10. CATEGORIES OF RECIPIENTS OF PERSONAL DATA

Some of the aforementioned processes and services are carried out by carefully selected service providers who comply with data protection regulations. These external service providers are bound by our instructions and are regularly monitored. They will not pass on your data to third parties.

With regard to the transfer of data to other recipients, we will only pass on information about you if this is required by law, you have given your consent or we are authorized to do so. If these requirements are met, recipients of personal data may include:

• Public authorities and institutions (e.g. tax authorities, law enforcement agencies) in the event of a legal or official obligation;
• Other companies or comparable institutions to which we transfer personal data in order to carry out the business relationship with you (e.g. network operators, credit agencies).

11. INTENTION TO TRANSFER THE PERSONAL DATA TO A THIRD COUNTRY OR AN INTERNATIONAL ORGANIZATION

An active transfer of personal data to a third country will only take place if this has been expressly indicated within the scope of the aforementioned services and if the prerequisites of Art. 44. GDPR are given. A third country is a country outside the European Economic Area (EEA) in which the GDPR is not directly applicable. For the USA, the EU Commission has not issued an adequacy decision pursuant to Art. 45 (1) GDPR.

12. CRITERIA FOR DETERMINING THE PERIOD FOR WHICH PERSONAL DATA ARE STORED

The criteria for determining the duration of storage are based on the end of the purpose and the subsequent statutory retention period. If the data is no longer required for the fulfillment of contractual or legal obligations, it is regularly deleted, unless its further processing - limited in time and scope - is necessary for the following purposes:

• Fulfillment of retention obligations under commercial and tax law: These include the German Commercial Code (HGB) and the German Fiscal Code (AO). These stipulate retention and documentation periods of up to 10 years.

Preservation of evidence within the framework of the statutory limitation provisions: In accordance with Sections 195 of the German Civil Code (BGB), the regular limitation period is 3 years, but in special circumstances up to 30 years.

13. DATA PROTECTION RIGHTS

At any time you can request information about the stored data, the purpose of storage or its origin. In addition, you can have your personal data blocked, corrected or deleted at any time. A corresponding request or a request for correction, blocking or deletion of personal data should be addressed to the responsible body. Further contact details can be found in the imprint.

All requests for information, correction, blocking or deletion as well as the revocation of consent granted for the collection, use or processing of data must be addressed to this office. You also have the right to lodge a complaint with the data protection supervisory authorities.

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data relating to you which is carried out on the basis of Art. 6 (1) s. 1 lit. e) GDPR (data processing in the public interest) and Art. 6 (1) s. 1 lit. f) GDPR (data processing on the basis of a balance of interests); this also applies to profiling based on this provision within the meaning of Art. 4 No. 4 GDPR.

In individual cases, we process your personal data in order to conduct direct advertising. You have the right to object at any time to the processing of personal data concerning you for the purposes of such advertising; this also applies to profiling insofar as it is related to such direct advertising.

If you object to processing for direct marketing purposes, we will no longer process your personal data for these purposes.

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

The objection can be made form-free and directed to the contact details provided above.

14. OBLIGATION TO PROVIDE DATA AND POSSIBLE CONSEQUENCES OF FAILURE TO PROVIDE DATA

Within the scope of our business relationship, you must provide the personal data that is required for the establishment and implementation of a business relationship and the fulfillment of the associated contractual obligations or which we are required to collect by law. Without this data, we will generally not be able to conclude or execute the contract with you.

15. EXISTENCE OF AUTOMATED DECISION MAKING INCLUDING PROFILING

For the establishment and implementation of the business relationship, we generally do not use automatic decision-making pursuant to Art. 22 GDPR. Should we use these procedures in individual cases, we will inform you about this separately if this is required by law.

16. DATA SECURITY

We protect your information through modern security systems and comply with the data protection and security regulations within the framework of the GDPR.

We maintain up-to-date technical measures to ensure data security, in particular to protect your personal data from risks during data transmissions and from third parties gaining knowledge. These are adapted to the current state of the art.

Online forms on our website are sent with SSL encryption to protect your entered data. Nevertheless, we cannot guarantee that the information sent cannot be viewed by third parties during transmission.

17.  INSTAGRAM ACCOUNT

To advertise our products and services and to communicate with interested parties or customers, we operate a company presence on the Instagram platform: https://www.instagram.com/messeturm_frankfurt/

On this social media platform, we are jointly responsible with Facebook Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2 Ireland.

The data protection officer of Instagram can be reached via a contact form: https://www.facebook.com/help/contact/540977946302970

We have regulated the joint responsibility in an agreement regarding the respective obligations within the meaning of the GDPR. This agreement, from which the mutual obligations result, is available under the following link: https://www.facebook.com/legal/terms/page_controller_addendum

When calling up our online presence on the Instagram platform, data of the user (e.g. personal information, IP address, etc.) is processed by Facebook Ireland Ltd. as operator of the platform in the EU.

This user data is used for statistical information about the use of our company presence on Instagram. Facebook Ireland Ltd. uses this data for market research and advertising purposes and to create profiles of the users. Based on these profiles, it is possible for Facebook Ireland Ltd., for example, to advertise users within and outside of Instagram based on their interests. If the user is logged into his account on Instagram at the time of the call, Facebook Ireland Ltd. can also link the data with the respective user account.

In the event that the user contacts us via Instagram, the user's personal data entered on this occasion will be used to process the request. The user's data will be deleted by us, provided that the user's inquiry has been conclusively answered and no legal retention obligations, such as in the case of subsequent contract processing, are opposed to this.

In order to process the data, Facebook Ireland Ltd. may also set cookies.

If the user does not agree to this processing, it is possible to prevent the installation of cookies by setting the browser accordingly. Cookies that have already been stored can also be deleted at any time. The settings for this depend on the respective browser. In the case of Flash cookies, processing cannot be prevented via the browser settings, but by the corresponding setting of the Flash player. If the user prevents or restricts the installation of cookies, this may mean that not all functions of Facebook can be fully used.

More details about the processing activities, their prevention and the deletion of the data processed by Instagram can be found in Instagram's data policy: https://help.instagram.com/519522125107875

It is not excluded that processing by Facebook Ireland Ltd. also takes place via Facebook Inc., 1601 Willow Road, Menlo Park, California 94025 in the USA.

18. FACEBOOK ACCOUNT

We have set up our own channel on Facebook: https://www.facebook.com/MesseturmFrankfurt

If you use this, please note the following: The service is offered on the technical platform and by means of the services of Facebook Ireland Ltd, 4 Grand Canal Square Grand Canal Harbour, Dublin 2, Ireland.

We would like to point out that you use our Facebook channel and its functions on your own responsibility and that we have no influence on the collection and processing of data by Facebook. This applies in particular to the use of the interactive functions (e.g. commenting, sharing, rating).

When you visit our Facebook page, Facebook collects, among other things, your IP address and other information that is present on your PC in the form of cookies. This information is used to provide us, as the operator of the Facebook page, with statistical information about the use of the Facebook page. Facebook provides more detailed information on this under the following links:http://de-de.facebook.com/help/pages/insights and Supplementary Agreement for Page Insights https://www.facebook.com/legal/terms/page_controller_addendum.

We, as the operator, do not make any decisions regarding the processing of Insights data and all other information resulting from Art. 13 GDPR, including legal basis, identity of the controller and storage duration of cookies on user devices.

The primary responsibility under the GDPR for the processing of Insights Data lies with Facebook.

The data collected about you in this context is processed by Facebook Ireland Ltd. and may be transferred outside the European Union in the process. Facebook describes in general terms what information it receives and how it is used in its data usage guidelines. There you will also find information on how to contact Facebook and on the settings options for advertisements.

The data use policy is available at the following link: http://de-de.facebook.com/about/privacy

The entire Facebook "Data Policy" can be found here: https://de-de.facebook.com/full_data_use_policy

In what way Facebook uses data from visits to Facebook pages for its own purposes, to what extent activities on the Facebook page are assigned to individual users, how long Facebook stores this data and whether data from a visit to the Facebook page is passed on to third parties, is not conclusively and clearly stated by Facebook and is not known to us.

When you access a Facebook page, the IP address assigned to your terminal device is transmitted to Facebook. Facebook also stores information about the end devices of its users (e.g. as part of the "login notification" function); if necessary, this enables Facebook to assign IP addresses to individual users.

If you are currently logged in to Facebook as a user, a cookie with your Facebook ID is located on your end device. This enables Facebook to track that you have visited this page and how you have used it. This also applies to all other Facebook pages. Via Facebook buttons embedded in websites, it is possible for Facebook to record your visits to these website pages and assign them to your Facebook profile.

If you want to avoid this, you should log out of Facebook, deactivate the "stay logged in" function if necessary, delete the cookies present on your device and exit and restart your browser. This will allow you to use our Facebook page without your Facebook identifier being revealed based on the information present in the cookies.

For information on how to manage or delete information Facebook has about you, see the Facebook Support-Seiten.

Stand: 08^th June 2023