privacy policy

The responsible party within the meaning of data protection laws, in particular the EU General Data Protection Regulation (GDPR), is:

xPay Card Services GmbH Stuntzstraße 16 81677 Munich Germany info@xpay.de

Data Protection Officer: XPAY Holding AG Stuntzstraße 16 81677 Munich datenschutz@xpay.de

1. Content of this privacy policy and definitions

In this Privacy Policy, we describe how xPay Card Services GmbH (hereinafter referred to as "we, us, our or XCS"), in its capacity as data controller, collects, uses, shares and retains information about you in accordance with the General Data Protection Regulation.

For the purposes of the General Data Protection Regulation (GDPR), the term:

• „Personal data" - Any information relating to an identified or identifiable natural person (hereinafter "data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
• "Processing" - Any operation or set of operations which is performed upon personal data, whether or not by automated means, such as collection, recording, organization, filing, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
• "Profiling" - Any type of automated processing of personal data that consists of using such personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects relating to that natural person's job performance, economic situation, health, personal preferences, interests, reliability, behavior, location or change of location.
• "Service Provider", "Partner" - Any supplier, third party and/or company that provides services to us or performs business activities for us, such as printing, mailing and other communication services (email, direct mail, etc.), marketing, data processing and outsourced technology, servicing, banking, transaction execution, collections, advertising management, auditors, consultants and professional advisors.

• „personenbezogene Daten“ - Alle Informationen, die sich auf eine identifizierte oder identifizierbare natürliche Person (im Folgenden „betroffene Person“) beziehen; als identifizierbar wird eine natürliche Person angesehen, die direkt oder indirekt, insbesondere mittels Zuordnung zu einer Kennung wie einem Namen, zu einer Kennnummer, zu Standortdaten, zu einer Online-Kennung oder zu einem oder mehreren besonderen Merkmalen identifiziert werden kann, die Ausdruck der physischen, physiologischen, genetischen, psychischen, wirtschaftlichen, kulturellen oder sozialen Identität dieser natürlichen Person sind;
• „Verarbeitung“ - Jeden mit oder ohne Hilfe automatisierter Verfahren ausgeführten Vorgang oder jede solche Vorgangsreihe im Zusammenhang mit personenbezogenen Daten wie das Erheben, das Erfassen, die Organisation, das Ordnen, die Speicherung, die Anpassung oder Veränderung, das Auslesen, das Abfragen, die Verwendung, die Offenlegung durch Übermittlung, Verbreitung oder eine andere Form der Bereitstellung, den Abgleich oder die Verknüpfung, die Einschränkung, das Löschen oder die Vernichtung;
• „Profiling“ - Jede Art der automatisierten Verarbeitung personenbezogener Daten, die darin besteht, dass diese personenbezogenen Daten verwendet werden, um bestimmte persönliche Aspekte, die sich auf eine natürliche Person beziehen, zu bewerten, insbesondere um Aspekte bezüglich Arbeitsleistung, wirtschaftliche Lage, Gesundheit, persönliche Vorlieben, Interessen, Zuverlässigkeit, Verhalten, Aufenthaltsort oder Ortswechsel dieser natürlichen Person zu analysieren oder vorherzusagen.
• „Dienstleister“, „Partner“ - Jeder Zulieferer, Dritter und/oder jedes Unternehmen, der oder das Dienstleistungen an uns erbringt oder für uns geschäftliche Tätigkeiten ausübt, wie Druck-, Postversand und andere Kommunikationsdienste (E-Mail, Direktversand usw.), Marketing, Datenverarbeitung und ausgelagerte Technologie, Servicing, Banking, Transaktionsdurchführung, Inkasso, Werbungsmanagement, Wirtschaftsprüfer, Consultants und professionelle Berater.

In dieser Datenschutzerklärung beschreiben wir, wie xPay Card Services GmbH (nachfolgend „wir, uns, unser oder XCS“ genannt) in seiner Eigenschaft als Datenverantwortlicher Informationen über Sie gemäß der Datenschutzgrundverordnung erfasst, nutzt, teilt und aufbewahrt.

Im Sinne der Datenschutzgrundverordnung (DSGVO) bezeichnet der Ausdruck:

• „personenbezogene Daten“ - Alle Informationen, die sich auf eine identifizierte oder identifizierbare natürliche Person (im Folgenden „betroffene Person“) beziehen; als identifizierbar wird eine natürliche Person angesehen, die direkt oder indirekt, insbesondere mittels Zuordnung zu einer Kennung wie einem Namen, zu einer Kennnummer, zu Standortdaten, zu einer Online-Kennung oder zu einem oder mehreren besonderen Merkmalen identifiziert werden kann, die Ausdruck der physischen, physiologischen, genetischen, psychischen, wirtschaftlichen, kulturellen oder sozialen Identität dieser natürlichen Person sind;
• „Verarbeitung“ - Jeden mit oder ohne Hilfe automatisierter Verfahren ausgeführten Vorgang oder jede solche Vorgangsreihe im Zusammenhang mit personenbezogenen Daten wie das Erheben, das Erfassen, die Organisation, das Ordnen, die Speicherung, die Anpassung oder Veränderung, das Auslesen, das Abfragen, die Verwendung, die Offenlegung durch Übermittlung, Verbreitung oder eine andere Form der Bereitstellung, den Abgleich oder die Verknüpfung, die Einschränkung, das Löschen oder die Vernichtung;
• „Profiling“ - Jede Art der automatisierten Verarbeitung personenbezogener Daten, die darin besteht, dass diese personenbezogenen Daten verwendet werden, um bestimmte persönliche Aspekte, die sich auf eine natürliche Person beziehen, zu bewerten, insbesondere um Aspekte bezüglich Arbeitsleistung, wirtschaftliche Lage, Gesundheit, persönliche Vorlieben, Interessen, Zuverlässigkeit, Verhalten, Aufenthaltsort oder Ortswechsel dieser natürlichen Person zu analysieren oder vorherzusagen.
• „Dienstleister“, „Partner“ - Jeder Zulieferer, Dritter und/oder jedes Unternehmen, der oder das Dienstleistungen an uns erbringt oder für uns geschäftliche Tätigkeiten ausübt, wie Druck-, Postversand und andere Kommunikationsdienste (E-Mail, Direktversand usw.), Marketing, Datenverarbeitung und ausgelagerte Technologie, Servicing, Banking, Transaktionsdurchführung, Inkasso, Werbungsmanagement, Wirtschaftsprüfer, Consultants und professionelle Berater.

Further official definitions can be found explained in Art. 4 GDPR.

2. Data Subject Rights

You can exercise the following rights at any time using the contact details provided by our data protection officer:

• Information about your data stored by us and its processing (Art. 15 GDPR),
• Correction of incorrect personal data (Art. 16 GDPR),
• Deletion of your data stored by us (Art. 17 GDPR),
• Restriction of data processing if we are not yet allowed to delete your data due to legal obligations (Art. 18 GDPR),
• Objection to the processing of your data by us (Art. 21 GDPR) and
• Data portability, insofar as you have consented to the data processing or have concluded a contract with us (Art. 20 GDPR).

If you have given us consent, you can revoke this at any time with effect for the future.

In addition, you have the right to complain to a supervisory authority (Art. 77 GDPR). As a rule, you can contact the supervisory authority of your usual place of residence or workplace or our company headquarters for this purpose. The following supervisory authority is responsible for us:

State Office for Data Protection Supervision Promenade 27 (Castle) 91522 Ansbach www.lda.bayern.de

Right of objection

Insofar as we process personal data as explained in this data protection declaration in order to protect our legitimate interests, which prevail in the context of a balancing of interests, you can object to this processing with effect for the future. If the processing is carried out for direct marketing purposes, you may exercise this right at any time as described above. Insofar as processing is carried out for other purposes, you only have the right to object on grounds relating to your particular situation.

After exercising your right to object, we will no longer process your personal data for these purposes unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or if the processing serves to assert, exercise or defend legal claims.

This does not apply if the processing is for direct marketing purposes. Then we will not further process your personal data for this purpose.

Wenn Sie von Ihrem Widerspruchsrecht Gebrauch machen wollen, teilen Sie uns die bitte per Email mit.

Profiling (Automated Decision Making)

Gemäß Art. 22 DSGVO haben Sie das Recht, nicht einer ausschließlich auf einer automatisierten Verarbeitung – einschließlich Profiling – beruhenden Entscheidung unterworfen zu werden, die Ihnen gegenüber rechtliche Wirkung entfaltet oder Sie in ähnlicher Weise erheblich beeinträchtigt. Eine automatisierte Entscheidungsfindung führen wir oder unsere Partner grundsätzlich nicht durch, es sei denn, dies dient der Erfüllung übergeordneter Rechtsvorschriften (z. B. Prävention von Geldwäsche und Terrorismusfinanzierung).

3. Scope of this Policy

By using our offers, we or our service providers sometimes collect, record, use, transmit and store personal data. This occurs in particular when you:

• visit or use our website or app;
• when you request or use products, goods or services;
• from research, surveys or sweepstakes that you participate in or respond to, or any marketing offers to which you sign up;
• participate in online rewards programs offered by us;
• initiate electronic communications with us or receive our responses;
• access and click on our advertisements or other content;
• Connect with us through social media or other channels.

We use your personal data:

4. Data Usage

The scope of the Privacy Policy includes the items listed above. The following provides more information about how we collect, use, transfer, record and store your information.

• when necessary for the performance of a contract;
• to ensure compliance with legal obligations;
• for our legitimate interests, such as establishing legal relations, exercising or defending legal claims, preventing fraud and/or enhancing our products or services; or
• where we have obtained your consent, including for marketing purposes.

Specifically, we use your personal information to do the following:

a. Deliver, or provide, our products and services. This includes, but is not limited to:

• Processing your requests about the purchase of the products and services we offer;
• Managing your customer account;
• Communicating with you via email, text message or other electronic methods about your customer account, products and services and to keep you updated on new features and benefits associated with the products or services you have requested;
• Providing benefit and insurance programs related to the products or services you have requested;
• responding to questions you submit to us and making decisions about your requests.

b. To improve our products and services. Your data will be anonymized to the greatest extent possible. The evaluations may include the following areas:

• better understanding our customers, their needs, preferences and behaviors;
• analyzing whether our advertisements, promotions and offers are effective;
• perform testing (to ensure security and when updating our systems), data processing, website administration and support for information technology systems and development;
• to allow you to provide feedback on our products and services, as well as those of our business partners, by means of an evaluation;
• the preparation of data analyses and statistical surveys;
• monitoring and/or recording your telephone calls to us or our service providers (provided you have given us and/or the service providers your prior consent to do so) to ensure consistent levels of service (including staff training) and management of your customer account.

5. Disclosure of your data

We do not share your personal information with anyone except as described in this statement. We will only share your personal information with your consent or when required or permitted by applicable law, for example, with:

• Regulatory authorities, law enforcement agencies, courts and government agencies to comply with legal orders, legal or regulatory requirements and requests for prosecution;
• PayCenter GmbH as issuer of the card;
• Collection agencies and outside legal counsel for collection of claims related to services used;
• Our service providers who provide services to us and assist us in managing your customer account and/or conducting our business;
• Companies in our group of companies ("Xpay Group");
• a party approved by you, including loyalty partners who link you to your account (if applicable), and depending on your Card Product, partners who may provide the Card Benefits offered under your Card Product and with whom you enroll; or
• someone to whom we transfer or assign our contractual rights.

6. Operation of our website

Our website uses HubSpot, a software of HubSpot Inc, USA. This software is used in the so-called area of inbound marketing and helps us, among other things, by means of statistical analysis and evaluation of logged user behavior, to better coordinate and optimize our marketing strategy. Cookies (see below) are used. You can prevent the storage of cookies at any time by selecting the appropriate settings on your browser software or delete the cookies already stored. Please note that if cookies are blocked, you may not be able to make full use of the services provided on our website. For more information, please refer to the Terms of Use and Privacy Policy of HubSpot Inc. accordingly at: http://www.hubspot.com/terms-of-service http://www.hubspot.com/privacy-policy https://legal.hubspot.com/de/dpa https://www.hubspot.de/data-privacy/privacy-shield https://legal.hubspot.com/de/privacy-policy If you do not want the information about your visit to be used for the purposes described, you are also welcome to notify us by email or by mail at any time. All information we collect is subject to this Privacy Policy. HubSpot is subject to TRUSTe 's Privacy Seal and the U.S. - EU Safe Harbor Framework and the U.S. - Swiss Safe Harbor Framework. Contact: HubSpot, 2nd Floor 30 North Wall Quay, Dublin 1, Ireland, Phone: +353 1 5187500.

The following data is stored:

This software is used in the so-called area of inbound marketing and helps us, among other things, by means of statistical analysis and evaluation of logged user behavior (reporting by traffic sources, accesses, etc. ...) to better coordinate and optimize our marketing strategy. Furthermore, HubSpot covers various aspects of our inbound marketing:

6. Operation of our website

6. Operation of our website

Folgende Daten werden gespeichert:

6. Operation of our website

• Email marketing (newsletters as well as automated mailings, e.g. to provide downloads)
• Contact management (e.g. user segmentation & CRM)
• Landing pages and contact forms

6. Operation of our website

Furthermore, personal data is collected that you voluntarily provide to us. This includes, but is not limited to, contact information such as your name, email address, business name, address, and phone number, as well as other data about you or your business. You can find more information about HubSpot's privacy policy here: https://legal.hubspot.com/de/privacy-policy

Storage period / data deletion

We retain personal data that you provide to us for as long as we have a legitimate business interest (such as to comply with our legal obligations, resolve disputes, and enforce our contractual rights). If we have no legitimate business interest in continuing to process your personal information, we will securely delete or anonymize it. If neither is possible, we will store your personal data in a secure manner and exclude it from any further data processing until erasure is possible.

Legal basis for processing

6. Operation of our website

6. Operation of our website

6. Operation of our website

6. Operation of our website

The legal basis for the use of Hubspot's services is Art. 6 I f GDPR - legitimate interest. Our legitimate interest in using this service is the optimization of our marketing measures and the improvement of our service quality on the website. HubSpot processes personal data to the extent necessary to provide the subscription services in accordance with the contract, the information provided in the order form and the instructions of the customer in the context of his use of the subscription services.

Our website uses HubSpot, a software of HubSpot Inc, USA. This software is used in the so-called area of inbound marketing and helps us, among other things, by means of statistical analysis and evaluation of logged user behavior, to better coordinate and optimize our marketing strategy. Cookies (see below) are used. You can prevent the storage of cookies at any time by selecting the appropriate settings on your browser software or delete the cookies already stored. Please note that if cookies are blocked, you may not be able to make full use of the services provided on our website. For more information, please refer to the Terms of Use and Privacy Policy of HubSpot Inc. accordingly at Customer Terms of Service, HubSpot Privacy Policy, Data Processing Policy, HubSpot verpflichtet sich zum Schutz von EU-Datenübertragungen and HubSpot Privacy Policy.Customer Terms of Service If you do not want the information about your visit to be used for the purposes described, you are also welcome to notify us by email or by mail at any time. All information we collect is subject to this Privacy Policy. HubSpot is subject to TRUSTe 's Privacy Seal and the U.S. - EU Safe Harbor Framework and the U.S. - Swiss Safe Harbor Framework. Contact: HubSpot, 2nd Floor 30 North Wall Quay, Dublin 1, Ireland, Phone: +353 1 5187500. The following data is stored: This software is used in the so-called area of inbound marketing and helps us, among other things, by means of statistical analysis and evaluation of logged user behavior (reporting by traffic sources, accesses, etc. ...) to better coordinate and optimize our marketing strategy. Furthermore, HubSpot covers various aspects of our inbound marketing:

• Email marketing (newsletters as well as automated mailings, e.g. to provide downloads)
• Contact management (e.g. user segmentation & CRM)
• Landing pages and contact forms

Furthermore, personal data is collected that you voluntarily provide to us. This includes, but is not limited to, contact information such as your name, email address, business name, address, and phone number, as well as other data about you or your business. You can find more information about HubSpot's privacy policy here: HubSpot-Datenschutzrichtlinie . Storage period / data deletion We retain personal data that you provide to us for as long as we have a legitimate business interest (such as to comply with our legal obligations, resolve disputes, and enforce our contractual rights). If we have no legitimate business interest in continuing to process your personal information, we will securely delete or anonymize it. If neither is possible, we will store your personal data in a secure manner and exclude it from any further data processing until erasure is possible. Legal basis for processing The legal basis for the use of Hubspot's services is Art. 6 I f DS-GVO - legitimate interest. Our legitimate interest in using this service is the optimization of our marketing measures and the improvement of our service quality on the website. HubSpot processes personal data to the extent necessary to provide the subscription services in accordance with the contract, the information provided in the order form and the instructions of the customer in the context of his use of the subscription services.

7. E-mail advertising and newsletter registration

Type and purpose of processing

If you wish to receive information, product updates and/or newsletters from us, we will use the data required for this purpose or separately provided by you in order to send you the requested information.

You can revoke your consent to the storage of your personal data and its use for sending information at any time with effect for the future and can be done either by sending a message to the contact option described above or via a link provided for this purpose in the newsletter. After unsubscribing, your data will be deleted unless you have expressly consented to further use of your data or we reserve the right to use data beyond this, which is permitted by law and about which we inform you in this statement.

Data transfer

The dispatch of the information requested by you is carried out by "xPay Solutions GmbH, Stuntzstraße 16, 81677 Munich" as an order data processor. In order to provide the service, we will pass on the necessary data to xPay Solutions GmbH. For this purpose, we have concluded appropriate contracts with the company to ensure the protection of your personal data.

Legal basis

Storage period

In this context, the data will only be processed as long as the corresponding consent is available. After that, they will be deleted.

Provision mandatory or required

The provision of your personal data is voluntary, based solely on your consent. Without existing consent, we can unfortunately not send you the requested information.

The following data is stored: This software is used in the so-called area of inbound marketing and helps us, among other things, by means of statistical analysis and evaluation of logged user behavior (reporting by traffic sources, accesses, etc. ...) to better coordinate and optimize our marketing strategy. Furthermore, HubSpot covers various aspects of our inbound marketing:

• Email marketing (newsletters as well as automated mailings, e.g. to provide downloads)
• Contact management (e.g. user segmentation & CRM)
• Landing pages and contact forms

Furthermore, personal data is collected that you voluntarily provide to us. This includes, but is not limited to, contact information such as your name, email address, business name, address, and phone number, as well as other data about you or your business. You can find more information about HubSpot's privacy policy here: HubSpot-Datenschutzrichtlinie . Storage period / data deletion We retain personal data that you provide to us for as long as we have a legitimate business interest (such as to comply with our legal obligations, resolve disputes, and enforce our contractual rights). If we have no legitimate business interest in continuing to process your personal information, we will securely delete or anonymize it. If neither is possible, we will store your personal data in a secure manner and exclude it from any further data processing until erasure is possible. Legal basis for processing The legal basis for the use of Hubspot's services is Art. 6 I f DS-GVO - legitimate interest. Our legitimate interest in using this service is the optimization of our marketing measures and the improvement of our service quality on the website. HubSpot processes personal data to the extent necessary to provide the subscription services in accordance with the contract, the information provided in the order form and the instructions of the customer in the context of his use of the subscription services.

Our website uses HubSpot, a software of HubSpot Inc, USA. This software is used in the so-called area of inbound marketing and helps us, among other things, by means of statistical analysis and evaluation of logged user behavior, to better coordinate and optimize our marketing strategy. Cookies (see below) are used. You can prevent the storage of cookies at any time by selecting the appropriate settings on your browser software or delete the cookies already stored. Please note that if cookies are blocked, you may not be able to make full use of the services provided on our website. For more information, please refer to the Terms of Use and Privacy Policy of HubSpot Inc. accordingly at Customer Terms of Service, HubSpot Privacy Policy, Data Processing Policy, HubSpot verpflichtet sich zum Schutz von EU-Datenübertragungen and HubSpot Privacy Policy.Customer Terms of Service If you do not want the information about your visit to be used for the purposes described, you are also welcome to notify us by email or by mail at any time. All information we collect is subject to this Privacy Policy. HubSpot is subject to TRUSTe 's Privacy Seal and the U.S. - EU Safe Harbor Framework and the U.S. - Swiss Safe Harbor Framework. Contact: HubSpot, 2nd Floor 30 North Wall Quay, Dublin 1, Ireland, Phone: +353 1 5187500. The following data is stored: This software is used in the so-called area of inbound marketing and helps us, among other things, by means of statistical analysis and evaluation of logged user behavior (reporting by traffic sources, accesses, etc. ...) to better coordinate and optimize our marketing strategy. Furthermore, HubSpot covers various aspects of our inbound marketing:

• Email marketing (newsletters as well as automated mailings, e.g. to provide downloads)
• Contact management (e.g. user segmentation & CRM)
• Landing pages and contact forms

Furthermore, personal data is collected that you voluntarily provide to us. This includes, but is not limited to, contact information such as your name, email address, business name, address, and phone number, as well as other data about you or your business. You can find more information about HubSpot's privacy policy here: HubSpot-Datenschutzrichtlinie . Storage period / data deletion We retain personal data that you provide to us for as long as we have a legitimate business interest (such as to comply with our legal obligations, resolve disputes, and enforce our contractual rights). If we have no legitimate business interest in continuing to process your personal information, we will securely delete or anonymize it. If neither is possible, we will store your personal data in a secure manner and exclude it from any further data processing until erasure is possible. Legal basis for processing The legal basis for the use of Hubspot's services is Art. 6 I f DS-GVO - legitimate interest. Our legitimate interest in using this service is the optimization of our marketing measures and the improvement of our service quality on the website. HubSpot processes personal data to the extent necessary to provide the subscription services in accordance with the contract, the information provided in the order form and the instructions of the customer in the context of his use of the subscription services.

Our website uses HubSpot, a software of HubSpot Inc, USA. This software is used in the so-called area of inbound marketing and helps us, among other things, by means of statistical analysis and evaluation of logged user behavior, to better coordinate and optimize our marketing strategy. Cookies (see below) are used. You can prevent the storage of cookies at any time by selecting the appropriate settings on your browser software or delete the cookies already stored. Please note that if cookies are blocked, you may not be able to make full use of the services provided on our website. For more information, please refer to the Terms of Use and Privacy Policy of HubSpot Inc. accordingly at Customer Terms of Service, HubSpot Privacy Policy, Data Processing Policy, HubSpot verpflichtet sich zum Schutz von EU-Datenübertragungen and HubSpot Privacy Policy.Customer Terms of Service If you do not want the information about your visit to be used for the purposes described, you are also welcome to notify us by email or by mail at any time. All information we collect is subject to this Privacy Policy. HubSpot is subject to TRUSTe 's Privacy Seal and the U.S. - EU Safe Harbor Framework and the U.S. - Swiss Safe Harbor Framework. Contact: HubSpot, 2nd Floor 30 North Wall Quay, Dublin 1, Ireland, Phone: +353 1 5187500. The following data is stored: This software is used in the so-called area of inbound marketing and helps us, among other things, by means of statistical analysis and evaluation of logged user behavior (reporting by traffic sources, accesses, etc. ...) to better coordinate and optimize our marketing strategy. Furthermore, HubSpot covers various aspects of our inbound marketing:

• Email marketing (newsletters as well as automated mailings, e.g. to provide downloads)
• Contact management (e.g. user segmentation & CRM)
• Landing pages and contact forms

Furthermore, personal data is collected that you voluntarily provide to us. This includes, but is not limited to, contact information such as your name, email address, business name, address, and phone number, as well as other data about you or your business. You can find more information about HubSpot's privacy policy here: HubSpot-Datenschutzrichtlinie . Storage period / data deletion We retain personal data that you provide to us for as long as we have a legitimate business interest (such as to comply with our legal obligations, resolve disputes, and enforce our contractual rights). If we have no legitimate business interest in continuing to process your personal information, we will securely delete or anonymize it. If neither is possible, we will store your personal data in a secure manner and exclude it from any further data processing until erasure is possible. Legal basis for processing The legal basis for the use of Hubspot's services is Art. 6 I f DS-GVO - legitimate interest. Our legitimate interest in using this service is the optimization of our marketing measures and the improvement of our service quality on the website. HubSpot processes personal data to the extent necessary to provide the subscription services in accordance with the contract, the information provided in the order form and the instructions of the customer in the context of his use of the subscription services.

Our website uses HubSpot, a software of HubSpot Inc, USA. This software is used in the so-called area of inbound marketing and helps us, among other things, by means of statistical analysis and evaluation of logged user behavior, to better coordinate and optimize our marketing strategy. Cookies (see below) are used. You can prevent the storage of cookies at any time by selecting the appropriate settings on your browser software or delete the cookies already stored. Please note that if cookies are blocked, you may not be able to make full use of the services provided on our website. For more information, please refer to the Terms of Use and Privacy Policy of HubSpot Inc. accordingly at Customer Terms of Service, HubSpot Privacy Policy, Data Processing Policy, HubSpot verpflichtet sich zum Schutz von EU-Datenübertragungen and HubSpot Privacy Policy.Customer Terms of Service If you do not want the information about your visit to be used for the purposes described, you are also welcome to notify us by email or by mail at any time. All information we collect is subject to this Privacy Policy. HubSpot is subject to TRUSTe 's Privacy Seal and the U.S. - EU Safe Harbor Framework and the U.S. - Swiss Safe Harbor Framework. Contact: HubSpot, 2nd Floor 30 North Wall Quay, Dublin 1, Ireland, Phone: +353 1 5187500. The following data is stored: This software is used in the so-called area of inbound marketing and helps us, among other things, by means of statistical analysis and evaluation of logged user behavior (reporting by traffic sources, accesses, etc. ...) to better coordinate and optimize our marketing strategy. Furthermore, HubSpot covers various aspects of our inbound marketing:

• Email marketing (newsletters as well as automated mailings, e.g. to provide downloads)
• Contact management (e.g. user segmentation & CRM)
• Landing pages and contact forms

Furthermore, personal data is collected that you voluntarily provide to us. This includes, but is not limited to, contact information such as your name, email address, business name, address, and phone number, as well as other data about you or your business. You can find more information about HubSpot's privacy policy here: HubSpot-Datenschutzrichtlinie . Storage period / data deletion We retain personal data that you provide to us for as long as we have a legitimate business interest (such as to comply with our legal obligations, resolve disputes, and enforce our contractual rights). If we have no legitimate business interest in continuing to process your personal information, we will securely delete or anonymize it. If neither is possible, we will store your personal data in a secure manner and exclude it from any further data processing until erasure is possible. Legal basis for processing The legal basis for the use of Hubspot's services is Art. 6 I f DS-GVO - legitimate interest. Our legitimate interest in using this service is the optimization of our marketing measures and the improvement of our service quality on the website. HubSpot processes personal data to the extent necessary to provide the subscription services in accordance with the contract, the information provided in the order form and the instructions of the customer in the context of his use of the subscription services.

Our website uses HubSpot, a software of HubSpot Inc, USA. This software is used in the so-called area of inbound marketing and helps us, among other things, by means of statistical analysis and evaluation of logged user behavior, to better coordinate and optimize our marketing strategy. Cookies (see below) are used. You can prevent the storage of cookies at any time by selecting the appropriate settings on your browser software or delete the cookies already stored. Please note that if cookies are blocked, you may not be able to make full use of the services provided on our website. For more information, please refer to the Terms of Use and Privacy Policy of HubSpot Inc. accordingly at Customer Terms of Service, HubSpot Privacy Policy, Data Processing Policy, HubSpot verpflichtet sich zum Schutz von EU-Datenübertragungen and HubSpot Privacy Policy.Customer Terms of Service If you do not want the information about your visit to be used for the purposes described, you are also welcome to notify us by email or by mail at any time. All information we collect is subject to this Privacy Policy. HubSpot is subject to TRUSTe 's Privacy Seal and the U.S. - EU Safe Harbor Framework and the U.S. - Swiss Safe Harbor Framework. Contact: HubSpot, 2nd Floor 30 North Wall Quay, Dublin 1, Ireland, Phone: +353 1 5187500. The following data is stored: This software is used in the so-called area of inbound marketing and helps us, among other things, by means of statistical analysis and evaluation of logged user behavior (reporting by traffic sources, accesses, etc. ...) to better coordinate and optimize our marketing strategy. Furthermore, HubSpot covers various aspects of our inbound marketing:

• Email marketing (newsletters as well as automated mailings, e.g. to provide downloads)
• Contact management (e.g. user segmentation & CRM)
• Landing pages and contact forms

Furthermore, personal data is collected that you voluntarily provide to us. This includes, but is not limited to, contact information such as your name, email address, business name, address, and phone number, as well as other data about you or your business. You can find more information about HubSpot's privacy policy here: HubSpot-Datenschutzrichtlinie . Storage period / data deletion We retain personal data that you provide to us for as long as we have a legitimate business interest (such as to comply with our legal obligations, resolve disputes, and enforce our contractual rights). If we have no legitimate business interest in continuing to process your personal information, we will securely delete or anonymize it. If neither is possible, we will store your personal data in a secure manner and exclude it from any further data processing until erasure is possible. Legal basis for processing The legal basis for the use of Hubspot's services is Art. 6 I f DS-GVO - legitimate interest. Our legitimate interest in using this service is the optimization of our marketing measures and the improvement of our service quality on the website. HubSpot processes personal data to the extent necessary to provide the subscription services in accordance with the contract, the information provided in the order form and the instructions of the customer in the context of his use of the subscription services.

Our website uses HubSpot, a software of HubSpot Inc, USA. This software is used in the so-called area of inbound marketing and helps us, among other things, by means of statistical analysis and evaluation of logged user behavior, to better coordinate and optimize our marketing strategy. Cookies (see below) are used. You can prevent the storage of cookies at any time by selecting the appropriate settings on your browser software or delete the cookies already stored. Please note that if cookies are blocked, you may not be able to make full use of the services provided on our website. For more information, please refer to the Terms of Use and Privacy Policy of HubSpot Inc. accordingly at Customer Terms of Service, HubSpot Privacy Policy, Data Processing Policy, HubSpot verpflichtet sich zum Schutz von EU-Datenübertragungen and HubSpot Privacy Policy.Customer Terms of Service If you do not want the information about your visit to be used for the purposes described, you are also welcome to notify us by email or by mail at any time. All information we collect is subject to this Privacy Policy. HubSpot is subject to TRUSTe 's Privacy Seal and the U.S. - EU Safe Harbor Framework and the U.S. - Swiss Safe Harbor Framework. Contact: HubSpot, 2nd Floor 30 North Wall Quay, Dublin 1, Ireland, Phone: +353 1 5187500. The following data is stored: This software is used in the so-called area of inbound marketing and helps us, among other things, by means of statistical analysis and evaluation of logged user behavior (reporting by traffic sources, accesses, etc. ...) to better coordinate and optimize our marketing strategy. Furthermore, HubSpot covers various aspects of our inbound marketing:

• Email marketing (newsletters as well as automated mailings, e.g. to provide downloads)
• Contact management (e.g. user segmentation & CRM)
• Landing pages and contact forms

Furthermore, personal data is collected that you voluntarily provide to us. This includes, but is not limited to, contact information such as your name, email address, business name, address, and phone number, as well as other data about you or your business. You can find more information about HubSpot's privacy policy here: HubSpot-Datenschutzrichtlinie . Storage period / data deletion We retain personal data that you provide to us for as long as we have a legitimate business interest (such as to comply with our legal obligations, resolve disputes, and enforce our contractual rights). If we have no legitimate business interest in continuing to process your personal information, we will securely delete or anonymize it. If neither is possible, we will store your personal data in a secure manner and exclude it from any further data processing until erasure is possible. Legal basis for processing The legal basis for the use of Hubspot's services is Art. 6 I f DS-GVO - legitimate interest. Our legitimate interest in using this service is the optimization of our marketing measures and the improvement of our service quality on the website. HubSpot processes personal data to the extent necessary to provide the subscription services in accordance with the contract, the information provided in the order form and the instructions of the customer in the context of his use of the subscription services.

8. Cookies

Type and purpose of processing

In order to make the visit to our website attractive and to enable the use of certain functions, to display suitable products or for market research, we use so-called cookies on various pages. You have the option to agree to the activation of cookies before visiting the website or to reject them. You can find more detailed information on the services we use in your cookie settings or in the following in this declaration.

9. Services used

10. Registration on our website

Type and purpose of processing

We collect personal data when you provide it to us as part of your order or when contacting us (e.g. via contact form or e-mail). Mandatory fields are marked as such, because in these cases we need the data mandatory for contract execution, or to process your contact and you can not complete the order or send the contact without their information. Which data is collected can be seen from the respective input forms.

Legal basis

The processing of the data entered during registration is based on the user's consent (Art. 6 para. 1 lit. a GDPR).

If the registration serves the fulfillment of a contract to which the data subject is a party or the implementation of pre-contractual measures, the additional legal basis for the processing of the data is Art. 6 para. 1 lit. b GDPR.

Storage period

After complete processing of the contract, your data will be restricted for further processing and deleted after expiry of any retention periods under tax and commercial law, unless you have expressly consented to further use of your data or we reserve the right to use data beyond this, which is permitted by law and about which we inform you in this declaration.

Provision mandatory or required

The provision of your personal data is voluntary, based solely on your consent. Without the provision of your personal data, we cannot grant you access to our offered content and services.

11. Provision of chargeable services

Type and purpose of processing

For the provision of chargeable services, we request additional data, such as payment details, in order to be able to execute your order. In order to fulfill the contract, we pass on your data to the shipping company commissioned with the delivery, insofar as this is necessary for the delivery of ordered goods. Depending on which payment service provider you select in the ordering process, we pass on the payment data collected for this purpose to the credit institution commissioned with the payment and, if applicable, to payment service providers commissioned by us or to the selected payment service. In some cases, the selected payment service providers also collect this data themselves, insofar as you create an account there. In this case, you must register with the payment service provider with your access data during the ordering process. In this respect, the privacy policy of the respective payment service provider applies.

The same applies to the transfer of data to our manufacturers or wholesalers in cases where they take over the shipping for us (drop shipment).

Legal basis

The processing of data required for the conclusion of the contract is based on Art. 6 (1) lit. b GDPR.

Storage period

We store this data in our systems until the statutory retention periods have expired. These are generally 6 or 10 years for reasons of proper accounting and tax law requirements.

Provision mandatory or required

The provision of your personal data is voluntary. Without the provision of your personal data, we cannot grant you access to our offered content and services.

12. International data transmission

We process your personal data on a European server. However, for some products or services it may be necessary to transfer your data outside the European Economic Area ("EEA").

For data transfers within and also outside the EEA, we conclude suitable contracts with our partners that guarantee the protection of your personal data abroad as well.

13. Security

We use organizational, administrative, technical and physical security measures to protect your personal data and to help ensure that your data is processed promptly, accurately and completely. We require service providers to protect your personal data, obligate them to maintain confidentiality, and use your personal data only for the purposes we designate.

14. Data storage

We will retain your personal information only for as long as we need it to deliver or provide the products and services you have requested, unless we are required to retain it for longer periods of time by law, regulation, litigation, or for regulatory investigative purposes. For example, your personal information will be retained by XCS as required by law for six years after you terminate and use our products and services (beginning at the end of the year in which the termination occurred). If you are delinquent in payment of past-due accounts or there is other litigation, this information could be retained by us for longer periods of time.

When your personal information is no longer needed for legal or regulatory needs, to administer your Card, or to deliver or provide the products and services you have requested, we will take reasonable steps to securely destroy or permanently obscure that information.

15. Marketing Services

You can choose whether and how you want to receive marketing communications. If you do not wish to receive marketing from us, you can set this in your customer account privacy settings. Please note that if you choose not to receive marketing communications, you may not be notified of certain offers associated with the products or services you select.

We may contact you to continue to communicate with you in connection with service for your Card, fulfillment of your applications, or administration of a program in which you have elected to participate.

16. Modification of this Policy

We reserve the right to adapt this data protection declaration so that it always complies with the current legal requirements or in order to implement changes to our services in the data protection declaration, e.g. when introducing new services. We will of course inform you of any changes to this data protection declaration.

17. Questions to the data protection officer

If you have any questions regarding the collection, processing or use of your personal data, for information, correction, restriction or deletion of data, as well as revocation of any consent given or objection to a particular use of data, please contact our company data protection officer at.

Data Protection Officer: XPAY Holding AG Stuntzstraße 16 81677 München datenschutz@xpay.de

18. Disclaimer