Data protection at Basler

Usage data

When you visit our website, so-called usage data is stored on our web server as a log for statistical purposes and analyzed in order to improve the quality of our website. This data record consists of

§ the name and address of the requested content

§ the date and time of the request,

§ the amount of data transferred,

§ the access status (content transmitted, content not found),

§ the description of the web browser and operating system used,

§ the referral link that indicates from which page you came to our site,

The aforementioned log data is only analyzed anonymously.

Storage of the IP address for security purposes

In addition, we store the complete IP address transmitted by your web browser for a strictly earmarked period of seven days in the interest of being able to recognize, limit and eliminate attacks on our websites. After this period has expired, we delete or anonymize the IP address. The legal basis is Art. 6 para. 1 sentence 1 lit. f GDPR.

Data security

We take technical and organizational measures to protect your data from unwanted access as comprehensively as possible. We use an encryption process on our websites. Your data is transmitted from your computer to our server and vice versa via the internet using TLS encryption. You can usually recognize this by the fact that the lock symbol in the status bar of your browser is closed and the address line begins with https://.

Contact form

You have the option of contacting us via our contact form. To use our contact form, we first need the data marked as mandatory fields from you.

If you use and submit forms on our website, the personal data transmitted by you will be stored in applications of the provider Pardot LLC/Salesforce Inc. and processed by us. Data from the user profiles created on the basis of pseudonyms will not be enriched unless you have given us permission to do so when submitting the form.

The purpose of combining the usage information with your personal data is to get to know you better as a potential customer and to provide you with information on our websites and by e-mail that is of particular interest to you personally. It also allows us to evaluate the efficiency of our communication measures.

If you wish to revoke this authorization or generally request the deletion of the personal data transmitted via the forms, please contact: pardot-data-privacy@baslerweb.com.

reCAPTCHA

To protect our web forms from automated requests, we use a so-called Captcha. Within the scope of the captcha function, you may be asked to solve tasks or click on checkboxes. The user input made in this context and possibly also the mouse movements are used to assess whether the input originates from a human or an automated program. The captcha also sets a technically necessary cookie after interaction.

The data processing is carried out on the basis of Art. 6 (1) (f) GDPR and in the legitimate interest of protection against spam and abuse as well as ensuring the security of our systems. If you do not wish this data processing, please refrain from using our web forms. We are supported in the provision and evaluation of the captcha by Google Cloud EMEA Ltd., a processor bound by our instructions. A data processing agreement has been concluded.

Registering in the online store - creating a customer account

If you would like to order via our online shop, you must first register and create an Basler account. For further data protection information on the Basler account, please read the section on the Basler account.

Processing of your data when placing an order

If you decide to order goods or services, we process your data for the fulfillment and processing of the service or purchase contract and, if necessary, its reversal in the context of the termination of the contract. In addition, we use your data to inform you about the status of your order.

If you appoint us as a contact person for a company or organization, we process your data. As the contact person, you can object to this processing at any time with effect for the future.

Messages by email

We process your data in order to send you messages by email. These are

• Necessary system-related messages, e.g. for invitations, account activation and password resets

• Notifications about the status of orders

In order to continuously improve our services, we send a tracking pixel in our messages to determine whether the messages have been opened and whether links in the message have been clicked on. If you would like to opt out of receiving emails from us please click on the link contained in the email you received from us.

Payment processing and reversal

Depending on the payment method you choose, we also process personal data as part of the processing and reversal of payments.

If you choose to pay by credit card, this includes the card number, cardholder, expiration date and card verification number.

In the case of a bank transfer after purchase on account, these are the name of the account holder, IBAN and BIC.

Depending on the payment method selected, we may transmit data to commissioned payment service providers, including banks, savings banks, credit card companies, e-money institutions, and payment initiation service providers.

We transmit data to the following payment service providers, among others

adyen N.V., Simon Carmiggeltstraat 6-50, 1011 DJ Amsterdam, Netherlands adyen is contractually obliged to us as a processor to process your data in accordance with applicable data protection regulations.

Credit Extension

In order for us to extend credit we complete a credit investigation as we deem appropriate, including contacting trade references, banks, and obtaining credit reports.

Collection and processing of personal data

When you apply for an employment opportunity with us, we process your personal data which you provide us as part of the application process. This may include contact details, all data related to the application (CV, certificates, qualifications, answers to questions, etc.) and, if applicable, bank details (to reimburse travel expenses).

When you visit our website, our web servers store the IP address assigned to you by your Internet service provider, the website from which you visit us, the web pages you visit on our site and the date and duration of your visit for a standard period of seven days. This data is processed for security purposes helping use be able to recognize, limit and eliminate attacks on our websites.

Deletion of data

If there is no statutory retention period, your personal data will be deleted as soon as storage is no longer necessary or the legitimate interest of storing the data has expired. If no employment relationship is entered into, your personal data is usually deleted no later than six months after the application process has been completed.

In individual cases, individual data may be stored for longer (e.g. travel expense reports). The duration of storage then depends on statutory retention obligations.

If you are not hired but your application is still of interest to us, we will ask you whether we may keep your application on file for future vacancies. If you agree, we will process your data on the basis of your consent, which you can revoke at any time.

Confidential treatment of your data

We treat your data confidentially and do not pass it on to third parties. We use strictly instruction-bound service providers who support us, for example, in the operation of the application process and the destruction of documents and with whom separate data processing contracts have been concluded.

All data is transmitted in encrypted form via SSL/TLS; this applies to your application, registration and authentication data.

Please contact us if you have questions regarding your data protection rights:

Basler AG - Human Resources

Julia Börries
An der Strusbek 60-62
22926 Ahrensburg
04102/463 369
julia.boerries@baslerweb.com

If you register for a Basler customer account “Basler ID”, you consent to the associated data processing by us. You can have your Basler ID deleted at any time. It is possible that services provided via the Basler ID can then no longer be provided.

We need your contact details for the Basler ID. All accesses made via your account are recorded in our technical log files (timestamp, application, username, IP address). The log files are used for the IT security of our systems, to rectify errors and for support purposes.

We generally analyze user interactions with our products based on anonymized data that does not allow for any identification of individuals.

In exceptional cases, if personal data is processed as part of such analysis, this is done either on the basis of your consent or based on our legitimate interests. In such cases, we will inform you during the ordering or registration process about the categories of personal data we process.

Our goal is to improve the security, stability, and user-friendliness of our products, and to further develop our offerings in marketing and sales. We may process your personal data in order to achieve these goals.

You may withdraw any consent you have given at any time with effect for the future. You may also have the right to object to processing not based on consent, provided the legal requirements are met.

For more information on withdrawing consent or the conditions for exercising your right to object, please refer to the section “Your rights as a data subject” in this privacy notice.

If you use pylon AI, we process all training data entered by you in pylon AI as a processor, including any personal data as defined by applicable data protection law. Depending on how pylon AI is used, the AI models generated may also contain personal data. Data processing is carried out in accordance with the instructions of our customers on the basis of our data processing agreements.

Your consent to advertising measures

We use your contact data for the purpose of direct advertising by e-mail and/or telephone. We generally process contact data (e.g. name, postal address, email address, telephone numbers) and your interests/preferences in relation to our products for, for example

• Invitations to events or trade fairs,

• Offers and information about our services and products by e-mail,

• Christmas/ New Year greetings,

• invitations to participate in customer surveys or market research.

If you have given your consent for advertising, you can revoke this at any time without giving reasons. In the case of direct advertising based on our legitimate interests, you have the right to object at any time. In order to opt-out please follow the link at the bottom of our email.

Newsletter registration and dispatch

You can subscribe to a newsletter on our website. Please note that we require certain data (at least your e-mail address) to subscribe to the newsletter.

The newsletter will only be sent if you have given us your express consent. Once you have signed up to receive the newsletter on our website, you will receive a confirmation email to the email address you have provided (double opt-in). You can withdraw your consent at any time. If you wish to revoke your consent please use the unsubscribe button located at the bottom of each newsletter.

By creating an individual confirmation link, we can record that consent has been confirmed at the e-mail address sent. In this context, we also store the time at which the confirmation was made. The corresponding data processing is carried out in the interest of being able to account for the legality of the newsletter dispatch.

We integrate individual tracking pixels into our newsletters, with which we can recognize when the newsletter sent to you has been called up or opened and individualize the links in the newsletter in order to be able to evaluate when you clicked on which link.

Communication by post, telephone, e-mail

If you communicate with us as an interested party, customer or business partner by post, telephone or e-mail, we process the data you provide for the respective business purposes of the correspondence. Data processing is generally carried out on the basis of existing or future contractual relationships and/or on the basis of your consent. Depending on the individual case, we are legally obliged to process data e.g. in the case of statutory retention obligations. Occasionally, we process your data on the basis of our legitimate interests, if and to the extent that our interests in this data processing prevail, e.g. in the case of ongoing limitation periods.

Online appointment scheduling

Appointments are planned and managed with the help of Microsoft Bookings. In addition to the necessary contact details of the participants of an appointment, the available times of the participants are also processed as part of the scheduling process. As a rule, data processing is carried out for the contractually agreed or planned business relationship and otherwise on the basis of our legitimate interests for business correspondence with corporate customers.

We operate the following social media sites:

• X (formerly Twitter): https://twitter.com/Basler_AG

• X II (formerly Twitter): https://twitter.com/imaginghub

• Facebook: https://www.facebook.com/BaslerAG

• Facebook II: https://www.facebook.com/BaslerAGKarriere

• Facebook III: https://www.facebook.com/imaginghubcom

• XING: https://www.xing.com/companies/baslerag

• LinkedIn: https://www.linkedin.com/company/basler-ag

• LinkedIn II: https://www.linkedin.com/showcase/imaginghub

• YouTube: https://www.youtube.com/user/BaslerAG

• YouTube II: https://www.youtube.com/channel/UCu1LJSyZ_mkqfnttIWiM-Cw

• Instagram: https://www.instagram.com/imaginghub

• Instagram II: https://www.instagram.com/basler_youngtalents/

• Kununu https://www.kununu.com/de/basler

Data processing by us

The data you provide on our social media pages, such as usernames, comments, videos, images, likes, public messages, etc., are published by the social media platform and are not processed by us for any other purposes at any time. We only reserve the right to delete content should this be necessary. We may share your content on our site if this is a function of the social media platform and communicate with you via the social media platform.

If you send us a request on the social media platform, we may also refer you to other secure communication channels that guarantee confidentiality, depending on the content. For example, you can send us your inquiries at any time to the address or email address stated in the legal notice. The choice of the appropriate communication channel is your own responsibility.

The data processing is carried out in the legitimate interest of conducting public relations work for our company and being able to communicate with you.

Data processing under joint responsibility

We are jointly responsible for some of the processing activities with the respective operators of social media platforms.

Accordingly, we have concluded the necessary data processing agreements insofar as the operator of the social media platform allows this.

X https://gdpr.x.com/en.html

https://gdpr.x.com/en/controller-to-controller-transfers.html

Facebook https://www.facebook.com/about/privacy/update

https://www.facebook.com/legal/controller_addendum?_rdr

Instagram https://www.instagram.com/legal/privacy/

https://www.facebook.com/legal/controller_addendum?_rdr

LinkedIn https://www.linkedin.com/static?key=privacy_policy

https://legal.linkedin.com/pages-joint-controller-addendum

The main elements of joint responsibility can be found in the following section.

Statistics (insights)

The social media platforms used, regularly compile statistics (insights) based on usage data that contain information about your interaction with our social media site. We cannot influence or prevent the performance and provision of these statistics.

However, we do not make use of optional statistics from the social media platforms.

We process the aforementioned information (statistics) in the legitimate interest of validating the use of our social media pages and improving our content in a target group-oriented manner.

Target group-oriented advertising

We also use the social media platforms described to display targeted advertising.

For this purpose, we use target group definitions provided to us by the social media operator. We only use anonymous target group definitions, i.e. we define characteristics based on general demographic information, behavior, interests and connections, for example. The operator of the social media platforms use these to display advertisements to their users accordingly. The legal basis for this is the consent that the operators of the social media platforms have obtained from users.

If you wish to revoke this consent, please use the revocation options provided by the operators of the social media platforms, as the social media platform operators are responsible for this processing.

We or the operators of the social media platforms also use publicly available data to define the target group. The legitimate interest on our part is to define the most suitable target group possible. We never use sensitive categories of personal data as defined by applicable data protection regulations (e.g. political opinions, sexual orientation) to define target groups.

We also use information about visits to and interactions with other websites (remarketing) to define target groups. We also use cookies for this purpose. In these cases, however, we obtain the consent of users in advance via a consent banner on the respective other pages and inform them about the data processing at this point. You can revoke this consent at any time by calling up the consent banner of the corresponding website again.

Data processing by the operator of the social media platform

The operators of the social media platforms use web tracking methods. Web tracking can also take place regardless of whether you are logged in or registered with the social media platform.

We would therefore like to point out that it cannot be ruled out that the operators of the social media platforms may use and evaluate your profile and behavioral data for its own purposes. We have no influence on the processing of your data by the operators of social media platforms. Please bear this in mind when using social media platforms.

For more information on data processing by the operators of the social media platforms, configuration options to protect your privacy and other objection options, please refer to the operators' privacy policy.

Data Processing Description

Basler accepts reports via designated reporting channels. You can provide information anonymously via our whistleblower system (https://baslerweb.integrityline.app/). Your data will only be transmitted in encrypted form. Your IP address and location will not be stored. After sending a report, you will receive access data to a mailbox in the whistleblower system so that you can continue to communicate with us anonymously and in a protected manner.

However, if you voluntarily provide us with personal data (e.g. your name, contact details), we will use this data to follow up on your report and contact you for further inquiries, if necessary. To protect your identity as a whistleblower, your data will only be processed by our compliance team.

The report you provide may relate to third parties and include their personal data. These third parties will be informed regularly by our compliance team about the notice and will be given the opportunity to comment on it. We will - as far as legally possible - not disclose any information about your identity.

We generally do not require particularly sensitive information from you or from other individuals (such as health data, information of religious or ideological beliefs, trade union membership, sexual orientation), please provide us with such information only to the extent that it is absolutely necessary; that is, if it cannot be avoided.

Legal basis

If you give us an anonymous report, it is not possible for us to connect the report with your person. The following information applies only when personal data is processed in connection with a whistleblower report.

If you voluntarily provide your own personal data as a whistleblower, we will process this to the extent necessary. On this basis, we also process any special categories of personal data (such as health data, information of religious or ideological beliefs, trade union membership, sexual orientation, etc.) that you may have provided.

We process the personal data of third parties that you provide as part of your report in order to fulfill our legal obligations or to protect our legitimate interests in order to follow up on reports about compliance violations.

Data Recipient

The whistleblower system is provided to us by EQS Group AG, which is contractually obligated to us as a processor. As a matter of principle, we do not disclose your identity - if you have disclosed it to us voluntarily - to other bodies unless we are legally compelled to do so. We only pass on personal data to third parties (e.g. law enforcement agencies) if this is permitted under data protection law. We may also pass on your personal data to external service providers (e.g. IT service providers, companies that destroy or archive data, printing service providers), which support us in data processing within the framework of processing data on our behalf strictly bound by instructions. International data processing only takes place if an appropriate level of data protection is guaranteed.

Duration of storage

We delete or anonymize all information after the statutory retention period of applicable whistleblower statutes have expired. The period begins after the conclusion of the proceedings. In order to comply with legal requirements or in the case of existing legitimate interests, the documentation may be retained for longer, as long as this is necessary and proportionate.

We pass on your data to service providers who support us in the operation of our websites and the associated processes. These are, for example, hosting service providers. Our service providers are strictly bound by our instructions and contractually obligated accordingly.

Below we list the processors with whom we work, which have not yet been mentioned in this privacy policy. Personal data will only be transferred internationally if an appropriate level of data protection is guaranteed.

We only store your personal data for as long as is necessary for the respective purposes. After these periods have expired, your data will be securely deleted or anonymized to ensure the protection of your privacy.

Except in cases where we have informed you in detail about the storage period, we delete personal data when it is no longer required for the aforementioned processing purposes and no statutory retention obligations prevent deletion.

If you are a resident of the United States, you may be entitled to certain rights. Dependent on your state of residence, you may have the following data protection rights:

Right of access

You have the right to request confirmation as to whether personal data concerning you is being processed; if this is the case, you have a right to information about this personal data in accordance with the applicable data protection law.

Right to rectification

You have the right to obtain without undue delay the rectification of inaccurate personal data concerning you and, where applicable, to have incomplete personal data completed.

Right to erasure

You have the right to demand that personal data concerning you be deleted immediately in accordance with applicable data protection law.

Right to restriction of processing

You have the right to request the restriction of processing in accordance with applicable data protection law.

Right to data portability

In certain cases, you have the right to receive the personal data concerning you in a structured, commonly used and machine-readable format or to request the transmission of this data to a third party.

Right to object

In certain cases, in accordance with applicable data protection laws, you may have the right to opt-out of the processing of your personal information at any time for reasons arising from your particular situation.

Right to not be discriminated against

You have the right to not receive discriminatory treatment for exercising Your rights, and We will not discriminate against You for exercising any of Your rights.

Assertion of your rights

Your rights may be restricted in case a legal obligation to store Your personal data is applicable. If You wish to exercise any of these rights or want further information, please contact the office named in the legal notice to assert your rights as a data subject.

Our data privacy team is happy to provide you with any data privacy requests or questions. Please contact us via email at DatenschutzBasler@baslerweb.com.

When contacting us, please provide:

1. your name

2. contact information and

3. a description of your request