DATA PRIVACY POLICY

We – Dr. Karsten Wetwitschka, 20HERTZ – Deeper Understanding of Leadership ("20HERTZ" or "we") – would like to inform you about our processing of your personal data in accordance with the General Data Protection Regulation ("GDPR").

Our privacy policy is structured modularly. It consists of general information regarding the processing of personal data in various situations (I.) and specific information that applies to each respective processing situation (II. onwards). To find the relevant sections for you, please refer to the following outline:

I.General Information

1.Data Controller

The data controller, as defined in the GDPR and other national data protection laws of the member states as well as other data protection regulations, is:

Dr. Karsten Wetwitschka
20HERTZ – Deeper Understanding of Leadership
Zur Sielwiese 8
25337 Kölln-Reisiek

Email: wetwitschka@20hertz.de

Webseite: www.20hertz.de

2.Legal Bases for Processing Personal Data

We process some of your personal data based on the following legal bases:

a)Consent of the Data Subject

Where we obtain the consent of the data subject for specific purposes, Article 6(1)(a) of the General Data Protection Regulation (GDPR) serves as the legal basis.

b)Performance of Contractual Obligations

Where processing is necessary for the performance of a contract to which you are a party, Article 6(1)(b) GDPR serves as the legal basis. This also applies to processing operations required for pre-contractual measures.

c)Legal Obligations

Where processing is necessary for compliance with a legal obligation to which we are subject, Article 6(1)(c) GDPR serves as the legal basis.

d)Legitimate Interests

Where processing is necessary for the purposes of our legitimate interests or those of a third party, and your interests, fundamental rights, and freedoms do not override our legitimate interests, Article 6(1)(f) GDPR serves as the legal basis.

3.Storage Period and Deletion of Personal Data

Personal data will be deleted or blocked as soon as the purpose that justifies the legal basis for processing no longer exists.

4.Recipients of Personal Data

Internally, only entities that require personal data for the fulfillment of their processing purposes will process such data. This also applies to external data processors, service providers, and agents engaged by us. All entities and individuals handling personal data are bound by confidentiality obligations and have been instructed on the sensitive handling of such data.

Personal data will only be disclosed to third parties in compliance with data protection regulations. Specifically, individuals involved in the conduct of our business operations (e.g., banks, tax consultants, IT service providers) as well as government authorities may receive your personal data to the extent required to fulfill a legal obligation.

5.Data Processing in Third Countries

Some of our services require the processing of personal data in countries outside the European Union/the European Economic Area ("third countries") by our data processors. If personal data is processed and the country does not provide a level of data protection equivalent to the European standard, confirmed by an adequacy decision pursuant to Article 45(3) GDPR by the European Commission, we have established suitable safeguards in accordance with Article 46 GDPR with the relevant data processors, such as EU Standard Contractual Clauses. A copy of the EU Standard Contractual Clauses can be found here: https://eur-lex.europa.eu/legal-content/DE/TXT/PDF/?uri=CELEX:32021D0914&from=DE.

In case of data processing in third countries, we will provide further information below.

6.Rights of the Data Subject

If your personal data is processed, you are a data subject within the meaning of the GDPR, and you have the following rights against us as the data controller:

a)Right to Information

According to Article 15 GDPR, you have the right to obtain information about the personal data we process. In particular, you can request:

• Information about the purposes of the processing,

• the categories of data concerned,

• the recipients or categories of recipients to whom the personal data has been or will be disclosed, including recipients in third countries or international organizations, and information about the appropriate safeguards relating to the transfer (in this context, you can request to be informed about the suitable guarantees pursuant to Article 46 GDPR),

• the envisaged storage period,

• the existence of the right to rectification, erasure, restriction of processing, or objection,

• the right to lodge a complaint, information about the source of the data, if the personal data was not collected from you,

• and whether automated decision-making, including profiling, pursuant to Article 22(1) and (4) GDPR, is taking place, and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for you.

b)Right to Rectification

According to Article 16 GDPR, you have the right to have your personal data corrected or completed if it is inaccurate or incomplete. We are obligated to make the correction without undue delay.

c)Right to Restriction of Processing

According to Article 18 GDPR, you have the right to request the restriction of the processing of your data if you contest the accuracy of the data or if the processing is unlawful.

If the processing has been restricted, you will be informed by us before the restriction is lifted.

d)Right to Erasure

According to Article 17 GDPR, you have the right to request the erasure of your personal data, unless the processing is necessary for exercising the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise, or defense of legal claims.

e)Right to Information

If you have asserted your right to rectification, erasure, or restriction of processing to us, we are obligated to communicate any rectification, erasure of personal data, or restriction of processing to all recipients to whom the personal data has been disclosed, unless this proves impossible or involves a disproportionate effort.

f)Right to Data Portability

According to Article 20 GDPR, you have the right to receive your personal data that you have provided to us in a structured, commonly used, and machine-readable format, or to request its transmission to another controller.

g)Right to Object

According to Article 21 GDPR, you have the right to object to the processing of your personal data if the processing is based on Article 6(1)(e) or (f) GDPR.

h)Right to Withdraw Consent

According to Article 7(3) GDPR, you have the right to withdraw your consent to data processing at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

i) Right to Lodge a Complaint with a Supervisory Authority

According to Article 77 GDPR, you have the right to lodge a complaint with a supervisory authority regarding our processing of your personal data.

II.Additional Information for Data Processing When Visiting the Website

We are responsible for our website www.20hertz.de and its subpages ("Website"). By using our website, personal data is processed. Below, we provide detailed information about the data processing activities taking place.

1.Provision of the Website and Creation of Log Files

When you access our website, we automatically collect data and information from the user's device (known as log files).

Data Processor

To provide our website, we use the Content Delivery Network service jsDelivr, provided by the data processor Prospect One sp. Zo.o. sp.k., Królewska 65A/1, PL-30-081 Kraków, Poland („jsDelivr“). We have signed a data processing agreement with jsDelivr, and they process personal data exclusively on our behalf.

Processed Information & Duration of Processing

The following information is processed when visiting the website:

• Information about the type and version of the browser

• Operating system of the device

• Internet service provider of the user

• IP address of the device

• Date and time of access

The log files are deleted within seven days at the latest.

Purpose of Processing & Legal Basis

The data is necessary for displaying the website on the user's device, ensuring its functionality, and analyzing any disturbances. Additionally, we use the data to optimize the website and ensure the security of our information technology systems.

The legal basis for this processing is Article 6(1)(f) of the GDPR. The collection of log files is essential for the operation of the website; therefore, there is no possibility for the user to object.

2.Use of Cookies

We use cookies on our website. These are text files that are stored in the internet browser or by the internet browser on the user's device system when visiting a website. Each cookie contains a unique character string that allows the browser to be identified when the website is accessed again, enabling the recognition of the specific user device. Technically necessary cookies are deleted at the end of the session.

On our website, we use optional analysis cookies. These cookies are used for functional, analytical, or marketing purposes. The use of these cookies is based on the user's consent, which the user grants to us when visiting the website for the first time. This consent includes storing and retrieving cookies as well as processing the resulting personal data for analytical purposes. The legal basis for storing and retrieving the analysis cookies is § 25 (2) of the Telemedia Act (TTDSG); for processing the resulting personal data, Article 6(1)(a) of the GDPR serves as the legal basis.

You can revoke your consent at any time by changing the settings in the Consent Manager accessible here. In the Consent-Manager, you will find all information about the cookies used, their purpose, the respective storage duration, and the recipients of the data processed by the cookies. The lawfulness of the processing carried out based on the consent before its revocation remains unaffected.

Data Processor

To provide the Consent Manager "CCM19" for managing your consents, we engage the data processor Papoo Software & Media GmbH, Auguststraße 4, 53229 Bonn. We have concluded a data processing agreement with Papoo Software & Media GmbH, and they process user settings exclusively on our behalf. There is no processing of personal data in third countries through them.

3.Google Services

We utilize several Google services. Our data processor for these services is Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"). Recipients of your data may include:

• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (as a data processor under Article 28 of the GDPR)

• Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA,

• Alphabet Inc., 1600 Amphitheatre Parkway Mountain View, CA 94043, USA.

When Google processes data outside the EU/EEA, Google Ireland Limited has established appropriate safeguards pursuant to Article 46 of the GDPR with its group companies Google LLC and Alphabet Inc., both located in California, USA, by implementing EU Standard Contractual Clauses. You can find a copy of the contractual clauses here: https://policies.google.com/privacy/frameworks?hl=de&gl=de. Data transfers to the USA also occur based on the EU/US Data Privacy Framework, to which the Google companies are registered.

a)Google Tag Manager

If you have given your consent, this website uses Google Tag Manager.

Google Tag Manager is primarily used to deploy other tools. Instead of loading a tool directly, it is loaded by Google Tag Manager. Google Tag Manager uses administrator cookies and transfers cookies associated with the Tag Manager to Google. The information collected through these cookies about your use of this website is usually transmitted to a Google server in the USA and stored there.

Due to the server connections between your internet connection and Google's servers, your IP address and network data, such as the following, are processed:

• Approximate location (region)

• Technical information about the browser and devices used (e.g., language settings, screen resolution)

• Internet service provider

• Referrer URL (which website/which advertising medium users came from to this website)

The legal basis for data processing by Google Tag Manager is your consent under § 25(1) TTDSG in conjunction with Article 6(1)(a) of the GDPR.

You can revoke your consent at any time for the future by accessing the settings Consent Manager and changing your selection. You will also find information about the processed cookies there. The legality of the processing carried out based on the consent before its revocation remains unaffected. The data collected via the Tag Manager will be processed until your consent is revoked.

You can also prevent the storage of cookies in advance by configuring your browser software accordingly. However, if you configure your browser to reject all cookies, certain functionalities on this and other websites may be restricted. Furthermore, you can prevent the collection of data generated by the cookie and related to your use of the website (including your IP address) and the processing of this data by Google by not giving your consent to the setting of the cookie.

For more information on terms of use for Google Tag Manager and data privacy at Google, please visit https://marketingplatform.google.com/about/tag-manager/ and https://policies.google.com/?hl=de.

b)Google Analytics

If you have given your consent, this website uses the web analysis service Google Analytics 4.

Google Analytics uses cookies that enable an analysis of your use of our websites. The information collected through these cookies about your use of this website is usually transmitted to a Google server in the USA and stored there.

In Google Analytics 4, IP addresses are anonymized by default. Due to IP anonymization, your IP address is truncated by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there. According to Google, the IP address transmitted by your browser as part of Google Analytics will not be merged with other data from Google.

During your website visit, your user behavior is recorded in the form of "events." Events can include:

• Pageviews

• First-time visit to the website

• Session start

• Your "click path," interaction with the website

• Scrolls (whenever a user scrolls to the end of the page (90%))

• Clicks on external links

• Internal search queries

• Interaction with videos

• File downloads

• Viewed/clicked ads

• Language settings

Additionally, the following information is collected:

• Your approximate location (region)

• Your IP address (in truncated form)

• Technical information about your browser and devices used (e.g., language settings, screen resolution)

• Your internet service provider

• The referrer URL (which website/which advertising medium you came from to this website)

Google will use this information on our behalf to evaluate your pseudonymous use of the website and to compile reports on website activities. The reports provided by Google Analytics are used to analyze the performance of our website..

Data that has reached its retention period is automatically deleted once a month.

The legal basis for this data processing is your consent under § 25(1) TTDSG in conjunction with Article 6(1)(a) of the GDPR. You can revoke your consent at any time for the future by accessing the cookie settings Consent Manager and changing your selection. You will also find information about the processed cookies there. The legality of the processing carried out based on the consent before its revocation remains unaffected.

You can also prevent the storage of cookies in advance by configuring your browser software accordingly. However, if you configure your browser to reject all cookies, certain functionalities on this and other websites may be restricted. Furthermore, you can prevent the collection of data generated by the cookie and related to your use of the website (including your IP address) and the processing of this data by Google by:

• Not giving your consent to the setting of the cookie

• Downloading and installing the browser add-on to disable Google Analytics here

For more information on Google Analytics terms of use and data privacy at Google, please visit https://marketingplatform.google.com/about/analytics/terms/de/ and https://policies.google.com/?hl=de.

III.Additional Information for Communication with Us

The following information applies to any communication with us.

If the communication occurs within an existing contractual relationship or any other contractual arrangement, the data processing is also governed by the supplementary information under section IV.

If the communication pertains to a job application with us, the data processing is also subject to the additional information provided under section V.

1.Phone

You can contact us by phone.

Processed Information & Duration of Processing

In addition to your phone number, we process the personal data that you provide to us during the conversation.

The data will be deleted – unless there is another reason for processing – once the issue has been resolved with you.

Purpose of Processing & Legal Basis

The personal data are processed solely for the purpose of handling the inquiry and in case of follow-up questions from you.

If the communication aims at concluding a contract, the legal basis for processing is Art. 6(1)(b) GDPR.

In all other cases, the legal basis is Art. 6(1)(f) GDPR. Your interest does not override our interest in responding to your inquiry; since you are communicating with us, responding to you is also in your interest, and you are aware that we need to process your personal data to communicate with you.

2.Email

You can contact us via email. We would like to inform you that there are possibilities for third parties to gain insights into email communications. If it is important to you that the information you provide is not exposed to the risk of illegal access by third parties, we recommend using a different communication method. However, if you choose to contact us via email, we assume that the ongoing exchange through this communication channel is also in your interest.

Processed Information & Duration of Processing

In addition to your email address, we process the personal data provided by you within the email communication.

The data will be deleted – unless there is another reason for processing – once the issue has been resolved with you.

Purpose of Processing & Legal Basis

The personal data are processed solely for the purpose of handling the inquiry and in case of follow-up questions from you.

If the communication aims at concluding a contract, the legal basis for processing is Art. 6(1)(b) GDPR.

In all other cases, the legal basis is Art. 6(1)(f) GDPR. Your interest does not override our interest in responding to your inquiry; since you are contacting us, responding to you is also in your interest, and you are aware that we need to process your personal data to respond to your inquiry.

3.Video Telephony

We also use video telephony for communication.

Data Processor

To conduct video telephony, we use the service ZOOM provided by Zoom Video Communications, INC., (55 Almaden Blvd., San Jose, CA 95113, USA; "ZOOM") as our data processor. We have entered into a data processing agreement with ZOOM. It is possible that ZOOM processes personal data in a third country to ensure smooth video telephony. Therefore, we have concluded EU Standard Contractual Clauses with ZOOM to provide appropriate safeguards as per Art. 46 GDPR. You can find the ZOOM data processing agreement along with the EU Standard Contractual Clauses here: https://explore.zoom.us/docs/doc/Zoom_GLOBAL_DPA.pdf?_ga=2.251769289.195750321.1646675462-801897819.1598290790.

Processed Information & Duration of Processing

The following communication data is processed during video telephony:

• Basic personal data (if voluntarily provided by you)

• Contents of the online meeting (if you appear personally with contributions in words and/or writing)

• Authentication data

• Log files, protocol data

• Metadata (e.g., IP address, time of participation, etc.)

• Profile data (e.g., your username if voluntarily provided by you)

The personal data will be deleted once the issue has been resolved with you and if there is no other reason for processing.

Purpose of Processing & Legal Basis

The personal data are processed solely for the purpose of handling the inquiry and in case of follow-up questions from you.

If the communication aims at concluding a contract, the legal basis for the processing is Art. 6(1)(b) GDPR.

In all other cases, the legal basis is Art. 6(1)(f) GDPR. Your interest does not override our interest in providing a technically simple and reliable provision of a modern communication tool.

4.Appointment Scheduling

We use the scheduling and organization tool Calendly on our website.

Data Processor

Calendly is provided to us by Calendly LLC, 115 E Main St., Ste A1B, Buford, GA 30518, USA ("Calendly"), with whom we have entered into a data processing agreement. The data processing agreement with Calendly includes the EU Standard Contractual Clauses ("SCC") and provides sufficient guarantees as per Art. 46 ff. GDPR. You can find the data processing agreement along with the SCC here: https://calendly.com/dpa

Scope and Purpose of Processing

With Calendly, we give users the opportunity to schedule appointments with us. For this purpose, users are asked to enter their name and email address, a preference for a call or video conference, and possibly information about the purpose of the meeting into a form. We use this data to prepare for and conduct the requested conversation.

Calendly uses technically necessary cookies that allow management of the incoming data traffic. These cookies are deleted after the session expires. The legal basis for storing the mandatory cookies is § 25 Abs. 2 Nr. 2 TTDSG. The legal basis for processing the resulting personal data is Art. 6(1)(f) GDPR. The use of these cookies is essential for the Calendly function, and therefore, the user cannot object to it. More information can be found in the accessible Consent-Manager.

Duration of Processing

The data you enter will remain with us until you request deletion, revoke your consent to storage, or the purpose for data storage no longer applies. Mandatory legal provisions, especially retention periods, remain unaffected.

Legal Basis

The legal basis for data processing is Art. 6(1)(f) GDPR. As website operators, we have a predominant legitimate interest in a straightforward appointment scheduling process with interested parties and customers.

IV.Additional Information for Contractual Partners

The following information applies to you if we are in a contractual relationship.

Processed Information & Duration of Processing

The specific data processed about you depends on the tasks within the contractual relationship. We use personal information exclusively for the purpose for which it was provided to us. This may include personal details (name, address, and other contact information, date and place of birth). Additionally, it may include order data (e.g., payment instructions), data from the fulfillment of our contractual obligations (e.g., transaction data in payment transactions), information about your financial situation (e.g., creditworthiness data), advertising and sales data, as well as other data similar to the mentioned categories.

The personal data will be deleted once the contractual relationship with you has ended and no other reason for processing exists.

Purpose of Processing & Legal Basis

Processing primarily occurs for the purpose of establishing and performing the contractual relationship; the legal basis is Art. 6(1)(b) GDPR.

Furthermore, we may process your data based on our legitimate interests, namely for the purpose of contact and communication management, economic efficiency checks, contract and project management, and to ensure the operation of information and telecommunication systems. The legal basis is Art. 6(1)(f) GDPR.

Additionally, as a company, we are bound by various legal obligations that must be complied with according to applicable laws and regulations. The legal basis for processing to fulfill legal obligations and requirements is Art. 6(1)(c) GDPR. This includes, among other things, tax-related retention obligations.

V.Additional Information for Applicants

The following information applies to you if you are applying for a position with us.

Processed Information & Duration of Processing

We process the personal data we receive from you through your application.

The personal data will be deleted after six months if no employment relationship is established. If an employment relationship is established, the data will be further processed for that purpose.

Purpose of Processing & Legal Basis

We collect and process the personal data of applicants for the purpose of handling the application process.

The legal basis for processing personal data is § 26 of the German Federal Data Protection Act (BDSG). If we enter into an employment contract with you, the data transmitted will be further processed for the purpose of managing the employment relationship; the legal basis remains § 26 BDSG in this case.

If no employment contract is concluded, the application documents will be deleted, provided that deletion does not conflict with any other legitimate interests of the data controller. Another legitimate interest in this context, for example, is the burden of proof in proceedings under the General Equal Treatment Act (AGG).