PRIVACY POLICY As of June 2021

I. Name and address of controller

Fanciety GmbH

Ballindamm 39

20095 Hamburg

General Manager: Prof. Dr. Björn Michaelis

tel.: +49 40 999 993 440

website: www.fanciety.com

II. Contact details of the data protection officer

You can contact the data protection officer of the controller by e-mail address datenschutz@fanciety.com and by writing a letter to the address of the controller.

III. General information on data processing

In general, we process personal data of users visiting our website only to the extent necessary, mostly to provide a functional website and to provide the website content and services. The further processing of personal data of our users is regularly only carried out with the user's consent. An exception is made in cases where prior consent cannot be obtained for factual reasons and law allows the processing of the data

Insofar as we obtain the consent of the data subject for the processing of personal data, Art. 6 (1)(b) of the General Data Protection Regulation (GDPR) serves as the legal basis.

For the processing of personal data, which is necessary to perform a contract to which the data subject is a party, Art. 6 (1)(b) GDPR serves as the legal basis. This also applies to processing operations that are necessary to carry out pre-contractual measures.

Insofar as processing of personal data is necessary to fulfil a legal obligation to which our company is subject, Art. 6 (1)(c) GDPR serves as the legal basis.

If the processing is necessary to safeguard a legitimate interest of our company or of a third party and fundamental rights and freedoms of the data subject do not outweigh our interest, Art. 6 (1)(f) serves as the legal basis for the processing.

IV. Data erasure and storage duration

The personal data that we collect will be deleted or blocked as soon as the purpose for which it was stored no longer applies. Furthermore, data may be stored if this is required by laws or other regulations to which the controller is subject to. Data will also be blocked or deleted when a prescribed storage period expires, unless it is necessary to continue storing the data in order to conclude or fulfill a contract.

V. Data collecting during provision of the website

Whenever our website visited, our system automatically collects data and information from the computer system of the visiting device.

The following data is collected based on Art. 6 para. (1)(f) GDPR:

Information about the browser type and version used
The user's operating system
The Internet service provider of the user
The IP address of the user
Date and time of access
Websites from which the user's system accesses our website
Websites that are called up by the user's system via our website

The temporary storage of the IP address by the system is necessary to enable the website to be delivered to the user's computer. For this purpose, the user's IP address must remain stored for the duration of the session.

The data is deleted as soon as it is no longer required for the purpose for what it was collected. In the case of collecting data for the provision of the website, this is the case when the respective session has ended.

Collecting data for the provision of the website and the storage of the data in log files is mandatory for the operation of the website. There is therefore no possibility of objection on the part of the user.

VI. Use of cookies

In addition to the data mentioned above, cookies are stored on the user's computer system during a visit to our website. Cookies are small text files that are stored on the user’s computer system and through which the website provider that installed the cookies (in this case by us) receives certain information ab. Cookies cannot execute programs or transmit viruses on the user's computer system. They are used to make the website more user-friendly and effective overall.

We mainly use transient cookies. Transient cookies are automatically deleted when the user closes the browser. This includes in particular session cookies. These store a so-called session ID, with which various browser requests can be assigned to the common session. This enables the user's computer system to be recognized when he or she returns to our website. The session cookies are deleted when the user logs out or closes the browser.

We use transient cookies mainly for the technical provision of the website. Cookies for the technical provision of the website are necessary in order to be able to move around the website, use basic functions and ensure the security of the website; they neither collect information about users for marketing purposes nor do they store which websites the user has visited.

We have a legitimate interest in the storage of cookies for the technically error-free and optimized provision of our website. Therefore, the legal basis for the processing of personal data is Art. 6 (1)(f) GDPR.

Any use of cookies that are not technically necessary is only permitted with the express consent of the user in accordance with Art. 6 (1)(a) GDPR. This applies in particular to the use of advertising cookies such as Google Analytics described under VII.

VII Google Analytics

Google Analytics is a service provided by Google Inc, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google"). Google Analytics also uses cookies. The information collected by the cookie about the use of our website (including your IP address) is usually transferred to a Google server in the USA and stored there. We would like to point out that on our websites Google Analytics has been extended by the code "gat._anonymizeIp();" in order to ensure an anonymized collection of IP addresses (so-called IP-Masking). Google therefore only records your IP address in abbreviated form at our instigation, which guarantees anonymization and does not allow any conclusions to be drawn about your identity. In case of activation of IP- anonymization on our websites, your IP address will be shortened by Google within member states of the European Union or in other states of the agreement on the European Economic Area before. Only in exceptional cases, will the full IP address be transferred to a Google server in the USA and shortened there. Google will use this information for the purpose of evaluating your use of our website, compiling reports on website activity for us and providing other services relating to website activity and internet usage. The IP address transmitted by your browser within the framework of Google Analytics is not combined with other data from Google. A transfer of this data by Google to third parties only takes place due to legal regulations or within the scope of order data processing. Under no circumstances will Google combine your data with other data collected by Google.

Data processing by Google Analytics requires your consent in accordance with Art. 6 (1)(a) GDPR. Without this consent, Google Analytics will not be executed on your device. You can revoke your consent at any time with effect for the future by calling up the cookie settings and changing your selection there.

For more information about Google Analytics' terms of use and Google's privacy policy, please visithttps://www.google.com/analytics/terms/de.html and https://policies.google.com/?hl=de.

VIII. E-mail contact

You can contact us electronically via our website www.fanciety.com. If a user takes this opportunity, the data entered in the input mask will be transmitted to us and stored. This data includes first name, last name, telephone number, e-mail address, the reason for your request and of course, the specific message sent to us.At the time the message is sent, the following data is also stored:

The IP address of the user
Date and time of registration

In this context, the data will not be passed on to third parties. The data will be used exclusively for processing the conversation.

The legal basis for the processing of the data, if the user has given his consent, is art. 6 (1)(a) GDPR. The legal basis for the processing of the data, which are transmitted in the course of sending an e-mail, is Art. 6 (1)(f) GDPR. If the e-mail contact is aimed at the conclusion of a contract, the additional legal basis for processing is Art. 6 (1)(b) GDPR.

The corresponding data will be deleted as soon as they are no longer necessary for the purpose of their collection. This is the case when the respective conversation with the user has ended. The conversation is terminated when it can be inferred from the circumstances that the matter in question has been conclusively clarified.

Any additional personal data collected during the sending process will be deleted after a period of seven days at the latest.

The user has the possibility to revoke his consent to the processing of personal data at any time. If the user contacts us by e-mail, he can revoke the storage of his personal data at any time. In such a case the conversation cannot be continued.

The revocation can be made by sending an e-mail to: info@fanciety.com.

IX. Social Media

We maintain profiles on Facebook, Instagram, Twitter and YouTube to communicate with the connected and registered users and to inform about our products, offers and services. This may involve data processing on our part if users contact us via our profiles or interact with the profile. The legal basis for the data processing carried out in this process is our legitimate interest in communicating with users and our interest in effective external representation. (Art. 6 (f) GDPR).

We have no influence on the data processing by the respective providers of the social media we use. The respective data protection notices and terms of use of the providers apply.

Further information on data protection for the respective social media we use can be found at the following addresses:

Facebook Inc., 1601 S California Ave, Palo Alto, CA 94304, USA
https://de-de.facebook.com/privacy/explanation

Instagram Inc., 1601 Willow Road, Menlo Park, CA 94025,USA
https://help.instagram.com/519522125107875

Twitter, Inc., 1355 Market St, Suite 900, San Francisco, CA 94103, USA
https://twitter.com/privacy

Youtube Inc., 901 Cherry Ave. San Bruno, CA 94066
https://policies.google.com/privacy?hl=de

X. Rights of persons whose data we have collected

If personal data of you are processed by us, you are entitled to the following rights:

1. Right of information
You can request confirmation from us as to if personal data which concern you are being processed by us.If such a processing exists, you can demand information from us about the following information:

The purposes for which the personal data are processed
The categories of personal data which are processed;
The recipients or the categories of recipients to whom the personal data concerning you have been or will be disclosed
The planned duration of the storage of the personal data concerning you or, if it is not possible to give specific details, criteria for determining the duration of storage;
The existence of a right to rectification or erasure of personal data concerning you, a right to have the processing limited by the controller or a right to object to such processing;
The existence of a right of appeal to a supervisory authority;
Any available information as to the origin of the data if the personal data are not collected from the data subject;
The existence of automated decision-making, including profiling, in accordance with Art. 22 (1) and (4) GDPR and, at least in these cases, meaningful information about the logic involved and the scope and intended effects of such processing on the data subject

You have the right to be informed if your personal data is transferred to a third country or to an international organization. In this context, you may request to be informed of the appropriate guarantees pursuant to Art. 46 GDPR in connection with the transfer.

2. Right of rectification
You have the right to ask us to correct and/or complete any of your personal data processed if it is incorrect or incomplete. The person in charge must make the correction immediately.

3. Right to limit processing
Under the following conditions, you may request the restriction of the processing of personal data concerning you:

if you dispute the accuracy of the personal data concerning you for a period that allows the person in charge to verify the accuracy of the personal data
if the processing is unlawful and you refuse to delete the personal data and instead demand the restriction of the use of the personal data;
the controller no longer needs the personal data for the purposes of the processing, but you need it for the purpose of asserting, exercising or defending legal claims; or
If you have lodged an objection to the processing pursuant to Art. 21 (1) GDPR and it is not yet clear whether the legitimate reasons of the controller outweigh your reasons.

If the processing of your personal data has been restricted, such data, apart from being stored, may be processed only with your consent or for the purpose of pursuing, exercising or defending legal claims or protecting the rights of another natural or legal person or on grounds of an important public interest of the Union or a Member State.

If the restriction of the processing has been restricted in accordance with the above conditions, the controller will inform you before the restriction is lifted.

4. Right of deletion
a) Duty to delete
You may also request that your personal data is deleted immediately, and the person who is responsible is obliged to delete it immediately if one of the following reasons applies:

The personal data concerning you are no longer necessary for the purposes for which they were collected or otherwise processed.
You revoke your consent on which the processing was based in accordance with Art. 6 (1)(a)or Art. 9(2)(a) GDPR, and there is no other legal basis for the processing.
You submit an objection to the processing pursuant to Art. 21 (1) GDPR and there are no legitimate reasons for the processing, or you submit an objection to the processing pursuant to Art. 21 (2) GDPR.
The personal data concerning you have been processed unlawfully.
Deletion of the personal data concerning you is necessary to comply with a legal obligation under Union law or the law of the Member States to which the controller is subject.
The personal data concerning you have been collected in relation to the information society services offered, in accordance with Art. 8 (1) of the GDPR.

b) Information to third parties
If the data controller has made public the personal data concerning you and is obliged to delete them in accordance with Art. 17 para. 1 DPA, he shall take reasonable measures, including technical measures, taking into account the available technology and the implementation costs, to inform data controllers who process the personal data that you, as a data subject, have requested them to delete all links to this personal data or copies or replications of this personal data.

c) Exceptions
The right to deletion does not exist insofar as the processing is necessary:

to exercise the right to freedom of expression and information
to comply with a legal obligation requiring processing under Union or national law to which the controller is subject, or to perform a task carried out in the public interest or in the exercise of official authority vested in the controller;
for reasons of public interest in the field of public health pursuant to Article 9 (2) letters h and i and Article 9 (3) GDPR;
For archival, scientific or historical research purposes in the public interest or for statistical purposes pursuant to Art. 89 (1) GDPR, insofar as the right referred to in section a) is likely to render impossible or seriously prejudice the attainment of the objectives of such processing, or
To assert, exercise or defend legal claims.

5. Right to information
If you have asserted the right to rectify, erase or limit the processing of your personal data, the controller is obliged to notify all recipients to whom the personal data concerning you have been disclosed of this rectification, erasure or limitation of processing, unless this proves impossible or involves a disproportionate effort.

6. Right to data transferability
You have the right to receive the personal data concerning you in a structured, common and machine-readable format. You also have the right to transfer these data to another controller without hindrance by the controller to whom the personal data have been made available, if the processing is based on consent by you according to Art. 6 (1)(a)GDPR or Art. 9 (2)(a) GDPR or on a contract according to Art. 6 (1)(b) GDPR and the processing is carried out by means of automated procedures.

In exercising this right, you also have the right to obtain that the personal data concerning you be transferred directly from one controller to another controller as far as this is technically feasible. The freedoms and rights of other persons may not be impaired by this.The right to data transferability does not apply to the processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

7. Right of objection
You have the right to object at any time, for reasons arising from your particular situation, to the processing of personal data concerning you that is carried out pursuant to Art. 6 (1)(e) or (f) GDPR; this also applies to profiling based on these provisions.The controller will no longer process the personal data concerning you unless he can demonstrate compelling reasons for processing which are worthy of protection and which outweigh your interests, rights and freedoms, or unless the processing serves to assert, exercise or defend legal claims.

If the personal data concerning you are processed for direct marketing, you have the right to object at any time to the processing of personal data concerning you for such marketing, including profiling, insofar as it is related to such direct marketing. If you oppose processing for the purposes of direct marketing, the personal data concerning you will no longer be processed for those purposes.

You have the possibility to exercise your right of objection in relation to the use of information society services, without prejudice to Directive 2002/58/EC, by means of automated procedures involving technical specifications.

8. Right to revoke the declaration of consent under data protection law
You have the right to revoke your consent at any time. Revocation of your consent does not affect the legality of the processing that has taken place on the basis of your consent until revocation.

9. Right of appeal to a supervisory authority
You have the right to revoke your data protection declaration of consent at any time. Revocation of your consent does not affect the legality of the processing that has taken place on the basis of your consent until revocation.The supervisory authority to which the complaint has been submitted will inform the complainant of the status and the results of the complaint, including the possibility of a legal remedy pursuant to Art. 78 GDPR.