We take your data protection very seriously and treat your personal data confidentially and in accordance with the statutory provisions. As new technologies and the constant further development of this website may result in changes to this data protection declaration, we recommend that you read the data protection declaration again at regular intervals. In addition to this data protection declaration, other data protection declarations may regulate specific matters.

This privacy policy is aligned with the EU General Data Protection Regulation (GDPR). Although the GDPR is a regulation of the European Union (EU), it is relevant to us. The Swiss Data Protection Act (DSG) is strongly influenced by EU law and companies outside the European Union or the European Economic Area (EEA) must comply with the GDPR under certain circumstances. We have therefore aligned this privacy policy with their standard.

For the purposes of this Privacy Policy, personal data means any information relating to an identified or identifiable person. If you provide us with the personal data of other persons (e.g. family members or work colleagues), please ensure that these persons are aware of this privacy policy and only provide us with their personal data if you are permitted to do so and this personal data is correct.

Name and contact details of the controller(s)

This data protection information applies to data processing by us as the controller:

Ella Media AG;

Metallstrasse 9a; 6300 Zug; Switzerland; verwaltung@ella-group.io

For further information about our company, please refer to the legal notice on our website https://www.ella-group.io/impressum/

Submit a request for information

Use of the Data Subject Request Tool (DSR) for the management of data subject requests

1. scope of the processing of personal data

We use functionalities of the data protection plugin “DSR” of DataCo GmbH, Dachauer Str. 65, 80335, Munich, Bavaria, Germany (hereinafter referred to as: DataCo).

By using the “Submit data subject request” button, all visitors to our website have the opportunity to make use of their data subject rights. To do so, you indicate your relationship with our company, which data subject right you wish to exercise, provide further optional information and, if necessary, identify yourself with further characteristics. The data subject request will then be processed by us.

The following personal data is processed by DataCo:

• Surname
• First name
• Reference to the person responsible (employee, customer, interested party, etc.)
• E-mail address
• Other voluntarily communicated personal data

Further information on the processing of data by DataCo can be found here: https://www.dataguard.de/datenschutzerklaerung

In addition, log files containing the following may be forwarded to DataCo GmbH to ensure technical functionality:

• Information about the browser type and version used
• The user’s operating system
• The user’s internet service provider
• The IP address of the user
• Date and time of access
• Websites from which the user’s system made the request

2. purpose of data processing

The use of DSR serves to safeguard the data subject rights of our website visitors. This enables you to make use of your rights as a data subject and to contact us quickly and easily.

3. legal basis for the processing of personal data

The legal basis for the use of the DSR tool and the sending of corresponding data is your declaration of consent in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR.

The legal basis for the use of log files is our legitimate interest in ensuring the technical functionality of the tool in accordance with Art. 6 para. 1 sentence 1 lit. f GDPR.

4. duration of storage

Your personal information will be stored for as long as necessary to fulfill the purposes described in this Privacy Policy or as required by law.

5. revocation and removal option

You can object to the collection and processing of your personal data or revoke your declaration of consent by contacting the controller by e-mail or using the DSR tool.

Contact details of the data protection officer

The data protection officer of the controller is:
DataCo GmbH
Dachauer Straße 65
80335 Munich
Germany
+49 89 7400 45840
www.dataguard.de

Collection and storage of personal data and the nature and purpose of its use

a) When visiting the website

When you visit our website, the browser used on your device automatically sends information to the server of our website. This information is stored temporarily (for a maximum of seven days) in a so-called log file. The following information is collected without any action on your part and stored until it is automatically deleted:

• Visited website
• IP address used by the requesting computer,
• Date and time of access,
• Name and URL of the retrieved file,
• Source, link from which you reached the page
• Browser used
• the operating system used on your computer and the name of your access provider.
• Amount of data sent in bytes

We process the aforementioned data for the following purposes:

• Ensuring a smooth connection to the website,
• To ensure a comfortable use of our website and its optimization,
• Ensuring system security and stability and
• for other administrative purposes.

The legal basis for data processing is Art. 6 para. 1 lit. f GDPR. Our legitimate interest follows from the purposes for data collection listed above. Under no circumstances do we use the data collected for the purpose of drawing conclusions about your person.

We also use cookies and analysis services when you visit our website. You can find more detailed explanations on this in sections 5 and 6 of this privacy policy.

b) When using our contact form

There is a contact form on our website that can be used to contact us electronically. The data you enter in the input mask will be transmitted to us and stored by us. We may request the following data:

• Gender
• Surname, first name, address of residence, nationality, company
• E-mail address, telephone number
• Date and time of contact
• Reason for contacting us & free text

When you send your message, the following data will also be saved:

• Your IP address
• Date and time of dispatch

Data processing for the purpose of contacting us is carried out in accordance with Art. 6 para. 1 lit. a GDPR on the basis of your voluntarily given consent. The personal data collected by us for the use of the contact form will be automatically deleted after your request has been dealt with.

c) When registering for online subscription

We use software on our website that enables the user to register as an investor. By selecting the “Start subscription here” plugin, you will be asked to enter the following data in the input mask, which will be transmitted to us and stored:

• Salutation Title
• First name, surname, address of residence, nationality
• Authorization to represent and domicile
• E-mail address, telephone number
• Retrieval and acknowledgement of the GTC
• Retrieval and acknowledgement of the data protection provisions
• Consent to receive e-mails for advertising purposes (optional)
• Desired subscription amount
• Date of birth

The legal basis for data processing for the purpose of online subscription is Art. 6 para. 1 lit. b, c and f GDPR. Our legitimate interest lies in obtaining new subscribers or investors for our company.

d) When an email is sent, the personal data transmitted with the email, including the user’s email address, will be stored. This serves to process and answer your request, e.g. to answer questions in connection with products, company investments or applications, based on Art. 6 para. 1 lit. a, b or f GDPR.

e) You will also send us a copy of your ID to complete the subscription. In addition to the data listed under c), the following data will be stored:

• Place of birth
• Exhibition venue
• Issuing authority
• ID number

The data is collected to clearly establish the identity of the contractual partner and to fulfill legal obligations, in particular to prevent money laundering and establish identity, for which purposes the data mentioned under c) and e) may also be forwarded to banks or external consultants with whom Ella Media AG cooperates or to state authorities. The legal basis for this is Art. 6 para. 1 lit. b and c.

f) Registration for the newsletter

You can register to receive our newsletter in a separate section of our website. To do so, you must enter your e-mail address. We will store this information and process it for the purpose of sending the newsletter based on Art. 6 para. 1 lit. a GDPR in accordance with your voluntarily granted consent.

---

Forwarding of data

Your personal data will not be transferred to third parties for purposes other than those listed below.

We only pass on your personal data to third parties if:

• you have given your express consent in accordance with Art. 6 para. 1 lit. a GDPR,
• the disclosure pursuant to Art. 6 para. 1 lit. f GDPR is necessary for the assertion, exercise or defense of legal claims and there is no reason to assume that you have an overriding interest worthy of protection in not disclosing your data,
• in the event that there is a legal obligation for disclosure pursuant to Art. 6 para. 1 lit. c GDPR, and
• this is legally permissible and necessary for the processing of contractual relationships with you in accordance with Art. 6 para. 1 lit. b GDPR (e.g. verification of the identity of the investor by the bank involved in the processing of the contract by us).

Duration of storage of personal data

We process and store your personal data for as long as is necessary for the fulfillment of our contractual and legal obligations or otherwise for the purposes pursued with the processing, i.e., for example, for the duration of the entire business relationship (from the initiation, execution to the termination of a contract) as well as beyond that in accordance with the statutory retention and documentation obligations. It is possible that personal data may be stored for the period in which claims can be asserted against our company (i.e. in particular during the statutory limitation period) and insofar as we are otherwise legally obliged to do so or legitimate business interests require this (e.g. for evidence and documentation purposes). As soon as your personal data is no longer required for the above-mentioned purposes, it will be deleted or anonymized as far as possible. Shorter retention periods of twelve months or less generally apply to operational data (e.g. system protocols, logs).

Cookies

We use cookies on our website. These are small files that your browser automatically creates and that are stored on your end device (laptop, tablet, smartphone, etc.) when you visit our website. Cookies do not cause any damage to your end device and do not contain any viruses, Trojans or other malware.

Information is stored in the cookie that results in each case in connection with the specific end device used. However, this does not mean that we obtain direct knowledge of your identity.

On the one hand, the use of cookies serves to make the use of our website more pleasant for you. For example, we use so-called session cookies to recognize that you have already visited individual pages of our website. These are automatically deleted after you leave our site.

In addition, we also use temporary cookies to optimize user-friendliness, which are stored on your end device for a specified period of time. If you visit our site again to use our services, it is automatically recognized that you have already visited us and which entries and settings you have made so that you do not have to enter them again. The data processed by such cookies are necessary for the purposes mentioned to safeguard our legitimate interests and those of third parties in accordance with Art. 6 para. 1 lit. f GDPR.

On the other hand, we use cookies to statistically record the use of our website and to evaluate it for the purpose of optimizing our offer for you (see section 5). These cookies enable us to automatically recognize that you have already visited our website when you visit it again. These cookies are automatically deleted after a defined period of time. When you visit our website, an information banner informs you about the use of cookies for analysis purposes, refers you to the data protection information and obtains your consent.

Most browsers accept cookies automatically. However, you can configure your browser so that no cookies are stored on your computer or a message always appears before a new cookie is created. However, deactivating cookies may mean that you cannot use all the functions of our website.

Analysis tools and tracking tools

The tracking measures listed below and used by us are carried out on the basis of Art. 6 para. 1 lit. f GDPR. With the tracking measures used, we want to ensure a needs-based design and the continuous optimization of our website. On the other hand, we use the tracking measures to statistically record the use of our website and to evaluate it for the purpose of optimizing our offer for you. These interests are to be regarded as legitimate within the meaning of the aforementioned provision.

The respective data processing purposes and data categories can be found in the corresponding tracking tools.

a) Google Analytics

We use Google Analytics, a web analysis service of Google Inc (https://www.google.de/intl/de/about/) (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; hereinafter referred to as “Google”) for the purpose of designing and continuously optimizing our pages to meet your needs. In this context, pseudonymized user profiles are created and cookies (see section 4) are used. The information generated by the cookie about your use of this website such as

• IP address of the user’s accessing system
• Website accessed
• Website from which the user has reached the accessed website
• Subpages that are accessed from the accessed website
• Time spent on the website
• Frequency of visits to the website
• demographic and geographical information (if provided)
• Technical information about the access device and software used

are generally transmitted to a Google server in the USA and stored there. The information is used to evaluate the use of the website, to compile reports on website activity and to provide other services relating to website activity and internet usage for the purposes of market research and the needs-based design of this website. This information may also be transferred to third parties if this is required by law or if third parties process this data on our behalf. Under no circumstances will your IP address be merged with other Google data. The IP addresses are anonymized so that they cannot be assigned (IP masking).

You may refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of this website.

You can also prevent the collection of data generated by the cookie and related to your use of the website (including your IP address) and the processing of this data by Google by downloading and installing a browser add-on (https://tools.google.com/dlpage/gaoptout?hl=de).

As an alternative to the browser add-on, especially for browsers on mobile devices, you can also prevent Google Analytics from collecting data by clicking on this link. An opt-out cookie will be set to prevent the future collection of your data when you visit this website. The opt-out cookie is only valid in this browser and only for our website and is stored on your device. If you delete the cookies in this browser, you must set the opt-out cookie again.

Further information on data protection in connection with Google Analytics can be found in the Google Analytics help section(https://support.google.com/analytics/answer/6004245?hl=de).

b) Google Tag Manager

We use the Google Tag Manager(https://www.google.com/intl/de/tagmanager/ ) of Google Ireland Ltd, Gordon House, Barrow Street, D04 E5W5, Dublin, Ireland (hereinafter referred to as: Google). With Google Tag Manager, tags from Google and third-party services can be managed and embedded in a bundle on an online presence. Tags are small code elements on an online presence that are used, among other things, to measure visitor numbers and behaviour, to record the impact of online advertising and social channels, to use remarketing and targeting and to test and optimize online presences. When a user visits the online presence, the current tag configuration is sent to the user’s browser. It contains instructions on which tags should be triggered. Google Tag Manager triggers other tags, which in turn may collect data. Information on this can be found in the sections on the use of the corresponding services in this privacy policy. Google Tag Manager does not access this data.
Further information on Google Tag Manager can be found at https://www.google.com/intl/de/tagmanager/faq.html and in Google’s privacy policy: https://policies.google.com/privacy?hl=de

The purpose of processing personal data is to collect and clearly manage and efficiently integrate the services of third-party providers. The legal basis for the processing of users’ personal data is generally the consent of the user in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR.

Your personal information will be stored for as long as necessary to fulfill the purposes described in this privacy policy or as required by law. Advertising data in server logs is anonymized by Google deleting parts of the IP address and cookie information after 9 and 18 months respectively.

You have the right to withdraw your declaration of consent under data protection law at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
You can prevent the collection and processing of your personal data by Google by preventing the storage of third-party cookies on your computer, using the “Do Not Track” function of a supporting browser, deactivating the execution of script code in your browser or installing a script blocker such as NoScript (https://noscript.net/) or Ghostery (https://www.ghostery.com) in your browser.
You can also prevent Google from collecting the data generated by the cookie and relating to your use of the online presence (including your IP address) and from processing this data by Google by downloading and installing the browser plug-in available under the following link:
https://tools.google.com/dlpage/gaoptout?hl=de
You can use the following link to deactivate the use of your personal data by Google:
https://adssettings.google.de
Further information on objection and removal options vis-à-vis Google can be found at
https://policies.google.com/privacy?gl=DE&hl=de

c) HubSpot

We use functions of HubSpot Inc, 2nd Floor, 25 First Street, Cambridge, MA 02141, USA (hereinafter referred to as HubSpot). This is an integrated software solution that we use to cover various aspects of our online marketing. These include, among others: Email marketing (newsletters and automated mailings, e.g. to provide downloads), social media publishing & reporting, reporting (traffic sources, access, etc.), contact management (user segmentation & CRM), landing pages, creation of ad target groups and contact forms. Cookies from HubSpot are stored on your end device. This allows personal data to be stored and evaluated, in particular the user’s activity (which pages have been visited and which elements have been clicked on), device and browser information (the IP address and operating system), data about the advertisements displayed (which advertisements have been displayed and whether the user has clicked on them) and also data from advertising partners (pseudonymized user IDs).

Further information on the processing of data by HubSpot can be found here:
https://legal.hubspot.com/de/privacy-policy

The use of the HubSpot plugin serves exclusively to optimize our marketing. The legal basis for the processing of users’ personal data is generally the consent of the user in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR. Your personal information will be stored for as long as necessary to fulfill the purposes described in this privacy policy or as required by law, e.g. for tax and accounting purposes.

You have the right to revoke your declaration of consent under data protection law at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
You can prevent the collection and processing of your personal data by HubSpot by preventing the storage of third-party cookies on your computer, using the “Do Not Track” function of a supporting browser, deactivating the execution of script code in your browser or installing a script blocker such as NoScript (https://noscript.net/) or Ghostery (https://www.ghostery.com) in your browser.

Further information on objection and removal options vis-à-vis HubSpot can be found at: https://legal.hubspot.com/de/privacy-policy

d) Microsoft Clarity
We use functionalities of the analysis plug-in Microsoft Clarity of Microsoft Corporation, One Microsoft Way, 98052, Redmond, Washington, USA and its representative in the European Union Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland (hereinafter referred to as: Microsoft).

As an analysis tool, Microsoft Clarity provides us with insights into the use of our website and the interaction of website users with our content in the form of heat maps.

The following personal data is processed by Microsoft:

• IP address
• Device and browser information
• User behavior on the website
• Websites visited

Data is transferred to Microsoft servers in the USA. To ensure appropriate guarantees for the protection of the transfer and processing of personal data outside the EU, so-called EU standard contractual clauses (Art. 46 para. 2 sentence 1 lit. c GDPR) have been concluded with Microsoft.
Further information on the processing of data by Microsoft can be found here:
https://privacy.microsoft.com/de-de/privacystatement

https://docs.microsoft.com/en-us/clarity/faq

We use Microsoft Clarity to analyze website interactions. The legal basis for the processing of users’ personal data is generally the consent of the user in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR. Your personal information will be stored for as long as necessary to fulfill the purposes described in this privacy policy or as required by law, e.g. for tax and accounting purposes.

You have the right to withdraw your declaration of consent under data protection law at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

You can prevent the collection and processing of your personal data by Microsoft by preventing the storage of third-party cookies on your computer, using the “Do Not Track” function of a supporting browser, deactivating the execution of script code in your browser or installing a script blocker such as NoScript(https://noscript.net) or Ghostery(https://www.ghostery.com) in your browser.

Further information on revocation and removal options vis-à-vis Microsoft can be found at:

https://www.privacy.microsoft.com/de-de/privacystatement

---

Social media plug-ins

We use social plug-ins from the social networks Facebook, Twitter and Instagram on our website on the basis of Art. 6 para. 1 lit. f GDPR in order to make our company better known. The underlying advertising purpose is to be regarded as a legitimate interest within the meaning of the GDPR. Responsibility for data protection-compliant operation must be guaranteed by their respective providers.

a) LinkedIn

We use the possibility of company appearances on professional networks. We maintain a company presence on the following professional networks:

LinkedIn:

LinkedIn, Unlimited Company Wilton Place, Dublin 2, Ireland

XING:

XING SE, Dammtorstraße 30, 20354 Hamburg, Germany

We provide information on our website and offer users the opportunity to communicate.

The company website is used for applications, information/PR and active sourcing.

We have no information on the processing of your personal data by the companies jointly responsible for the company’s website. Further information can be found in the privacy policy of:

LinkedIn:

https://www.linkedin.com/legal/privacy-policy?trk=hb_ft_priv

b) XING:

https://privacy.xing.com/de/datenschutzerklaerung

If you carry out an action on our company website (e.g. comments, posts, likes, etc.), you may make personal data (e.g. real name or photo of your user profile) public.

The legal basis for the processing of your data in connection with the use of our company website is Art. 6 para. 1 sentence 1 lit. f GDPR. The purpose of our company website is to inform users about our services. Every user is free to publish personal data through activities. We store your activities and personal data published via our company website until you withdraw your consent. In addition, we comply with the statutory retention periods.

You can object to the processing of your personal data that we collect in the context of your use of our company website at any time and assert your data subject rights mentioned under IV. of this privacy policy. To do so, please send us an informal email to the email address stated in this privacy policy.

Further information on objection and removal options can be found here:

LinkedIn:

https://www.linkedin.com/legal/privacy-policy?trk=hb_ft_priv

XING:

https://privacy.xing.com/de/datenschutzerklaerung

---

Rights of data subjects

You have the right:

• in accordance with Art. 15 GDPR, to request information about your personal data processed by us. In particular, you can request information about the processing purposes, the category of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned storage period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, the origin of your data if it was not collected by us, as well as the existence of automated decision-making including profiling and, if applicable, meaningful information on its details;
• in accordance with Art. 16 GDPR, to immediately request the correction of incorrect or incomplete personal data stored by us;
• in accordance with Art. 17 GDPR, to demand the deletion of your personal data stored by us, unless the processing is necessary to exercise the right to freedom of expression and information, to fulfill a legal obligation, for reasons of public interest or to assert, exercise or defend legal claims;
• in accordance with Art. 18 GDPR, to demand the restriction of the processing of your personal data if the accuracy of the data is disputed by you, the processing is unlawful but you refuse to delete it and we no longer need the data, but you need it to assert, exercise or defend legal claims or you have lodged an objection to the processing in accordance with Art. 21 GDPR;
• in accordance with Art. 20 GDPR, to receive your personal data that you have provided to us in a structured, commonly used and machine-readable format or to request that it be transmitted to another controller
• in accordance with Art. 7 para. 3 GDPR, to withdraw your consent once given to us at any time. The consequence of this is that we may no longer continue the data processing based on this consent in the future and
• to lodge a complaint with a supervisory authority in accordance with Art. 77 GDPR. As a rule, you can contact the supervisory authority of your usual place of residence or workplace or our company headquarters (in Switzerland, the competent data protection authority is the Federal Data Protection and Information Commissioner (http://www.edoeb.admin.ch)).

Right of objection

• If your personal data is processed on the basis of legitimate interests in accordance with Art. 6 para. 1 lit. f GDPR, you have the right to object to the processing of your personal data in accordance with Art. 21 GDPR, provided that there are reasons for this arising from your particular situation or the objection is directed against direct advertising. In the latter case, you have a general right to object, which will be implemented by us without specifying a particular situation.

If you would like to exercise your right of revocation or objection, simply send an e-mail to: verwaltung@ella-group.io

Please note, however, that we reserve the right to assert the restrictions provided for by law, for example if we are obliged to store or process certain data, have an overriding interest in doing so (insofar as we are entitled to invoke this) or require it for the assertion of claims. If you incur costs, we will inform you in advance.

The exercise of your rights as a data subject also generally requires that you clearly prove your identity (e.g. by means of a copy of your ID, where your identity is otherwise not clear or cannot be verified).

Every data subject also has the right to enforce their claims in court or to lodge a complaint with the competent data protection authority. The competent data protection authority in Switzerland is the Federal Data Protection and Information Commissioner (http://www.edoeb.admin.ch).

Up-to-dateness and amendment of this privacy policy

This privacy policy is currently valid and is dated August 2022.

It may become necessary to amend this privacy policy as a result of the further development of our website and services or due to changes in legal or official requirements. You can access and print out the current privacy policy at any time on the website at https://www.ella-group.io/datenschutzerklaerung/.