Contents

1. Data protection at a glance
2. Who we are and what we do
3. Calling up and general use of the website
4. Use of special functions of the website
5. Newsletter advertising
6. Information we process about you
7. Explanation of cookies
8. Integration of social network plugins
9. Use of third-party technologies
10. Disclosure of information to third parties
11. Your rights
12. Contact and data protection officer
13. Changes to this privacy and cookie statement

Annex: Consent forms

The information in this section is intended to give you a brief overview of the personal data we collect and process from you when you visit this website and how we and third-party providers use cookies and similar technologies. You will find detailed information on our handling of personal data and the rights to which you are entitled in the following sections of this data protection and cookie declaration.

In order for you to visit this website and use our services, we collect, process and use the following categories of personal data.

Access data: Each time you visit this website, our web servers temporarily record technical data that your browser automatically transmits to us. This includes browser type, operating system used and time of the page request. The IP address of the requesting system is also collected. We process this data, including the IP address, exclusively for the technical administration of the website, for abuse detection and troubleshooting.

Personal data that you transmit to us: As part of the use of special functions of this website, such as the use of comment functions or contact forms, we collect and store the personal data you provide in each case. This includes your e-mail address as well as other details that are required in each case for the provision and use of the service. The same applies when registering for our newsletter.

Usage data: We also collect information about your use of this website and offers provided, such as time and duration of page interaction, sub-pages visited, search queries made and clicks on banners and links. We use the information collected for various purposes, in particular to better understand the needs and preferences of visitors to our website so that we can improve the website and its features, to create usage profiles and to show you more personalised and relevant content and offers.

Cookies and similar technologies: We collect this usage data automatically using cookies, web beacons and similar technologies. In some cases, we store unique identifiers in cookies to recognise your browser on your next visit.

Third Party Technologies: We also use or allow third-party analytics, tracking and advertising technologies to use cookies and similar technologies on this website. These third parties include service providers and advertising networks that help us better understand how you use our website and offers so that we can present you with more relevant and personalised offers. These third parties may also collect data to identify your device, for example IP address or other unique device IDs.

Social networks: In addition, we may use social network functions ("plug-ins") on some pages of this website to give you the opportunity to quickly and easily share or recommend interesting offers on these networks. When you interact with the plug-ins, these networks may also collect data about your use of our website.

Disclosure/transfer to third parties: We only share your personal data with third parties (business partners or service providers) if this is necessary for the purpose of providing this website and our services, if we are contractually or legally obliged or entitled to do so, or if you have given your prior consent. In some cases, we also work with service providers outside the European Union (EU)/European Economic Area (EEA). However, we only work with companies that offer an adequate level of data protection in accordance with the requirements of the GDPR.

Under the motto "Experience pictures", we, myphotobook GmbH, based in Berlin, distribute high-quality photo print products. Our range includes more than 200 items from photo books, calendars and gift items to fancy interior products that our customers can customise and personalise with personal digital photos. The operator of this website ("Website") is the

myphotobook GmbH

Viktor-Frankl-Straße 22

86916 Kaufering

Commercial register: HRB 268975 B

VAT ID No.: DE247799011

(hereinafter "we"),

a company of the Elanders Group, address

Elanders AB (publ)

Designvägen 2

P.O. Box 137

435 23 Mölnlycke

Sweden.

We use your data in compliance with the applicable data protection regulations, in particular the General Data Protection Regulation ("DS-GVO").

Insofar as we obtain your consent for the processing of your personal data (e.g. as part of the newsletter subscription), Art. 6 (1) sentence 1 lit. a DS-GVO and Art. 6 (1) sentence 1 lit. c DS-GVO serve as the legal basis for the processing and storage of this data. For all other processing operations in the context of the use of this website, Art. 6 (1) sentence 1 lit. f DS-GVO serves as our legal basis. According to this, the processing of personal data is permissible for the protection of legitimate interests, provided that the interests of the data subject do not prevail.

3.1 Log data (log files)

Each time this website is accessed, our servers automatically store general access data about this process in server log files ("log files").

These data include:

• the web page accessed
• the IP address of the requesting system
• Information about the browser type and version used
• The operating system used

We do not combine this data with other data sources. The temporary storage of the IP address in log files is necessary for technical reasons and to ensure system security, in particular for abuse detection. These purposes are also our legitimate interest in data processing according to Art. 6 para. 1 p. 1 lit. f DSGVO. We delete the data as soon as it is no longer required to achieve the purpose for which it was collected. The IP addresses of the users are deleted or shortened after 14 days at the latest.

3.2 Other data that we actively collect

We also actively collect other information about your use of the website and offers. This includes the following information:

• Java On / Off
• Cookies On / Off
• Shortened IP address (the last three digits are deleted)
• Referrer URL (the previously visited page)
• Operating system
• Date and time of the visit
• Information on page interaction (such as scroll heights, clicks and mouse movements)
• Time and duration of page interactions
• Subpages visited and respective length of stay
• Posed search queries
• Clicks on banners and links

We collect this information automatically by means of cookies, web beacons and similar technologies, whereby selected third-party technologies are also used (see section 9). In some cases, unique identifiers are stored in the cookies so that your browser can be recognised on your next visit. The identifiers do not allow any direct conclusions to be drawn about your identity. Detailed information on the cookies and similar technologies we use can be found in our cookie policy.

We process the above information for the following purposes:

To provide and improve our services

This includes using the information to administer and improve the technical and functional aspects of this website. We also use the information to improve our service, to make the website more user-friendly and to optimise the selection of content and functionalities.

To provide personalised offers

We also use this information to adapt our content and offers to your needs. For this purpose, we create pseudonymous usage profiles with the help of cookies. These usage profiles help us to better understand the needs and preferences of our users so that we can show you more individualised and usage-based content and offers on this website. The pseudonymous usage profiles do not contain any information from which we could directly infer your identity. We also do not combine the usage profiles with data that directly identifies the bearer of the pseudonym (e.g. e-mail address), unless you have expressly given your consent to this (for example, as part of the newsletter registration in accordance with section 5 of this data protection declaration).

For usage-based advertising ("re-targeting")

We also use this information to recommend relevant offers to you individually on third-party websites based on your previous visit to our website. In this way, those users who have already shown interest in our offers are targeted with advertising on third-party websites. The legal basis for designing and optimising our websites, offers and advertising in line with requirements and adapting them to the interests and habits of users is Article 6 (1) (a) of the German Data Protection Act (DSGVO).

You can object to the use of your usage data for the creation of pseudonymous usage profiles for advertising purposes at any time with effect for the future by sending an e-mail to datenschutz@myphotobook.de. In this case, we store a so-called "opt-out" cookie in your computer. This opt-out cookie deletes the previously stored information and prevents further collection of pseudonymised information. Alternatively, you can deactivate the setting of cookies in your browser. For further information on cookies, please refer to section 7.

We process the data in each case for as long as is necessary to fulfil the above-mentioned purposes. After that, the data is deleted.

Pseudonymous user profiles are stored for a maximum of 24 months.

4.1 Contact form and e-mail contact

We offer you various options on the website for contacting us. If a contact form is provided on the website for general or specific enquiries or messages, you can use this to contact us electronically. If you make use of this option, the following

Enter data in the input mask:

• Name
• E-mail address
• Message text
• Further details for specific enquiries or messages

Alternatively, you have the option of contacting us by e-mail.

The respective data from the e-mail or input mask is automatically transmitted to the employees responsible for processing customer enquiries at our company.

At the time of sending the contact form, your IP address and the date and time of the request are also automatically stored on our servers.

The processing of personal data from the input mask or e-mail serves solely to process your enquiry. The other data collected during the submission process (IP address, etc.) is used to prevent misuse of the contact form and to ensure the security of our information technology systems.

Personal data that are transmitted by you in the event of a contact are stored for the duration of the respective conversation with you, for a maximum of 6 months after the end of the conversation, unless there are longer legal retention periods in individual cases. The conversation is deemed to have ended when the circumstances indicate that the matter in question has been conclusively clarified.

We delete the additional personal data collected during the sending process after 14 days at the latest. You have the option to revoke your consent to the processing of personal data at any time. To do so, simply send an e-mail to: datenschutz@myphotobook.de. All personal data stored in the course of contacting us will be deleted immediately in this case

5.1 Newsletter registration

You have the option of registering for our free newsletter on our website. When you register for the newsletter, the personal data to be entered from the input mask is transmitted to us. As a rule, you only have to enter your e-mail address. In some cases, further details such as surname, first name and gender are requested. In addition, your IP address and the date and time of the request are automatically collected and stored on our servers.

When you register for the newsletter for the first time, you will receive a confirmation e-mail at the e-mail address you provided. This confirmation e-mail contains a link that you must click to confirm your registration. This so-called double opt-in procedure serves to verify whether the owner of the e-mail address has actually authorised the receipt of the newsletter and agrees to receive the newsletter.

All registration processes are logged in order to be able to prove the registration process in accordance with legal requirements. This includes the storage of the time of registration and confirmation as well as the IP address.

You can unsubscribe from our newsletter at any time and without giving reasons, without incurring any costs other than the transmission costs according to the basic rates. To do this, you can either use the unsubscribe link in our emails or contact us by email at kundenservice@myphotobook.de.

5.2 Product recommendation by e-mail

Following your purchase, you may also receive product recommendations of our own similar goods by e-mail, even if you have not subscribed to our newsletter. In doing so, we comply with the legal requirements of Art. 6 Para. 1 lit. F DSGVO in conjunction with § 7 Para. 3 UWG. You can, of course, object to your individual product recommendation at any time and without giving reasons, without incurring any costs other than the transmission costs according to the basic rates. To do this, you can either use the unsubscribe link in our emails or send your objection to kundenservice@myphotobook.de.

5.3 Use of e-mail dispatch service providers

We use the services of external service providers ("email service providers") to send and evaluate our newsletters. Some of the email delivery service providers are based outside the EU/EEA. However, we only work with companies that offer an appropriate level of data protection in accordance with the requirements of the GDPR. Further information on the transfer to companies in third countries can be found in section 10.3. We currently work with the following email delivery service providers:

• "Brevo" (formerly "Sendinblue"), a service of the company Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin, Germany.

The email addresses of the newsletter recipients and also other data described in this section 5 are stored on the servers of the email delivery service providers. Our e-mail dispatch service providers use the information collected on our behalf to dispatch and evaluate the use of the newsletter. Under no circumstances are our e-mail dispatch service providers authorised to use the data of our newsletter subscribers to write to them themselves or to pass the data on to third parties.

5.3.1 Brevo (Sendinblue)

We use the service Brevo (formerly Sendinblue) for sending e-mails and newsletters.

The provider is SendinBlue GmbH, Köpenicker Straße 126, 10179 Berlin, a subsidiary of the French parent company SendinBlue SAS, 55 rue d'Amsterdam, 75008 Paris, France.

The data you enter to receive the newsletter is stored and processed on Brevo's servers.

Brevo enables us to analyse the behaviour of newsletter recipients (e.g. opening rates, click rates). The links used in mails are tracking links that can be used to count clicks.

You can unsubscribe from our newsletter at any time - no more data will then be processed by Brevo and no email will be sent.

You can find more information here: https://www.brevo.com/de/legal/privacypolicy/

A corresponding contract exists with Brevo, which obliges Brevo to protect our customers' data and not to pass it on to third parties.

5.3.2 Brevo Tracker and Marketing Automation

We use the Brevo Tracker or Brevo Tracking Script to collect more detailed information about user behaviour on our website. The Brevo Tracker captures different types of actions and interactions that you perform on our website. This may include, for example, the purchase of products or clicks on certain products. This data is then linked to your email subscriber profile if you are already signed up to our email list or use other forms of identification. This linking enables us to better target our marketing automation. This allows us to send emails that are better tailored to your previous activities with our company. The aim of this automation is to send you more relevant and useful content based on your individual needs and interests. The Brevo tracking script allows us to deliver this type of personalised marketing on a data-driven basis. Please note that you have the option to object to the use of the Brevo tracker by making appropriate settings in your browser or by using the opt-out options described in our privacy policy.

5.4 Newsletter tracking

If you have consented to this when registering for the newsletter, we can evaluate your use of the newsletter using a tracking technology provided by the email delivery service provider. A so-called tracking pixel (also called web beacons or tracking pixel) is embedded in the HTML emails sent with the newsletter. If the newsletter is opened, the external server of the e-mail dispatch service provider can record certain data of the recipient via this tracking pixel. The name of the image file is individualised for each newsletter recipient by appending a unique ID. The mail sender notes which ID belongs to which e-mail address and can thus determine which newsletter recipient has just opened the e-mail when the image is retrieved. The following data is collected via the tracking pixel when the email is opened:

• Information about the browser and your system
• Your IP address
• Time and frequency of opening the e-mail
• Clicked links

We combine the data about your use of our newsletter with your other usage data that we have stored under a pseudonymous usage profile as part of your general use of the website (see section 3.2), if you have consented to this. This de-pseudonymises your data collected in the past. This summary entry helps us to understand your needs and preferences even better so that we can optimally adapt the contents of the newsletter and our website to your personal interests.

The wording of the declarations of consent that you may have given by subscribing to the newsletter is listed at the end of this privacy policy.

5.5 Storage period and right of revocation

The personal data processed in the context of ordering and sending the newsletter will be stored by us for as long as the subscription to the newsletter is active. You can revoke your order for the newsletter and your consent to the processing of your data for the aforementioned purposes at any time, either by using the link provided in the newsletter or by sending an e-mail to the e-mail address: datenschutz@myphotobook.de.

A separate revocation regarding the described tracking is not possible. However, you have the option of configuring the mail programme you use so that e-mails are displayed in text form and not in HTML format. This hides image and graphic files so that tracking is not possible. You can also prevent the use of tracking pixels by preventing the installation of cookies through a corresponding setting in your browser software or by deactivating this function via our cookie settings. Tracking pixels are used together with cookies. In these cases, however, the newsletter will not be displayed in its entirety and you may not be able to use all functions.

6.1 Registration and customer account

When you register with us, we use your data to create a customer account and to identify all data and orders relating to you. Your customer account remains active with us until you delete it or instruct us to do so.

6.2 Processing your order

We use the data you provide to fulfil the product order you have placed. Photo book data is deleted 60 days after delivery.

6.3 Payment processing

After successful ordering and execution of an order, we use the data provided by you for billing purposes. We retain order data and related correspondence in accordance with the statutory retention periods, but for at least 7 years.

6.4 Individual offers

We use the data you provide and the history of your orders with our company to send you individual offers.

6.5 Application

If you apply via our online portal, we use the information you provide exclusively for the application process. We keep your application documents for a maximum of 6 months after rejection, unless we hire you.

6.6 PhotoCloud

You have the possibility to store your pictures in a cloud storage provided by us. In the FotoCloud, you also have the option of sharing images with third parties and exchanging information about them. It is up to you to manage the access to the photos as well as the communication. Myphotobook only provides you with the technology. You remain responsible for the processing of the data within the cloud storage space. Myphotobook only uses this data in connection with photo book projects created by you and to monitor the use of the cloud storage space. For details please refer to the terms of use of our offer.

With your consent, we will also provide you with personalised offers for our products or from third parties.

7.4 Didomi, Cookie Consent Tool / Cookie Management

We use the consent management tool (CMP) Didomi (Didomi SAS, 32 Avenue de l'Opera, 75002 Paris, France). The CMP supports us in the transparent presentation of data processing processes and enables the storage and retrieval of the user's consent decision for the respective data processing, so that the accountability under data protection law can be fulfilled in accordance with Art. 5 (2) DS-GVO.

In doing so, Didomi as a processor processes the date and time of the visit, device and browser information, cookie and device ID as well as the consent profile "consent" or "refusal". The legal basis for the processing is the fulfilment of a legal obligation pursuant to Art. 6 (1) c) DS-GVO.

Withdrawal of consent is kept for 13 months to meet our accountability and regular limitation periods. Didomi's privacy policy can be found at https://privacy.didomi.io/.

7.5 Your choices

Most browsers accept cookies automatically. However, you can configure your browser so that no cookies are stored on your computer or a notice always appears before a new cookie is created. Every browser is a little different, so please refer to your browser's help settings to see how to manage your browser settings.

If you use different devices (e.g. smartphone, tablet, computer, etc.), please ensure that each browser on each device complies with your cookie settings.

You also have the option of switching off the receipt of all cookies via this website that are not absolutely necessary for the website to function. In this case, we store a so-called "opt-out" cookie on your device. If you delete the "opt-out cookie" set by us, use a different browser or change the device, you must activate the opt cookie again. Please also note that "opt-out cookies" only work if the browser is set so that the use of cookies is generally permitted.

Some internet browsers offer the possibility to transmit "Do Not Track" or "DNT" signals. Uniform standards for "DNT" signals have not yet been developed, this website therefore does not currently process or respond to "DNT" signals.

Please note that the complete deactivation of cookies may mean that you cannot use all the functions of this website.

If you have any questions about the use of cookies and similar technologies through this website, please email us at: datenschutz@myphotobook.de.

You can also find more information on cookies at www.aboutcookies.org or www.allaboutcookies.org.

We may use so-called social plug-ins ("plug-ins") of social networks and similar platforms ("social networks") on this website to give you the opportunity to quickly and easily share or recommend interesting offers on social networks and to make our company better known. The use of plug-ins takes place in order to make our company better known and on the legal basis of Art. 6 Para. 1 lit. a DSGVO with your consent.

We currently use plugins from the following companies:

• Plugins of the social network facebook.com, which is operated by Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA ("Facebook").
• Plugins of the social network instagram.com, which is operated by Instagram LLC., 1601 Willow Road, Menlo Park, CA, 94025, USA ("Instagram").
• Plugins of the video platform YouTube, which is operated by YouTube LLC, 901 Cherry Ave, San Bruno, CA 94066, USA - belonging to Google Inc ("YouTube").
• Plugins from Twitter, which is operated by Twitter Inc., 1355 Market St, Suite 900, San Francisco, CA 94103, USA ("Twitter").

You can recognise the plugins used by the respective logo of the associated social network (e.g. white "f" on a blue background for Facebook or an "Instagram camera" for Instagram).

Embedding a plugin in a website usually results in your browser establishing a direct connection to the servers of the respective provider when you call up the website and loading the corresponding plugin and its content onto your browser in order to integrate it into the website you are visiting. However, we have integrated the plugins in such a way that contact with the social network concerned is only established when you actively interact with the plugins, for example by clicking the "Like" or "Instagram" button and/or sharing content via the buttons. If you interact with the plugins without being logged in to the providers, the respective provider initially only receives the information from which website the corresponding page is accessed. Only when you confirm that you want to share the information is a direct contact established between you and the social network. The shared information may be transmitted directly to the server of the respective provider and stored there. The data collected by the providers may include user data, including your IP address and geographical location, as well as technical data, such as the type of browser or operating system used.

We do not control the collection, storage and use of such data by the social networks. We do not have access to the collected data. For the purpose and scope of the data collection and the further processing and use of the data by the providers, as well as your rights in this regard and setting options for protecting your privacy, please refer to the providers' data protection notices.

• Facebook privacy policy: http://www.facebook.com/policy.php
• Instagram privacy policy: https://help.instagram.com/155833707900388/
• YouTube privacy policy: https://www.google.de/intl/de/policies/privacy/
• Twitter privacy policy: https://twitter.com/de/privacy

8.1 Youtube

On our website, we use a plugin to integrate YouTube videos to display video content. The provider of the video portal is YouTube, LLC with headquarters at 901 Cherry Ave, San Bruno, CA 94066, USA.

When a page with an integrated YouTube plugin is called up, a connection to the YouTube servers is established. This provides YouTube with information about which of our pages you have accessed.

If you are logged into your YouTube account while visiting our website, YouTube can assign your surfing behaviour directly to your personal profile. However, you have the option to prevent this by logging out of your account beforehand.

YouTube is used in the interest of an appealing presentation of our online offers. This represents a legitimate interest within the meaning of Art. 6 para. 1 lit. f DSGVO.

Further information on the handling of user data can be found in YouTube's privacy policy at: https://www.google.de/intl/de/policies/privacy.

We use third-party technologies within our website for analysis, optimisation and advertising purposes.

These third parties may collect information about your use of this website and your interaction with its content and features, including the total number of visitors to this website, the referrer URL, the pages they visit, the date, time and duration of their visit, frequency, banners/links clicked, as well as information about device type, browser version, language settings and geographical location (including country, city, region). The third-party providers may also use cookies and collect your device identifier and IP address.

All information collected is transferred directly to the servers of the third-party providers and stored there. We are only provided with the information anonymously and in statistical form. We do not have access to data that enables us to identify you.

For the analysis of your website visit and, if applicable, the playout of personalised offers, we also use service providers from the USA or other states outside the EEA without an EU adequacy decision. Further information on this can be found in section 10.3.

Below we provide you with an overview and description of the third-party technologies that may be used on this website.

You can deactivate these technologies by deselecting them via our cookie banner or by following the corresponding instructions. We process this data on the legal basis of Art. 6 Ab. 1 lit. a DSGVO only with your consent.

9.1 Performance or web analysis tools

We use all performance or web analysis tools only with IP anonymisation activated, so that the last three digits of the IP address are deleted immediately after the data is collected and only the shortened IP address is stored on the servers of the respective third-party providers.

9.1.1 Google Analytics

Google Analytics is a web analytics service provided by Google Inc, Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google"). Google uses cookies to collect information about how users use our website. Google uses the collected data on our behalf to evaluate the use of our website, to compile reports on the activities on our website and to provide us with other services related to the use of our website.

The information collected by Google about the use of this website (including the shortened IP address) is stored on Google servers in the USA. Only in exceptional cases will the full IP address be transmitted directly to a Google server in the USA and shortened there. According to Google, the shortened IP address will not be merged with other Google data. Google automatically deletes user identifiers (e.g. cookie IDs) stored by Google Analytics after 14 months.

You can find more information on the terms of use and data protection of Google Analytics at: https://support.google.com/analytics/answer/6004245?hl=de.

Opt-Out: You can prevent the processing of your data by Google Analytics by downloading and installing the browser add-on provided by Google to deactivate Google Analytics, https://tools.google.com/dlpage/gaoptout?hl=de.

9.1.2 Google Analytics with Google Consent Mode

Google Analytics also uses Consent Mode, which provides a connection to the Consent Management Platform (in our case Didomi) and facilitates the anonymised measurement of events.

More information here: https://support.google.com/analytics/answer/9976101?hl=de&sjid=18046556372386624399-EU

9.1.3 Google Signals

On this website, in addition to Google Analytics, we also use the Google Signals service to create cross-device reports (so-called "cross-device tracking").

If you have activated the "personalised ads" option in your Google account and your internet-enabled devices are linked to this account, Google can analyse cross-device user behaviour using Google Analytics and your consent in accordance with Art. 6 (1) lit. a DSGVO and create database models on this basis. This includes all logins and device types of page visitors who were logged into a Google account and performed a conversion.

The data collected shows, among other things, on which device an ad was first clicked and on which device the associated conversion was carried out. We do not receive any personal information from Google in this regard, only statistics generated on the basis of Google Signals. If you would like to deactivate cross-device tracking, you can switch off the "personalised ads" function in the settings of your Google account.

For further information, please visit: https://support.google.com/analytics/answer/7532985?hl=de

9.1.4 Hotjar

"Hotjar" is an analytics software provided by Hotjar Ltd, Level 2, St Julians Business Centre, 3, Elia Zammit Street, St Julians STJ 1000, Malta.

We use Hotjar to identify opportunities to improve our website, diagnose technical problems, analyse user trends and generally optimise the website.

For more information, please see Hotjar's privacy policy: https://www.hotjar.com/privacy.

Opt-out: https://www.hotjar.com/opt-out.

9.1.5 Google Tag Manager

For our website, we use the Google Tag Manager, which is provided by Google Inc. In the European area, the company Google Ireland Limited (Gordon House, Barrow Street Dublin 4, Ireland) is responsible for all Google services.

With the Google Tag Manager, we can integrate and manage website tags centrally and easily via a user interface. Tags are small sections of code that, for example, record your activities on our website. For this, we use JavaScript code sections that are inserted into the source code of the page. The tags often come from Google products such as Google Ads or Google Analytics, but tags from other companies can also be integrated and managed via the manager. These tags have different functions and can, for example, collect browser data, feed marketing tools with data, embed buttons, set cookies and also track users across multiple websites.

In order to optimally design our website for all visitors, we use various tracking tools such as Google Analytics. The collected data helps us to identify your interests, improve our services and present relevant offers. JavaScript codes on our website are necessary for tracking. Instead of integrating each tracking tool individually into the source code, we use the Google Tag Manager. This allows us to manage the scripts in one place and gives us a better overview. The Google Tag Manager offers a user-friendly interface and does not require any programming knowledge, which helps us keep track of our tags.

The Google Tag Manager only serves as a management tool for the implemented tags and does not store any data. The individual tags of the various web analytics tools collect the data and pass it through the Tag Manager without storing it. However, the various analysis tools, such as Google Analytics, set cookies to collect, store and process data about web behaviour. Information on this can be found in our data protection texts on the respective analysis and tracking tools.

In the Tag Manager account settings, we have allowed Google to receive anonymised data from us, but this only relates to the use and usage of our Tag Manager and not your data stored via the code sections. We agree to share our website data anonymously, with Google deleting any information that could identify our website. Google uses the anonymised data for benchmarking purposes and compares it with data from other anonymous websites to create user trends and optimise processes.

The data is stored by Google on its own servers, which are distributed worldwide. Most servers are located in America. You can find out exactly where the Google servers are located at https://www.google.com/about/datacenters/inside/locations/?hl=de. You can find more information about the storage of data in our individual data protection texts for the individual tracking tools.

The Google Tag Manager manages tags of various tracking websites without setting cookies itself. Information on the management and deletion of your data in relation to the individual tracking tools can be found in the respective data protection texts.

Google is a participant in the EU-U.S. Privacy Shield Framework, which regulates the secure and correct transfer of personal data. For more information, please visit https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&tid=111388091. If you would like to learn more about Google Tag Manager, you can read through the FAQs at https://www.google.com/intl/de/tagmanager/faq.html.

9.1.6 Klar Attribution

We use the services of Klar (Klar Insights GmbH, Marktstr. 18, 80802 Munich, Germany) on our website. Klar collects, processes and stores data on this website and its subpages for reach measurement and statistical analysis on our behalf. This collection takes place on the following legal basis:

• If no consent has been given by the user, the data is collected anonymously, i.e. without collecting personal or personally identifiable data, and in groups, i.e. by randomly assigning the collected data to groups of users. It is therefore not possible to draw conclusions about individual users. This anonymous collection is mandatory in accordance with Section 25 (2) No. 2 TTDSG in order to optimise business costs and thus guarantee the desired service.
• If the user has given consent in accordance with Article 6 para. 1 sentence 1 a GDPR and Section 25 para. 1 sentence 1 TTDSG, the data to be processed is collected on a user-related basis.

Different cookies are used for the aforementioned different types of recording in order to guarantee the respective type of recording. To object to the use of clear in principle, please use this link: https://573777913.myphotobook.ie/donottrack/me. This will set a cookie with the name "do_not_track" from the domain "myphotobook.ie". Please do not delete this, as otherwise we cannot guarantee that you will not be tracked by Klar. Information on data protection and data usage by Klar can be found on the following website: https://www.getklar.com/data-protection

9.1.7 Microsoft Advertising

Our website uses conversion tracking from Microsoft Advertising, a service of Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA. Microsoft Advertising places cookies on your end device if you have reached our website via a Microsoft ad. This enables us to recognize whether someone has come to our website via an advertisement and has subsequently carried out a certain action (e.g. a purchase or filling out a form).

The information generated by the cookie is usually transferred to a Microsoft server in the USA and stored there. Microsoft processes the data in accordance with the guidelines of the EU-US Data Privacy Framework and guarantees appropriate security measures.

The data collected does not include any personal information such as names, telephone numbers or e-mail addresses, but only pseudonymized information such as your IP address, browser information, location data and device type. The data is used exclusively to track campaigns and improve our offering.

Further information on data protection at Microsoft Advertising can be found here: https://privacy.microsoft.com/de-de/privacystatement Opt-out: You can deactivate the storage of cookies by Microsoft Advertising via the settings in your browser or via the following opt-out options: https://account.microsoft.com/privacy/ad-settings or https://optout.networkadvertising.org

9.2 Content Management System (CMS)

We use the services of Contentful GmbH, Ritterstraße 12-14, 10969 Berlin, for our website. Contentful is a content management system (CMS) hosted in the cloud (AWS). All content and documents displayed on the website are stored in the CMS. When you access the website, the system also accesses the Contentful server, but Contentful does not store any user data in the log file.

The legal basis for the use of the CMS is our legitimate interest (Art. 6 para. 1 lit f DSGVO). Contentful ensures that our online offers are presented optimally for our users.

Further information on the purpose and scope of data collection and its processing by Contentful can be found on the website of the provider https://www.contentful.com and in their privacy policy at https://www.contentful.com/legal/de/privacy/.

9.3 Advertising technologies

We use third-party advertising technologies on this website, where you have consented to this, to provide you with personalised content that we think you will be interested in. Where the third party providers use cookies to perform these services, the use of the cookies and the resulting collection of information is subject to our limited control. We can only select segments and target groups (e.g. by age, interests) that we want to address with our advertising. The third-party providers may combine information they collect about your use of this website with information they have collected about your use of other websites on which the advertising technologies are also embedded.

For detailed information about what information may be collected by the advertising technologies, how it is used and shared, please refer to the respective third party providers' privacy policies linked below.

9.3.1 Google

We use marketing and remarketing functions of Google Inc. 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States ("Google") on the website. These functions allow us to display advertisements for this website in a more targeted manner.

Google states that it stores the following data in connection with the placement of advertisements: Your web request, IP address, browser type, browser language, the date and time of your request and one or more cookies that may uniquely identify your browser.

You can find more information on how Google handles your data in Google's privacy policy: https://www.google.de/policies/privacy/.

(A) Google Adwords Conversion Tracking

As part of the conversion tracking of Google AdWords, a cookie is set by Google on your computer ("conversion cookie") when you click on an ad placed by Google and are redirected to this website. The conversion cookie enables us to track whether and how many people who have reached this website via an AdWords ad make use of our offers (e.g. redeem a voucher code). Google only provides us with the data collected about you anonymously and in statistical form, so we cannot draw any conclusions about your identity. The information is used to compile visitor statistics and to optimise our advertisements on Google.

(B) Google Dynamic Remarketing

Using Google's remarketing technology, we can also target users of our website with interest-based advertising on other websites.

For this purpose, when our web pages are called up, a code is directly executed by Google and so-called (re)marketing tags (invisible graphics or code, also known as "web beacons") are integrated into the web page. With their help, an individual cookie is stored on your device. The cookies can be set by various domains, including google.com, doubleclick.net, invitemedia.com, admeld.com, googlesyndication.com or googleadservices.com. This file records which content you are interested in and which offers you have clicked on, as well as technical information on the browser and operating system, the IP address, referring websites, time of visit and other information on the use of the website. If you later visit another website that is also part of Google's advertising network, you will be presented with targeted product recommendations and interest-based advertisements that are based on the offers viewed on our website.

(C) Google DoubleClick for Publishers

DoubleClick for Publishers is also an advertising service from Google. We use this service on our website to show you offers based on your previous or simultaneous visit to partner sites. Cookies are used for this purpose, which are assigned a pseudonymous identification number. If you have created a shopping cart in a business partner's online shop but have not yet paid, and then call up this website, pseudonymous information about your open shopping cart (including purchase value and product category) may be automatically transmitted to Google via this cookie. This is the case if our business partners also use Google DoubleClick and have expressly consented to the transmission of the information. We can then offer you vouchers that match your open shopping basket. This form of advertising is completely automated and pseudonymous. We can only define general segmentation criteria (such as purchase value, product category), on the basis of which certain vouchers are played out.

The information generated by the cookies is transmitted by Google to a server in the USA and stored there.

Opt-out: If you have a Google account, you can deactivate personalised advertising from Google via the advertising settings in your account: https://myaccount.google.com/intro/privacy#ads. To do this, you must be logged in to Google. Alternatively, you can disable personalised advertising from Google using this link or download and install the browser plugin available at the following link: https://www.google.com/settings/ads/plugin?hl=de.

9.3.2 Facebook / Meta

We use pixels of the social network Facebook on the website, which is operated for users based in the EU by Meta Platforms Ireland Ltd (Facebook Ireland Ltd.), 4 Grand Canal Square, Dublin 2, Ireland.

The pixels are directly integrated by Facebook when the website is called up and store a cookie on the end device of our users. Facebook thereby receives the information from your browser that our page was called up from your end device. If you are logged in to Facebook at the same time or log in to Facebook after visiting our website, Facebook can also directly assign the visit to our website to your user account. If you visit other websites that also use Facebook pixels, this information will also be linked to your user account. However, it is not apparent to us which other websites you visit.

(A) Custom Audiences from Website (Custom Audience)

With the help of these pixels, it is possible for Facebook to determine the users of a website as the target group for the display of ads for this website on Facebook ("re-targeting"). Accordingly, we use these pixels to ensure that our advertisements on Facebook are only displayed to users who have already visited this website and shown interest in our offer. These pixels collect information about the user's browser session, in particular the banners and links clicked, a hashed version of the Facebook ID and the URL being viewed. Each Facebook user thus has a unique and device-independent Facebook ID, which enables us to address the users again on Facebook. We do not transmit any data records, in particular no e-mail addresses of our users, to Facebook.

(B) Conversion tracking

Furthermore, we can use the pixels to record and evaluate the effectiveness of our Facebook ads for statistical and market research purposes. For example, Facebook can use the pixels to determine how many users clicked on an ad placed for us and were redirected to our website.

(C) Facebook Impressions

We also receive a report from Facebook with information on the interaction of users with our ads placed on Facebook (e.g. number of "views", "likes" or "comments").

Facebook only provides us with the collected data anonymously and in statistical form, without reference to a specific person. We can only select which segments of Facebook users (such as age, interests) should be shown our advertising. However, as the data is stored and processed by Facebook, Facebook can theoretically link this data to your Facebook account and also use it for its own advertising purposes. Information on how Facebook handles your data can be found in Facebook's privacy policy, which you can access here: https://www.facebook.com/about/privacy.

Opt-out: If you have a Facebook account, you can disable personalised advertising from Facebook via the advertising settings in your account: https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen. To do this, you must be logged in to Facebook. Alternatively, you can object to usage-based advertising by Facebook on the website (http://www.youronlinechoices.com/de/praferenzmanagement/) of the European Interactive Digital Advertising Alliance.

9.3.3 Criteo

On our pages, the technology of Criteo (Criteo GmbH, Unterer Anger 3, 80331 Munich, Germany) collects information about the surfing behaviour of website visitors for marketing purposes in a purely anonymised form and sets cookies for this purpose. Criteo can thus analyse the surfing behaviour and subsequently display targeted product recommendations as suitable advertising banners when other websites are visited. In no case can the anonymised data be used to personally identify the visitor to the website. The data collected by Criteo is only used to improve the advertising offer. On each banner displayed, there is a small "i" (for information) in the bottom right-hand corner, which opens when the mouse is over and, when clicked, leads to a page on which the system is explained and an opt-out is offered. When you click on Opt-Out, an "Opt-Out" cookie is set, which prevents the display of these banners in the future. No other use or disclosure to third parties will take place. You can obtain more detailed information from Criteo in general about the data protection declaration and the data protection guidelines (http://www.criteo.com/de/privacy/corporate-privacy-policy/) and object to the anonymous analysis of your surfing behaviour (opt-out) (http://www.criteo.com/de/deactivate-criteo-banners/).

9.3.4 Sovendus

Voucher offers from Sovendus GmbH: In order to select a voucher offer that is currently of interest to you, we transmit the hash value of your e-mail address and your IP address to Sovendus GmbH, Moltkestr. 11, 76133 Karlsruhe (Sovendus) in a pseudonymised and encrypted form (Art. 6 para. 1 f DSGVO). The pseudonymised hash value of the e-mail address is used by Sovendus to take into account a possible objection to advertising (Art. 21 para. 3, Art. 6 para. 1 c DSGVO). The IP address is used by Sovendus exclusively for data security purposes and is usually anonymised after seven days (Art. 6 para. 1 f DSGVO). In addition, we transmit the order number, order value with currency, session ID, coupon code and timestamp to Sovendus in pseudonymised form for billing purposes (Art. 6 para.1 f DSGVO). If you are interested in a voucher offer from Sovendus, if there is no advertising objection to your e-mail address and if you click on the voucher banner that is only displayed in this case, we will transmit your title, name and e-mail address in encrypted form to Sovendus for the preparation of the voucher (Art. 6 para. 1 b, f DSGVO). For further information on the processing of your data by Sovendus, please refer to the online data protection information at www.sovendus.de/datenschutz.

Advantage offers from Sovendus GmbH: In order to select an advantage offer that is currently of interest to you regionally, we transmit your title, year of birth, country, postcode, hash value of the e-mail address and your IP address to Sovendus GmbH, Moltkestr. 11, 76133 Karlsruhe (Sovendus) in pseudonymised and encrypted form (Art. 6 para. 1 f DSGVO). The pseudonymised hash value of the e-mail address will also be used by Sovendus to take into account any objection you may have to advertising (Art. 21 para.3, Art. 6 para.1 c DSGVO). The IP address is used by Sovendus exclusively for data security purposes and is usually anonymised after seven days (Art. 6 para. 1 f DSGVO). Insofar as necessary for the respective advantage offer, your name, address data, e-mail address and/or telephone number will be transmitted by us in encrypted form to Sovendus when you click on the advantage offer in order to prepare the personalised request for the advantage offer from the product provider (Art. 6 para.1 b, f DSGVO). For further information on the processing of your data by Sovendus, please refer to the online data protection information at www.sovendus.de/datenschutz.

9.3.5 WonderPush

We provide news and updates to our website via web push notifications.

To use this free service, which is powered by our push provider WonderPush (https://www.wonderpush.com/), you must first sign in by confirming an authorisation request, which depends on your browser and device.

The navigation data we store and process to operate this service and send you relevant messages is anonymised and kept on WonderPush's servers for a maximum of 90 days and never shared with third parties. We do not store any personal data. In particular, we do not store IP addresses in connection with this service.

You can stop receiving our web push notifications at any time by unsubscribing.

Learn how to manage your Web Push subscription and delete associated data here: https://docs.wonderpush.com/docs/manage-your-data-and-unsubscribe-from-web-push-notifications

9.3.6 The Reach Group

Cookies are used on our website to enable the placement of retargeting campaigns by The Reach Group GmbH (Am Karlsbad 16, 10785 Berlin, Germany). The data stored within the cookie is only an encrypted, pseudonymised user ID. The adserving technology used uses a shortened and hashed IP address to evaluate the geographical region, the access speed and the Internet provider. In addition, the time of the visit, the IDs of the products that were viewed, searched for or purchased, the URLs of the pages viewed, possible search terms and/or the IDs of the categories called up are stored in order to deliver more relevant advertising content. IP or browser data is stored exclusively in Germany and for the anonymised compilation of visitor statistics and the allocation of transactions. It is not possible to draw conclusions about specific persons, the exact address, the location or further personal data at any time. IP data is not explicitly passed on to third parties. All information also has a maximum expiry date of 90 days, after which your browser automatically deletes the stored data. You can prevent the storage of cookies by setting your browser software accordingly. You can also prevent the collection of data generated by the cookie and related to your use of the website by activating the OptOut function under the following link: https://hal9000.redintelligence.net/privacy/8lcfmzhxc8d6/.

Further information on data protection at The Reach Group GmbH can be found at https://trg.de/datenschutzerklarung/.

This objection is valid as long as the associated OptOut cookie is not deleted. This cookie is set for the domain, per browser and user of a computer. If you access our website from several end devices and browsers, you must therefore object to the data collection separately and again on each of these devices and in each browser.

9.3.7 Targeting 360

So-called 'cookies' are used on our website to enable retargeting advertising campaigns by targeting360 GmbH, Gredinger Str. 24a, 90453 Nuremberg, Germany. The ad serving technology of NEORY GmbH, Dortmund, is used for this purpose. For the same purpose, targeting360 GmbH may also load technologies from the providers Adform, Adition, Google or The Trade Desk. These technologies may set further cookies for this purpose.

The purpose of retargeting is to be able to display interest-based advertising to visitors to our websites on websites of partners in the advertising network.

Cookies are small text files. Unless they are so-called 'session cookies', cookies remain stored on your end device until you delete them. In general, you can prevent the storage of cookies by making the appropriate settings in your browser software or have them deleted, for example, when you close your internet browser.

When you visit our website and after you have given your consent, a cookie with a unique identifier (cookie ID) is stored in the browser on your end device by the technology used. If a cookie stored in the browser with this ID is read on a partner site, your end device can be recognised in this way. You can then be shown advertisements on the partner site that relate, for example, to content that you have previously accessed on our websites.

In order to only show you advertising that corresponds to your interests, a usage profile is created by evaluating the data that is transmitted from your end device to the requested server during your interaction with the websites. Your IP address is anonymised at the beginning of the processing by shortening and hashing. In addition, the cookie ID, the approximate location according to the shortened IP address, internet provider, access speed, technical information on the browser and terminal device used, operating system, preferred languages according to browser settings, HTTP referrer and date and time of the server request are used for the usage profile. Your pseudonymised data processed in this way cannot be assigned to you without further ado. An accounting of an advertising success also takes place via pseudonymous data, without being able to infer a concrete person.

The legal basis for the use of the cookies used here and the subsequent processing is, in accordance with Art. 6 para. 1 lit a) DSGVO, your consent given for this.

You can terminate the processing of the above-mentioned data based on your consent and the further use of the cookies used for this purpose by making use of your right of revocation or objection under the following link: https://ad.adsrv.net/privacy/kdb0xdq3ls8m.

9.3.8 Usemax advertisement

usemax advertisement is a service of Emego GmbH, Rheinpromenade 13, 40789 Monheim am Rhein, Germany. When the user accesses our website, a cookie is set via the usemax ad server, which contains a reference to his or her surfing behaviour.

The information collected in this way is used to address the user individually and in a personalised manner via the website or via advertising placements on third-party websites which are connected to usemax.

The user can delete his or her collected data via the following link: https://www.usemax.de/index.php?l=rm&kunde=&id=1

9.3.9 advanced store GmbH

For the optimised playout of relevant advertising material and advertising campaigns, advanced store GmbH, Stefan-Heym-Platz 1, 10367 Berlin, Germany collects pseudonymous information and data about users' surfing behaviour on this site using ad4mat technology.

This is done by storing a randomly generated pseudonymous user ID in the local storage of your computer. advanced store uses this data, which is stored locally in your browser's cache and can be read even after you close the browser window - unless you delete the cache - with the help of an analysis of surfing behaviour based on a special algorithm in order to recommend relevant products and offers on this and other websites, i.e. products and offers that correspond to your interests through advertising banners. The use of the usage data, i.e. the addresses (URLs) of the pages you visit on this website, is solely for the purpose of optimising the recommended advertising content; the website user is not personally identified. Third parties cannot access the data stored in the local storage.

advanced store GmbH is committed to the European industry standard for online behavioural advertising, the EDAA.

Further information on this as well as a preference management can be found here http://www.youronlinechoices.com/de/. The services of advanced store GmbH are provided on the basis of Art. 6 para. 1 lit f DSGVO. Should you wish to use the

If you wish to object to the use of pseudonymised user IDs and the corresponding analysis of your surfing behaviour, you have the option to do so via the cookie administration.

You can also find further information and the privacy policy of advanced store GmbH here: https://www.advanced-store.com/de/datenschutz/

9.3.10 KUPONA

The use of KUPONA GmbH (Kothenbachweg 6 D-36041 Fulda) enables us to recognise visitors to our website and present advertising material tailored to their interests. The advertising material may also relate to products and services that users have already viewed on our website. To do this, we analyse user interactions on one of our websites, such as which offers users are interested in, in order to be able to display targeted advertising to users on other websites even after they have visited our website. For this purpose, KUPONA uses tracking technologies such as cookies and so-called tracking pixels to collect the information generated by the user's terminal device about interactions with our website and our advertising materials (e.g. calling up a specific web page or clicking on an advertising material) as well as access data, in particular IP address, browser information, the website previously visited as well as the date and time of the server request for the purpose of cross-device analysis of user behaviour, playout and measurement of individualised advertising materials to address our users again. For these purposes, it can also be determined whether different end devices belong to you or your household. For this purpose, your data will be transmitted to the ad server of NEORY (NEORY GmbH, Brandschatstraße 2, 44149 Dortmund, Germany). While loading a website on which individualised advertising is to be displayed, your browser sends a request to NEORY's ad server via which the individualised advertising is placed in real time. The ad server is used for the purpose of central planning and control of the advertising content, targeted delivery of advertisements and optimisation of the advertising space as well as for reporting on the success of the delivery of the advertising material. The legal basis for the processing of your data is your consent in accordance with Art. 6 Para. 1 S. 1 lit. a) DSGVO. KUPONA also processes your data in the USA. The legal basis for the transfer to the USA is your consent according to Art. 49 para. 1 p. 1 lit. a) DSGVO. KUPONA will automatically delete your data after 60 days without updating it. You can revoke your consent to the processing and the third country transfer at any time by making the appropriate settings in the settings of the Consent Tool. In this case, the lawfulness of the processing carried out on the basis of the consent until the revocation is not affected by the revocation.

9.3.11 Fatmedia

We use the re-targeting and pre-targeting function of fatmedia.io (a brand of ad-shot LLC) on our websites. This allows us to target visitors to our websites with advertising by displaying personalised, interest-based advertisements for visitors to the websites. fatmedia.io uses cookies to carry out the analysis of website usage, which forms the basis for the creation of the interest-based advertisements. No personal data of visitors to the website is stored. If the user visits another website, he or she will be shown advertisements that are highly likely to take into account previously accessed product and information areas or that contain a high level of relevance for the user. Opt-out link: https://analytics.fatmedia.io/opt-out

9.3.12 Taboola

Taboola Europe Ltd (Oneustonsq, 40 Melton Street, NW1 2FD London, United Kingdom): We use Taboola's service on our website, which enables user-specific recommendations for content and advertisements to be played based on surfing behaviour and customer interests in order to improve the user-friendliness of our offering. The usage profiles are created using pseudonyms, they are not merged with the data about the bearer of the pseudonym and do not allow any conclusions to be drawn about personal data. Taboola collects the following user information by means of cookies:

• Operating system of the user
• Web pages accessed/content on our websites
• Reference/link from which the user came to our website
• Time and number of website hits
• Error page calls
• Location information (city and state)
• IP addresses in shortened form

Your rights/opposition: You can find more information about Taboola at https://www.taboola.com/privacy-policy. There you can deactivate tracking at any time in the "User Choices" section. Once you have opted out, you will no longer be shown personalised content/advertising.

9.3.13 Pinterest Tag / Pixel

In order to analyse and optimise our online offer and to use our Pinterest campaigns in a needs-based manner, we use the "Pinterest tag" (an individual code snippet) of the company Pinterest Inc., 635 High Street, Palo Alto, CA, USA, ("Pinterest"), which is integrated on our website. This processing is based on our legitimate interests pursuant to Article 6(1)(f) of the General Data Protection Regulation (DSGVO). When a Pinterest user clicks on or sees our ad, further actions are tracked and target groups are formed that have shown interest in our offer. This allows us to ensure that our Pinterest ads are only shown to users who are interested in our products. This data allows us to measure the conversions of the Pinterest campaigns and is used for statistical and market research purposes to optimise our campaigns.

The data collected is anonymous and does not offer the possibility to determine the identity of the user. Device information (e.g. type, brand), operating systems, IP addresses, time of the call, type and content of the campaign, reactions to the campaign (e.g. purchase completions, newsletter sign-ups) as well as device identifiers are collected in order to recognise the user's terminal device on our website.

Processing for behavioural and interest-based advertising purposes is recognised as a legitimate interest in accordance with recital 47 of the GDPR. The data is stored in accordance with the statutory retention periods and then automatically deleted. If you log into your Pinterest account after visiting our website or visit our website while logged in, this data may be stored and processed by Pinterest. Pinterest may possibly link this data to your Pinterest account and also use it for its own advertising purposes. For more information, please refer to Pinterest's privacy policy: https://policy.pinterest.com/de/privacy-policy. You have the option to object to this special data processing at any time, either by deactivating the corresponding settings under "Individual customisation" in your Pinterest account https://help.pinterest.com/en/article/personalization-and-data or by clicking on "Opt-Out".

9.3.14 TikTok Pixel

We use the TikTok Pixel, a conversion tracking tool for advertisers, on our website. The tool is provided by TikTok, a company based in China. TikTok Technology Limited (10 Earlsfort Terrace, Dublin, D02 T380, Ireland) is responsible for the European region.

Please note that TikTok also processes your data in the USA.

TikTok uses so-called Standard Contractual Clauses (SCC) in accordance with Article 46(2) and (3) of the GDPR as a basis for the processing of data by recipients located in third countries, in particular in the USA, or to enable data transfers there. Standard contractual clauses are model templates of the EU Commission that are intended to ensure that your data comply with European data protection standards even if they are transferred to and stored in third countries (such as the USA). Through these clauses, TikTok undertakes to comply with the European level of data protection when processing your relevant data, even if the data is stored, processed and managed in the US. These clauses are based on an implementing decision of the EU Commission. You can find the decision with the relevant standard contractual clauses here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de

For more information on the standard contractual clauses and the data processed through the use of the TikTok Pixel, please see the privacy policy on https://www.tiktok.com/legal/privacy-policy-eea?lang=de and https://ads.tiktok.com/i18n/official/policy/controller-to-controller respectively.

9.4 Trustpilot rating service

As part of our quality improvement, we conduct a satisfaction survey through our partner Trustpilot (Trustpilot A/S, Trommesalen 5, 3. sal, 1614 København, Denmark) after every order. You can, but do not have to, open an account with Trustpilot for the survey. You are then subject to Trustpilot's privacy policy and terms of use. Without an account, your information is processed anonymously for us and helps us to improve our products. This is done on the basis of our legitimate interests under Article 6(1f) DSGVO. To protect your data subject rights, we have concluded an order processing agreement with Trustpilot for this purpose. For ratings via the rating service https://de.trustpilot.com/, the conditions and data protection provisions of trustpilot.de apply, published at https://de.legal.trustpilot.com/end-user-privacy-terms and https://de.legal.trustpilot.com/end-user-terms-and-conditions. If you participate (prior registration required) in this rating system, your rating will be published on our website and on the websites of Trustpilot and its partners in accordance with the terms and conditions of trustpilot.de. For the purpose of using trustpilot.co.uk, we pass on your e-mail address, your name and our internal booking number to Trustpilot A/S, Trommesalen 5, 3. sal, 1614 København, Denmark.

9.5 Interacty

We use Holge SIA's Interacty service to embed interactive elements on our website. This involves processing your IP address and device-related information. You can block access to Interacty services via your browser. For more information, please see their privacy policy at https://interacty.me/de/privacy-policy. The legal basis for the processing of your personal data is § 25 para.1 TTDSG.

Sometimes we need your email address and name to enter our quizzes, competitions and tests. We also measure play time, count attempts and collect your IP address to evaluate and comply with rules. By participating, you consent to the collection of data.

When you send us your details, you agree to us transferring them to our email marketing tool Brevo. This allows us to send you prize notifications and inform you about specials and news. There is a commissioned data processing contract with Brevo to ensure the careful processing and protection of your data. We do not share your data with other service providers. You can unsubscribe from our newsletter at any time by clicking on the appropriate link in each email.

Participation in our free competitions and games is in no way connected to Meta or other social media platforms. The competitions are exclusively organised by us and legal recourse is always excluded. If advertising is included, this only concerns our own company and our own products. By participating in the games, you agree to these rules and the use of your data.

9.6 Amazon Cloudfront

We use the Cloudfront Content Delivery Network (CDN) from Amazon Web Services Inc, 410 Terry Avenue North, Seattle, WA 98109-5210, to provide faster website load times, increased website resilience and data loss protection. Some images and videos embedded on the website are retrieved from Cloudfront CDN when the page loads and your IP address and other information is transmitted to and stored by Amazon on servers located in other EU countries.

The use of Amazon Web Services and the Cloudfront CDN is a legitimate interest pursuant to Art. 6 (1) lit. f DSGVO. Amazon Web Services is certified for the EU-European Privacy Shield. Further information on the data protection measures of Amazon Web Services can be found at https://aws.amazon.com/de/data-protection/ and in the current data protection declaration at https://aws.amazon.com/de/privacy/.

9.7 Payment service provider / Payment provider

9.7.1 Paypal

We offer the possibility of payment via PayPal on our website. This is a service provided by PayPal (Europe) S.à.r.l. et Cie, S.C.A., with its registered office at 22-24 Boulevard Royal, L-2449 Luxembourg. If you choose to pay via PayPal, the payment data you enter will be transmitted to PayPal.

The transfer of your data to PayPal is based on the legal grounds of Art. 6 para. 1 lit. a DSGVO (consent) and Art. 6 para. 1 lit. b DSGVO (processing for the performance of a contract). You have the option to revoke your consent to data processing at any time. Please note that a revocation does not affect data processing operations that have already been carried out.

All PayPal transactions are subject to the PayPal privacy policy. You can find this at https://www.paypal.com/de/webapps/mpp/ua/privacy-full

9.7.2 Stripe

We offer the option of payment by credit card via Stripe on our website. The payment processing is carried out by Stripe Payments Europe Ltd. with its registered office at 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. As part of the payment process, we pass on the information required for this, such as name, address, account number, bank code, credit card number if applicable, invoice amount, currency and transaction number, in accordance with Art. 6 Para. 1 lit. b DSGVO.

Your data will only be passed on for the purpose of processing payments with Stripe and only insofar as this is necessary for this purpose. You can find more information about Stripe's data protection at: https://stripe.com/de/privacy#translation.

9.7.3 Adyen

We offer the option of payment by credit card, PayPal and Klarna via Adyen on our website. The payment processing is carried out by Adyen NV. with its registered office at Simon Carmiggeltstraat 6, 1011 DJ, Amsterdam, The Netherlands. As part of the payment process, we pass on the information required for this, such as name, address, account number, bank code, credit card number if applicable, invoice amount, currency and transaction number, in accordance with Art. 6 Para. 1 lit. b DSGVO.

Your data will only be passed on for the purpose of processing payments with Adyen and only insofar as this is necessary for this purpose. You can find more information about Adyen's data protection at: Privacy Statement - Adyen

9.8 Prerender.io

Our site uses the Prerender.io service to display cached versions of our website to users. This increases the loading speed. The service is provided by saas.group Germany, SaaS.Group GmbH, Attilastr. 18, 12529 Schönefeld / Germany or saas.group Americas: SaaS.Group LLC, 304 S. Jones Blvd. Jones Blvd. #1205, Las Vegas, NV 89107 / USA.

You can find more information at: https://docs.prerender.io/docs/content-security-1

9.9 Sentry

We want to provide our users with the best possible service, but we cannot exclude the possibility of errors. In order to determine whether errors occur in the provision of our service, we use the service provider Functional Software Inc. (Sentry), 132 Hawthorne Street, San Francisco, CA 94105, USA, to log errors.

For this purpose, Sentry collects anonymous error data on our behalf. Further details can be found in Sentry's privacy policy, which is available at the following link: https://sentry.io/terms/privacy/

We will only disclose your personal data to third parties if this is necessary for the purpose of providing our products and services, if we are contractually or legally obliged or entitled to do so, or if you have given your express consent.

10.1 Passing on to suppliers

We work with various suppliers (printers, postal service providers, photo optimisers) who produce the products offered in our online shop for us. The transfer of data therefore takes place in accordance with Art. 6 Para. 1 lit. b DSGVO for the purpose of contract processing.

10.2 Passing on to service providers

We also work with technical service providers who are authorised on the basis of Art. 28 DS-GVO to provide services on our behalf and in accordance with our instructions. These companies may have access to your personal data, but only to the extent necessary to perform their respective tasks. For example, we commission service providers to send our newsletters or provide other marketing services, customer service, web analysis or infrastructure and IT services as well as website hosting.

10.3 Transfer of your data to companies outside the EU

It may happen that the service providers we commission are located in a third country, i.e. in countries outside the European Union (EU)/European Economic Area (EEA). However, we only work with such companies that offer an adequate level of data protection in accordance with the requirements of the GDPR.

We currently work with some service providers that are based in the USA. The data transfer to service providers in the USA is based on so-called standard contractual clauses of the EU Commission. The EU Commission's standard contractual clauses are a contract in which the service provider undertakes to protect the user's data, to process it on our behalf in accordance with the contractual regulations and, in particular, not to pass it on to third parties.

You have the following rights free of charge in relation to our processing of your personal data.

11.1 Right of withdrawal according to Art. 7 DS-GVO

If you have given us your consent to process your data, you have the right to revoke your consent at any time by sending an e-mail or letter to our contact address as stated below. If the revocation is justified, we will immediately stop processing your data.

11.2 Right to information pursuant to Art. 15 DSGVO

You have the right to obtain information about your personal data stored by us at any time. However, we would like to point out that with regard to the pseudonymous usage profiles we have created, we are not able to assign these to individual persons. Accordingly, we are unable to provide information on this data unless you provide us with information that enables us to assign the usage profile to you personally. We will point this out to you separately in the event of a request.

11.3 Right of rectification and deletion pursuant to Art. 16 and 17 DSGVO

You can demand that we correct incorrect data and - insofar as the legal requirements are fulfilled and there are no storage obligations to the contrary in the case of deletion - complete or delete your data.

11.4 Right to restrict the processing of your data pursuant to Art. 18 DSGVO

You can demand from us - insofar as the legal requirements are met - that we restrict the processing of your data.

11.5 Right to data portability according to Art. 20 DSGVO

If you have provided us with data in the context of perception, you have the right to receive this data in a structured, common and machine-readable format. Within the scope of our photo cloud, you have the option of exporting or downloading your data at any time.

11.6 Right to object on the legal basis of "legitimate interest" pursuant to 21 DSGVO

Under the conditions of Art. 21 (1) DSGVO, you also have the right to object to data processing on grounds that may arise from your particular situation. The above general right to object applies to all processing purposes described in this privacy statement that are not processed on the basis of consent given by you. In contrast to the specific right of objection directed at data processing for the creation of a user profile pursuant to section 3.2 of this data protection and cookie statement, we are only obliged to implement such a general objection if you provide us with reasons of overriding importance for this (e.g. a possible danger to life or health). If you wish to make use of this right, please contact us at the contact address stated in section 12.

11.7 Right to complain to the supervisory authority

You also have the right to lodge a complaint with a supervisory authority if you believe that your data is being processed in breach of applicable law. You can contact the data protection authority responsible for your place of residence or your federal state or the data protection authority responsible for us.

The data protection authority responsible for us is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit Alt-Moabit 59-61 10555 Berlin Phone: +49 30 13889-0 Fax: +49 30 2155050 E-mail: mailbox@datenschutz-berlin.de

If you have any questions about this privacy statement, wish to exercise your rights or have any suggestions or complaints regarding the processing of your personal data, please contact us by email at: datenschutz@myphotobook.de.

You can also reach us at any time at the following contact details:

myphotobook GmbH

Data protection

Köpenicker Str. 10

10997 Berlin

Phone: +49 7151 16517 0

You can also reach our data protection officer, Mr Michael Mayer, using these contact details.

We reserve the right to make changes to this data protection and cookie statement at any time in the future. The current version of this data protection and cookie policy will be published on the website. Please therefore note the current version of our data protection and cookie policy.

---

Annex: Consent forms

In connection with your use of this website, you may have expressly given one or more of the following consents.

1. when calling up our website (cookie consent)

"This website uses cookies and similar technologies to analyse website usage and provide you with personalised content. Third parties may also place cookies on this website for advertising, tracking and analysis purposes. You can find out more about the cookies used on this website and your choices in this regard in our [Cookie Policy]. By continuing to use our website, for example by clicking on the content, you consent to this use of cookies and similar technologies. You can change your cookie settings at any time."

2. upon registration

"I have read the [privacy policy] and consent to the processing of my personal data for the purpose of registration. I can revoke this consent at any time."

3. when registering for the newsletter

• Yes, I would like to register for the newsletter and agree to be informed by myphotobook GmbH regularly by e-mail about current offers, events and/or other information.
• I also agree to a personalised user profile being created in order to adapt the content of the newsletter to my personal interests. This is done by evaluating my use of the newsletter (e.g. opening the emails and clicking on the offers) and the website using tracking pixels and cookies, as explained in more detail in our [Privacy and Cookie Policy].

You can cancel your newsletter subscription at any time with effect for the future and revoke your consent to the creation of a user profile. To do so, please click on the link at the end of the newsletter or send us an email to datenschutz@myphotobook.de.

4. when using a contact form

"I have read the [privacy policy] and consent to the processing of my personal data described therein for the processing of my request. I can revoke this consent at any time."

--

LAST UPDATED OCTOBER 2023