Welcome to our website! We take the protection of your data and your privacy very seriously. The purpose of this document is to provide you with information about what types of data we process and when, for what purpose and on what legal basis we process data. In this document, we would like to explain to you how our services work and how we protect your personal data.

In accordance with Article 4 (1) of the GDPR, personal data means all information relating to an identified or identifiable individual. An identifiable natural person is someone who can be identified, either directly or indirectly. For further information, please refer to Article 4 (1) of the GDPR.

This privacy policy is accessible electronically via https://dvhventures.de/privacy-policy may be downloaded, saved and printed any time.

In the individual sections, we will point out the right to object separately to you (e.g. by saying: "You have the right to object") if this right applies. There you will also find further information on how to exercise your right to object.

In order to keep the following privacy policy transparent, we refer to information and privacy notices on external websites (see also the section "Social Networks & External Links" in this privacy policy) in various places via links. We endeavour to keep the links listed in this privacy statement up to date. Nevertheless, due to the constant updating of the websites, it cannot be excluded that links do not function correctly. Should you notice such a link, we would be pleased if you inform us so that we can include the latest link.

The controller for the processing of personal data within the meaning of Article 4 (7) of the GDPR is:

Dieter von Holtzbrinck Ventures GmbH
Goltsteinstraße 106
50968 Köln
Tel.-No.: +49 0 22 1 / 933 161 0
Fax-No..: please send an email
E-Mail: privacy@dvhventures.de

If you have any questions regarding the processing of your personal data or your with respect to data protection, please contact:

Dieter von Holtzbrinck Ventures GmbH
- Fabian von Trotha -
Goltsteinstraße 106
50968 Köln
Tel.-No.: +49 0 22 1 / 933 161 0
Fax-No..: please send an email
E-Mail: privacy@dvhventures.de

Every time you visit our website, we automatically collect data and information from your device's system and store it in so-called ‘server log files’. This is data that relates to an identified or identifiable natural person (in this case: website visitors). The data is automatically transmitted by your browser when you visit our website.

This following data is collected:

· your IP address
· browser type and version
· files viewed on our site (e.g., HTML pages, graphics, etc.)
· operating system
· access times and referring website addresses.

We process this data to ensure that our website is accessible from your device, and that it displays correctly on your device or in your browser. In addition, the data is used to optimize the website and to ensure the security of our systems. The data is analyzed for the purpose of troubleshooting.

The legal basis for this processing is Article 6 (1) point (f) of the GDPR. We have a legitimate interest in presenting you with a website that is optimized for your browser, and to facilitate communication between our server and your device. The latter, in particular, requires your IP address to be processed.

The information processed shall be stored only for as long as is necessary for the purpose for which it was processed.

The recipient of the data is our server host, who works for us within the framework of a data processing agreement.

The provision of personal data is not a statutory or contractual requirement, nor a requirement necessary to enter into a contract. While you are not under any obligation to provide us with your personal data, if you do not do so, you may not be able to use all the features of the website fully.

Our website uses cookies. Cookies are text files that are stored on your device in order, for example, to make the use of a website more convenient or to recognise the user's device and save settings or similar. In cookies, entries and settings can be saved on a website so that you do not have to re-enter them each time you visit a website. Cookies contain a so-called cookie ID, which makes it possible to identify the device in which the cookie was stored. In detail, we use the following cookies:

- Cookies which contain a randomly generated, concrete identification number which makes you or your device identifiable during your visit to our website. These cookies are automatically deleted at the end of your visit.

- Cookies that contain a randomly generated, concrete identification number that makes you or your device identifiable on our website. You can either see the storage time in the overview below or determine it via your browser by displaying the cookies (usually by clicking on the "i" next to the address bar, e.g. with Firefox or Google Chrome).

In particular, the following cookies are set by us and by the services we use:

Cookie: _ga
Provider/Service: Google/Google Tag Manager
Experiation period: 2021-12-16T10:23:40.000Z
Description: Used to distinguish users.

Cookie: _gat
Provider/Service: Google
Experiation period: 2019-12-17T10:24:41.000Z
Description: Used to throttle request rate.

Cookie: _git
Provider/Service: Google/Google Tag Manager
Experiation period: 2019-12-18T10:23:40.000Z
Description: Used to distinguish users.

All cookies set by us on the respective website and further information on these can also be displayed at any time via your browser.

The purpose of processing the cookies set directly by us is to make your use of our website convenient and to provide you with the opportunity to save settings.

The legal basis for the processing is Article 6 (1) point f) of the GDPR. We have a legitimate interest in presenting you with a website that stores your personal settings and makes it easier for you to visit our website.

The provision of personal data is not a statutory or contractual requirement, nor a requirement necessary to enter into a contract. While you are not under any obligation to provide us with your personal data, if you do not do so, you may not be able to use all the features of the website fully.

Other services used by us also use cookies. We point out to you separately with the individual services the use of the Cookies.

We use various services on our website from Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Irland.

You can find more information about each of the specific Google services that we use on this website in another privacy policy.

Google may collect and process information (including personal data) about you through the integration of Google services. It cannot be ruled out that Google may also transfer the information to a server in a third country.

In some circumstances, embedding Google services means that Google collects and processes information (including personal data). In such cases, we cannot rule out the fact that Google may also transmit the information to a server in a third country.

As outlined in Google’s Privacy Shield certification (available at https://www.privacyshield.gov/list by searching for ‘Google’), Google is obligated to comply with the EU-US Privacy Shield Framework and the Swiss-US Privacy Shield Framework with respect to the collection, use and storage of personal data from EU member states, or Switzerland. Through certification, Google, including Google LLC and its wholly owned subsidiaries in the USA declares that it complies with Privacy Shield principles. You can find more information about this at https://www.google.de/policies/privacy/frameworks/.

We have no influence over the information that Google actually collects and processes. However, Google states that it can generally only process the following information (including personal data):

· Protocol data (in particular the IP address)
· Location-related information
· Unique application numbers
· Cookies and similar technologies.

Information about the types of cookies used by Google can be found at https://policies.google.com/technologies/types.

If you're signed in to your Google Account, Google may add the processed information to your account and treat it as personal information, depending on your account preferences. Google does the following, among other things:

"When you create a Google Account, you provide us with personal information that includes your name and a password. You can also choose to add a phone number or payment information to your account. Even if you aren’t signed in to a Google Account, you might choose to provide us with information — like an email address to receive updates about our services.

We also collect the content you create, upload, or receive from others when using our services. This includes things like email you write and receive, photos and videos you save, docs and spreadsheets you create, and comments you make on YouTube videos." (https://policies.google.com/privacy?hl=en)

You can prevent this information from being added directly by logging out of your Google Account or by making the appropriate account settings in your Google Account. You may also refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of this website.

You can find out how to delete cookies in the most common browsers here:

· Google Chrome: Website
· Mozilla Firefox: Website
· Apple Safari: Website
· Microsoft Internet Explorer: Website

For more information, please refer to Google's privacy policy, which can be found here:

· https://www.google.com/policies/privacy/

You can find information about Google's privacy settings at https://privacy.google.com/take-control.html

We use the service google analytics on our website from Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Irland.

Google Analytics uses "cookies", which are text files placed on your device, to help the website analyze how users use the site. Google Analytics may also use web beacons (invisible graphics). These web beacons can be used to evaluate information such as visitor traffic to websites. The information generated by cookies and web beacons about the use of our website (including the user's IP address) is transmitted to a Google server, possibly in the USA or other third countries, and stored there. This information can be passed on by Google to Google's contractual partners.

Information on Google's existing Privacy Shield certification and other relevant data relating to data processing by Google in connection with the use of Google services can be found in this privacy statement under the section "6) Information on Google services".

The following data types are processed by Google:

· Online identifiers (including cookie identifiers)
· IP address
· device identifiers

In addition, you can find more detailed information about the information processed at

https://www.google.com/intl/de/policies/privacy/#infocollect

under "Data we receive as a result of your use of our services" and at

https://privacy.google.com/businesses/adsservices/.

In the context of the granting of consent for the use of Google Analytics, the following data will also be processed by us:

· Your IP address
· Date and time of sending

We only use Google Analytics with IP anonymization enabled ("anonymize IP"). This will cause Google to shorten your IP address within member states of the European Union or other states party to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to and truncated by Google on servers in the United States.

Furthermore, we have concluded an order processing agreement with Google for the use of Google Analytics (Art. 28 DSGVO). Google processes the data on our behalf in order to evaluate your use of the website, compile reports on website activity for us and provide us with other services relating to website activity and internet usage. Google may transfer this information to third parties where required to do so by law, or where such third parties process the information on Google's behalf.

By integrating Google Analytics, we pursue the purpose of analysing user behaviour on our website and being able to react to it. This enables us to continuously improve our services. The purpose of processing the data collected in the course of the declaration of consent is to record your consent.

The legal basis for the processing of personal data described here within the framework of the measurement procedure is your express consent pursuant to Art. 6 Para. 1 lit. a) DSGVO.

The legal basis for the processing of data processed within the scope of obtaining consent is our legitimate interest pursuant to Art. 6 para. 1 lit. f) DSGVO. We have a legitimate interest in being able to prove your consent to the measurement procedure (Art. 7 para. 1 DSGVO).

Within the scope of order processing, Google is entitled to commission subcontractors. A list of these subcontractors can be found at https://privacy.google.com/businesses/subprocessors/.

Your rights:
1. Right of withdrawal

2. Right of objection

If the processing of your data is not covered by the consent (proof of consent), you have the right to object.

The data collected and processed within the framework of the measurement procedure are stored for 14 months and automatically deleted after the expiry of this storage period.

The data of the recording of the consent are deleted as soon as they are no longer necessary for the purpose of their collection.

For further information on data handling in connection with Google Analytics, please refer to Google's privacy policy:

https://support.google.com/analytics/answer/6004245?hl=en

You can find information about Google's privacy settings at

https://privacy.google.com/take-control.html?categories_activeEl=sign-in

The provision of personal data is neither required by law nor by contract and is also not necessary for the conclusion of a contract. You are also not obliged to provide the personal data. Failure to do so may, however, result in you not being able to use our website or not being able to use it to its full extent.

You have the possibility to subscribe to our newsletter on our website.

To send the newsletter we use the newsletter service of MailChimp. Provider is the Rocket Science Group LLC, 675 Ponce De Leon Ave NE, Suite 5000, Atlanta, GA 30308, USA. MailChimp is a service with which, among other things, the dispatch of newsletters can be organized and analyzed.

If you enter data for the purpose of subscribing to the newsletter (e-mail address), this will be stored on the servers of MailChimp in the USA.

As stated in the Privacy Shield certification of "The Rocket Science Group LLC" (MailChimp) (to be found at https://www.privacyshield.gov/list under the search term "MailChimp"), MailChimp is committed to complying with the EU-US Privacy Shield Framework published by the US Department of Commerce and the Swiss-US Privacy Shield Framework on the collection, use and storage of personal data from the member states of the EU and Switzerland respectively. The Rocket Science Group LLC (MailChimp) has declared by certification that it complies with the Privacy Shield Principles.

Furthermore, we have concluded a "Data Processing Agreement" with MailChimp. This is a contract in which MailChimp undertakes to protect the data of our users and to process the data exclusively in accordance with the data protection regulations on our behalf. Further information can be found at: https://mailchimp.com/legal/privacy/

If you register for our newsletter, we process the following information (also personal data) from you:

· Object and profile reference
· email address
· Date and time
· IP address
· Action type (entry, update, permission change)
· Metadata of the action

In order to be able to display the proof of consent and the proof of subscription in a legally compliant manner, we keep the following data on the events entry, change, confirmation and subscription of the newsletter for each user profile which is generated with an e-mail address confirmed by the double opt-in procedure:

· Date and time
· IP address

In addition, we process the following information (also personal data) from you within the scope of your use of our newsletter:

· Object and profile reference
· email address
· Date and time
· IP address
· Action type (entry, update)
· permission change
· Metadata of the action

The processing of the data takes place through us, Mailchimp and - if available - subcontractors of Mailchimp within the scope of the data processing. Subcontractors process the data according to instructions and on our behalf as well as Mailchimp itself.

With the help of the Mailchimp service, we analyse the success and reach of our newsletters (campaigns). We evaluate, for example, whether you open a newsletter or how you proceed with the newsletter.

For this purpose, Mailchimp uses and stores cookies, for example, to enable statistical surveys and to build up interest profiles. It is possible for us to understand how you react to individual newsletters from us (e.g. whether you have opened the newsletter).

By registering for the newsletter, you consent to the processing of your personal data (Art. 6 para. 1 lit. a) GDPR), whereby we secure the registration with a double opt-in procedure:

In a first step, you enter the mandatory information (e.g. e-mail address) and consent to the processing of your personal data by activating the appropriate box. In a second step, you will then automatically receive an e-mail with a confirmation or activation link, which you should also confirm or activate. This will ensure that the email address you enter on our website is yours.

The collection and processing of the user's e-mail address serves the purpose of delivering the newsletter. The collection and processing of further personal data as part of the registration process has the purpose of preventing misuse of our newsletter or the e-mail address used. In addition, the processing described above serves to enable us to prove that we have received your consent.

The purpose of processing cookie and measurement data is to track the success and reach of our newsletters.

Legal basis for the processing of personal data, which is necessary for the technical provision of the newsletter to you, as well as for the processing of cookie and measurement data is your consent according to Art. 6 para. 1 lit. a) GDRP.

The legal basis for the processing of further personal data is our legitimate interest pursuant to Art. 6 para. 1 lit. f) GDPR. We have a legitimate interest in being able to prove that you have given us your consent. In addition, we have a legitimate interest in being able to prevent or prove misuse of our newsletter.

Your rights:
1. Right of withdrawal

2. right of objection

If the processing of your data is not covered by the consent (especially protocol files), you have the right to object.

The data will be deleted as soon as they are no longer required for the purpose of their collection. Your registration data will therefore only be stored as long as the newsletter subscription is active. Tracking and cookie data are deleted as soon as the purpose of processing is achieved. If you do not confirm the e-mail as part of the double opt-in procedure, your registration will be automatically deleted.

The provision of personal data is neither required by law nor by contract and is also not necessary for the conclusion of a contract. You are also not obliged to provide the personal data. Failure to do so, however, would mean that we would not be able to provide you with a newsletter.

On our website we use services from Netlify, Inc. ("Netlify"),2325 3rd Street, Suite 215, San Francisco, 94107 CA, USA. Netlify is a cloud computing company of hosting services and customer relationship management systems.

Netlify enables us to integrate various codes and services into our website in an orderly and simplified manner. Netlify processes the following personal date:

· none

For data transmission to the USA, we have agreed corresponding standard contractual clauses of the EU with Netlify. These can be viewed at:

https://cms.dvhventures.de/files/netlify-dpa.pdf

You can also find more detailed information about Netlify on their websites:

https://www.netlify.com/privacy/

Furthermore, we have concluded an data processing agreement for the use of Netlify with Netlify (Article 28 of the GDPR). Netlify processes the data on our behalf in order to trigger the stored tags and display the services on our website. Netlify may transfer this information to third parties if required to do so by law or if third parties process this data on behalf of Netlify.

If you have deactivated individual tracking services (e.g. by setting an opt-out cookie), the deactivation will continue for all affected tracking tags that are integrated by Netlify.

Through the integration of Netlify, we pursue the purpose of being able to carry out a simplified and clear integration of various services. In addition, the integration of Netlify optimizes the loading times of the various services.

The legal basis for the processing of personal data described here is Article 6 (1) point f) of the GDPR. Our justified interest in this is the great benefit that the integration of various services via the Netlify brings. By integrating Netlify, we reduce our maintenance effort as well as the loading effort of the website and the server and traffic load. In addition, Netlify has a justified interest in the collected (personal) data in order to improve its own services.

The processed information will only be stored as long as it is necessary or legally required for the intended purpose.

The provision of personal data is neither required by law nor by contract and is also not necessary for the conclusion of a contract. They are also not obliged to provide the personal data. Failure to do so may, however, result in you not being able to use our website or not being able to use it to its full extent.

In addition to this website, we also maintain presences in various social media, which you can reach via the corresponding buttons on our website. If you visit such a presence, personal data may be transmitted to the provider of the social network.

We would like to point out that user data is also transferred to a server in a third country and can therefore be processed outside the European Union. US providers who are certified under the Privacy Shield have undertaken to comply with the data protection standards of the EU. Further information can be found at https://www.privacyshield.gov/Program-Overview.

It is possible that, in addition to the storage of the data you have specifically entered in this social medium, further information may also be processed by the provider of the social network.

In addition, the social network provider may process the most important data of the computer system from which you visit it, such as your IP address, processor type and browser version used, including plug-ins.

If you are logged in with your personal user account of the respective network while visiting such a website, this network can assign the visit to this account.

The purpose and scope of the data collection by the respective medium and the further processing of your data there as well as your rights in this regard can be found in the respective provisions of the respective responsible party, e.g. below:

· Facebook (Facebook, Inc., 1 Hacker Way, Menlo Park, CA
94025, USA):
› At Fanpages: Agreement on joint processing of personal data (Art. 26 (1) GDPR)
https://www.facebook.com/legal/terms/page_controller_addendum
› Privacy Policy Facebook: https://www.facebook.com/about/privacy/
› Opt-out possibility: https://www.facebook.com/settings?tab=ads and https://www.facebook.com/settings?tab
› Privacy Shield Certification: https://www.privacyshield.gov/participant?id=a2zt0000000GnywAA C&status=Active

· Twitter (Twitter Inc., 1355 Market Street, Suite 900, San
Francisco, CA 94103, USA):
› Privacy Policy: https://twitter.com/de/privacy
› Opt-out option: https://twitter.com/personalization
› Privacy Shield Certification: https://www.privacyshield.gov/participant?id=a2zt0000000TORzAAO
&status=Active

· LinkedIn (Ireland Unlimited Company, Wilton Place Dublin 2, Irland):
› Privacy policy: https://www.linkedin.com/legal/privacypolicy?_
l=en_DE
› Opt-out possibility: https://www.linkedin.com/psettings/guestcontrols/
retargeting-opt-out
› Privacy Shield Certification: https://www.privacyshield.gov/participant?id=a2zt0000000L0UZAA0 &status=Active

· Xing (New Work SE, Dommtorstraße 30, 20354 Hamburg, Germany)
› Privacy Policy: https://privacy.xing.com/de/datenschutzerklaerung
› Opt-Out: https://nats.xing.com/optout.html?locale=de_DE

We secure our website and other systems through technical and organizational against loss, destruction, access, alteration or distribution of your data by persons. Despite regular checks, however, complete protection all dangers is not possible.

Changes in the law or in our internal processes may make it necessary to adapt this policy.

In the event of such a change, we will notify you at the beginning of this Privacy Policy.

You have the right to revoke your consent at any time with effect for the future, without affecting the lawfulness of the processing carried out on the basis of your consent until revocation.

You have the following rights:

· Right of access by the data subject (Art. 15 GDPR)
· Right to rectification (Art. 16 GDPR)
· Right to object (Art. 21 GDPR)
· Right to erasure (‘right to be forgotten’) (Art. 17 GDPR)
· Right to restriction of processing (Art. 18f. GDPR)
· Right to data portability (Art. 20 GDPR)

For inquiries of this kind, please contact privacy@dvhventures.de. Please note that we must ensure that such requests are actually about the person concerned.

You have the right to complain to a data protection supervisory authority, without prejudice to any other administrative or judicial remedy.

Automated decision making does not take place on our website.

Status: 17.01.2020

Facebook Ireland Ltd ("Facebook") provides us with so-called "Facebook Insights" as a Facebook fan page operator. Insights are various statistics that provide us with information about the use of our Facebook fan page. You can also find detailed information on this at:

https://www.facebook.com/business/a/page/page-insights.

In order to compile these statistics, various information provided by you (including personal data) is processed by Facebook. The personal data will be processed by Facebook and us as joint controllers within the meaning of Art. 26 GDPR. In the following, we provide you with the essential information of the agreement concluded between Facebook and us (https://www.facebook.com/legal/terms/page_controller_addendum) in accordance with Art. 26 GDPR.

Joint controllers for the processing are

Facebook Ireland Ltd
4 Grand Canal Square
Dublin 2
Irland

and

Dieter von Holtzbrinck Ventures GmbH
Goltsteinstraße 106
50968 Köln
Tel.-No.: +49 0 22 1 / 933 161 0
Fax-No.: please send an email
E-Mail: privacy@dvhventures.de

Facebook has assumed the primary responsibility (assumption of all obligations under the GDPR) for data processing. This means in particular:

• Facebook assumes the necessary duties to provide information (e.g. Art. 13 GDPR).
• Data subject rights can be asserted against Facebook (e.g. right to information or deletion, objection to data processing or revocation of any consent given; see also section "V. Data subject rights").
• Ensuring the technical and organizational measures of data processing

Facebook provides comprehensive information regarding data processing at www.facebook.com (Art. 13 GDPR). In order to provide you with an overview of the essential information, we also refer to the contents provided by Facebook within the framework of this data protection notice.

Regardless of Facebook's agreed primary responsibility, you can of course also assert your rights directly against us within the framework of the GDPR. We will immediately forward this request to Facebook using a form available for this purpose.

You can view the legal basis and the purposes of the processing of Facebook at https://www.facebook.com/about/privacy/legal_bases as well as https://de-de.facebook.com/policy.php.

Our legal basis for the processing of Insights data is our legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR. We have a legitimate interest in being able to track user behaviour on our Facebook fan page. In particular, this enables us to record the scope and effectiveness of our campaigns, postings and other activities through prepared statistics. This enables us to continuously optimize our website and our services in line with demand. This also represents the purpose of the processing for us.

In particular, Facebook may process the following data:

• User interaction (click behaviour, postings, likes, viewing videos, page views, etc.)
• Cookies
• Demographic characteristics (age, gender, state, etc.)
• IP address
• System and device information (e.g. browser type, operating system, etc.)

The exact processing of your data when you visit our Facebook fan page depends on whether you have a Facebook account or not. If you have a Facebook account, Facebook can permanently associate the information with your account to learn more about you.

Even if you do not have a Facebook account, Facebook can still store your information. This can be done through the use of cookies. These are usually small text files that are stored on your device. Various information is written into this text file, which can be read out again at a later point in time. This makes it possible for Facebook to store and process information about you even without you having a Facebook account. More detailed information about Facebook's cookies can be found at https://de-de.facebook.com/policies/cookies/.

As part of the Insights usage, we only receive anonymous statistics from Facebook about the use of our fan page. We can only see how many users have performed certain interactions, not which user has performed a certain action. The statistics of the Insights data do not allow us to draw any conclusions about a person.

You have the following rights:

• Right of access by the data subject (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right of object (Art. 21 GDPR)
• Right to erasure (‘right to be forgotten’) (Art. 17 GDPR)
• Right to restriction of processing (Art. 18f. GDPR)
• Right to data portability (Art. 20 GDPR)

You have the right to revoke your consent at any time with effect for the future, without affecting the lawfulness of the processing carried out on the basis of your consent until revocation.
You can assert these rights directly against Facebook or against us (see section "II. Responsibility with regard to the processing of Insights Data"). If you wish to assert your rights against us, please contact us at the e-mail address privacy@dvhventures.de and describe your specific request in as much detail as possible.

You have the right to object to the processing by cookies. You can exercise this right as follows:

You can determine the storage time of the cookies via your browser by displaying the cookies (usually by clicking on the "i" next to the address bar, e.g. Firefox or Google Chrome).

Status: November 2018