Following information is to be provided pursuant to Art. 13 ff. GDPR where personal data are collected from our customers and prospective customers. Our offer is addressed exclusively to entrepreneurs, tradesmen, freelancers and public institutions.

Lauterbach GmbH
Altlaufstraße 40
85635 Hoehenkirchen-Siegertsbrunn/Germany
Phone: +49 8102 9876 150

(hereinafter „Lauterbach“, „we“, „us“).

Holzhofer Consulting GmbH
Martin Holzhofer
Lochhamer Straße 31
82152 Planegg/Germany
Phone: +49 89 1 25 01 56 00
E-Mail: dsb-lauterbach@holzhofer-consulting.de

If you are interested in our offered goods and services (hardware, software, training, technical support, licenses, maintenance contracts, etc.) we process and store the following data (for the purpose of processing your inquiry and preparing an offer) when you contact us (e.g. by e-mail, telephone, or contact form on our website or on-site during a trade show/exhibition when you provide us your contact details via business card or automatic lead registration system or by other means):

• Title
• Name, First name
• Company/organization and possibly department in the company
• Position in the company
• Business address
• Business phone numbers
• Business fax number
• busines e-mail address
• Homepage (URL)

We reserve the right to inquire about your decision by telephone or e-mail within 3 months after you have submitted our offer, unless you have objected to our inquiry.

The legal basis for processing your data is our legitimate interest pursuant to Art. 6 Sec. 1 lit. f GDPR. A balancing of interests has been carried out and came to the conclusion that the processing of your data is necessary to respond to your inquiry and possibly for further pre-contractual measures and that our interest override your interests or fundamental rights and freedoms to protect your data.

In order to implement and fulfill an existing contractual relationship, in particular to provide services owed (e.g. delivery of goods, performance of services) and to send you contractual documents, we and any third parties or processors commissioned by us process the following data from you, insofar as you have provided us with this data when concluding the contract or during the contractual relationship:

Contact details of contact persons and, if applicable, other employees in the company of the business customer

• Title
• Name, first name
• Company/organization and possibly department in the company
• Position in the company
• Business address
• Business phone numbers
• Business fax number
• Business e-mail address
• Bank data (IBAN, bank, account holder) and other payment information

For invoicing, monitoring and collection of trade receivables, we process contact details of accounting contacts and other persons entrusted with these processing operations.

If you make use of the offer of our trainings and courses and register for them (e.g. online via our website or by e-mail), we process the following data for the planning and execution of the trainings and if applicable for the creation and sending of personalized certificates of attendance:

Personal information of the training participants

• Title
• Name, first name
• Company/organization and possibly department in the company
• E-mail address
• Address

Other information such as: Course date, duration, location, price, date of registration/time stamp.

The training participants are usually employees of our customers and prospective customers.

We also use online video conferencing systems of the respective customer or alternatively our own system for various services, e.g. for technical support or for conducting trainings and courses. The activation of video transmission is the responsibility of the respective participant and is not linked to any advantages or disadvantages in the provision of the service. A recording of the video conferences by us shall only be made upon request and in consultation with all participants. If, in exceptional cases, recording by us is necessary, consent will be obtained from the participants in accordance with Art. 6 Sec. 1 lit. a in conjunction with Art. 7 GDPR.

The legal basis for processing your data is our legitimate interest pursuant to Art. 6 Sec. 1 lit. f GDPR. A balancing of interests has been carried out and came to the conclusion that the interests of the data subjects do not override our interests in the processing. We have a legitimate interest in the implementation and execution of contractual obligations with our customers, for which the processing of the data and data categories mentioned here is necessary.

The provision of the data specified in section 3.2 is mandatory. If you do not provide us with this information, a contract will not be concluded with us. All other data is provided voluntarily.

Automated decision-making including profiling pursuant to Art. 22 Sec. 1 and Sec. 4 GDPR do not take place on the part of Lauterbach GmbH.

Data transfers to countries outside the EU and the European Economic Area ("Third Countries") arise in the context of the administration, development and operation of IT systems. The transfer takes place only on the basis:

• of an adequacy decision of the European Commission according to Art. 45 GDPR.
• of an approved certification mechanism pursuant to Art. 42 GDPR together with legally binding and enforceable obligations of the controller or processor in the third country.
• of standard data protection clauses adopted by the Commission pursuant to the examination procedure referred to in Art. 93 Sec. 2 GDPR.

Currently, there is no data transfer to countries outside the EU and the European Economic Area ("third countries") taking place in the context of pre-contractual measures and the conclusion and fulfillment of a contract. Data processed on our systems are located exclusively on servers in Germany.

Exception: Only in the context of the use of our video conferencing system (WebEx) personal data may be transferred to third countries:

• Transfer of data to Cisco Systems, Inc., Corporate Headquarters, 170 West Tasman Dr., San Jose, CA 95134, USA.

For the processing of personal data for the purposes mentioned here, we use the following categories of recipients as processors pursuant to Art. 28 GDPR:

• Service provider for hosting and operation of the online video conferencing system and the remote maintenance software for technical customer support
• Service provider for hosting of servers for provision of web-based services
• Service provider for operation of e-mail servers

Other recipients who are not processors:

• Financial institutions and providers of payment services for billings as well as processing of payments
• Lawyers for the defense and enforcement of claims
• Tax consultants for financial accounting and preparation of balance sheets
• Debt collection service providers and competent courts to collect receivables and enforce claims in court. If personal data (customer and contact data, payment data and data on the claim) is transferred to a debt collection service provider in the event of collection, we will inform you in advance of the intended transfer.

In addition, we will only pass on your personal data to third parties if you have given your express prior consent. You have the right to withdraw your consent at any time with effect for the future.

Your data will also be passed on if we are legally obliged to do so.

We process personal data that we have received from prospective customers and customers in the course of our business relationships.

Insofar as it is necessary for the provision of our service, we process personal data that we permissibly obtain from publicly accessible sources (debtor directories, land registers, commercial and association registers, press, Internet) or that we are legitimately provided with by other third parties (a credit agency or an address service provider).

Personal data will only be stored as long as necessary to fulfill the purposes mentioned here or as required by the retention periods specified by law.

We delete data from inquiries about our products and services in accordance with the statutory retention obligations, which arise primarily from commercial and tax law (in particular §§ 147 AO and 257 HGB).

We store your data for the period of the existing contract and after termination of the contract with you for a period until receipt of the tax assessment notice for the year in which the contract was terminated. In the event that the notice is not final, the data will be stored until the completion of the complete company audit. In addition, we store your data for the duration of the settlement of legal disputes and the assertion, exercise or defense of legal claims. If there are statutory retention periods, we are obliged to store the data until these periods expire. After expiry of the statutory retention periods, which result primarily from commercial and tax law (in particular §§ 147 AO and 257 HGB), we delete this data again.

We store your data for advertising purposes until you object to its use, you withdraw your consent or the use is no longer permitted by law. We store your other data for as long as we need it to fulfill the specific purpose (e.g. to fulfill or process a contract) and delete it after the purpose no longer exists.

Lauterbach GmbH, Altlaufstraße 40, 85635 Höhenkirchen-Siegertsbrunn, is responsible for processing your data, unless otherwise stated.

You have the right to request from us access to personal data (Art. 15 GDPR) and the rectification of inaccurate personal data (Art. 16 GDPR). Furthermore, you have the right to obtain the erasure of personal data (Art. 17 GDPR) concerning your person, the right to restriction of processing (Art. 18 GDPR) and the right to receive (Art. 20 GDPR) the personal data provided to us by you, in a structured, commonly used and machine-readable format.

In addition, you have the right to object at any time to the use of your data based on public or legitimate interests (Art. 21 GDPR).

Where the processing is based on your given consent you can withdraw the consent (Art. 7 Sec. 3 GDPR) at any time. Upon receipt of your withdrawal of consent, we will no longer use or process the data concerned for purposes mentioned in your consent.

If you wish to exercise your rights as a data subject, please send your request to:

Lauterbach GmbH
Altlaufstraße 40
85635 Höhenkirchen-Siegertsbrunn/Germany
E-Mail: datenschutz@lauterbach.com

Furthermore you have the right to lodge a complaint with a supervisory authority. The Bavarian State Office for Data Protection Supervision, Postfach 1349, 91504 Ansbach, is generally responsible for us. Alternatively, you can approach the supervisory authority that is locally responsible for you.