Privacy policy in accordance with Art. 13, 14 GDPR - fulfillment of information obligations

Thank you for visiting our website! The protection of your data is a top priority for us. In this privacy policy, we inform you in detail about how we process your data.

Our privacy policy provides you with insights into data processing within Redux Recycling GmbH (Redwood Germany) as well as for the use of our website. The legal basis for this processing is the General Data Protection Regulation (hereinafter “GDPR”) and the German Federal Data Protection Act (“BDSG”).

All references to persons always refer to all genders. The use of the masculine form is for ease of reading only.

1 Data processing in general

1.1 Controller

The controller pursuant to Art. 4 (7) of the EU General Data Protection Regulation (GDPR) is

Redux Recycling GmbH (Redwood Germany)

Batteriestraße 94

27568 Bremerhaven

Germany

Tel: +49 (0) 471 97 24 80

E-Mail: info@redux-gmbh.de

The company has appointed a data protection officer. This can be contacted at bvm(at)meineberater.at

1.2 Data processing in accordance with Art. 13 GDPR

We process data that various individuals provide to us through their own disclosures, for example in the context of an email inquiry, for the purpose of initiating and concluding a contract or business relationship.

1.3 Data processing in accordance with Art. 14 GDPR

In addition, we process data from persons who may be part of a contractual relationship, which we have lawfully obtained from third parties (e.g., managing directors provide us with the data of their employees).

1.4 Data subjects

We process the following data from interested parties: company, names of contact persons, and professional contact and address data.

We process the following data from customers (companies, partners): company name, names of contact persons, professional contact and address details, bank details, and contract data.

We process the following data from suppliers and business partners: company name, names of contact persons, professional contact and address details, bank details, and contract data.

1.5 Legal bases

The legal bases for data processing are:

• Consent (e.g., when processing your email address for advertising purposes) in accordance with Art. 6 (1) (a) GDPR
• Contract initiation and fulfillment Art. 6 (1) (b) GDPR
• Legal obligations (e.g., legally prescribed storage and documentation obligations, publication obligations in accordance with copyright law) in accordance with Art. 6 (1) lit. c GDPR
• Legitimate interests of our company (e.g., use of software) in accordance with Art. 6 (1) lit. f GDPR

We will inform you separately about the legal basis and purpose of the processing for each data processing operation described below.

1.6 Transfer of data

Data is transferred exclusively for the purpose of fulfilling the contract in accordance with Art. 6 (1) lit. b GDPR in order to provide you with our services.

• Transfer within the group: The personal data collected will be transferred within the group to parent companies and subsidiaries, if necessary. This is necessary because various group companies provide IT services, among other things. The transfer is based on internally concluded contracts.
• Transfer to processors: We work with processors to whom personal data is transferred in order to provide services efficiently. These include companies that perform tasks such as contract fulfillment, payment processing, account management, newsletter distribution, and IT services.
• Other transfers: In certain cases, such as legal obligations or in the context of a legal dispute, personal data may be disclosed to authorities or lawyers.

1.7 Storage/deletion/anonymization of data

• Contractual storage obligations: After termination of a contractual relationship or after expiry of contractually agreed periods, your data will be deleted or anonymized as soon as there are no legal storage obligations to the contrary.
• Revocation of consent: If consent to the processing of personal data is revoked, the data will be deleted or anonymized, unless there is another legal basis for processing.
• Statutory retention obligations: In order to comply with statutory retention obligations, personal data must be retained for a legally prescribed period even after the end of the contract or revocation of consent. After these periods have expired, the data will be deleted anonymously.

2 Contact

When you contact us by email, telephone, contact form, or social media, the data you provide will be stored so that we can process your enquiries.

Legal basis: Art. 6 (1) lit. f GDPR (legitimate interest)

3 Applicant management

General: When you send us your application documents, we process the personal data contained therein for the purpose of personnel selection and filling vacancies.

Legal basis: Art. 6 (1) lit. b GDPR (contract initiation and fulfillment)

Deletion: In the event of rejection, we will delete your documents 6 months after sending you the rejection.

Legal basis: Art. 6 (1) lit. f GDPR (legitimate interest)

Record keeping: If we wish to keep you on file for future contact, we will send you a separate request for your consent. If you explicitly grant us this consent, we will store your application documents. If no further job opportunities arise at our company within one year of receiving your consent, we will delete all of your application documents.

Legal basis: Art. 6 (1) (a) GDPR (consent)

4 Video surveillance

As part of our security measures, we use video surveillance technology at our location in Bremerhaven to ensure the safety of people and the protection of property. The surveillance serves to enforce house rules and to investigate criminal offenses and security-related incidents. Monitored areas are marked with appropriate signs. The recordings are stored for a period of 48 hours and then deleted, unless they are needed to clarify incidents or to initiate legal action. Real-time monitoring is carried out by the Group's security department.

Access to the recordings is restricted to authorized persons, and the data is treated as confidential unless disclosure is required by law.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest)

5 Access Control and Issuance of Safety Induction Cards

Before entering the company premises, presenting a valid safety induction card is mandatory. To issue the induction card, personal data is processed, including the first and last name of the individual, the date of the completed induction, the email address, and the name of the company the individual is employed by. Data collection is carried out via QR codes displayed at the entrances, which link to a Microsoft Forms form.

The purpose of data processing is to control access to the premises in order to ensure operational safety and prevent unauthorized entry. The data in question is retained for a period of six months and is properly deleted after this period.

Legal basis: Article 6(1)(f) GDPR (legitimate interest)

6 Social media presence

We operate social media pages on LinkedIn and Xing. When you visit our social media presence, personal data, including the IP address of the respective provider, is processed and cookies are used for data collection. Please refer to the privacy policy of the respective service for details on exactly what information is transmitted. There you will also find information on how to contact us and how to restrict the processing of this data.

We would also like to point out that you use the respective services and their functions at your own risk. This applies in particular to the use of interactive functions (e.g., sharing, commenting, or rating).

The providers of social media services have provided us with corresponding agreements—in most cases, these are agreements on joint responsibility for data processing. The use of social media platforms is based on our legitimate business interest.

If we are obliged to fulfill the rights of data subjects (see 10), you can contact both us and the provider of the respective social media platform.

Legal basis: Art. 6 (1) lit. f GDPR (Legitimate interest)

7 Whistleblowing system – online whistleblowing portal

7.1 Purpose of processing

We have set up a whistleblowing system (online whistleblowing portal) on our website. The whistleblowing system allows you to contact us and report compliance and legal violations without fear of reprisals. Where legally permissible, reports can generally be made without providing personal data. We process personal data, if provided to us, in order to review the report made via the reporting office and investigate the alleged compliance and legal violations. In doing so, we may have further questions. For this purpose, we use the communication channels provided by this whistleblower system.

7.2 Data processing in accordance with Art. 13 GDPR

We process the data that the whistleblower provides us with in the report.

7.3 Data processing in accordance with Art. 14 GDPR

In addition, we process data from persons named by the whistleblower in the course of reporting violations (e.g., names or functions of the persons who caused the violation, names or functions of the persons who are also affected by a violation, description of behaviors or actions of the person concerned in connection with the reported misconduct that could contribute to their identification).

7.4 Personal data, forwarding, and legal basis

In principle, the whistleblower system can be used without providing personal data, insofar as this is legally permissible. However, personal data may be disclosed voluntarily as part of the whistleblowing process, in particular information on identity, first and last name, country of residence, telephone number, or email address.

When using anonymous communication with us, your IP address and current location are not stored at any time. After submitting a report, the whistleblower receives access data to the mailbox of the online portal in order to continue communicating with us in a protected manner. In order to fulfill the purpose stated above, it may also be necessary for us to transfer personal data to external parties such as law firms, criminal or competition authorities, within or outside the European Union.

We process personal data, if we have received it, to the extent necessary to fulfill legal obligations in terms of whistleblower protection on the basis of Art. 6 (1) lit. c GDPR and local data protection laws.

7.5 Responsible body

For the processing of personal data within the framework of the whistleblower system, Redwood Materials Inc. (parent company) and we, Redux Recyling GmbH, act as joint controllers within the meaning of Art. 26 (1) GDPR. We jointly determine the purposes and means of processing personal data. We fulfill our data protection obligations in accordance with our respective responsibilities. A corresponding agreement on joint data processing has been concluded.

The whistleblower software is obtained from our processor, AllVoices Holding Co, 1507 7th St, Santa Monica, 90401 California, USA, with whom a corresponding processing agreement has been concluded.

7.6 Duration of storage

We only store personal data for as long as is necessary to process your report or if we have a legitimate interest in storing your personal data. Storage may also take place if this has been provided for by national or European legislators to fulfill legal obligations, such as retention obligations.

We do not collect or store personal data that is not required for processing a report. Such data will be deleted immediately if necessary.

After completion of the investigation, all reports and associated data will be archived for a period of 5 years. After this period has expired, we guarantee the irretrievable deletion or anonymization of all data. In addition, the data will be retained for as long as necessary for any administrative or legal proceedings that have already been initiated.

7.7 Your rights

According to DIRECTIVE (EU) 2019/1937 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of October 23, 2019 on the protection of persons who report breaches of Union law, whistleblowers cannot exercise highly personal data protection rights (Articles 15 to 21 EU GDPR).

If you believe that we have violated German or European data protection law in the processing of your data and thereby infringed your rights, you have the right to lodge a complaint with the data protection and freedom of information officer listed in point 4.

8 Data processing when using our website

8.1 Informational use of the website

When using the website for informational purposes only, we only collect the personal data that your browser transmits to our server (server log files). When you visit our website, we collect the data that is technically necessary for us to display our website to you and to ensure stability and security:

• IP address
• Date and time of the request
• Time zone difference to Coordinated Universal Time (UTC)
• Content of the request (specific page)
• Access status/HTTP status code
• Website from which the request originates
• Browser
• Operating system and its interface
• Language and version of the browser software

This data is not merged with personal data sources. We reserve the right to check this data retrospectively if we become aware of specific indications of illegal use and to pass the data on to the law enforcement authorities in the event of a cyberattack. No further disclosure to third parties takes place.

Legal basis: Art. 6 (1) lit. f GDPR (legitimate interest)

8.2 Cookies

When you visit our website, cookies are stored on your device. Cookies are small text files that are assigned to the browser you are using and stored on your hard drive. They enable us or third-party providers to collect certain information. Cookies cannot execute programs or transfer viruses to your computer.

The information contained in the cookies is used, for example, to determine whether you are logged in, what data you have already entered, or to recognize you as a user when a connection is established between our web server and your browser.

We distinguish between technical cookies, which serve exclusively to ensure the operation of a website, and cookies requiring consent, which are set by us or third-party providers for the purposes of statistical analysis, tracking, or advertising/marketing.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest; for technical cookies), Art. 6 (1) (a) GDPR (Consent; for all other cookies)

8.3 Data transfer to a third country

It cannot be ruled out that when you visit our website, personal data may be transferred to an unsafe third country (countries outside the EEA without an adequate level of data protection). If this is the case, we will point this out directly in the description of the external service in this privacy policy.

The GDPR requires so-called appropriate safeguards in accordance with Art. 46 GDPR for data transfers to an unsafe third country or to an international organization.

When personal data is processed in a third country or when data is processed by US data recipients who are not subject to the provisions of the EU-US Data Privacy Framework, the following risks in particular cannot currently be ruled out for you as the data subject:

• Your personal data could potentially be passed on to other third parties by the respective service provider beyond the actual purpose of fulfilling the order.
• You may not be able to assert or enforce your rights to information against the respective service provider in the long term.
• There may be a higher probability of incorrect data processing, as the technical and organizational measures for the protection of personal data do not fully meet the requirements of the GDPR in terms of quantity and quality.

By giving your consent via the consent banner to the use of external services and the setting of the corresponding cookies, you expressly consent to the possible transfer of your personal data to unsafe third countries.

Legal basis: Art. 6 (1) lit. a GDPR (consent)

9 Data processing for Google services

We use services from Google Ireland Limited (“Google”) on our website, a company registered and operated under Irish law with its registered office at Gordon House, Barrow Street, Dublin 4, Ireland.

For more information, please refer to Google's privacy policy at https://policies.google.com/privacy?hl=de.

9.1   Google Analytics

We use Google Analytics on our website, a tool that allows us to analyze how our website is used. With Google Analytics, we can see how many people visit our website and how long they stay.

This website uses the “IP anonymization” function (i.e., Google Analytics has been extended by the code “gat._anonymizeIp();” to ensure anonymous collection of IP addresses (so-called IP masking)). This means that your IP address is truncated by Google within member states of the European Union or in other signatory states to the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and truncated there.

Google uses the collected information to analyze your use of the website, to compile reports on website activity, and to provide other services related to website usage.

Your IP address transmitted by your browser to Google Analytics will not be merged with other Google data. However, Google may transfer this information to third parties if required by law or if third parties process this data on behalf of Google.

You can prevent cookies from being stored on your computer by adjusting the settings in your browser. However, please note that in this case you may not be able to use all the features of our website to their full extent.

Further information on terms of use and data protection can be found at https://www.google.com/analytics/terms/de.html or at https://support.google.com/analytics/answer/6004245?hl=de.

Legal basis: Art. 6 (1) (a) GDPR (consent)

9.2   Google Tag Manager

We use Google Tag Manager on our website, which enables us to integrate and manage website tags such as tracking codes or conversion pixels. This collects data on the website and forwards it to connected analysis tools, which store and evaluate this data. Although Google Tag Manager collects data (e.g., IP address), it does not store it and has no access to it. It merely acts as an interface between the website and the analysis software.

For more detailed information, please visit: https://www.google.com/intl/de/tagmanager/faq.html.

Legal basis: Art. 6 (1) lit. f GDPR (legitimate interest)

10 Adobe Fonts

We use the Adobe Fonts service to design our website. This is a service provided by Adobe Systems Software Ltd. Ireland, 4-6 Riverwalk, Citywest Business Campus, Dublin 24, Ireland, which gives us access to a library of fonts. In order to include the fonts we use, your browser must connect to an Adobe server in the US and download the font required for our website. This provides Adobe with the information that our website has been accessed from your IP address. Accessing the libraries automatically triggers a connection to the library operator.

Information on how Adobe Fonts uses your data can be found at https://fonts.adobe.com/ and in Adobe's privacy policy at https://www.adobe.com/de/privacy/policies/typekit.html.

Legal basis: Art. 6 (1) (a) GDPR (consent)

11 Borlabs Cookie (Consent-Management)

Our website uses the consent management tool “Borlabs Cookie” from Borlabs GmbH, Hamburger Str. 11, 22083 Hamburg, Germany.

The service uses a technically necessary cookie (borlabs-cookie) to store your cookie consent. The consent management tool records and stores the cookie selection of each user of our website. With the express consent of the website visitor, statistical and marketing cookies are only set.

By integrating Borlabs Cookie on our own server, we guarantee that no data will be passed on to third parties.

For further information, please refer to Borlabs' privacy policy at: https://de.borlabs.io/datenschutz/.

Legal basis: Art. 6 (1) lit. f GDPR (legitimate interest)

12 Your rights

You have the following rights with regard to your personal data:

• Right to information, correction, and deletion
• Right to restriction of processing
• Right to object to processing
• Right to data portability
• Right to lodge a complaint with the Bremen State Commissioner for Data Protection and Freedom of Information, Dr. Timo Utermark, Arndtstraße 1, 27570 Bremerhaven, Germany, telephone: +49 421 3612010, email: office@datenschutz.bremen.de

If you believe that we have violated German or European data protection law in the processing of your data and thereby infringed your rights, please contact us so that we can clarify any questions you may have.

Please send your inquiries and concerns by email to info@redux-gmbh.de or contact us using the contact details provided.

13 Changes to this privacy policy

We reserve the right to make changes to our privacy policy from time to time. All changes to the privacy policy will be published by us on this page. Please refer to the current version of our privacy policy in this regard.