Privacy policy of Binder+Co AG

DOWNLOAD

1. introduction

With this data protection declaration we would like to inform you about our data protection policy, how we collect, use and process your personal data and how we fulfil our legal obligations towards you. The protection of your personal data is of particular concern to us and we are committed to protecting and safeguarding your data protection rights. We therefore process your data exclusively on the basis of the statutory provisions (DSGVO, TKG 2003). This data protection declaration applies to the personal data of visitors to our website, applicants, customers and suppliers or partners with whom we may contact. Note: The status of the data protection declaration is indicated by the date (below). We reserve the right to change this data protection declaration at any time with effect for the future. A current version can be accessed directly via our website. Please visit our website and this page in particular regularly and inform yourself about the applicable data protection declaration. 1.1 TermsPersonal Data: Information by which you can be directly or indirectly identified as an individual; "Directly" means, for example, your name, postal address, email address and telephone number or a unique device identifier; "Indirectly" means combined with other information to identify you. Processing: the term "processing" means any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organisation, filing, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction; ((Art. 4 ) GDPR). 1.2 Where do we obtain your personal data? We obtain personal data from the following sources:

• Applicant data: from the applicant himself, via professional agencies and career portals.
• Customer data: from the customer himself, from credit institutions
• Supplier/service provider data: from the supplier/service provider itself.

1.3 For what purpose is your personal data used? Your personal data will be used exclusively for the following purposes.

• Acquisition, order execution and processing, sales and after sales
• Applications
• Invoicing
• Cooperation on projects

1.4 In the context of which activities is your personal data collected? Applicant data: We collect your personal data as part of the following procedures:

• Application procedure
• Unsolicited applications

Customer data: Your personal data is collected within the following procedures:

• Acquisition
• Updating the contact database
• Collaboration on projects
• Invoicing

Supplier and service provider data: Your personal data is collected within the following procedures:

• Updating the contact database
• Collaboration on projects
• Invoicing

1.5 What types of personal data are collected? We process the personal data that we receive from you in the course of a business relationship, a visit to our website or an application.

• Visitors to our website: We process certain information in order to be able to offer you optimal, tailor-made and targeted information. We only ask for information that will actually help us serve you better, such as your name, email address and company.
• Applicants: We need to process certain information about you in order to provide you with optimal, tailored employment opportunities. We only ask for information that will actually help us to help you better, such as name, age, date of birth, contact details, education details, work history.
• Customers: If you are a customer of Binder+Co AG, we need to collect and use information about you or people within your organisation in order to provide services to you.
• Suppliers/service providers: If you are a supplier or service provider for Binder+Co AG, we need to collect and use information about you or persons within your organisation in order to be able to use your services or to jointly provide services for our customer.

Depending on the nature of the personal data in question and the reasons for its processing by us, we may not be able to fulfil our contractual obligations or, in extreme cases, may not be able to continue the business relationship if you refuse to provide us with this data. 1.6 What personal information is used in detail? Want to know in more detail what information we collect about you? Here is a more detailed description of the information we collect. The information described below is of course in addition to the personal data we are legally obliged to process in the relevant situations. Applicant Data: Depending on the relevant conditions and applicable local laws and regulations, we may collect some or all of the information listed below in order to provide you with employment opportunities tailored to your situation and interests. The following information is collected:

• Name
• Address
• Contact details (email address, phone numbers,...)
• Age/Date of birth
• Gender
• Photo
• Details of education
• School education
• Work history
• Employment references
• Citizenship
• Additional information that you provide to us of your own accord

Please note that this is not an exhaustive list of the personal data we may collect. Customer data or data from suppliers/service providers: We usually need your contact details or the contact details of individual contacts within your organisation (such as their names, telephone numbers and email addresses) to ensure a smooth business relationship. Other information collected:

• Name
• Company form
• Address
• Location
• E-mail address
• Telephone number
• Contact persons
• Company bank data
• Company register number
• UID
• Short profile
• Departments / Specialist departments
• Credit information

1.7 How is your personal data protected? The protection of your information is important to us. We therefore take appropriate measures to prevent unauthorised access to and misuse of your personal data. Your data is stored by us in an ERP system, the provider of which also adheres accordingly to the specifications of an order processor in accordance with the German Data Protection Regulation (DS-GVO). 1.8 How long will your personal data be stored?Applicant data:

• Applicant data is stored for a maximum of six months, depending on the duration of the application process. After the end of the selection procedure, these are deleted again - provided that no other legitimate interests prevent deletion. Such legitimate interests in this sense are, for example, obligations to provide evidence in proceedings under the Equal Treatment Act (GLBG §15). Longer storage is based on your consent.
• In the event that no employment relationship is established, the application will be retained for as long as there is a possibility that the application may be of interest, unless a retention of evidence has been agreed in writing.
• Your applicant data will only be collected, processed and used by us and our subsidiaries for the purpose of the applicant selection process and for internal statistics. Your personal data will be stored and processed in accordance with the applicable data protection regulations.
• We will store your personal data in our system in order to be able to allocate any queries and, if necessary, to be able to approach previous applicants in the event of new vacancies.

Client data:

• Data will be stored on an ongoing basis. As long as business relations exist between the two parties, the data will be retained. Legally required retention periods are observed.

Supplier and service provider data:

• The data is stored on an ongoing basis. The data is retained as long as business relations exist between the two parties. Legally required retention periods are complied with.

As a general rule, we always delete or block your personal data when the purpose for storing it no longer applies. However, data may be stored beyond this if this is provided for by legal or statutory requirements to which we are subject, for example with regard to statutory storage and documentation obligations. In such a case, we will delete or block your personal data after the end of the corresponding requirements. 1.9 Will your personal data be passed on? All personal data from your application and all attachments that you specify in your application will also be forwarded to an internal department or branch if necessary. In this process, only the respective personnel managers and selected executives of Binder+Co AG will have access to your data. Your details will be treated in strict confidence. Personal data will only be passed on to professional agencies (e.g. CATRO). Creditworthiness information is also obtained without express consent in order to fulfil our contractual obligations or maintain our business relationships. External forwarding of certain customer, supplier or service provider data may be forwarded to the following companies within the following procedures, but only with your express consent:

• Subsidiaries
• Trading and distribution partners
• carriers, freight forwarders, subcontractors and delivery agents
• Customs authorities
• Professional agencies (e.g. CATRO)
• Other third party companies involved in projects (subcontractors, planners, structural engineers, etc.)

1.10 Your rights One of the main objectives of the GDPR is to protect and clarify the data protection rights of EU citizens as well as individuals within the EU. This means that you still have various rights with regard to your data, even if you have already provided it to us. These rights are described in more detail below. If you wish to contact us in relation to these rights, please contact us. We will endeavour to respond to your request as soon as possible and in any event within one month (extensions may be applied which we are entitled to by law). Please note that we may keep records of our communications in order to better resolve issues raised by you. Right to object: based on this right, you may object to us processing your personal data if we do so for any of the following reasons:

• our legitimate interests,
• for statistical purposes.

The "legitimate interests" category above is the category most likely to apply to visitors to our website, candidates, clients, suppliers and service providers. If you object to us processing your personal data because we consider it necessary for your legitimate interests, we must stop the relevant activities as a result of your objection unless:

• we can demonstrate that we have overriding legitimate grounds for processing which override your interests; or
• we are processing your data to assert, exercise or defend a legal claim.

Right to withdraw consent: If you have given us your consent to process your personal data for certain activities, you can withdraw that consent at any time. We will cease the activity to which you had previously consented unless, in our opinion, there is an alternative reason that justifies our continuing to process your data for that purpose. If this is the case, we will inform you. Data subjects' request for access to personal data: You can request confirmation from us at any time as to what information we hold about you and ask us to amend, update or delete that information. We may ask you to confirm your identity or ask you for more information about your request. If we give you access to the information we hold about you, we will not charge you for this unless your request is "manifestly unfounded or excessive". If you request further copies of this information from us, we may charge you reasonable administrative costs where permitted by law. We may refuse your request where permitted by law. If we refuse your request, we will give reasons in each case. Right to erasure: In certain circumstances, you may request that we erase your personal information. Usually, the information must meet one of the following criteria:

• The data is no longer needed for the purpose for which we originally collected and/or processed it;
• You have withdrawn your previously given consent for us to process your data and there is no other valid reason to continue processing it;
• the data has been processed unlawfully (i.e. in a way that is contrary to the GDPR);
• the data must be erased in order for us to comply with our obligations as data controller; or
• You object to the processing and we cannot demonstrate overriding legitimate grounds for us to continue processing if we process the data because we consider it necessary for our legitimate interests.

Right to restrict processing: in certain circumstances you can request that we restrict the processing of your personal data. This means that we will only store your data in the future and cannot carry out any further processing activities until:

• one of the conditions listed below has been removed,
• you give your consent, or
• further processing is necessary to assert, exercise or defend legal claims, to protect the rights of others, or if it is necessary on the basis of legitimate public interest of the EU or a member state.

Right to rectification: You can also request that we rectify inaccurate or incomplete personal data that we hold about you. If we have disclosed this personal data to third parties, we will inform them of the correction, provided this is possible and does not require a disproportionate effort. Where appropriate, we will inform you of the third parties to whom we have disclosed the inaccurate or incomplete personal data. If we consider it unreasonable to comply with your request, we will explain the reasons for this decision. Right to data portability: If you wish, you are entitled to transfer your data from one data controller to another. For this purpose, we will provide you with the data in a standard machine-readable format, password-protected, so that you can transfer the data to another online platform. Alternatively, we may transfer the data directly for you. The right to data portability applies to:

• personal data that we process automatically (i.e. without human intervention),
• personal data that you have provided to us; and
• personal data that we process on the basis of your consent or for the performance of a contract.

Right to complain to a supervisory authority: You have the right to lodge a complaint with the relevant local supervisory authority. If you wish to exercise any of these rights or withdraw your consent to the processing of your personal data (where your consent is the legal basis for the processing of your personal data), please contact us. Please note that we may keep records of your communications in order to better resolve issues raised by you. You can unsubscribe from any notifications or newsletters at any time. It is important that the personal information we hold about you is accurate and up to date. Please keep us informed if your personal information includes any changes during the period we hold data. 1.11 Who is responsible for the processing of your personal data on the website? Binder+Co AG is responsible for the processing of your personal data on the website. You can contact us for these reasons:

• if you suspect that your personal information has been misused, lost or accessed without authorisation,
• to withdraw your consent to the processing of your personal information (where consent is the legal basis for the processing of your personal information),
• for comments or suggestions about this privacy policy.

Send a letter by post to the following address: Binder+Co AG Grazer Strasse 19-25 8200 Gleisdorf Austria or alternatively an email to: datenschutz@binder-co.at1.12 Is there a data protection officer? There is no internal data protection officer at Binder+Co AG, as this is not required by law for our company. However, there is a data protection officer who provides support in all matters.

2 Use of our homepage

2.1 Information about your computer

Each time you access our homepage, we collect the following information about your computer: the IP address of your computer, the request of your browser and the time of this request. In addition, the status and the amount of data transferred are recorded as part of this request. We also collect product and version information about the browser used and the computer's operating system. We further record from which website the online offer was accessed. The remaining data is stored for a limited period of time (maximum 26 months). Our website uses the IP anonymisation option offered by Google Analytics. Your IP address is therefore shortened before being transmitted to Google and thus anonymised. This means that only a rough localisation is possible. Google will use this information on our behalf for the purpose of evaluating your use of the website, compiling reports on website activity and providing us with other services relating to website activity and internet usage. The IP address transmitted by your browser as part of Google Analytics will not be merged with other data by Google. The relationship with the web analytics provider is based on a corresponding contract for commissioned data processing with the provider. Further information on data protection at Google can be found here: www.google.com/intl/de/policies/privacy and services.google.com/sitestats/de.html. Alternatively, you can visit the Network Advertising Initiative (NAI) website at www.networkadvertising.org. Google has submitted to the EU-US Privacy Shield, www.privacyshield.gov/EU-US-Framework. Data processing is carried out on the basis of the legal provisions of § 96 para 3 TKG as well as Art 6 para 1 lit a (consent) and/or lit f (legitimate interest) of the DSGVO.

3 Communication with Binder+Co

You can contact us in various ways, including via our contact forms on our website, as well as via various social media channels. In addition, you will be contacted by us regularly by means of our newsletter or info service by e-mail. 3.1 Contact forms If you wish to use the contact form on our website, personal data such as first name, surname and e-mail address will be requested for this purpose. We collect and use the data transmitted via the contact form solely for the purpose of answering your enquiry or request. The legal basis for the processing of your data is your consent in accordance with Art. 6 Para. 1 lit. a) DSGVO. After we have processed the matter, the data will initially be stored in case of any queries. Deletion of the data can be requested at any time, otherwise the data will be deleted after the matter has been fully dealt with; statutory retention obligations remain unaffected in each case. 3.2 Newsletter You have the option of subscribing to our newsletter via our website. For this, we need your e-mail address and your declaration that you agree to receive the newsletter. To subscribe to our newsletter, we use the so-called double opt-in procedure, unless you have given us your consent in writing, i.e. as soon as you have registered for the newsletter, we will send you a confirmation e-mail with a link to confirm your registration. When you subscribe to our newsletter, you will receive regular information by e-mail on the selected topics as well as e-mails on special occasions. The e-mails may be personalised and individualised based on our information about you. You can cancel your subscription to the newsletter at any time. At the end of each newsletter you will find a link to unsubscribe completely from our newsletter. We will then immediately delete your data in connection with the newsletter dispatch. 3.3 Social media channels You will find links to social networks on our website. You can recognise the links by the respective logo of the provider. Clicking on the links opens the corresponding social media pages, for which this data protection declaration does not apply. For details of the provisions applicable there, please refer to the corresponding data protection declarations of the individual providers. No personal information is transmitted to the respective providers before the corresponding links are called up. Your calling up of the linked page is at the same time the basis for the data processing by the respective providers. 3.4 Orders and registrations for events Our online offer contains enquiry forms that you can fill out to request information or tickets for events (e.g. trade fairs). In these forms, personal data such as first name, surname, e-mail address and telephone number are requested in order to respond to your enquiry.

4. consent

In certain circumstances, we may need to obtain your consent to process your personal data in connection with certain activities. Depending on what exactly your data is needed for, we will obtain this consent explicitly. According to Article 4(11). of the GDPR, consent is "any freely given specific, informed and unambiguous indication of wishes in the form of a statement or other unambiguous affirmative act by which the data subject signifies his or her agreement to personal data relating to him or her being processed". In simple terms, this means that:

• You must give us your consent voluntarily, without us putting any form of pressure on you;
• You need to know what you are giving your consent to - so we will make sure we have given you sufficient information;
• you should have control over the processing activities you do and do not consent to. We will make these detailed controls available to you in our Privacy Settings Centre; and
• you must give us your consent in the form of a positive, affirmative act.

We keep records of the consents you have given in this way. As mentioned above, in some cases soft opt-in consent is sufficient. As mentioned above, you have the right to withdraw your consent for our activities. You can do this at any time.

5. contact

Binder+Co AG Grazer Strasse 19-25 8200 Gleisdorf, Austria Tel: +43 3112 800-0 Fax: +43 3112 800 300 E-mail: office@binder-co.at E-mail : datenschutz@binder-co.at As at: July 23, 2021