General Privacy Policy of ClassiCon GmbH

1. With this Privacy Policy, we would like to inform you about the data processing that is carried out in our company.

Data Controller According to Data Protection Law:

ClassiCon GmbH
CEOs Oliver S. Holy, Larissa Sarjeant
Sigmund-Riefler-Bogen 3

81829 Munich, Germany

Tel. +49 89 74 81 33-0 Fax +49 89 74 81 33-99 Email info@classicon.com

Data Protection Officer Contact Data:

ClassiCon GmbH
Attention: Data Protection Officer CONFIDENTIAL Sigmund-Riefler-Bogen 3

81829 Munich, Germany

You can reach the Data Protection Officer via the above mailing address or via datenschutz@classicon.com.

2. We process the following personal data:

• First name and last name, title, academic/professional/occupational title (if applicable)
• Mailing address(es)
• Telephone number(s)
• Fax number(s) (if applicable)
• Email address(es)
• Bank account information
• Photos (designer résumé/presentation)
• Information needed for adequate job execution

3. We process personal data for the following purposes:

• Execution and performance of the corresponding contract, e.g., purchase contract / design contract / sales representative contract / rental agreement, including the necessary correspondence
• Fulfillment of our contractual and legal obligations as a company
• Processing within the scope of mutual rights arising from the respective contract (e.g., billing, rights pertaining to performance, compensation, and liability, etc.)
• Showroom appointment scheduling

4. The legal basis for data processing is formed by the following:

• Article 6(1)(b) of the GDPR on contract initiation and performance,
• Article 6(1)(c) of the GDPR on fulfillment of legal obligations that we are subject to,
• Article 6(1)(f) of the GDPR if data processing is necessary for the safeguarding of our or of a third party’s legitimate interests; continuation of business relationships with our business partners and efficient handling of inquiries are especially in our legitimate interests,
• Article 6(1)(a) of the GDPR if you have given us your consent to process your personal data for specific purposes (e.g., newsletter).

5. Transmission of personal data to third parties is only done if this is permissible. We pass personal data on within the scope of performance of the contract to the following recipients:

• Postal services and shipping service providers, freight forwarders, transport companies
• Banks, credit institutions, payment service providers (e.g., special sale to end consumer – SumUp device)
• Insurance companies and employers’ liability insurance associations
• Contracted data processors (e.g., data centers, IT service providers, print service providers, telephone service providers, disposal companies, etc.) whose services we just use
• Other recipients, depending on the job and in agreement with you

6. Transfer of data to third countries (countries outside the European Economic Area) only takes place if this is necessary for performance of the contract (e.g., payment orders) or if you have given us consent for this or if it is otherwise legally permissible. If data transfer occurs, we take measures, for example, through contractual regulations, to ensure that your data are protected. We only transfer to recipients who ensure that your data are protected in accordance with the rules of the GDPR for the transfer to third countries (Articles 44 to 49 of the GDPR).

7. We store your personal data for the duration of the statutory retention periods. As a rule, the maximum period is 10 years.

8. We generally collect personal data from you directly. In certain cases, we may also receive your contact data from intermediaries (e.g., material suppliers).

9. You have the following rights as a “data subject”, whose data we process:

• Right to access pursuant to Article 15 of the GDPR
• Right to rectification pursuant to Article 16 of the GDPR
• Right to erasure (“right to be forgotten”) pursuant to Article 17 of the GDPR
• Right to restriction of processing pursuant to Article 18 of the GDPR
• Right to transmission of your data in a structured, standard, and machine-readable format pursuant to Article 20 of the GDPR

If we process your personal data for specific purposes based on your consent, pursuant to Article 7(3) of the GDPR, you have the right to withdraw your consent at any time. After we receive your withdrawal notification, we will stop processing data for the purposes for which you granted us consent. The lawfulness of processing up to the time of receipt of your withdrawal notification remains unaffected by this.

Right to object: If we process your personal data for the safeguarding of legitimate interests in the sense given in Article 6(1)(f) of the GDPR, you have the right to object to this processing for reasons arising from your particular situation pursuant to Article 21(1) of the GDPR. Pursuant to Article 21(2) of the GDPR, you can object to the processing for purposes of direct advertising at any time without stating any reasons. To exercise your right to object, just send a message in any format (e.g., by email to datenschutz@classicon.com), specifying which data processing activity you object to.

If you believe that the processing of personal data concerning you is being done in violation of the General Data Protection Regulation, pursuant to Article 77(1) of the GDPR, you have the right to lodge a complaint with a data protection supervisory authority (usually the state commissioner for data protection and freedom of information). The complaint can be lodged in particular with a supervisory authority in the place in which you habitually reside, at your workplace, or in the place in which the alleged violation occurred.

9. This policy was last updated in August 2023. We reserve the right to adapt our Privacy Policy to reflect changes in legislation or in case law.