Data protection information for our LinkedIn fan page

The following information pursuant to Art. 13 et seq. GDPR on data protection serve the information obligation when collecting personal data in connection with the access and use of our business LinkedIn page on www.linkedIn.de.

1. Name and contact details of the controller (Art. 4 No. 7 GDPR, Art. 26 GDPR)

We use the technical platform and services of LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland ("LinkedIn platform") for the information service offered. Responsible for the processing of your personal data when using our business LinkedIn page is CARFAX Europe GmbH (operator of the page) Barthstraße 2-10 80339 Munich, Germany E-mail: info@carfax.eu

(hereinafter referred to as "CARFAX", "we", "us")

together with:

LinkedIn Ireland Unlimited Company (provision of the technical platform and other services) Wilton Place, Grand Canal Dock Dublin 2, Ireland Contact: https://www.linkedin.com/help/linkedin/ask/ppq

(hereinafter referred to as "LinkedIn")

CARFAX (together with LinkedIn) is responsible for the operation of the business LinkedIn page. However, the focus of data processing lies with the LinkedIn platform and is therefore the sole responsibility of LinkedIn. The specific content and responsibilities can be found in LinkedIn's terms of use and privacy policy.

We have concluded an agreement with LinkedIn on processing as joint controllers in accordance with Art. 26 GDPR, the so-called Page Insights Joint Controller Addendum. However, we would like to point out that despite the joint responsibility with LinkedIn, we have no full influence on data processing by LinkedIn. LinkedIn is not fully transparent about how it uses the data from visits to LinkedIn pages for its own purposes, to what extent activities on the LinkedIn page are assigned to individual users, how long LinkedIn stores this data and whether data from a visit to the LinkedIn page is passed on to third parties, and is therefore not known to us.

2. Contact details of the data protection officer:

Holzhofer Consulting GmbH Martin Holzhofer Lochhamer Str. 31 82152 Planegg Phone: (0 89) 1 25 01 56 00 E-mail: privacy@carfax.eu

LinkedIn has also appointed a data protection officer. This can be reached via the following link: https://www.linkedin.com/help/linkedin/ask/TSO-DPO

3. purposes for which the personal data are to be processed and the legal basis for the processing

3.1 General information

We would like to point out that you use our LinkedIn fan page and its functions on your own responsibility. This applies in particular to the interactive functions (e.g. commenting, sharing, liking and rating). We have no influence on the associated processing by LinkedIn.

The use of the LinkedIn page is not mandatory in order to contact us or receive our information. Alternatively, you can also access the information offered via LinkedIn on our website at https://www.carfax.eu/.

The type and scope of processing of your personal data when you visit our LinkedIn page depends heavily on your user behavior and can be partially influenced by you as a user.

The business LinkedIn fan page is the user account provided to us by LinkedIn. This gives us the opportunity to present ourselves to LinkedIn users and other people who visit our LinkedIn page with special content and to interact with you.

3.2 Processing of personal data by LinkedIn and by us

As part of the provision of the LinkedIn platform, LinkedIn processes information and personal data about users and their usage behavior when they visit our LinkedIn page.

3.2.1 Processing of access data and usage data

Each time a LinkedIn page is accessed, LinkedIn processes personal data (so-called connection data). This data is technically necessary to establish and maintain a connection between your device and LinkedIn's servers.

The following data or data categories may be collected by LinkedIn:

• IP address (according to LinkedIn, the IP address is anonymized)

• Source port of the calling device or a gateway (e.g. firewall or proxy)

• Timestamp (date and time) of the request

• Amount of data transferred

• Message as to whether the request was successful (via HTTP error code)

• Message as to why a retrieval may have failed (via HTTP error code)

• Referrer

• User agent (type of browser you are using to access our website and version)

• Width and height of the display screen

• Language settings of your browser

In addition, to the best of our knowledge, LinkedIn processes the following personal data about you when you visit our LinkedIn page or the LinkedIn platform, for example

- Registration data, such as user name, password, e-mail address and telephone number - Profile information such as your details in fields such as education, professional experience, skills, photo, location or region and knowledge confirmations (on a voluntary basis) - Information about your activities on the LinkedIn platform such as time zone and language, when you created your LinkedIn profile, your comments including date and time, your location, etc.

- Your contact and calendar data, such as email addresses or phone numbers, if others synchronize your contact or calendar data with LinkedIn services, assign your contacts to member profiles, scan and upload business cards or send messages via LinkedIn services (including invitations or contact requests). If you or others agree to synchronize email accounts with LinkedIn's services, LinkedIn also collects information from the "headers" of the emails that LinkedIn can associate with member profiles

LinkedIn uses this personal data to provide you with the LinkedIn platform, but also to analyze your usage behavior and to offer you personalized content - including across other LinkedIn platforms.

LinkedIn buttons integrated into websites enable LinkedIn to record your visits to these websites and assign them to your LinkedIn profile. This data can be used to tailor content or advertising to you.

If you want to avoid this, you should log out of LinkedIn or deactivate the "stay logged in" function, delete the cookies on your device and close and restart your browser. This will delete LinkedIn information that can be used to directly identify you.

This allows you to use our LinkedIn page without revealing your LinkedIn identifier. If you access interactive functions on the page (like, comment, share, message, etc.), a LinkedIn login screen will appear. After logging in, you will once again be recognizable to LinkedIn as a user.

Further information, in particular on the legal basis and the purpose of processing by LinkedIn, can be found here: https://de.linkedin.com/legal/privacy-policy (Sections 2 and 5.3).

There you will also find (with references) information on your privacy settings options.

3.2.2 Data collected via cookies and similar technologies

When you visit our LinkedIn page via a browser or the LinkedIn app, LinkedIn may process information about your use of our LinkedIn page and the LinkedIn platform as a whole, which LinkedIn collects using cookies and similar technologies such as pixels and web beacons on your PC or other device. In addition, advertisers or other LinkedIn partners may place cookies or similar technologies on your device, over which we have no control.

You can find more information about cookies and similar technologies on the LinkedIn platform at https://de.linkedin.com/legal/privacy-policy (section 1.4) and at https://de.linkedin.com/legal/cookie-policy

Further information, in particular on the legal basis and purpose of processing by LinkedIn, can be found here: https://de.linkedin.com/legal/privacy-policy (sections 2 and 5.3).

3.2.3 Use of LinkedIn Insights

We use LinkedIn's web analytics service ("LinkedIn Insights"), which enables us to perform an aggregated analysis of visitor behavior on our LinkedIn page. When the LinkedIn page is accessed and used, LinkedIn Insights provides us with data for statistics and evaluations about access to our LinkedIn page and we process this data.

LinkedIn processes the following data in particular:

- Data that you have already provided to LinkedIn via the information in your profile, such as data on function, country, industry, seniority, company size and employment status

- Information about how you interact with our LinkedIn page, e.g. whether you are a follower of our LinkedIn page, demographic information and information about the use and creation of content

The information transmitted to us by LinkedIn is anonymized. We are therefore unable to link it to you personally. However, this does not necessarily mean that data collection and processing by LinkedIn itself is also anonymized. In addition, LinkedIn can display further information or advertisements to you according to your preferences.

This function is a component of the user agreement with LinkedIn that cannot be waived by us. This means that we cannot unilaterally decide whether or not the analysis data is collected.

As long as you are logged into your LinkedIn account and visit our LinkedIn page, LinkedIn can assign the information collected to your profile.

The analysis data is collected with the help of cookies. These are stored on your computer when you visit the LinkedIn page.

Users have the option of influencing the scope of data processing by means of a consent banner ("cookie banner") set by LinkedIn. Further information on data processing in connection with LinkedIn Insights and the use of cookies as well as the setting options can be found at https://www.linkedin.com/help/linkedin/answer/a547077 and at https://de.linkedin.com/legal/cookie-policy

The processing of personal data in the context of LinkedIn Insights is carried out by LinkedIn and us as joint controllers.

Insofar as your data is processed by us when you visit the LinkedIn page, the permissibility of this processing for us is based on Art. 6 para. 1 f lit. f GDPR. This states that processing is permissible if it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data. A balancing of interests was carried out and came to the conclusion that the interests of the data subject do not outweigh our interests in the processing. The legitimate interest lies in evaluating the anonymized analysis data in order to understand the usage behavior on our LinkedIn page and, as a result, to be able to optimize the services offered on the page.

3.2.4 Communication by means of direct messages

It is also possible to contact us via direct messages on the LinkedIn page. When you contact us, we, as the operator of the LinkedIn page, will be shown the name that is stored as the user name in your LinkedIn profile. In addition, we process, for example, your name, profile picture, contact details or a message to us (message data) in order to be able to process the request effectively or to communicate with you in this regard.

The legal basis for this processing is Art. 6 para. 1 lit. f GDPR, according to which processing is lawful if it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data. A balancing of interests was carried out and came to the conclusion that the interests of the data subject do not outweigh our interests in the processing. The use of data for the purpose of communicating with users of our LinkedIn page constitutes a legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR.

The provision of your data is neither legally nor contractually required or necessary for the conclusion of a contract. You are not obliged to provide this data. However, the provision of the data is necessary so that you can contact us in the manner described above.

3.2.5 Further interactions via the LinkedIn page

As a user of the LinkedIn page, you can also select various integrated "social actions" to interact with us, for example by following our LinkedIn page, liking, posting, sharing, commenting or taking other active user actions. We also receive your personal data when you use certain hashtags or when we share your LinkedIn posts. We then only process the personal data that you publish on the LinkedIn platform for us and for any other user to see. We process this data in order to manage our LinkedIn page and adapt content to the interests of our followers.

This data includes, for example, your user name and the content published via your profile, if you have set this in your privacy settings on the LinkedIn platform. We do not receive any other usage data from you or from LinkedIn in the background (such as your IP address, your device number or information that you have not made public).

The legal basis for this processing is Art. 6 para. 1 lit. f GDPR, according to which processing is lawful if it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data. A balancing of interests was carried out and came to the conclusion that the interests of the data subject do not outweigh our interests in the processing. The use of data for the purpose of interacting with users via the functions provided by LinkedIn in order to evaluate the reach of our LinkedIn page and to improve and expand the visibility of our LinkedIn page constitutes a legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR.

The provision of your data is neither legally nor contractually required or necessary for the conclusion of a contract. You are not obliged to provide this data. However, the provision of the data is necessary so that you can interact with us in the manner described above.

4. Obligation to provide the data

As a rule, the provision of the personal data mentioned in section 3 is neither legally nor contractually required. You are not obliged to provide the data. Failure to provide it therefore has no consequences. This only applies if no other information is provided in the respective processing operations.

5 Automated decision-making, including profiling

CARFAX does not carry out automated individual decision-making, including profiling, in accordance with Art. 22 (1) and (4) GDPR.

6. Data transfer to a third country

Data transfers to countries outside the EU and the European Economic Area ("third countries") only take place on the basis

• an adequacy decision of the European Commission within the meaning of Art. 45 GDPR.

• an approved certification mechanism pursuant to Art. 42 GDPR together with legally binding and enforceable obligations of the controller or processor in the third country

• standard data protection clauses adopted by the Commission in accordance with the examination procedure pursuant to Art. 93 (2) GDPR.

In connection with accessing and using our LinkedIn page, personal data is transferred to third countries in the following cases

- Transmission of data to LinkedIn Corporation, 1000 W Maude Ave, Sunnyvale, CA 94085, United States.

For the USA, there is an adequacy decision of the EU Commission within the meaning of Art. 45 para. 3 GDPR, which extends to the EU-US Data Privacy Framework (DPF). For data exports to recipients in the USA that are certified under the DPF, the level of data protection is therefore considered adequate. LinkedIn Corp. has certified itself in accordance with the DPF and has thus undertaken to comply with European data protection principles.

7 Categories of recipients of data

Depending on your account settings, the data collected when you access and use our LinkedIn page and the information you provide when contacting us is generally transmitted to LinkedIn and stored there. The data collected about you by LinkedIn may also be transferred to third parties. You can find more information on the transfer of your data by LinkedIn to third parties at https://www.linkedin.com/legal/privacy-policy (Section 3).

We may also transfer your communication and action data in connection with the purposes described here to the following categories of recipients as processors within the meaning of Art. 28 GDPR:

• Server providers for the purpose of hosting

• Other processors within the meaning of Art. 28 GDPR in the course of order processing

These service providers process information about you on our behalf and on the basis of our instructions and are contractually obliged to comply with the applicable data protection laws within the meaning of Art. 28 GDPR.

Other recipients may be employees of the controller who are involved in the processing (e.g. marketing department).

Your data will also be passed on if we are legally obliged to do so, e.g. to investigate or prevent suspected or actual unlawful activities.

In this context, we would also like to point out that personal information on LinkedIn that is posted in publicly accessible areas or becomes visible when you log in can be viewed by other users. We cannot control or influence how other users of our LinkedIn page use this information. In particular, we cannot prevent unsolicited messages from being sent by other users.

8 Storage duration and criteria for determining the duration

Personal data is generally only stored for as long as is necessary to fulfill the purposes stated here or for the retention periods stipulated by law. This generally means as long as we operate our LinkedIn page or as long as you follow our LinkedIn page.

After the respective purpose no longer applies or after the retention periods have expired, the data will be deleted in accordance with the statutory provisions.

We have no influence on the storage period of your personal data stored by LinkedIn. According to its own information, LinkedIn deletes all data collected in connection with the use of its products and services within 30 days of account closure, provided that there are no legal obligations to the contrary. For more information on the storage period of the data stored by LinkedIn, see https://de.linkedin.com/legal/privacy-policy (section 4).

9. Information on your rights as a data subject

In connection with the use of the LinkedIn page, you have the right to assert all the data subject rights listed here both against LinkedIn and against us.

Information on your data subject rights vis-à-vis LinkedIn and how to exercise them can be found in LinkedIn's privacy policy at: https://de.linkedin.com/legal/privacy-policy (Section 4.2).

You can request information from us at any time (Art. 15 GDPR) about the data stored about you and its correction (Art. 16 GDPR) in the event of errors. You can also request the restriction of processing (Art. 18 GDPR), the portability (Art. 20 GDPR) of the data you have provided to us in a machine-readable format or the erasure of your data (Art. 17 GDPR) - insofar as it is no longer required.

You also have the right to object at any time to the use of your data based on public or legitimate interests (Art. 21 GDPR).

If we process your data on the basis of your consent, you can withdraw this consent at any time with effect for the future (Art. 7 para. 3 GDPR). Upon receipt of your withdrawal, we will no longer process your data for the purposes specified in the consent.

If you wish to exercise your rights as a data subject, please send your request by email to privacy@carfax.eu or by post to the above address.

10. Right to lodge a complaint with a supervisory authority

You can also lodge a complaint with a supervisory authority at any time in accordance with Art. 77 (1) GDPR. For us, this is generally the

Bavarian State Office for Data Protection Supervision, Promenade 18, 91522 Ansbach, P.O. Box 1349, 91504 Ansbach, e-mail: poststelle@lda.bayern.de, telephone: +49 (0) 981 180093-0, is responsible for us.

Alternatively, you can contact your local supervisory authority.

LinkedIn and we have also agreed that the Irish Data Protection Commission is the lead supervisory authority overseeing processing in connection with LinkedIn Insights. You therefore also have the right to lodge a complaint with the Irish Data Protection Commission (see www.dataprotection.ie).

Status: June 2024