The protection of your personal data is of particular concern to us. We, VORN Bioenergy and our subsidiaries (hereinafter jointly referred to as "VORN Bioenergy") therefore process your personal data (hereinafter referred to as "data") exclusively on the basis of the statutory provisions. With the data protection declaration, we want to inform you comprehensively about the processing of your data in our company and the data protection claims and rights to which you are entitled within the meaning of the European General Data Protection Regulation (EU DS-GVO).

Who is responsible for data processing and who can you contact?

VORN Bioenergy, Fritz-Fend-Str. 4, 93047 Regensburg, is responsible. Email: info@vornbioenergy.com, Tel.: +49 941 698730 0. The data protection officer of VORN Bioenergy can be reached at the specified address or by e-mail at privacy@vornbioenergy.com

What data is processed and from which sources does this data originate?

We process the data that we receive from you in the context of the initiation and relationship of business. In addition, we process data that we have legitimately received from credit agencies, creditor protection associations, from publicly accessible sources (e.g. company register, register of associations, land register, media) and other companies with which we have a permanent business relationship.

Personal data includes

Your master/contact details such as:

• as a private customer: first and last name, address, contact details (e.g. e-mail address, Telephone number, fax), date of birth, data from submitted proof of identity (copy of identity card), bank details

• as a corporate customer or supplier: Name of your legal representative, company name, commercial register number, VAT ID number, company number, address, contact person, contact details (e-mail address, telephone number, fax), bank details

In addition, we also process the following other personal data:

• Information about the nature and content of our business relationship, such as contract data

• Order data, sales and document data, customer and supplier history, consulting documents, vehicle data

• Advertising and sales data

• Documentation data (e.g. consultation protocols), image data

• Information from your electronic transactions with VORN Bioenergy. (e.g. IP address, log-in data)

• Other data that we have received from you in the context of our business relationship (e.g. in customer meetings)

• Data that we generate ourselves from master/contact data as well as other data, e.g. by means of customer needs and customer potential analyses.

• The documentation of your declaration of consent for the receipt of e.g. newsletters.

• Image data from video surveillance systems

• Photos taken at public events

For what purposes and on what legal basis are the data processed?

We process your data in accordance with the provisions of the General Data Protection Regulation (GDPR) and the BDSG 2018 as amended:

for the fulfilment of (pre-)contractual obligations (Art. 6 para. 1 lit. b GDPR):

The processing of your data takes place for the sale and distribution of our goods and

services, for procurement and logistics purposes as well as for supplier and

Customer management and analysis. The data will be processed in particular when initiating business and executing contracts with you, for example in the following cases:

• Creation and management of a customer account or a supplier account

• Delivery of orders

• Keeping loyalty cards

• Participation in competitions

• Sending of information, e.g. request for a catalogue

to fulfil legal obligations (Art. 6 para. 1 lit.c GDPR):

The processing of your data is for the purpose of fulfilling various legal obligations, e.g. from the Commercial Code or the Tax Code, Money laundering regulations, product-specific regulations such as the Hazardous Substances Ordinance are required to safeguard legitimate interests (Art. 6 para. 1 lit. f GDPR):

On the basis of a balancing of interests, data processing may take place beyond the actual fulfilment of the contract to safeguard our legitimate interests or those of third parties. Data processing to safeguard legitimate interests takes place, for example, in the following cases:

• Consultation of and data exchange with credit agencies and creditor protection associations on

• Determination of creditworthiness data and the maintenance of a group-wide creditworthiness database to identify financial default risks for joint customers;

• Advertising or marketing

• measures for business management and further development of services and products;

• Maintaining a customer database to improve customer service

• Measures to protect VORN Bioenergy sites against breach of contract or law

• behavior, e.g. access controls, video surveillance;

• in the context of legal proceedings.

within the scope of your consent (Art. 6 para. 1 lit. a GDPR):

If you have given us your consent to process your data, processing will take place in accordance with the purposes and to the extent agreed in the declaration of consent. A given consent, e.g. to send our newsletter, can be revoked at any time with effect for the future. To do so, please contact the contact mentioned under No. 1.

Processing personal data for advertising purposes

We communicate with you about your orders, certain products or marketing promotions and to recommend products or services that may interest you.

You can object to the use of your personal data for advertising purposes at any time in whole or for individual measures. On the part of VORN Bioenergy, this objection is free of charge for you. To do so, please contact the contact mentioned above.

Product recommendations by e-mail

Under the legal requirements of § 7 para 3 UWG, VORN Bioenergy is entitled to use the e-mail address that you provided to us when ordering a product or service for direct advertising of its own similar goods or services. You will receive these product recommendations from us regardless of whether you have subscribed to a newsletter.

If you no longer wish to receive product recommendations from us by e-mail, you can object to the use of your address for this purpose at any time without incurring any costs other than the transmission costs according to the basic rates. To do so, please contact the contact mentioned above. Of course, every e-mail always contains an unsubscribe link.

Newsletter

We use the so-called double opt-in procedure to send the newsletter, i.e. we will only send you a newsletter by e-mail if you have expressly confirmed to us beforehand that we should activate the newsletter service. We will then send you a notification e-mail and ask you to confirm that you wish to receive our newsletter by clicking on a link contained in this e-mail.

If you no longer wish to receive newsletters from us at a later date, you can object to this at any time without incurring any costs other than the transmission costs according to the basic rates. A notification in text form to the contact mentioned above is sufficient for this purpose.

Of course, you will also find an unsubscribe link in every newsletter.

Who receives my data?

If we use a service provider in the sense of order processing, we nevertheless remain responsible for the protection of your data. All processors are contractually obliged to treat your data confidentially and to process it only in the context of the provision of services. The processors commissioned by us receive your data if they need data to fulfil their respective services. These are, for example, IT service providers that we need for the operation and security of our IT system as well as advertising and address publishers for our own advertising campaigns.

Your data will be processed in customer databases of VORN Bioenergy and its subsidiaries, including VORN Bioenergy. These customer databases support the increase in data quality of existing customer data (duplicate cleansing, moved/deceased license plates, address correction), and enable enrichment with data from public sources.

If an offer/sale is made via manufacturer portals, data provided by you will be processed directly in the manufacturer's portal.

In the event of a legal obligation and in the context of legal prosecution, authorities and courts as well as external auditors may be recipients of your data.

In addition, for the purpose of initiating and fulfilling contracts, insurance companies, banks, credit agencies and service providers may be recipients of your data and, in the case of the sale of projects, also investors.

How long will my data be stored?

We process your data until the termination of the business relationship or until the expiry of the applicable guarantee, warranty, limitation and statutory retention periods (e.g. from the Commercial Code or the Tax Code); in addition, until the termination of any legal disputes in which the data is required as evidence.

With video surveillance, the image data is usually deleted after seven days.

Processing of applicant data

If you send us your application via the VORN Bioenergy job portal, we store your personal data in a secure operating environment in order to protect it from loss or Protect abuse. Responsible for the processing of your data is the respective Company of the VORN Bioenergy Group where you can apply within the framework of our applicant management system. The contact details of this company can be found in the job advertisement in the VORN Bioenergy job portal.

What data is processed and from which sources does this data originate?

As part of the application process, we process the following categories of personal data in particular:

• Master data (e.g. name, date of birth, nationality, place of residence)

• Documents (e.g. certificates, certificates, curriculum vitae)

• Training history (e.g. data on (university) education, vocational qualification)

• Billing data, (e.g. bank details for the reimbursement of application costs)

• Communication data (e.g. e-mail, telephone)

• Log data generated when using IT systems

In individual cases, the processed data may also include special categories of personal data pursuant to Article 9 (1) of the European General Data Protection Regulation (GDPR), such as data on health, religious or trade union membership, provided that you provide them to us as part of your application.

For what purposes and on what legal basis are my data processed?

We process your personal data in compliance with the GDPR, national data protection laws and other relevant national laws.

The data processing serves to carry out the application process, to initiate and establish an employment relationship with the company of the VORN Bioenergy Group to which you have applied.

The legal basis for the implementation of the application procedure is Art. 6 para. 1 sentence 1 b GDPR in conjunction with the relevant national regulation for the implementation of pre-contractual

Measures to establish an employment relationship. In Germany, the legislator has enacted the provision of § 26 BDSG – data processing for employment purposes – in addition to Art. 6 para. 1 sentence 1 b GDPR.

Insofar as special categories of personal data are processed, this is done on the Basis of Art. 9 para. 2 b GDPR. If the position for which you have applied requires the processing of health data for the assessment of your ability to work, this is done on the basis of Article 9 (2) (h) GDPR in conjunction with the relevant national regulation.

How does the application process work?

You can apply directly to a job advertisement published in VORN Bioenergy portal by entering your data in the application form of the advertised position. In addition to manual entry, you have the option of selecting certain Master data from your XING or LinkedIn profile as well as through the use of "CV Parsing" in the application form.

We will keep you informed about the processing status of your application by email. As part of the application process, we may ask you whether we may forward your application documents to other job offers that match your profile – possibly also at other companies of the VORN Bioenergy Group – or include them in our applicant pool.

If you have applied to us on your own initiative via the VORN Bioenergy job portal, we may ask you whether we can send your application documents to your profile.

Forward job vacancies within the VORN Bioenergy Group. If there is no position corresponding to your qualifications or wishes at the time of application, you may be included in our applicant pool after prior consultation with you.

Applications in paper form or by email will not be accepted with reference to the application process via our VORN Bioenergy job portal. There is no transfer of the data to the applicant management system. Therefore, applications in paper form are immediately disposed of in accordance with data protection regulations; Applications by email will be deleted immediately. An exception to this is the receipt of an application in paper form or by e-mail due to a special (e.g. getting to know each other at a trade fair). This is how your data is transferred to the applicant management system imported. For applications of this kind, the process described above also applies.

Who receives my data?

Within the company of the VORN Bioenergy Group to which the application is made, only the persons responsible for this and the bodies involved in the application process (e.g. Supervisors, Human Resources, Department, Employee Representatives), for the above-mentioned purposes, access to your personal data. If the persons involved in the application process belong to another company of the VORN Bioenergy Group, your data may be transmitted to the respective persons in individual cases.

We use service providers to fulfil our contractual and legal obligations. We have concluded the contracts required under data protection law with these service providers, insofar as they process personal data on our behalf. For applicant management, we use a Software solution of rexx systems GmbH, Süderstraße 75-79, 20097 Hamburg, which acts as a processor for us in this regard.

Is personal data transferred to a third country?

When applying for a company of the VORN Bioenergy Group outside the European Economic Area (EEA), the transmission takes place on the basis of Art. 49 para. 1 b GDPR, unless other appropriate data protection guarantees are in place.

The data center for the applicant platform of rexx systems GmbH used by us  is located in Germany.

How long will my data be stored?

To meet requirements for the proper processing of an application and to be able to answer questions in connection with your application and/or its rejection.

Six months after completion of the application process, i.e. after you have received an acceptance or rejection from us, your personal data will be deleted. For statistical purposes, anonymized application body data is created.

As soon as you have agreed to be included in our applicant pool, your data will be stored and processed there for a period of 12 months. At the end of this period, your personal data will be deleted.

As soon as a job offer from a company of the VORN Bioenergy Group has been proposed to you and you have agreed to be included in the associated application process, your data will be transmitted to the respective company. For your personal data, the aforementioned retention period of six months after completion of the Application procedure. If there was no recruitment during the application process or if you have not agreed to be included in the application process, your data will be transferred back to our applicant pool or have not even left it. In both cases, your personal data will be processed for the period of 12 months starting with the date of the initial pool inclusion and then deleted.

You can revoke the storage of your data in our applicant pool at any time. The usual retention period of 6 months then applies. A manual deletion of your data before the end of the normal retention period is not possible.

Communication by e-mail

Please note that the sending of unencrypted e-mails is to be regarded as insecure, as unauthorized persons can take note of the content of the e-mail and, if necessary, manipulate it. Therefore, we advise you not to send sensitive data by e-mail when communicating with us. As an applicant, please use our applicant portal, as your application documents will be transferred there in a secure way. Should it ever be necessary to send sensitive data by e-mail, please use a content encryption option.

What data is collected when you visit this website?

General information on the use of cookies

VORN Bioenergy uses so-called cookies and pixels on its website (hereinafter generally referred to as "cookies"). These are small text or image files that your browser stores on your device (computer, tablet, smartphone or similar) to store certain information when you visit our website with this device. Cookies are accepted by your web browser and are intended to identify your device.

We use cookies to make our offer user-friendly. Only the cookie on your device is recognized. Personal data will only be stored with your express consent or if this is strictly necessary for the use of the services you have accessed.

Some cookies remain stored on your device until you delete them. They enable us to recognize your browser the next time you visit. If you do not want this, you can set up your browser so that it informs you about the setting of cookies and you only allow this in individual cases. Disabling cookies may limit the functionality of our website.

An explanation of the scope and functioning of the cookies used by VORN Bioenergy on its website is listed below.

Functional cookies

With the help of so-called functional cookies, information already provided (e.g. username, language selection or the location where you are located) and provide the user with better and more personalized features. These types of cookies also enable requested functions, such as playing videos. Anonymized data is collected, your movement on other websites is not tracked.

Preference cookies

Preference cookies allow a website to remember information that affects the way a website behaves or looks, such as: Your preferred language or the region you are in.

Analytical cookies

These cookies help us to collect information about how our website is used, e.g. the number of visitors and the traffic origin. This data allows us to measure the performance of our website and initiate improvements. Analytical cookies allow us to find out which content has the most frequent and least views, whether error messages occur and how the user navigates our website. The data collected is aggregated and therefore anonymous. An identification of the user is not given. We use these cookies exclusively to continuously improve the performance of the VORN Bioenergy websites and the associated user experience. If you do not agree with this anonymous recording of your usage behavior, you can prevent it by deactivating cookies in your browser.

Marketing cookies

Marketing cookies are used to display advertisements that are relevant to the user's interests in a targeted manner. In addition, they are used to measure the effectiveness of certain campaigns. These types of cookies recognize whether a website has been visited or not. This may be passed on to third parties. Cookies that serve to improve targeting and advertising are often linked to third-party site functionalities.

Specifically used cookies

The specific cookies used on each VORN Bioenergy website are described on the respective website. A link to the description "Website Data Tracking & Opt-Out" can  be found in the footer of each website. There you will also find the links to opt out of cookies.

Is personal data transferred to a third country?

A transfer of data to third countries takes place in individual cases and only on the basis of an adequacy decision of the European Commission, standard contractual clauses, suitable guarantees or your express consent.

What data protection rights do I have?

You have a right at any time to information, correction, deletion or restriction of the Processing of your stored data, a right to object to the processing as well as a Right to data portability and to lodge a complaint in accordance with the requirements of data protection law.

Right to information

You can request information from us as to whether and to what extent we process your data.

Right to rectification

If we process your data that is incomplete or incorrect, you can request us to correct or complete it at any time.

Right to erasure

You can request us to delete your data if we process it unlawfully or if the processing disproportionately interferes with your legitimate interests in protection. Please note that there may be reasons that prevent immediate deletion, e.g. in the case of legally regulated retention obligations.

Regardless of the exercise of your right to deletion, we will delete your data immediately and completely, unless there is a legal or statutory retention period to the contrary.

Right to restriction of processing 

• You can request us to restrict the processing of your data if:

• you contest the accuracy of the data, for a period of time that enables us to verify the accuracy of the data.

• the processing of the data is unlawful, but you reject a deletion and instead request a restriction of the use of the data,

• we no longer need the data for the intended purpose, but you still need this data to assert or defend legal claims, or

• you have objected to the processing of the data.

Right to data portability

You can request us to provide you with the data you have provided to us in a structured, commonly used and machine-readable format and to be able to transmit this data to another controller without hindrance from us, provided that:

• we process this data on the basis of a consent given and revocable by you or for the performance of a contract between us, and

• this processing is carried out by automated means.

If technically feasible, you can request us to transmit your data directly to another controller.

Right to object

If we process your data for legitimate interest, you can object to this object to data processing at any time for reasons arising from your particular situation; this also applies to profiling based on these provisions. We will then no longer process your data unless we can demonstrate compelling legitimate grounds for the processing which outweigh your interests, rights and freedoms or the processing serves to assert, exercise or defend legal claims. You can object to the processing of your data for the purpose of direct advertising at any time without giving reasons.

Right to lodge a complaint

If you believe that we are violating German or European data protection law when processing your data, please contact us to clarify any questions. Of course, you also have the right to contact the supervisory authority responsible for VORN Bioenergy, the Bavarian State Office for Data Protection Supervision (“Bayerisches Landesamt für Datenschutzaufsicht”).

If you wish to assert one of the aforementioned rights against us, please contact the contact mentioned under No. 1. In case of doubt, we may request additional information to confirm your identity.

Am I obliged to provide data?

The processing of your data is necessary for the conclusion or fulfilment of your agreement received with us.

Contract required. If you do not provide us with this data, we will usually have to refuse the conclusion of the contract or the execution of the order or will no longer be able to perform an existing contract and consequently

have to terminate it. However, you are not obliged to give your consent to data processing with regard to data that is not relevant for the fulfilment of the contract or is not required by law.