with legal basis of legitimate interest, Art. 6 para. 1 letter f) GDPR

We carry out usage analyses on the legal basis of Art. 6 para. 1 letter f) GDPR, i.e. after weighing up interests. You can find an overview of the technologies and services used in our consent dialogue (accessible in the footer and/or via the respective privacy icon on the website). There you will also find an explanation of how each service works and which data is used for processing.

In doing so, we pursue the legitimate interests of

– reviewing our services, optimising them and adapting them to the needs of users and rectifying errors,

– to statistically determine characteristic values about the use of our services (reach, intensity of use, surfing behaviour of users) – on the basis of uniform standard procedures – and thus to obtain market-wide comparable values in order to optimally market our services,

– measure the success of advertising campaigns, optimise our ads for the future and also enable marketers and advertisers to optimise their ads accordingly.

Can I object to the collection and analysis?

Yes, you can object to the respective processing in our consent dialogue (accessible in the footer and/or via the respective privacy icon on the website).

Tracking with legal basis consent, Art. 6 para. 1 letter a) GDPR

We carry out tracking with your consent. We explain the type and scope of tracking in our consent dialogue (accessible in the footer and/or via the respective privacy icon on the website). To clarify: If no consent is requested, no tracking takes place on this basis.

Consent is voluntary. It is given by clicking the corresponding button in the consent dialogue on our services. There you will find all the necessary information about the type and scope of data processing.

Can I revoke my consent?
Once you have given your consent, you can withdraw it at any time with effect for the future. You will find an option to withdraw your consent in our consent dialogue (accessible in the footer and/or via the respective privacy icon on the website). This does not affect the lawfulness of processing up to the point of withdrawal.

6. Tracking & usage analysis

In the following, we describe the cases in which your personal data is processed to analyse the use of our services and when tracking technologies are used to track and evaluate the behaviour of visitors, for example to display advertising tailored to them.
Burda Principal Investments GmbH & Co. KG observes the requirements of the IAB Europe Transparency & Consent Framework and complies with its specifications and guidelines.

a. Usage analysis with legal basis of legitimate interest, Art. 6 para. 1 letter f) GDPR
We carry out usage analyses on the legal basis of Art. 6 para. 1 letter f) GDPR, i.e. after weighing up interests. You can find an overview of the technologies and services used in our consent dialogue (accessible in the footer and/or via the respective privacy icon on the website). There you will also find an explanation of how each service works and which data is used for processing.

In doing so, we pursue the legitimate interests of
– reviewing our services, optimising them and adapting them to the needs of users and rectifying errors,
– to statistically determine characteristic values about the use of our services (reach, intensity of use, surfing behaviour of users) – on the basis of uniform standard procedures – and thus to obtain market-wide comparable values in order to optimally market our services,
– measure the success of advertising campaigns, optimise our ads for the future and also enable marketers and advertisers to optimise their ads accordingly.

Can I object to the collection and analysis?
Yes, you can object to the respective processing in our consent dialogue (accessible in the footer and/or via the respective privacy icon on the website).

b. Tracking with legal basis consent, Art. 6 para. 1 letter a) GDPR
We carry out tracking with your consent. We explain the type and scope of tracking in our consent dialogue (accessible in the footer and/or via the respective privacy icon on the website). To clarify: If no consent is requested, no tracking takes place on this basis. Consent is voluntary. It is given by clicking the corresponding button in the consent dialogue on our services. There you will find all the necessary information about the type and scope of data processing.

III. Rights of data subjects

1. Right to object
If we process your personal data for direct marketing purposes, you have the right to object at any time to the processing of personal data con-cerning you for such marketing with future effect, which includes profiling to the extent that it is related to such direct marketing.
You also have the right, at any time with future effect and for reasons relating to your particular situation, to object to the processing of personal data concerning you which is based on Art. 6, subs. 1 e) or f), GDPR, including profiling based on these provisions.
The right to object may be exercised free of charge. In order to be able to process your request faster, please reach us using the contact information provided in paragraph I.3., e.g . via email to: investments@burda.com.

2. Right of access
You have the right to obtain confirmation from us as to whether or not personal data concerning you are being processed and, where that is the case, access to the personal data and the other information listed in Art. 15 GDPR .

3. Right to rectification
You have the right to obtain from us the rectification of inaccurate personal data concerning you without undue delay (Art. 16 GDPR). Taking into ac-count the purposes of the processing, you have the right to have incomplete personal data completed, including by means of providing a supplemen-tary statement.

4. Right to erasure (“right to be forgotten”)
You have the right to obtain from us the erasure of personal data concerning you without undue delay if one of the reasons listed in Art. 17, subs. 1, GDPR is applicable and the processing operations are not required for one of the purposes approved in Art. 17, subs. 3, GDPR.

5. Right to restriction of processing
You are entitled to obtain from us the restriction of the processing of personal data if one of the conditions laid down in Art. 18, subs. 1 a) to d), GDPR is met.

6. Right to data portability
Under the conditions set out in Art. 20, subs. 1, GDPR, you have the right to receive the personal data concerning you which you have provided to us, in a structured, commonly used and machine-readable format and the right to transmit those data to another controller without hindrance on our part. In ex-ercising your right to data portability, you have the right to have the personal data transmitted directly by us to another controller where technically fea-sible.

7. Right to withdraw consent
If the processing is based on your consent, you have the right to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

8. Right to lodge a complaint
You have the right to lodge a complaint with the supervisory authority responsible for our company. The supervisory authority responsible for our com-pany is:
Landesamt für Datenschutzaufsicht, Promenade 27 (Schloss), 91522 Ansbach