This Privacy Notice describes how Malao GmbH, Rosenheimer Straße 108, 81669 München, Germany ("Malao ", "we" or "us"), as the controller within the meaning of the EU General Data Protection Regulation ("GDPR"), the Federal Data Protection Act ("BDSG") and other data protection regulations ("Applicable Data Protection Laws"), processes personal data and other information from users ("Users" or "you") of our Website https://malao.com ("Website").

1. CATEGORIES OF PERSONAL DATA, PURPOSE OF PROCESSING, LEGAL BASIS AND ORIGIN

The use of the Website and its functions requires the following processing of certain personal data on a regular basis:

1.1 Informational use of the Website

If you access our Website and use it for purely informational purposes (i.e. without using additional functions such as the contact form), the Website may automatically collect, process and store certain personal data in a pseudonymized form. This is device and usage information that may include (i) specific information about the device used to access the Website (including model, operating system, IP address, language and similar information) and (ii) information about the use of features, functions or notifications on the device to recognize you and to analyze trends.

The legal basis for this is our legitimate interest (Art. 6 para. 1 lit. f) GDPR) to monitor and maintain the performance of the Website and to analyze uses, activities and trends in connection with our Website.

1.2 Web analysis with Google Analytics

When you access our Website, the Google Analytics service is loaded for statistical evaluation of the use of our Website. This service is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). By using the "anonymizeIp()" extension, we ensure that Google Analytics only transfers a shortened version of your IP address to Google.

By accessing the Website and loading the service, Google obtains knowledge that our Website was accessed via your IP address. Google Analytics uses cookies which are stored on your terminal device unless you have prohibited the use of cookies in your browser and allow for an analysis of your use of our Website. The information generated by the cookies about your use of the Website will be transferred to and stored by Google on servers in the United States. Any data transfers to the US are carried out in accordance to the Model Contractual Clauses that we concluded with Google: https://privacy.google.com/businesses/processorterms/mccs/.

The use of Google Analytics is based on our legitimate interests (Article 6 para. 1 sentence 1 lit. f) GDPR), which consist in appropriately designing and optimizing our Website. In addition, we have concluded an agreement for data processing with Google in accordance with the requirements of the German data protection authorities for the use of Google Analytics.

We collect your IP address to enable its shortening and then transmission to Google. You are not obliged to provide this personal data, a use of our Website is possible without the provision. You can prevent the provision of this personal data by setting your browser software accordingly by installing the browser add-on available under the following link: https://tools.google.com/dlpage/gaoptout?hl=de.

More information about Google Analytics can be found at http://www.google.com/intl/de_ALL/analytics. Google's privacy policy can be found at https://www.google.com/policies/privacy/.

1.3 Contact form and newsletter distribution with Hubspot

When you use the contact form included on our Website or contact us by e-mail or other means, e.g. to request information or send us content for inspection, the information provided in the contact form will first be stored by our IT service provider, Hubspot, transmitted to us and processed for the purpose of dealing with the request. Hubspot is a service provider, Hubspot, 25 First Street, Cambridge, MA 02141 USA (“Hubspot”). We have concluded an agreement with Hubspot in which we oblige Hubspot to protect the data of our customers and not to pass them on to third parties. This contract can be viewed at the following link: https://legal.hubspot.com/dpa.

For our applicant process, we additionally use Typeform to collect specific information and responses from applicants. The data collected via Typeform are also integrated into our CRM system provided by Hubspot to enable efficient processing and evaluation of applications. Typeform acts as a data processor for us in the sense of Art. 28 GDPR and operates exclusively according to our instructions. The data processing is based on the legal basis of Art. 6 (1) lit. f GDPR, i.e., our legitimate interest in managing the application process as efficiently and effectively as possible.

With Hubspot we can organize and analyze our newsletter campaigns. If you enter your data in the contact form, it will be stored on Hubspot's servers in the United States. Any data transfers to the US are carried out in accordance to the Standard Contractual Clauses that we concluded with Hubspot: https://legal.hubspot.com/dpa#Annex4-Standard-Contractual-Clauses.

When you sign up for our newsletter on our website, the data entered will be processed also by Hubspot. We base these data processing operations on your consent given (Art. 6 para. 1 lit. a) GDPR). You can withdraw your consent to receive our newsletter at any time by clicking the link in each newsletter or by contacting us under the contact details provided in section 7. If you withdraw your consent, your data will be deleted from Hubspot.

When you open an e-mail sent with Hubspot, a file contained in the e-mail (so-called web beacon) connects to the servers of Hubspot in the USA. This allows us to determine whether a newsletter message has been opened and which links have been clicked. In addition, technical information (e.g. time of retrieval, IP address, browser type and operating system) is collected. This information cannot be assigned to the respective newsletter recipient. It is used exclusively for the statistical analysis of newsletter campaigns. The results of these analyses can be used to better adapt future newsletters to the interests of the recipients.

We process your data for the purpose of processing and answering your enquiry and any follow-up questions, to prevent misuse of the contact form, to ensure the security of our information technology systems and to analyze our newsletter campaigns. We base these data processing operations on our legitimate interests (Art. 6 para. 1 lit. f) GDPR) which include processing your enquiry, protecting our information technology systems and enabling us to design and optimize our newsletters to meet your needs.

Hubspot privacy policy can be found at https://legal.hubspot.com/de/privacy-policy. Detailed information about the cookies used by Hubspot can be found at https://legal.hubspot.com/de/cookie-policy.

1.4 Customer relationship management

We process your contact data in order to maintain an effective customer relationship management (CRM). For this purpose, we are using the CRM system provided by Hubspot. Hubspot acts for us as a processor within the meaning of Art. 28 GDPR and exclusively according to our instructions. This is ensured by a contractual arrangement in which we have entered into with Hubspot. The data processing is carried out on the legal basis of Art. 6 (1) lit. f GDPR, i.e. our legitimate interest in designing, operating and maintaining our customer relationships as efficiently as possible.

2.4 How to delete or manage cookies

You have the right to accept or decline the storage of cookies on your device. You can exercise this right at any time by changing the settings in your browser according to your wishes.

However, if you disable cookies, you may not be able to use all the interactive features of the website and its content.

Most browsers provide instructions on how to customize cookie settings. The cookie settings are usually located under the menu item "settings" of your browser. If you wish to limit the use of third-party cookies, you can do so using one of the following links:

• Your Online Choices (http://www.youronlinechoices.com/uk/)
• Network Advertising Initiative (http://www.networkadvertising.org/)
• Digital Advertising Alliance (http://www.aboutads.info/consumers)

Please note that many companies are listed on these pages that do not set cookies via our Website.

3. DATA RECIPIENTS

3.1 External service providers

Malao may engage external service providers who act as our data processors to provide certain services to us, such as email, Website, marketing or other IT services. While providing these services, the external service providers may have access to or process your personal data.

Based on the data processing agreements concluded with them, the external service providers used are obligated to take appropriate technical and organizational security measures to protect the personal data processed and to process the personal data only in accordance with the assignment.

3.2 Additional recipients

Malao may also disclose your personal data to law enforcement and government agencies, legal advisers and other external advisers in accordance with Applicable Data Protection Laws. The legal basis for this processing is compliance with legal obligations (Art. 6 para. 1 lit. c) GDPR) to which Malao is subject or our legitimate interests (Art. 6 para. 1 lit. f) GDPR), such as exercising or defense of legal claims.

4. YOUR RIGHTS AS A DATA SUBJECT AND HOW TO ASSERT THEM

According to Applicable Data Protection Laws, as a data subject you may have the right of access (Art. 15 GDPR), the right to rectification (Art. 16 GDPR), the right to erasure (Art. 17 GDPR), the right to restriction of processing (Art. 18 GDPR) and the right to data portability (Art. 20 GDPR). The right to access and the right to erasure may be restricted under certain circumstances in accordance with applicable local data protection law. In addition, you are entitled to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).

If you have declared your consent to the processing of your personal data, you can withdraw this consent at any time with future effect. Such withdrawal will not affect the lawfulness of the processing prior to the consent withdrawal. If you withdraw your consent, we will no longer process your personal data unless any other (legal) basis permits this. However, if the consent is withdrawn and no other legal basis exists, we must delete the personal data immediately (Art. 17 para. 1 lit. b) GDPR).

Under certain circumstances, on grounds relating to your particular situation, you have the right to object at any time (Art. 21 para. 1 GDPR) to the processing of personal data concerning you processed on the basis of our legitimate interests (Art. 6 para. 1 lit. f) GDPR). Furthermore, if your personal data is processed for the purpose of direct marketing, you have the right to object at any time to the processing of your personal data for these purposes, to the extent that it is related to such direct marketing (Art. 21 para. 2 GDPR). In this case, we will no longer process your personal data for these purposes.

In order to exercise your rights, please contact us under the contact details provided in section 7.

5. STORAGE PERIOD OF YOUR PERSONAL DATA

Your personal data will be stored as long as necessary for the purposes of the data processing described in section 1 above. If Malao no longer processes your personal data for the described purposes, we will remove it from our systems and records or make it completely anonymous so that you can no longer be identified from it. Your data will not be erased or made completely anonymous if and as long as we have to store your data in order to fulfil legal or regulatory obligations, e.g. legal retention requirements, which may arise from the German Commercial Code (Handelsgesetzbuch, HGB) or the German Tax Code (Abgabenordnung, AO), for example, which stipulate retention periods of 6 to 10 years, or if we need the data to preserve evidence within the limitation period, which is usually 3 years, but can be up to 30 years in individual cases.

6. CONTACT

If you have any questions about this Privacy Notice or the processing of your personal data, please contact us at:

Malao GmbH
Rosenheimer Straße 108
81669 München
Germany
Tel: +49 89 287 773 00
Email: future(at)malao(dot)com