Privacy

1. Introduction
2. General information on data processing
3. Marketing-relevant data protection provisions
   • – Provision of the website and creation of log files
   • – Use of Google Analytics, Google AdWords and Google Remarketing
   • – Meta Pixel and Meta Custom Audiences
   • – Newsletter
4. Rights of the data subject

This data protection guideline applies to all services of ChainBrain FlexCo. This policy describes the type of personal data collected from customers and users in connection with products and services, and how this data is processed, protected, used and maintained.

The trust of all visitors and customers, the security of your data and the protection of your privacy are of central importance to us.

Name and address of those responsible

The person responsible for processing in relation to the General Data Protection Regulation and other national data protection laws as well as other provisions of data protection law is:

Contact

The data protection officer can be reached via the following contact information:

E-mail: hello@chainbrain.fi

a. Scope of the processing of personal data

We collect and use the personal data of our users only to the extent necessary to provide a functioning website and our content and services. The collection and use of user personal data is carried out only with consent. An exception applies in those cases in which, for practical reasons, it is not possible to obtain prior consent and the processing of the data is permitted in accordance with the statutory provisions.

b. Legal basis for the processing of personal data

In so far as consent of the data subject is obtained for the processing of personal data, Art. 6 (1) point (a) of the General Data Protection Regulation (GDPR) of the EU serves as the legal basis for the processing of personal data.

The legal basis for the processing of personal data, which is necessary for the performance of a contract in which the data subject is a party, is Art. 6 (1) point (b) GDPR. This also applies to processing operations that are required to carry out pre-contractual measures.

If the processing of personal data is necessary to fulfil a legal obligation to which the company is subject, Art. 6 (1) point (c) GDPR serves as the legal basis.

In the event that vital interests of the data subject or another natural person require the processing of personal data, Art. 6 (1) point (d) GDPR serves as the legal basis.

If the processing is necessary to protect a legitimate interest of the company or a third party, and if the interests, fundamental rights and freedoms of the data subject do not override the former interest, Art. 6 (1) point (f) GDPR serves as legal basis for the processing.

c. Deletion of data and storage duration

The personal data of the data subject will be deleted or no longer made available as soon as the purpose of storage no longer applies. In addition, the storage can take place if this is provided for by European or national legislators in Union regulations, or other regulations to which the person responsible for the processing is subject to laws. The data will also not be made available or deleted if a storage period prescribed by the above standards expires, unless further storage of the data is necessary for the conclusion or performance of a contract.

Provision of the website and creation of log files

a. Description and scope of data processing

Every time our website is accessed, our system automatically collects data and information from the computer system of the accessing computer.

In this context, the following data is collected:

• (1) Information about the browser type and version used
• (2) The user's operating system
• (3) The user's Internet service provider
• (4) Date and time of access
• (5) Websites from which the user's system is accessed on our website
• (6) Websites that the user's system accesses through our website

b. Legal basis for data processing

The legal basis for the temporary storage of the data is our legitimate interest in Article 6 (1) point (f) GDPR.

c. Purpose of data processing

We use the data to optimize the website and to ensure the security of our information technology systems. This is also the legitimate interest in data processing in accordance with Art. 6 (1) Point (f) GDPR.

d. Duration of the storage of the data

The data will be deleted as soon as they are no longer required to achieve the purpose for which they were collected. When collecting data for the provision of the website, this is the case when the respective session is ended.

e. Right of objection and removal

You have the right to object to this processing. Data processing only has to cease if the conditions specified by law apply.

Website usage

Cookies

Our website uses so-called cookies. These are small text files that are stored on your device with the help of the browser. They do no harm. Cookies are used to make the offer user-friendly. Some cookies remain stored on your device until you delete them. They enable recognition of your browser the next time you visit. You can control the setting of cookies and their storage duration via the settings of your browser. Deactivating cookies may restrict the functionality of the website. A list of the cookies used by the website and more information can be found in the cookie banner.

2.2.1. Functional cookies

Functional cookies (session cookies and permanent cookies) are processed on the basis of the exception provision in Section 96 (3) TKG. Your consent is not required.

Session cookies are used to show website content. Session cookies are deleted after the session is closed.

Permanent cookies are used to improve user-friendliness, e.g. to be able to save the language selected and to show the website in the language selected when you visit again.

2.2.2. Analysis tools

Legal basis

We process the data within the scope of your express consent in accordance with Section 96 (3) TKG to achieve the stated purposes for improving the website. You can give your consent to the use of the analysis tools via the cookie banner.

You can revoke your consent at any time via the cookie banner or by deleting all or individual cookies in the browser settings. If you revoke your consent or change the browser settings so that cookies are no longer stored, you will no longer be recognised when you return to the website.

In the event of revocation, not all functions and contents of the website can be used to their full extent.

Purposes of processing:

Your data is processed for web usage analysis purposes, in particular to compile reports on website activity and so that we can improve our website.

Transfer of your data to third countries:

As part of the website analysis, your data will be transmitted to third countries. The transmission of your data to providers in the USA and worldwide, such as Google or YouTube, takes place without an adequacy decision and without suitable guarantees. This transfer takes place on the basis of your consent in accordance with the exemption clause of Article 49 (1) (a) GDPR.

2.3. Social media plugins

We work with various social networks. When using these services, your browser is automatically connected to the relevant network. It transmits your IP address and other information, such as cookies, if you have already visited the platform in question.

No personal data is collected via the plugins integrated on the website. The processing of personal data in the context of the plugins takes place on the basis of your express consent in accordance with Section 96 (3) TKG via the cookie banner. The purpose of these plugins is to be able to offer more information about services.

If you give your consent by actively clicking on "I agree" in the cookies banner when you visit the website, your personal data (IP address) can be transmitted to the social network. This happens regardless of whether you have a user account on the social network. If you have a user account with one of the social networks and are logged into your user account while clicking on the cookie banner on the website, the data collected via the respective plug-in will be linked directly to your account. If you do not want a link to your user account, you must log out of your social media account before activating the plug-in.

You can revoke your consent at any time by deleting all or individual cookies in the browser settings.

In the event of revocation, not all functions and contents of the website can be used to their full extent.

Use of Google Analytics, Google AdWords and Google Remarketing

a. Description and scope of data processing

In order to increase the efficiency of our website, we use the services of Google Analytics, a web analysis service from Google Inc. ("Google"). Google Analytics uses so-called "cookies" or text files that are stored on the user's computer and enable an analysis of the user's use of the website. The information generated by the cookie about the use of the website (including the user's IP address) is transmitted to a Google server in the USA, where it is stored.

In addition, this website uses cookies in order to address users via remarketing campaigns (Google AdWords and Google Remarketing) with online advertising at a later point in time in the Google advertising network. In order to place remarketing advertising, cookies – with the consent of the user – are set / stored on the basis of a visit to the website.

A cookie is only stored on the user's computer after the user has given consent. As a user, you can also prevent Google from collecting the data generated by the cookie and relating to your use of the website (including your IP address) and from processing this data by downloading the browser plug-in available under and install the following link: tools.google.com/dlpage/gaoptout.

In this context, the following data is collected:

• (1) The IP address of the user
• (2) Date and time of access
• (3) Frequency of opening pages
• (4) Use of website functions
• (5) Operating system of the user
• (6) Internet service of the user provider
• (7) Date and time of access
• (8) Websites from which the user's system accesses our website
• (9) Websites that the user's system accesses via our website
• (10) Operating systems used by end devices
• (11) Age, gender, languages, Interests, country of origin

b. Legal basis for data processing

The legal basis for the processing of personal data by means of cookies is the consent of the user in accordance with Art. 6 (1) Point (a) GDPR.

c. Approval

We obtain the user's consent before we set or save a cookie. This consent is voluntary. This consent can be revoked at any time with effect for the future by sending an email to hello@chainbrain.fi. In addition, users can delete cookies that have been stored in their web browser at any time. Users can find more information about this in the browser instructions (under Help in the browser menu). When accessing the website again, the user is free not to give any more consent.

If the user's consent is not given, full use of all functions of the website is no longer possible (identification of the user when changing pages, language selection). However, it is still possible to visit the website. If no consent is given, no cookie will be set.

d. Purpose of data processing

The transmission of data to Google serves to increase the efficiency of our website, to evaluate user behavior in this regard and to finance this website. The processing of the data enables analysis of the surfing behavior of users. By evaluating the data received, information about the use of the individual components of the website can be compiled. This helps to continuously improve the website and its user-friendliness.

e. Transfer of the data

By using Google Analytics, Google AdWords and Google Remarketing from Google LLC, 1600 Amphitheater Parkway, Mountain View, CA 94043, USA to increase efficiency, the user's data is sent to Google LLC, 1600 Amphitheater Parkway, Mountain View, CA 94043, USA broadcast.

Google LLC is a company included in the Privacy Shield List under the Privacy Shield Framework. The EU-US Privacy Shield was adopted by the European Commission as part of an adequacy decision C (2016) 4176 of July 12, 2016. Accordingly, Google LLC offers appropriate security precautions for the transmission of data to the USA. For more information, see the official Privacy Shield website www.privacyshield.gov.

f. Storage duration, right of objection and removal

Cookies are stored on the user's computer and information is transferred from it to us. As a user, you therefore have complete control over the use of cookies. You can deactivate or restrict the setting / saving / transfer of cookies by changing the settings in your internet browser. Cookies that have already been saved can be deleted at any time. This can also be done automatically. If cookies are deactivated for the website, it is possible that not all functions of the website can be used to their full extent.

Meta Pixel and Meta Custom Audiences

a. Description and scope of data processing

Our website uses Meta conversion tracking, the so-called "Meta Pixel" from Meta, for the purpose of analysis and to optimize our website. The provider of these services is Meta Platforms, Inc., 1 Hacker Way, Menlo Park, CA 94025, USA. If you are based in the EU, the provider of the services is Meta Platforms Ireland Limited, 4 Grand Canal Square, Port of Grand Canal, Dublin 2, Ireland (hereinafter "Meta").

By using the Meta pixel, Meta can identify and determine the visitors to our website as a potential target group for the presentation of advertising (so-called "Meta ads"). The Meta pixel is therefore used to only display the Meta ads placed for Meta users who have also shown interest in the website or who have certain characteristics (interests that are determined on the basis of the websites visited, etc.). This information is transmitted to Meta and so-called "Custom Audiences" are created.

b. Legal basis for data processing

The legal basis for the processing of personal data with the Meta pixel is the consent of the user in accordance with Article 6 (1) point (a) GDPR and your express consent in accordance with Article 49 (1) (a) GDPR.

c. Approval

You can object to the use of the Meta pixel and the use of your data to display Meta ads. To determine which types of advertising are displayed to you on Meta, you can call up the page set up by Meta and follow the instructions there on the settings for usage-based advertising: facebook.com/settings. The settings are platform-independent, ie they are adopted for all devices such as desktop computers or mobile devices.

d. Purpose of data processing

By using the Meta pixel, we want to ensure that our Meta ads correspond to the potential interest of the visitors and are not perceived as annoying. With the help of the Meta pixel, we can track the effectiveness of Meta ads for market research. We analyze whether visitors are redirected to the website after clicking on a Meta ad, ie whether a so-called "conversion" takes place.

e. Transfer of the data

We would like to point out that there is a possibility that data will be transferred to the USA and processed by US authorities. According to the current legal situation, the USA is an insecure third country with an inadequate level of data protection.

At the moment there is no adequacy decision according to Art. 45 GDPR, nor can suitable guarantees according to Art. 46 GDPR be offered.

General information on processing the data by Meta can be found at: https://www.facebook.com/policy.php

Further information and details about the Meta pixel can be found at: https://www.facebook.com/business/help/651294705016616

Newsletter

a. Description and scope of data processing

Our website offers the possibility to subscribe to free newsletters. When you register for the newsletter, the data from the input mask is transferred.

In addition, the date and time of registration are collected during registration.

Your consent to the processing of your data will be obtained during the registration process and reference will be made to this data protection declaration.

b. Legal basis for data processing

The legal basis for processing the data after the user has registered for the newsletter is Art. 6 (1) point (a) GDPR and Section 107 TKG, if the user has given his consent.

c. Purpose of data processing

The user's email address is recorded to deliver the newsletter.

The collection of other personal data as part of the registration process serves to prevent misuse of the services or the email address used and to generate a personalised salutation.

d. Storage period

The data will be deleted as soon as they are no longer required to achieve the purpose for which they were collected. The user's email address is therefore stored for as long as the newsletter subscription is active.

e. Right of objection and removal

The subscription to the newsletter can be canceled at any time by the user concerned. There is a corresponding link in every newsletter for this purpose.

If your personal data is processed, you have the following rights vis-à-vis the person responsible for processing:

In principle, you have the right to information, correction, deletion, restriction and data portability, unless statutory or contractual provisions conflict with these rights.

Complaints can be submitted to the Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna, dsb@dsb.gv.at, (www.dsb.gv.at).