1. Introduction and Contact Details of the Data Controller 1.1 We are pleased that you are visiting our website and thank you for your interest. In the following, we will inform you about how we handle your personal data when you use our website. Personal data includes all data with which you can be personally identified.

1.2 The data controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is Allplast GmbH, Neurieder Str. 6, 82131 Gauting, Germany, Tel.: +49 89 86 48 74 46, Email: systeme@allplast.de. The data controller is the natural or legal person who alone or jointly with others determines the purposes and means of processing personal data.

1.3 For security reasons and to protect the transmission of personal data and other confidential content (e.g., orders or inquiries to the data controller), this website uses SSL or TLS encryption. You can recognize an encrypted connection by the string “https://” and the lock symbol in your browser bar.

2. Data Collection When Visiting Our Website When you visit our website for informational purposes only, i.e., if you do not register or otherwise provide us with information, we only collect the data that your browser sends to our server (so-called “server log files”). When you access our website, we collect the following data, which is technically necessary for us to display the website:

• Our visited website
• Date and time of access
• Amount of data sent in bytes
• Source/referral from which you came to the page
• Browser used
• Operating system used
• IP address used (if applicable: in anonymized form)

The processing is carried out in accordance with Art. 6(1)(f) GDPR based on our legitimate interest in improving the stability and functionality of our website. There is no further disclosure or use of the data. However, we reserve the right to retrospectively check the server log files if there are specific indications of illegal use.

3. Cookies To make your visit to our website attractive and to enable the use of certain functions, we use cookies, which are small text files that are stored on your end device. Some of the cookies we use are automatically deleted after you close your browser (so-called “session cookies”), while others remain on your end device and enable us or our partner companies to recognize your browser on your next visit (persistent cookies). You can find the storage duration of the cookies in the overview of the cookie settings of your web browser. If cookies are also used to process personal data, the processing is carried out in accordance with Art. 6(1)(b) GDPR either for the performance of a contract, in accordance with Art. 6(1)(a) GDPR in the case of consent given, or in accordance with Art. 6(1)(f) GDPR to safeguard our legitimate interests in the best possible functionality of the website and a customer-friendly and effective design of the page visit. You can configure your browser settings according to your preferences and, for example, refuse to accept third-party cookies or all cookies. Please note that if you do so, you may not be able to use all functions of this website.

4. Contact When you contact us (e.g., via contact form or email), personal data is processed solely for the purpose of handling and responding to your inquiry and only to the extent necessary for this purpose. The legal basis for the processing of this data is our legitimate interest in responding to your inquiry pursuant to Art. 6(1)(f) GDPR. If your contact is aimed at concluding a contract, an additional legal basis for the processing is Art. 6(1)(b) GDPR. Your data will be deleted when it can be inferred from the circumstances that the relevant matter has been finally clarified and provided that there are no legal obligations to retain data.

5. Data Processing When Opening a Customer Account In accordance with Art. 6(1)(b) GDPR, personal data will continue to be collected and processed to the extent necessary if you provide us with this information when opening a customer account. You can find out which data is required for opening an account in the respective input mask on our website. You can delete your customer account at any time by sending a message to the address of the data controller provided above. After your customer account has been deleted, your data will be deleted provided that all contracts concluded via your customer account have been fully processed, there are no legal retention obligations, and we have no legitimate interest in further storage.

6. Data Processing for Order Handling 6.1 To the extent necessary for the processing of contracts for delivery and payment purposes, the personal data collected by us will be disclosed to the shipping company and the credit institution commissioned with the delivery and payment.

If we owe you updates for goods with digital elements or for digital products based on a corresponding contract, we will process the contact data (name, address, email address) provided by you during the order to inform you personally via a suitable communication channel (e.g., postal or email) about upcoming updates within the legally prescribed period in accordance with Art. 6(1)(c) GDPR as part of our statutory information obligations. Your contact details will be used strictly for the purpose of notifying you about updates owed by us and processed by us only to the extent necessary for the respective information.

To process your order, we also cooperate with the following service provider(s), who support us in whole or in part in the execution of concluded contracts. Certain personal data will be transmitted to these service providers in accordance with the following information.

6.2 Use of Payment Service Providers (Payment Services)

• PayPal If you pay via PayPal, credit card via PayPal, direct debit via PayPal, or – if offered – “purchase on account” or “installment payment” via PayPal, we will share your payment details with PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter “PayPal”) for the purpose of processing payments in accordance with Art. 6(1)(b) GDPR. The transfer is made exclusively for the purpose of payment processing. For payment methods such as credit card via PayPal, direct debit via PayPal, or – if offered – “purchase on account” or “installment payment” via PayPal, PayPal reserves the right to carry out a credit check. For this purpose, your payment data may be transferred to credit agencies in accordance with Art. 6(1)(f) GDPR based on PayPal’s legitimate interest in determining your ability to pay. PayPal uses the result of the credit assessment regarding the statistical probability of default for the purpose of deciding on the provision of the respective payment method. The credit report may contain probability values (so-called score values). If score values are included in the result of the credit assessment, they are based on a scientifically recognized mathematical-statistical procedure. The calculation of the score values includes, among other things, address data. For further information on data protection, including the credit agencies used, please refer to PayPal’s privacy policy: https://www.paypal.com/de/webapps/mpp/ua/privacy-full You can object to this processing of your data at any time by sending a message to PayPal. However, PayPal may still be entitled to process your personal data if this is necessary for the contractual payment processing.

7. Web Analysis Services Google (Universal) Analytics This website uses Google (Universal) Analytics, a web analysis service provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”). Google (Universal) Analytics uses so-called “cookies,” which are text files placed on your computer, to help the website analyze how users use the site. The information generated by the cookie about your use of this website (including the truncated IP address) is usually transmitted to a Google server and stored there; this may also involve transmission to Google LLC servers in the United States. This website uses Google (Universal) Analytics exclusively with the extension “_anonymizeIp()”, which ensures anonymization of the IP address by truncation and excludes direct personal reference. By means of the extension, your IP address will be shortened by Google within member states of the European Union or in other signatory states to the Agreement on the European Economic Area before. Only in exceptional cases will the full IP address be transmitted to a Google LLC server in the USA and shortened there. On our behalf, Google will use this information to evaluate your use of the website, to compile reports on website activity, and to provide us with further services related to website and internet use. The IP address transmitted by your browser as part of Google (Universal) Analytics will not be merged with other data from Google. Google Analytics allows the creation of statistics with statements about the age, gender, and interests of site visitors based on an evaluation of interest-based advertising and the use of third-party information. This allows the definition and differentiation of user groups on the website for the purpose of target group-optimized marketing measures. However, data records collected via “demographic characteristics” cannot be assigned to any specific person. For details on the processing initiated by Google Analytics and Google’s handling of website data, please refer to Google’s website: https://policies.google.com/technologies/partner-sites All processing described above, in particular the setting of Google Analytics cookies to read information on the device used, will only be carried out if you have given us your express consent in accordance with Art. 6(1)(a) GDPR. Without this consent, the use of Google Analytics during your visit to the website will be discontinued. You can revoke your consent at any time with future effect. To exercise your revocation, please deactivate this service in the “Cookie Consent Tool” provided on the website. We have concluded an order processing agreement with Google for the use of Google Analytics, in which Google undertakes to protect the data of our website visitors and not to disclose it to third parties. For the transfer of data from the EU to the USA, Google relies on so-called standard data protection clauses of the European Commission, which are intended to ensure compliance with the European level of data protection in the USA. Further information on Google (Universal) Analytics can be found here: https://policies.google.com/privacy?hl=en&gl=en

8. Tools and Miscellaneous Cookie Consent Tool

This website uses a so-called “cookie consent tool” to obtain effective user consent for cookies subject to consent and cookie-based applications. The “cookie consent tool” is displayed to users in the form of an interactive user interface when the page is accessed, allowing consent to be given for specific cookies and/or cookie-based applications by checking boxes. By using the tool, all cookies/services subject to consent are only loaded if the respective user gives consent by checking the boxes. This ensures that such cookies are only set on the respective user’s end device if consent is given. The tool sets technically necessary cookies to store your cookie preferences. Personal user data is not generally processed in this context. If, in individual cases, personal data is nevertheless processed for the purpose of storing, assigning, or logging cookie settings (such as the IP address), this is done in accordance with Art. 6(1)(f) GDPR based on our legitimate interest in a legally compliant, user-specific, and user-friendly consent management for cookies and thus in a legally compliant design of our online presence. Another legal basis for processing is Art. 6(1)(c) GDPR. As data controllers, we are subject to the legal obligation to make the use of technically unnecessary cookies dependent on the respective user’s consent. Further information about the operator and the settings options of the cookie consent tool can be found directly in the corresponding user interface on our website.

9. Rights of the Data Subject 9.1 The applicable data protection law grants you, as the data subject, the following rights regarding the processing of your personal data by the data controller (rights of access and intervention), with reference to the legal basis mentioned for the respective exercise requirements:

• Right of access pursuant to Art. 15 GDPR;
• Right to rectification pursuant to Art. 16 GDPR;
• Right to erasure pursuant to Art. 17 GDPR;
• Right to restriction of processing pursuant to Art. 18 GDPR;
• Right to be informed pursuant to Art. 19 GDPR;
• Right to data portability pursuant to Art. 20 GDPR;
• Right to withdraw consent granted pursuant to Art. 7(3) GDPR;
• Right to lodge a complaint pursuant to Art. 77 GDPR.

9.2 RIGHT TO OBJECT

IF WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR LEGITIMATE INTERESTS IN THE CONTEXT OF A BALANCING OF INTERESTS, YOU HAVE THE RIGHT TO OBJECT TO THIS PROCESSING AT ANY TIME FOR REASONS ARISING FROM YOUR PARTICULAR SITUATION, WITH EFFECT FOR THE FUTURE. IF YOU MAKE USE OF YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE DATA CONCERNED. HOWEVER, FURTHER PROCESSING IS RESERVED IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR PROCESSING THAT OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS, AND FREEDOMS, OR IF PROCESSING IS NECESSARY FOR THE ESTABLISHMENT, EXERCISE, OR DEFENSE OF LEGAL CLAIMS. IF YOUR PERSONAL DATA IS PROCESSED BY US TO CONDUCT DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH MARKETING. YOU CAN EXERCISE THE RIGHT TO OBJECT AS DESCRIBED ABOVE. IF YOU MAKE USE OF YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE DATA CONCERNED FOR DIRECT MARKETING PURPOSES.

10. Duration of Personal Data Storage The duration of the storage of personal data is determined by the respective legal basis, the purpose of processing, and, if applicable, additionally by the respective statutory retention period (e.g., commercial and tax retention periods). If personal data is processed on the basis of an express consent pursuant to Art. 6(1)(a) GDPR, this data is stored until the data subject revokes their consent. If there are legal retention periods for data processed within the scope of legal or similar obligations based on Art. 6(1)(b) GDPR, this data will be routinely deleted after the retention periods have expired, provided it is no longer necessary for the fulfillment or initiation of contracts and/or there is no longer any legitimate interest on our part in continuing to store it. If personal data is processed on the basis of Art. 6(1)(f) GDPR, this data is stored until the data subject exercises their right to object pursuant to Art. 21(1) GDPR, unless we can demonstrate compelling legitimate grounds for processing that override the interests, rights, and freedoms of the data subject, or if the processing serves to assert, exercise, or defend legal claims. If personal data is processed for the purpose of direct marketing on the basis of Art. 6(1)(f) GDPR, this data is stored until the data subject exercises their right to object pursuant to Art. 21(2) GDPR. Unless otherwise stated in the other information in this statement on specific processing situations, stored personal data will be deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.