Data Privacy

Information about the Processing of Your Data

Pursuant to Article 12 of the General Data Protection Regulation (GDPR), we are obligated to inform you about the processing of your data when using our website. We take the protection of your personal data seriously, and this privacy policy provides details about the processing of your data as well as your related legal rights.

We reserve the right to adjust this privacy policy with effect for the future, particularly in the case of website advancements, the use of new technologies, or changes in legal foundations and corresponding jurisprudence.

We recommend that you periodically review the privacy policy and keep a copy for your records.

Definitions

• 'Website‘ or 'Internet presence' hereinafter refers to all pages of the data controller at www.worqroom.com.
• 'Personal data' means all information relating to an identified or identifiable natural person. An identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more specific characteristics expressing the physical, physiological, genetic, psychological, economic, cultural, or social identity of that natural person. Personal data may include a person's name, email address, and phone number, as well as potentially information about preferences, hobbies, and memberships.
• 'Processing' means any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment, combination, restriction, erasure, or destruction.
• 'Pseudonymization' means processing personal data in a way that the data can no longer be attributed to a specific data subject without additional information, provided that such additional information is kept separately and is subject to technical and organizational measures to ensure that the personal data is not attributed to an identified or identifiable natural person.
• 'Consent' hereinafter means any freely given, specific, informed, and unambiguous indication of the data subject's wishes by which they signify agreement to the processing of their personal data for the specified purpose, either by a statement or by a clear affirmative action.
• 'Google' hereinafter refers to Google, LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; reachable within the European Union at Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001.

Scope

This privacy policy applies to all pages of worqroom.com. It does not extend to linked websites or internet presences of other providers.

Responsible Provider

Responsible for the processing of personal data within the scope of this privacy policy is:

WORQROOM GmbH
Am Sandtorkai 72
20457 Hamburg
E-Mail: contact@worqroom.com

Represented by:

Cheng De Yu
Am Sandtorkai 72
20457 Hamburg
E-Mail: contact@worqroom.com

Questions About Data Privacy

If you have any questions about data privacy related to our company or our website, you can contact our data protection officer:

Cheng De Yu
Am Sandtorkai 72
20457 Hamburg
E-Mail: contact@worqroom.com

Security

We have implemented comprehensive technical and organizational measures to protect your personal data from unauthorized access, misuse, loss, and other external disturbances. We regularly review our security measures and adapt them to the state of the art.:

Your Rights

You have the following rights regarding your personal data that concerns you, which you can assert against us:

• Right to information (Art. 15 GDPR),
• Right to rectification (Art. 16 GDPR) or erasure (Art. 17 GDPR),
• Right to restriction of processing (Art. 18 GDPR),
• Right to object to processing (Art. 21 GDPR),
• Right to withdraw your consent (Art. 7 para. 3 GDPR),
• Right to receive data in a structured, commonly used, and machine-readable format ('data portability') and the right to transfer data to another controller if the conditions of Art. 20 para. 1 lit. a, b GDPR are met (Art. 20 GDPR).

You can assert your rights by contacting the contact details provided in the 'Data Controller' section or by contacting the data protection officer designated by us.

You also have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data by us (Art. 77 GDPR).

Use of the Website, Access Data

You can use our website for informational purposes without disclosing your identity. When you access the individual pages of the website for informational purposes, only access data is transmitted to our web space provider to display the website to you. This includes the following data::

• Right to information (Art. 15 GDPR)
• Operating system used
• Language and version of the browser software
• Hostname of the accessing device
• IP address
• Website from which the request comes
• Content of the request (specific page)
• Date and time of the server request
• Access status/HTTP status code
• Referrer URL (previously visited page)
• Amount of data transmitted
• Time zone difference from Greenwich Mean Time (GMT)

The temporary processing of the IP address by the system is necessary to enable the delivery of the website to your computer. Processing your IP address for the duration of the session is required for this purpose. The legal basis for this processing is Art. 6 para. 1 sentence 1 lit. f) GDPR.:

The access data is not used to identify individual users and is not combined with other data sources. The access data is deleted when it is no longer necessary for the purpose of processing. In the case of data collection for the provision of the website, this is the case when you end your visit to the website.:

The storage of IP addresses is done in log files to ensure the functionality of the website. In addition, the data serves us to optimize the website and ensure the security of our information technology systems. There is no evaluation of the data for marketing purposes in this context. The data is generally deleted after a maximum of seven days, further processing is possible in individual cases. In this case, the IP address is deleted or anonymized so that it is no longer possible to associate the calling client.:

The collection of data for the provision of the website and the processing of data in log files is mandatory for the operation of the website. You can object to the processing. In the case of your justified objection, we will review the situation and either stop or adjust the data processing or show you our compelling legitimate grounds for continuing the processing.:

Cookies

In addition to the access data mentioned above, so-called cookies are stored in the internet browser of the device you are using when you use the website. These are small text files with a sequence of numbers that are stored locally in the cache of the browser being used. Cookies do not become part of the PC system and cannot execute programs. They are used to make our website user-friendly. The use of cookies may be technically necessary or for other purposes (e.g., analysis/evaluation of website usage).

a) Technically necessary cookies

Some elements of our website require that the calling browser can be identified even after a page change. The following data is processed in the cookies:

• Language settings

User data collected by technically necessary cookies is not used to create user profiles. We also use so-called "session cookies" that store a session ID that can be used to associate various requests from your browser with the common session. Session cookies are necessary for using the website. In particular, we can recognize the device used when you return to the website. We use this cookie to recognize you on subsequent visits to the website if you have an account with us; otherwise, you would have to log in again on each visit. The legal basis for this processing is Art. 6 para. 1 sentence 1 lit. f) GDPR. Session cookies are deleted as soon as you log out or close the browser.

Most browsers are set to automatically accept cookies. You can object to the processing of your data by cookies. By changing the settings in your Internet browser, you can disable or restrict the transmission of cookies. Already stored cookies can be deleted at any time. This can also be done automatically. If cookies for our website are deactivated, some functions of the website may no longer be fully available.

b) Not technically necessary

In addition, we use cookies on the website that allow an analysis of user behavior. The following data is stored and processed in the cookies, for example:

• Entered search terms
• Frequency of page views
• Use of website functions

These cookies are used to make the use of the website more efficient and attractive. The legal basis for this processing is Art. 6 para. 1 sentence 1 lit. f) GDPR. Non-technically necessary cookies are automatically deleted after a specified duration, which may vary depending on the cookie.

You can object to the processing of your data by cookies. If you do not wish to use cookies, you have the option to block or remove already stored cookies by changing your browser settings. You can also display corresponding notices before setting a cookie. If you change your browser settings to disable cookies or deactivate cookies, the functionality of this website may be limited.

If we integrate third-party cookies into our web offering, we will notify you separately in the following.

Contacting Our Company

When you contact our company, for example, by email or through the contact form on the website, we process the personal data you provide to us in order to respond to your inquiry.

For processing inquiries through the contact form on the website, it is mandatory to provide a name or a pseudonym, as well as a valid email address. Furthermore, at the time of sending the message to us, the following data is also processed:

• IP address
• Date/time of registration

The legal basis for processing is Art. 6 para. 1 sentence 1 lit. f) GDPR or Art. 6 para. 1 sentence 1 lit. b) GDPR if the contact aims at concluding a contract.

The processing of personal data from the input form serves solely for processing the contact. In the case of contact via email, there is also a legitimate interest in processing the data. The other personal data processed during the submission process is used to prevent misuse of the contact form and to ensure the security of our information technology systems.

In this context, the data is not passed on to third parties. The data is processed exclusively for processing the conversation. We delete the data that arises in this context when it is no longer required for processing, or we restrict processing to comply with legal retention obligations.

You have the option to object to the processing of your personal data for contact inquiries at any time. This is the case when the processing is not necessary to fulfill a contract with you, as described in our previous function descriptions. In such a case, the processing of the request may not be continued. In the event of a justified objection, we will examine the situation and either stop or adjust data processing, or show you our compelling legitimate reasons for continuing processing.

Processing and Disclosure of Personal Data for Contractual Purposes

We process your personal data when and to the extent necessary for the initiation, establishment, execution, and/or termination of a legal transaction with our company. The legal basis for this is Art. 6 para. 1 sentence 1 lit. b) GDPR.

After the purpose has been achieved (e.g., contract processing), personal data will be blocked or deleted for further processing unless we are authorized to further retention and processing due to your consent (e.g., consent to process the email address for sending electronic advertising mail), a contractual agreement, a legal authorization (e.g., authorization for sending direct marketing), or due to legitimate interests (e.g., retention for asserting claims) in the respective context.

Your personal data will be disclosed when:

• It is necessary for initiating, executing, or terminating legal transactions with our company (e.g., disclosing data to a payment service provider/a shipping company for processing a contract with you) (Art. 6 para. 1 sentence 1 lit. b) GDPR), or
• A subcontractor or auxiliary agent, whom we use exclusively within the scope of providing the offers or services requested by you, requires this data (such agents are, unless expressly stated otherwise, only authorized to process the data to the extent necessary for providing the offer or service), or
• A legally enforceable administrative order (Art. 6 para. 1 sentence 1 lit. c) GDPR) exists, or
• A legally enforceable court order (Art. 6 para. 1 sentence 1 lit. c) GDPR) exists, or
• We are obligated by law (Art. 6 para. 1 sentence 1 lit. c) GDPR) to do so, or
• Processing is necessary to protect vital interests of the data subject or another natural person (Art. 6 para. 1 sentence 1 lit. d) GDPR), or
• We are authorized or even obligated by predominant legitimate interests to disclose (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Any further disclosure of your personal data to other individuals, companies, or authorities will not occur unless you have effectively consented to such disclosure. The legal basis for processing in this case is Art. 6 para. 1 sentence 1 lit. a) GDPR.

Application Process

We are pleased that you are interested in us and have applied or are applying for a position in our company. Below, we would like to provide you with information regarding the processing of your personal data in connection with the application. We process the data that is necessary for the application process (name, email address, and location), as well as any data you have sent us in connection with your application, to assess your suitability for the position (or possibly other open positions in our company) and to conduct the application process.

The legal basis for processing your personal data in this application process is primarily § 26 of the German Federal Data Protection Act (BDSG) in the version valid from May 25, 2018. According to this, processing data is permitted if it is necessary in connection with the decision to establish an employment relationship. If, after the completion of the application process, the data may be necessary for legal action, data processing may be carried out on the basis of the requirements of Article 6 GDPR, especially for the exercise of legitimate interests under Article 6 (1)(f) GDPR. Our interest in this case is the assertion or defense of claims.

Data of applicants will be deleted after 6 months in case of rejection. If you have agreed to further storage of your personal data, we will include your data in our applicant pool. There, the data will be deleted after two years. In the event that you are selected for a position during the application process, the data from the applicant data system will be transferred to our personnel information system.

For the application process, we use a specialized software provider. This provider acts as a service provider for us and may have knowledge of your personal data in connection with the maintenance and upkeep of the systems. We have concluded a so-called data processing agreement with this provider, ensuring that data processing is carried out in a permissible manner.

Your applicant data will be reviewed by the human resources department upon receipt of your application. Suitable applications will then be forwarded internally to the department heads for the respective open positions. The further process is coordinated from there. In the company, only those individuals who require access to your data for the proper conduct of our application process have access to it.

You have the option to object to the processing of your data at any time. This is the case, in particular, if the processing is not necessary to fulfill a contract with you, as described in our previous function descriptions. In the event of a justified objection, we will examine the situation and either stop or adjust data processing, or show you our compelling legitimate reasons for continuing processing.

Email Marketing for Existing Customers

We reserve the right to process the email address you provided during registration in accordance with legal regulations to send you the following content by email during or after the contract processing, unless you have already objected to the processing of your email address:

• Additional interesting offers from our portfolio,
• Information about our company's events,
• Technical information,
• Sending our catalog,
• Questions about special requests,
• Overview of possible leisure offers,
• Information about public transportation routes.

The legal basis for processing is Article 6 (1)(f) GDPR. We carry out the mentioned processing for customer care and to enhance our services. We will delete your data when you terminate the newsletter subscription, but no later than two years after the contract termination.

We would like to inform you that you can object to receiving direct marketing at any time, without incurring any costs other than the transmission costs according to the basic tariffs. To do so, click on the unsubscribe link in the newsletter or send your objection to the contact details listed in the 'Responsible Provider' section.

Newsletter

You have the option to subscribe to our email newsletter on the website, which will regularly inform you about the following contents:

• Offers from our portfolio,
• Events of our company,
• Offers (including events) from third parties, provided you have given your consent,
• New articles/collections,
• Special offers/temporary offers.

The following personal data is required for receiving the newsletter:

• Recipient (name or pseudonym),
• Valid email address.

The registration for our email newsletter takes place in the double-opt-in procedure. Subsequent to entering the data marked as mandatory fields, we will send you an email to the email address you provided, in which we ask you for an explicit confirmation of your newsletter subscription (by clicking on a confirm link). This ensures that you actually wish to receive our email newsletter. If confirmation does not occur within 24 hours, we will block the information sent to us and automatically delete it no later than one month after.

We process your IP address, the time of registration for the newsletter, and the time of your confirmation in order to document your newsletter registration and prevent misuse of your personal data. The legal basis for processing is Article 6 (1)(f) GDPR. We process this data for a maximum of two years after contract termination. If newsletter registration takes place outside of a contractual agreement, we process this data for a maximum of two years after the end of the usage process. We will delete this data when the newsletter subscription ends.

After your confirmation, we will process the email address and the recipient's name/pseudonym for the purpose of sending our email newsletter. The legal basis for processing is Article 6 (1)(a) GDPR. We will delete this data when you terminate the newsletter subscription.

You can withdraw your consent to the processing of your email address for receiving the newsletter at any time, either by sending a message to us (see the contact details in the 'Responsible Provider/ Representative of the Provider in the European Union' section) or by directly clicking the unsubscribe link in the newsletter.

Hosting

We use external hosting services that provide the following services: infrastructure and platform services, computing capacity, storage resources, and database services, as well as security and technical maintenance services. All data required for the operation and use of our website is processed in this context.

We use external hosting services for the operation of this website. With the use of external hosting services, we aim to efficiently and securely provide our website. The legal basis for processing is Article 6 (1)(f) GDPR.

The collection of data for the provision and use of the website and the processing of data via external web hosts is essential for the operation of the website. You have the option to object to the processing. In the event of your justified objection, we will examine the situation and either stop or adjust data processing, or show you our compelling legitimate reasons for continuing processing.

Services for Statistical, Analytical, and Marketing Purposes

We use services from third-party providers for statistical, analytical, and marketing purposes. This allows us to provide you with a user-friendly and optimized experience on the website. Third-party providers use cookies to control their services (see the 'Cookies' section above). Unless otherwise explained below, personal data is not processed.

Some of the third-party providers offer the option to directly object to the use of their respective services, e.g., by setting an opt-out cookie.

If you activate a corresponding opt-out cookie, the external provider will no longer process data regarding your usage behavior. A selective objection against individually selected external services is also possible. If you change your browser or the device you use or delete all cookies, you will need to set the opt-out cookie again. Furthermore, you can also object to the use of cookies directly through the opt-out platform of the Bundesverband Digitale Wirtschaft e.V. (BVDW) at http://www.meine-cookies.org/cookies_verwalten/praeferenzmanager.html or through the deactivation page of the Network Advertising Initiative at http://www.networkadvertising.org/choices/. Additional information on interest-based advertising and opt-out options can be found at the following link: http://www.youronlinechoices.com/de/

Below, we provide you with information about the services of external providers currently used on our website, as well as the purpose and scope of each individual processing, and your existing objection options.

Social Network Plugins

Social network plugins are integrated on our website. These are provided by the following providers:

• LinkedIn Corporation, 2029 Stierlin Court, Mountain View CA 94043 ( https://www.linkedin.com/legal/privacy-policy ). LinkedIn has submitted to the EU-US Privacy Shield ( https://www.privacyshield.gov/EU-US-Framework ),
• Twitter Inc., 795 Folsom St., Suite 600, San Francisco, CA 94107, USA ( https://twitter.com/privacy ). Twitter has submitted to the EU-US Privacy Shield, ( https://www.privacyshield.gov/EU-US-Framework ),
• XING AG, Dammtorstraße 29-32, 20354 Hamburg, Germany ( https://www.xing.com/privacy );

The plugins are identified within our online presence by the aforementioned logos or small stylized symbols.

We offer you the option to communicate directly with the plugin provider through the button. Only if you click on the marked field and thereby activate it, the plugin provider will receive information that you have accessed the respective website of our online offering. In addition, the data mentioned under the 'Access Data' section will be transmitted.

According to the respective providers, the IP address is immediately anonymized in Germany after collection in the case of Facebook and Xing. By activating the plugin, personal data is therefore transmitted to the respective plugin provider and processed there (by US providers in the USA). Since the plugin provider primarily collects data through cookies, we recommend that you delete all cookies in your browser's security settings before clicking on the grayed-out box.

We have no influence on the data collected and processing operations, nor are we aware of the full extent of data processing, the purposes of processing, or the storage periods. We also do not have any information on the deletion of data collected by the plugin provider.

The plugin provider stores the data collected about you as user profiles and uses them for advertising, market research, and/or to tailor its website to your needs. Such evaluation is carried out especially (even for users not logged in) to display tailored advertising and to inform other users of the social network about your activities on our website.

The legal basis for using the plugins is Article 6 (1) sentence 1 lit. f) GDPR. Through the plugins, we offer you the opportunity to interact with social networks and other users, so that we can improve our offering and make it more interesting for you as a user.

You have the right to object to the creation of these user profiles, and you must contact the respective plugin provider to exercise this right. You can prevent the creation of user profiles in various ways and thereby exercise your right to object:

• by adjusting your browser software accordingly, in particular by suppressing third-party cookies, which will prevent you from receiving third-party advertisements;
• by deactivating interest-based advertisements from providers that are part of the self-regulation campaign 'About Ad' via the link http://www.aboutads.info/choices, which will be deleted if you delete your cookies.

Data is transferred regardless of whether you have an account with the plugin provider and are logged in. If you are logged in with the plugin provider, the data collected by us will be directly assigned to your existing account with the plugin provider. If you activate the button and, for example, link the page, the plugin provider will also store this information in your user account and share it publicly with your contacts.

We recommend that you regularly log out after using a social network, especially before activating the button, in order to avoid an assignment to your profile with the plugin provider.