Privacy.

Data Protection Statement of Paulaner Franchise & Consulting GmbH

Thank you for your interest in our website. The protection of your privacy in relation to the processing of personal data is important to us. Paulaner Franchise & Consulting GmbH will handle your data responsibly. Of course we therefore comply with the statutory provisions in collection, processing and use of your data, in particular as specified by the General Data Protection Regulation (GDPR) and the Federal Data Protection Act (Bundesdatenschutzgesetz; BDSG-new). Nevertheless, we know that many users of the internet experience considerable uncertainty about how this protection is ensured from case to case. The following data protection statement will therefore provide you with an overview of which data we collect, use, store and potentially pass on to any third parties, what safety measures we take for your protection and what information rights you have in this respect.

1. Information concerning collection of personal data

a) Below, we will inform you about collection of personal data when you use our website. Personal data are any data that permit a conclusion as to you personally, e.g. your name, address, email addresses, user behaviour.

b) The controller in accordance with sect. 4 para. 7 EU General Data Protection Regulation (GDPR) is Paulaner Franchise & Consulting GmbH, represented by managing directors Thomas Drossé and Marcus Thieme, Ohlmüllerstraße 42, D-81541 Munich, phone: 089 / 48 00 5-652, fax: 089 / 48 00 5-606, email: franchise@paulaner.de.

2. Information on the data protection officer

The contact details of the data protection officer are: datenschutz@paulaner.de.

3. Collection of personal data when you visit our website (type and purpose)

a) General

If you use our website for information, i.e. if you do not register or otherwise submit any information to us, we will only collect the personal data your browser submits to our server. The provider of the website will collect and store information in server log files that your browser submits to us automatically. These are:

• IP address
• Date and time of the query
• Time zone difference from Greenwich Mean Time (GMT)
• Content of the request (specific page)
• Access status /HTTP-status code
• The respective data volume transferred
• Website sending the request
• Browser
• Operating system and its interface
• Language and version of the browser software.

The data named will be processed by us for the purpose of a smooth connection to the website in order to ensure comfortable use of our website, and to evaluate system safety and stability by us.

The legal basis for processing activities shall be sect. 6 para. 1 s. 1 lit. f) GDPR.

Our legitimate interests follow from the purposes listed above for data collection. We do not use the collected data in order to draw conclusions as to persons.

b) Contact via contact form or email

When you contact us by email or through a contact form, the complete data disclosed by you (e.g. your complete name, postal code, place of residence and email address) will be saved by us in order to answer your questions.

Data processing for the purpose of contacting us shall take place according to sect. 6 para. 1 s. 1 lit. a) and b) GDPR based on your free consent and to perform pre-contractual measures upon your request.

4. Newsletter

a) With your consent, you can subscribe to our newsletter in which we will inform you about our current interesting offers. The advertised goods and services are designated in the declaration of consent.

b) We use the double opt-in procedure for our newsletter. This means that we send an email to your indicated email address after your subscription, in which we ask you to confirm that you desire to receive the newsletter. If you do not confirm your registration within 24 hours, your information will be locked and erased automatically after one month. Beyond this, we store the IP addresses used by you from time to time and both the times of registration and confirmation. The purpose of the proceedings is to document your registration and to investigate any possible abuse of your personal data.

c) The only mandatory information for receiving the newsletter is your email address. Indicating any other, separately marked data is voluntary and used in order to enable us to address you personally. After your confirmation, we store your email address for the purpose of sending you the newsletter.

d) The legal basis shall be sect. 6 para. 1 s. 1 lit. a) GDPR.

e) You may withdraw your consent to receiving the newsletter at any time and unsubscribe from the newsletter. You can withdraw your consent by clicking the link provided in each newsletter email or by sending a message to the contact details indicated in the imprint.

f) For our newsletter, we use the service of CleverReach GmbH & Co. KG, Mühlenstr. 43, D-26180 Rastede. The required data from the newsletter recipients are hosted web-based on a server of CleverReach in an area to which only we have a password-protected access. The terms and conditions and the data protection statement of CleverReach are the contractual basis. You can view them under the following link: https://www.cleverreach.com/en/terms-of-service/ and https://www.cleverreach.com/en/privacy-policy/ The newsletter tool analyses the reach of the respective newsletters in order to ensure that the shipments actually reach the recipients. The individual behavioural patterns that can be found in this are only used for statistical evaluation of the newsletter success and will never be passed on to any third parties or used for any other purposes.

5. Passing on personal data

a) The data will be system-technically forwarded to the provider who provides the web server. It operates its servers within Europe.

b) The data you send to us via the contact form or email will be forwarded to B.I.T.S, Ohlmüllerstraße 42, D-81541 Munich, which provides the email server.

c) In addition to this, data will be passed on by using Google Analytics. For details, see item 6 of this data protection statement.

d) Your personal data will generally not be passed on to any third parties beyond this. We shall also only pass on your personal data to third parties if:

• you have explicitly consented to this pursuant to sect. 6 para. 1 s. 1 lit. a) GDPR,
• forwarding is required under sect. 6 para. 1 s. 1 lit. f) GDPR for assertion, exercise or defence of legal claims and there is no reason to assume that you have an overriding protection-worthy interest in your data not being passed on,
• forwarding is required due to statutory obligations pursuant to sect. 6 para. 1 s. 1 lit. c) GDPR, and
• this is legitimate by law and required according to sect. 6 para. 1 s. 1 lit. b) GDPR for processing contractual relationships with you.

6. Use of cookies

a) We use cookies partially on our website. Cookies are small files your browser creates automatically and stores on your device (e.g. computer, tablet or phone). In the cookie information is filed which result in connection with the used device. However, this does not mean that we obtain direct knowledge of your identity. Please also note that cookies can not cause any damage on your device.

b) The use of cookies serves to make your visit to our website as comfortable as possible. For example we use so-called session cookies to record your navigation on our website. This data will be deleted automatically when you leave the website.

c) In addition, temporary cookies can be used to optimize the user friendliness of the website. These cookies will be saved on your device for a determined period of time.

d) This data is required for the mentioned purposes to ensure our legitimate interest according to sect. 6 para. 1 s. 1 lit. a) GDPR.

e) Many web browsers accept cookies automatically. You can, however, change your browser's settings so that cookies will not be saved on your computer or that you receive a message on your screen, when a new cookie shall be created. If you deactivate cookies entirely, not all functions on our website might be available for you.

7. Use of Google Analytics

a) This website uses Google Analytics, a web analysis service of Google Inc. ("Google"). Google Analytics uses "cookies", i.e. text files that are stored on your computer and that permit analysis of your use of the website. As a rule, the information generated by the cookie through your use of this website is sent to a Google server in the USA and stored there. Due to activation of IP anonymisation on these websites, your IP address will be abbreviated first by Google within member states of the European Union or in other contracting states of the convention on the European Economic area. Only in exceptions will your full IP address be transferred to a server of Google in the USA and abbreviated there. On the order of the operator of this website, Google will use this information to evaluate your use of the website, in order to compile reports on the website activities and to render further services connected to website use and internet use towards the website operator.

b) The IP address submitted by your browser will not be combined with any other Data of Google.

c) You may prevent saving of the cookies by making the corresponding settings in your browser software; however, note that you may be unable to fully use all functions of the website in such a case. You may furthermore prevent recording of the data generated by the cookie and referring to your use of the website (incl. your Internet Protocol address) and processing of these personal data by Google by downloading and installing the browser plugin available under the following link: http://tools.google.com/dlpage/gaoptout?hl=de.

d) This website uses Google Analytics with the extension "_anonymizeIp()". This causes IP addresses to be abbreviated before further processing so that conclusions as to persons are excluded.

e) You may check out of Google Analytics by clicking the following link as well: Yes, I would like to check out.

f) We use Google Analytics, in order to analyse use of our website and regularly improve it. The statistics acquired enable us to improve our offer and to make it more interesting for you as the user. For exceptions in which personal data are transmitted to the USA, Google has subjected to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework.

g) The legal basis for using Google Analytics is sect. 6 para. 1 s. 1 lit. f) GDPR.

h) Information on the third-party provider: Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001. User conditions: http://www.google.com/analytics/terms/de.html, Overview of data protection: http://www.google.com/intl/de/analytics/learn/privacy.html, and the data protection statement: http://www.google.de/intl/de/policies/privacy.

8. Integration of services and third-party contents

1) Vimeo

a) We may have videos of provider Vimeo LLC, headquartered in 555 West 18th Street, New York, New York 10011 integrated.

b) Some of our websites contain videos by Vimeo. If you call up such a website of our online offer, a connection to the Vimeo servers will be established. This informs the Vimeo server on which of our websites you have visited. If you are logged in as a member of Vimeo during this, Vimeo will assign this information to your personal user account. When you click the start button of a video, this information may also be assigned to an existing user account. You can prevent this assignment by logging out of your Vimeo user account before you use our website and deleting the corresponding cookies by Vimeo.

c) We use the service within our online offer based on a legitimate interest, i.e. in analysis, optimisation and economic operation of our online offer. The legal basis is sect. 6 para. 1 lit. f) GDPR.

d) For more information on data processing and notes on data protection by Vimeo, see https://vimeo.com/privacy.

e) Vimeo will also call the tracker Google Analytics via an iFrame in which the video is called up. This is a dedicated tracking by Vimeo that we have no access to. You can prevent tracking by Google Analytics by using deactivation tools that Google offers for some internet browsers. The users may furthermore prevent recording of the data generated by Google Analytics and referring to your use of the website (incl. your internet Protocol address) and processing of these personal data by Google by downloading and installing the browser plug-in available under the following link: http://tools.google.com/dlpage/gaoptout?hl=de.

2) Google Maps

a) The website uses Google Maps in order to visually display geographic information. When using Google Maps, Google (Google Inc., 1600 Amphitheatre Parkway, Mountain View, California, 94043) will also collect, process and use data on use of the maps function by visitors of the websites.

b) For more detailed information on data processing by Google, see the data protection notes of Google, which you can find at www.google.com/privacypolicy.html.

c) Use of Google Maps is based on a legitimate interest within the meaning of sect. 6 para. 1 lit. f) GDPR, since we want to optimise our online offer.

d) You may check out by clicking the following link: https://adssettings.google.com/authenticated.

9. Ajax and jQuery

This website partially uses Ajax and jQuery technologies, which, for example, optimise the loading speed. In this respect, program libraries of Google servers are called. The CDN (Content delivery network) of Google is used. If you used jQuery on a different page of Google before, your browser will use the copy stored in your cache. If this does not apply, it must be downloaded, which means that data from your browser will reach Google!Inc. ("Google"). Your data will be transmitted to the USA. For more details, see: https://developers.google.com/speed/libraries/#jquery and the data protection provisions of google.de.

10. Google Hosted Libraries

This website uses Google Hosted Libraries, provided by Google. When accessing a page your browser loads the required JavaScript library at all times in its latest version from the server ajax.gooleapis.com so that the required JavaScript functions can be executed correctly for the impeccable function of the website.

For this purpose your browser has to establish a connection to the Google servers. Through this Google obtains knowledge of your IP address. The use of Hosted Libraries serves a reliable allocation of our website.

The legal basis is our legitimate interest according to sect. 6 para. 1 lit. f) GDPR.

Further information about Hosted Libraries is provided in the Data Protection Statement to the Google API and in the general Data Protection Statement of Google https://www.google.com/policies/privacy/.

11. Information on location of the web server (§13 para. 1 TMG)

The data we receive via our website will be processed on servers within Germany.

12. Your rights

You have the right:

• to demand information in accordance with sect. 15 GDPR regarding processing of your personal data by us. In particular, you may request information on the processing purposes, category of personal data, categories of recipients to whom your data have been or are disclosed, the planned storage duration, the existence of a right to correction, erasure, restriction of processing or objection, existence of a right to complaint, origin of your data if they were not collected at our site, and the existence of automated decision-making, including profiling and any indicative information on its details;

• in accordance with sect. 16 GDPR, demand correction of any inaccurate personal data stored by us or completion of these without undue delay;

• in accordance with sect. 17 GDPR, demand erasure of your personal data stored by us as far as processing is not required in order to exercise the right to freedom of expression and information, to comply with a legal obligation, for reasons of public interest or for assertion, exercise or defence of legal claims;

• in accordance with sect. 18 GDPR, demand restriction of processing of your personal data as far as the accuracy of the data is disputed by you, processing is not legitimate, but you decline erasure and we no longer require the personal data, but you still require them to assert, exercise or defend legal claims or you have objected to processing in accordance with sect. 21 GDPR;

• in accordance with sect. 20 GDPR, demand to receive your personal data that you have provided to us in a structured, common and machine-readable format or to demand transfer to another controller;

• in accordance with sect. 7 para. 3 GDPR, to revoke your consent once given to us towards us at any time. This has the consequence that we may no longer continue the processing activities that were based on this consent in future and

• in accordance with sect. 77 GDPR, file a complaint with a supervisory authority. Usually, you may contact the supervisory authority at your common place of residence or work place or our registered office for this.

The Bayerisches Landesamt für Datenschutzaufsicht, Promenade 27 (Schloss), D-91522 Ansbach, Germany, phone: +49 (0) 981 53 1300, telefax: +49 (0) 981 53 98 1300, email: poststelle@lda.bayern.de is responsible for our headquarters.

13. Right to object

If your personal data are processed based on legitimate interests in accordance with sect. 6 para. 1 s. 1 lit. f) GDPR, you have the right to object to processing of your personal data in accordance with sect. 21 GDPR as far as there are reasons for this that result from your special situation.

If you object, your personal data will no longer be processed, except if compelling legitimate reasons for processing can be documented which override your interests, rights and freedoms or if processing serves to establish, exercise or defend legal claims.

The objection must be sent to us; an email to datenschutz@paulaner.de will suffice.

14. Duration of storage

This website does not store any complete IP addresses of persons who use the website for information, or they will be deleted again without delay after the end of use of the website. The stored usage processes will be deleted at the latest after 6 months.

If you send us an email, these data will generally be deleted 6 months after the last communication after answering the request.

If any customer relationship develops from this context or if it refers to an existing customer relationship, these data will be used for setting up a customer file or stored in the customer file if applicable. If the law does not stipulate any archiving periods, the existing data will be deleted after the end of the contract. If there are any statutory archiving periods, archiving may last up to ten years. Thereafter, the data will be finally deleted; in the meantime, the data will be blocked so that access to these data is no longer possible easily. The blocking phase shall commence at the end of the year following the end of the contract.

15. Obligation to provide data

As far as collection and processing of the server log files is concerned, the information is mandatory. Indication of the personal data, name and email address in the scope of contact via the contact form are also mandatory.

Indication of further data is voluntary.

16. Automated decision-making

Automated decision-making pursuant to sect. 22 GDPR does not take place.

17. Change to the purpose

Personal data are processed for the purpose for which they were collected. The purpose is not changed.

18. Safety note

If personal data are collected via our website, transmission shall take place encrypted using the data transmission procedure SSL "Secure-Socket-Layer". Beyond this, we ensure that only such employees will receive access to your personal data who need them to perform their respective tasks. They are trained accordingly regarding safety and data protection.

19. Changes to our data protection statement

We reserve the right to change our safety and data protection measures as far as this becomes necessary due to technical developments. In such cases, we will also adjust our notes on data protection accordingly. Therefore, please observe the respective valid version of our data protection statement.