Privacy policy of Rugenbräu AG

Rugenbräu AG (hereinafter also "we", "us") obtains and processes personal data relating to you or also other persons (so-called "third parties"). We use the term "data" here synonymously with "personal data" or "personal data".

Personal data" refers to data relating to specific or identifiable persons, i.e. conclusions about their identity are possible on the basis of the data itself or with corresponding additional data. "Particularly protectable personal data" is a category of personal data that is particularly protected by the applicable data protection law. Personal data requiring special protection includes, for example, data revealing racial and ethnic origin, information on religious or ideological beliefs, biometric data for identification purposes and information on trade union membership. Section 3 provides details of the data we process under this Privacy Policy. "Processing" means any handling of personal data, e.g., obtaining, storing, using, customizing, disclosing and deleting.

In this Privacy Policy, we describe what we do with your data when you use www.rugenbraeu.ch (hereinafter collectively "Website"), obtain our services or products, otherwise interact with us under a contract, communicate with us, or otherwise deal with us. Where appropriate, we will notify you by timely written notice of additional processing activities not mentioned in this Privacy Policy. In addition, we may inform you separately about the processing of your data, for example, in consent forms, contract terms, additional privacy statements, forms and notices.

If you transmit or disclose data about other persons to us, we assume that you are authorized to do so and that this data is correct. By submitting data about third parties, you confirm this. Please also ensure that these third parties have been informed about this privacy policy.

This Privacy Policy is designed to meet the requirements of the Swiss Data Protection Act ("DPA"), the revised Swiss Data Protection Act ("nDSG", which will come into force on 01.09.2023) and the EU General Data Protection Regulation ("GDPR"). Whether and to what extent these laws are applicable depends on the individual case.

Rugenbräu AG, Matten bei Interlaken (the "Company"), is responsible for the data processing of Rugenbräu AG described in this privacy policy, unless otherwise communicated in individual cases.

You can contact us for your data protection concerns and to exercise your rights under Section 11 as follows:

Rugenbräu AG

Wagnerenstrasse 40

3800 Matten near Interlaken

office@rugenbraeu.ch

We process different categories of data about you. The most important categories are following:

Technical data: When you use our website or other electronic offerings, we collect the IP address of your terminal device and other technical data to ensure the functionality and security of those offerings. This data also includes logs recording the use of our systems. We generally retain technical data for six months. In order to ensure the functionality of these offers, we may also assign an individual code to you or your end device (e.g. in the form of a cookie, see section 12). The technical data in itself does not allow any conclusions to be drawn about your identity. However, in the context of user accounts, registrations, access controls or the processing of contracts, they can be linked to other data categories (and thus possibly to your person).

Technical data includes, among other things, the IP address and information about the operating system of your terminal device, the date, region and time of use, and the type of browser you use to access our electronic offerings. This can help us convey the correct formatting of the website. Based on the IP address, we know which provider you are using to access our offerings (and therefore the region), but we generally cannot infer who you are from this. This changes when you create a user account, for example, because personal data can then be linked to technical data (we can see, for example, which browser you use to access an account via our website).

Server log files: We do not use any server log files that allow conclusions to be drawn about a person and does not carry out any tracking measures that allow conclusions to be drawn about a person. possible. The pages contain the content management management, which records all calls without an IP address (ip.anonymized). records. The IP addresses are completely anonymized, i.e. no parts of the IP address are no parts of the IP are recorded.

Registration data: Certain offers and services (e.g. login areas of our website, newsletter delivery) can only be used with a user account or registration, which can be done directly with us or via our external login service providers. In doing so, you must provide us with certain data, and we collect data about the use of the offer or service.

Registration data includes, among other things, the information you provide when you create an account on our website (e.g. user name, password, name, e-mail). However, registration data also includes the data we may require from you before you can use certain services. In the context of access controls, we may have to register you with your data (access codes in badges, biometric data for identification) (see the category "other data").

Communication Data: If you are in contact with us via the contact form, by e-mail, telephone or chat, by letter or via other means of communication, we collect the data exchanged between you and us, including your contact data and the marginal data of the communication. If we record or listen to telephone conversations or video conferences, e.g. for training and quality assurance purposes, we will specifically draw your attention to this. Such recordings may only be made and used in accordance with our internal guidelines. You will be informed whether and when such recordings take place. If you do not wish to be recorded, please notify us or terminate your participation.

We generally retain this data for twelve months from the last exchange with you. This period may be longer if required for evidentiary purposes or to comply with legal or contractual requirements, or if technically necessary. E-mails in personal mailboxes and written correspondence are generally retained for at least ten years.

Master Data: We use the term master data to refer to the basic data that we require, in addition to the contractual data (see below), for the processing of our contractual and other business relationships or for marketing and advertising purposes, such as name, contact data and information about, for example, your role and function, your bank details, your date of birth, customer history, powers of attorney, signature authorizations and declarations of consent. We process your master data if you are a customer or other business contact or work for one (e.g. as a contact person of the business partner), or because we want to address you for our own purposes or the purposes of a contractual partner (e.g. as part of marketing and advertising, with invitations to events, with vouchers, with newsletters, etc.). We receive master data from you yourself (e.g. when you make a purchase or as part of a registration), from bodies that work for you, or from third parties such as our contractual partners, associations and address dealers, and from publicly accessible sources such as public registers or the Internet (websites, social media, etc.).

We may also process information about third parties as part of master data. We may also collect master data from our shareholders and investors. We generally retain this data for ten years from the last exchange, but at least from the end of the contract. This period may be longer if this is necessary for reasons of evidence or to comply with legal or contractual requirements, or for technical reasons. For pure marketing and advertising contacts, the period is usually much shorter, usually no more than two years since the last contact.

Master data is not collected comprehensively for all contacts. Which data we collect in detail depends in particular on the purpose of the processing.

Contract data:This is data that arises in connection with the conclusion or performance of a contract. e.g. information about contracts and the services to be rendered or services rendered, and to be performed or services rendered, as well as data from the run-up to a necessary or used for the execution of the contract, and data on reactions (e.g. Information about reactions (e.g. complaints or information about satisfaction, etc.). As a rule, we collect this data from you, from contractual partners and from those involved in involved in the processing of the contract, but also from third party sources (e.g. providers of creditworthiness data) and from publicly available sources. We generally retain this data for ten years from the last contractual activity contract activity, but at least from the end of the contract. This period may be longer longer, if this is necessary for reasons of evidence or to comply with legal or contractual contractual requirements or for technical reasons.

Behavioral and preference data: Depending on our relationship with you, we try to get to know you and better tailor our products, services and offers to you. To do this, we collect and use data about your behavior and preferences. We do this by evaluating information about your behavior in our area, and we may also supplement this information with information from third parties - including publicly available sources. Based on this, we can, for example, calculate the probability that you will use certain services or behave in a certain way. The data processed for this purpose is partly already known to us (e.g. when you use our services), or we obtain this data by recording your behavior (e.g. how you navigate on our website).

We anonymize or delete this data when it is no longer meaningful for the purposes pursued, which may be between three weeks and 24 months (for product and service preferences) depending on the type of data. This period may be longer insofar as this is necessary for reasons of proof or to comply with legal or contractual requirements or is technically required.

Other data: We also collect data from you in other situations. In connection with official or judicial proceedings, for example, data is generated (such as files, evidence, etc.) that may also relate to you. We may obtain or produce photographs, videos and audio recordings in which you may be identifiable (such as at events, through security cameras, etc.). We may also collect data about who enters certain buildings or has corresponding access rights and when (including during access controls, based on registration data or visitor lists, etc.), who participates in events or campaigns (e.g. competitions) and when, or who uses our infrastructure and systems. Finally, we collect and process data about our shareholders and other investors; in addition to master data, this includes information for the relevant registers, regarding the exercise of their rights and the holding of events (e.g. general meetings).

The retention period for this data depends on the purpose and is limited to what is necessary. This ranges from a few days in the case of many security cameras and usually a few weeks in the case of data for contact tracing, to visitor data that is usually retained for three months, to reports on events with pictures that can be retained for several years or longer. Data about you as a shareholder or other investor is retained in accordance with company law requirements.

You disclose much of the data mentioned in this Item 3 to us yourself (e.g. via forms, as part of communication with us, in connection with contracts, when using the website, etc.). You are not obliged to do so, subject to individual cases, e.g. in the context of binding protection concepts (legal obligations). If you wish to conclude contracts with us or claim services, you must also provide us with data, in particular master data, contract data and registration data, as part of your contractual obligation under the relevant contract. When using our website, the processing of technical data is unavoidable. If you wish to gain access to certain systems or buildings, you must provide us with registration data. We only provide you with certain services if you provide us with registration data because we or our contractual partners want to know who is using our services or has accepted an invitation to an event, because it is technically necessary or because we want to communicate with you.

Unless this is inadmissible, we also take data from publicly accessible sources (e.g. debt enforcement registers, land registers, commercial registers, the media or the Internet, including social media) or receive data from other companies within our group, from public authorities or from other third parties (such as associations, contractual partners, Internet analysis services, etc.).

We process your data for the purposes we explain below. You will find further information for the online area in sections 12 and 13. These purposes or the underlying objectives represent legitimate interests of us and, where applicable, of third parties. You will find further information on the legal basis for our processing in section 5.

We process your data for purposes related to communication with you, in particular to respond to inquiries and assert your rights (section 11) and to contact you in the event of queries. For this purpose, we use in particular communication data and master data and, in connection with offers and services used by you, also registration data. We retain this data to document our communication with you, for training purposes, for quality assurance and for follow-up inquiries.

This is for all purposes in connection with which you and we communicate, whether in customer service or consulting, authentication in case of use of the website or for training and quality assurance (e.g. in the area of customer service). We further process communication data so that we can communicate with you via email and telephone, as well as messenger services, chat, social media and letter. Communication with you is mostly in connection with other processing purposes, for example, so that we can provide services or respond to a request for information. Our data processing operations also serve to provide evidence of the communication and its content.

We process data for the purpose of establishing, managing and settling contractual relationships. We conclude contracts of various kinds with our business and private customers, with suppliers, subcontractors or other contractual partners such as partners in projects or with parties in legal disputes. In particular, we process master data, contract data and communication data and, depending on the circumstances, registration data of the customer or the persons to whom the customer provides a service. This includes, for example, the recipients of our products or services who receive vouchers and invitations from our customers for this purpose and who, when redeeming them, may in turn become our customers. In this case, we process data for the processing of the contract with these recipients, but also with the contractual partners who have invited them.

In the context of initiating business, personal data - in particular master data, contract data and communication data - are collected from potential customers or other contractual partners (e.g. in an order form or contract) or result from a communication. Also in connection with the conclusion of a contract, we process data to check creditworthiness and for the opening of the customer relationship. In some cases, this information is checked for compliance with legal requirements.

In the context of the processing of contractual relationships, we process data for the administration of the customer relationship, for the provision and collection of contractual services (which also includes the involvement of third parties, such as logistics companies, security services, advertising service providers, banks, insurance companies or credit agencies, which may then in turn provide us with data), for consulting and for customer support. The enforcement of legal claims arising from contracts (debt collection, legal proceedings, etc.) is also part of the processing, as is accounting, termination of contracts and public communication.

We process data for marketing purposes and relationship management, e.g. to send our customers and other contractual partners personalized advertising on products and services from us and from third parties (e.g. from advertising contractual partners). This may take the form of newsletters and other regular contacts (electronically, by mail, by telephone), via other channels for which we have contact information from you, but also as part of individual marketing campaigns (e.g. events, competitions, etc.) and may also include free services (e.g. invitations, vouchers, etc.). You can refuse such contacts at any time or refuse or revoke your consent to be contacted for advertising purposes. With your consent, we can target our online advertising on the Internet more specifically to you. Finally, we also want to enable our contractual partners to contact our customers and other contractual partners for advertising purposes.

• We continue to process your data for market research, to improve our services and operations, and for product development. We strive to continuously improve our products and services (including our website) and to be able to react quickly to changing needs. We therefore analyze, for example, how you navigate through our website or which products are used by which groups of people and how new products and services can be designed. This provides us with information on the market acceptance of existing products and services and the market potential of new ones. To this end, we process in particular master data, behavioral data and preference data, but also communication data and information from customer surveys, polls and studies and other information, e.g. from the media, social media, the Internet and other public sources. As far as possible, we use pseudonymized or anonymized data for these purposes. We may also use media monitoring services or conduct media monitoring ourselves and process personal data in the process in order to conduct media work or to understand and respond to current developments and trends. We use anonymized location data, for example, to make recommendations to our contractors on how to avoid rush hour. With your consent, we use non-anonymized location data to point you to interesting offers and products in the vicinity based on your position, to infer your interests from the location data (dwell time), and to tell you which products and services other contractual partners with similar interests have used.
• We may also process your data for security and access control purposes. We continually review and improve the appropriate security of our IT and other infrastructure (e.g., buildings). Like all companies, we cannot rule out data security breaches with absolute certainty, but we do our best to reduce the risks. We therefore process data, for example, for monitoring, inspection, analysis and testing of our networks and IT infrastructures, for system and error checks, for documentation purposes and as part of security backups. Access controls include, on the one hand, controlling access to electronic systems (e.g., logging into user accounts), and on the other hand, physical access control (e.g., building access). For security purposes (preventive and incident investigation) we also keep access logs or visitor lists and use surveillance systems (e.g. security cameras). We draw your attention to surveillance systems at the relevant locations by means of appropriate signs.
• We process personal data to comply with laws, directives and recommendations from authorities and internal regulations ("Compliance"). This includes, for example, the implementation of security concepts or the legally regulated fight against money laundering and terrorist financing. In certain cases, we may be required to make certain inquiries about customers ("Know Your Customer") or to report to authorities. The fulfillment of disclosure, information or reporting obligations, e.g. in connection with supervisory and tax obligations, also requires or entails data processing, e.g. the fulfillment of archiving obligations and the prevention, detection and clarification of criminal offenses and other violations. This also includes the receipt and processing of complaints and other reports, the monitoring of communications, internal investigations or the disclosure of documents to an authority if we have sufficient reason to do so or are legally obliged to do so. We may also process personal data about you in the course of external investigations, for example, by a law enforcement or regulatory agency or an appointed private entity. Furthermore, we process data to serve our shareholders and other investors and to fulfill our obligations in this regard. For all these purposes, we process in particular your master data, your contractual data and communication data, but also, under certain circumstances, behavioral data and data from the categories of other data.
• We also process data for the purposes of our risk management and in the context of prudent corporate governance, including business organization and corporate development. For these purposes, we process in particular master data, contract data, registration data and technical data, but also behavioral and communication data. For example, we need to monitor our debtors and creditors as part of our financial management, and we need to avoid becoming victims of crime and abuse, which may require us to analyze data for relevant patterns. We may also conduct profiling and create and edit profiles for these purposes and to protect you and us from criminal or abusive activity. As part of the planning of our resources and organization of our operations, we may need to evaluate and process data relating to the use of our services and other offerings, or share information about them with others (e.g., outsourcing partners), which may include your data. The same applies with respect to services provided to us by third parties. As part of our business development, we may sell or acquire businesses, operations or companies to or from others or enter into partnerships, which may also involve the exchange and processing of data (including from you, e.g. as a customer or supplier or as a supplier representative).
• We may process your data for other purposes, such as as part of our internal operations and administration or for training and quality assurance purposes. These further purposes include, for example, training and educational purposes, administrative purposes (such as the administration of master data, accounting and data archiving and the testing, administration and ongoing improvement of IT infrastructure), the protection of our rights (e.g. in order to enforce claims in court, before or out of court and before authorities in Germany and abroad or to defend ourselves against claims, for example by preserving evidence, legal clarifications and participation in court or official proceedings) and the evaluation and improvement of internal processes. The protection of other legitimate interests is also one of the other purposes, which cannot be named exhaustively

If we ask you for your consent for certain processing (e.g. for the processing of particularly sensitive personal data), we will inform you separately about the corresponding purposes of the processing. You can revoke consent at any time with future effect by notifying us in writing (by post) or, where not otherwise specified or agreed, by e-mail; you will find our contact details in section 2. Where you have a user account, revocation or contact with us may also be carried out via the relevant website or other service, if applicable. Once we have received notification of the withdrawal of your consent, we will no longer process your data for the purposes to which you originally consented, unless we have another legal basis for doing so. The revocation of your consent does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation.

Where we do not ask you for your consent for processing, we base the processing of your personal data on the fact that the processing is necessary for the initiation or execution of a contract with you (or the entity you represent) or that we or third parties have a legitimate interest in doing so, so in particular to pursue the purposes and related objectives described above under section 4 and to be able to implement appropriate measures. Our legitimate interests also include compliance with legal regulations, insofar as this is not already recognized as a legal basis by the respective applicable data protection law. However, this also includes the marketing of our products and services, the interest to better understand our markets and to safely and efficiently manage and develop our business, including operations.

If we receive sensitive data (e.g. information on political, religious or ideological views or biometric data for identification purposes), we may also process your data on the basis of other legal grounds, e.g. in the event of disputes due to the need for processing for a possible lawsuit or the enforcement or defense of legal claims. In individual cases, other legal grounds may come into play, which we will communicate to you separately where necessary.

We may automatically evaluate ("profile") certain of your personal characteristics for the purposes mentioned in section 4 using your data (section 3), if we want to determine preference data, but also to determine abuse and security risks, to perform statistical evaluations or for operational planning purposes. For the same purposes, we may also create profiles, i.e. we may combine behavioral and preference data, but also master and contract data and technical data assigned to you, in order to better understand you as a person with your different interests and other characteristics.

In both cases, we pay attention to the proportionality and reliability of the results and take measures against misuse of these profiles or profiling. If these can have legal effects or significant disadvantages for you, we generally provide for a manual review.

In connection with our contracts, the website, our services and products, our legal obligations or otherwise to protect our legitimate interests and the other purposes listed in section 4, we also transfer your personal data to third parties, in particular to the following categories of recipients:

• Service providers: we work with service providers in Switzerland and abroad who process data about you on our behalf or in joint responsibility with us or receive data about you from us in their own responsibility (e.g. IT providers, shipping companies, advertising service providers, login service providers, cleaning companies, security companies, banks, insurance companies or, debt collection companies).
• Contractual partners including customers: First of all, this refers to customers (e.g. service recipients) and other contractual partners of ours, because this data transfer results from these contracts. You receive, for example, registration data on issued and redeemed vouchers, invitations, etc.. If you work for such a contractual partner yourself, we may also transfer data about you to them in this context. Recipients further include contractual partners with whom we cooperate or who advertise for us and to whom we therefore transmit data about you for analysis and marketing purposes.
• Authorities: We may disclose personal data to offices, courts and other authorities in Germany and abroad if we are legally obliged or entitled to do so or if this appears necessary to protect our interests. The authorities process data about you that they receive from us under their own responsibility.
• Other persons: This refers to other cases where the inclusion of third parties results from the purposes pursuant to Section 4. Other recipients are, for example, delivery addressees or third-party payees specified by you, other third parties also in the context of agency relationships (e.g. if we send your data to your lawyer or your bank) or persons involved in official or legal proceedings. If we cooperate with media and transmit this material (e.g. photos), you may also be affected under certain circumstances. The same applies when we publish content (e.g., photos, interviews, quotes, etc.), for example, on our website or in other publications. In the course of business development, we may sell or acquire businesses, parts of businesses, assets or companies, or enter into partnerships, which may also result in the disclosure of data (including about you, e.g. as a customer or supplier or as a supplier representative) to the persons involved in these transactions. Communications with our competitors, industry organizations, associations and other bodies may also involve the exchange of data that also relates to you.

All of these categories of recipients may in turn involve third parties, so that your data may also become accessible to them. We can restrict processing by certain third parties (e.g. IT providers), but not by other third parties (e.g. authorities, banks, etc.).

We also allow certain third parties to collect personal data from you on our website and at events organized by us (e.g. media photographers, providers of tools that we have integrated on our website, etc.). Insofar as we are not decisively involved in these data collections, these third parties are solely responsible for them. If you have any concerns or wish to assert your data protection rights, please contact these third parties directly. Cf. point 12 for the website.

As explained in Section 7, we also disclose data to other entities. These are not only located in Switzerland. Your data may therefore be processed in Europe; in exceptional cases, however, in any country in the world. You agree that the disclosure of data may also take place abroad.

If a recipient is located in a country without adequate legal data protection, we contractually obligate the recipient to comply with the applicable data protection (for this purpose, we use the revised standard contractual clauses of the European Commission), unless the recipient is already subject to a legally recognized set of rules to ensure data protection and we cannot rely on an exception provision. An exception may apply in particular in the case of legal proceedings abroad, but also in cases of overriding public interests or if the performance of a contract requires such disclosure, if you have given your consent or if it is data that you have made generally available and you have not objected to its processing.

Please also note that data exchanged via the Internet is often routed via third countries. Your data may therefore end up abroad even if the sender and recipient are in the same country.

We process your data for as long as it is necessary for our processing purposes, the legal retention periods and our justified interests in processing for documentation and documentation and evidence purposes or as long as storage is technically required. storage is required. Further information on the respective storage and processing duration can be found in each case for the individual data categories in para. 3 and the cookie categories in section 12 . If there are no legal or contractual obligations to the contrary, we will delete or contractual obligations, we will delete or anonymize your data after the expiry of the storage or processing period as part of our normal processes.

We take reasonable security measures to protect the confidentiality, integrity and availability of your availability of your personal information, to protect you against unauthorized or unlawful unauthorized processing and to protect against the risks of loss, accidental unintentional alteration, unauthorized disclosure or access. unauthorized access.

Under certain circumstances, applicable data protection law grants you the right to object to the processing of your data, in particular that for direct marketing purposes, profiling for direct marketing purposes and other legitimate interests in processing.

To help you control the processing of your personal data, you also have the following rights in connection with our data processing, depending on applicable data protection law:

• The right to request information from us as to whether we are processing data about you and, if so, what data we are processing;
• The right to have us correct data if it is inaccurate;
• the right to request that we delete data;
• the right to request that we provide certain personal data in a commonly used electronic format or transfer it to another controller;
• The right to withdraw consent where our processing is based on your consent;
• the right to obtain, on request, further information necessary for the exercise of these rights.

If you wish to exercise any of the above rights against us, please contact us in writing, at our premises or, unless otherwise stated or agreed, by email; you will find our contact details in section 2. In order for us to rule out abuse, we must identify you (e.g. with a copy of your ID card, unless otherwise possible).

Please note that conditions, exceptions or restrictions apply to these rights under applicable data protection law (e.g. to protect third parties or trade secrets). We will inform you accordingly if necessary. In particular, we may need to further process and store your personal data in order to fulfill a contract with you, to protect our own interests worthy of protection, such as the assertion, exercise or defense of legal claims, or to comply with legal obligations. To the extent legally permissible, in particular to protect the rights and freedoms of other data subjects and to safeguard interests worthy of protection, we may therefore also reject a data subject request in whole or in part (e.g., by blacking out certain content relating to third parties or our trade secrets).

If you do not agree with our handling of your rights or data protection, please notify us (Section 2) in writing. In particular, if you are located in the EEA, the United Kingdom or Switzerland, you also have the right to complain to the data protection supervisory authority in your country.

On our website, we use various techniques with which we and third parties engaged by us can recognize you during your use and possibly also track you over several visits. In this section, we inform you about this.

In essence, this is so that we can distinguish accesses by you (via your system) from accesses by other users, so that we can ensure the functionality of the website and carry out evaluations and personalizations. In doing so, we do not want to infer your identity, even if we could do so insofar as we or third parties engaged by us can identify you through combination with registration data. Even without registration data, however, the techniques used are designed in such a way that you are recognized as an individual visitor each time you access a page, for example by our server (or the servers of third parties) assigning you or your browser a specific recognition number (a so-called "cookie").

We use such techniques on our website and allow certain third parties to do so as well. However, depending on the purpose of these techniques, we may ask for your consent before they are used. You can program your browser to block or deceive certain cookies or alternative techniques, or to delete existing cookies. You can also enhance your browser with software that blocks tracking by certain third parties. You can find more information about this on the help pages of your browser (usually under the heading "Privacy") or on the websites of the third parties that we list below.

A distinction is made between the following cookies (techniques with comparable functionalities such as fingerprinting are included here):

Necessary cookies: some cookies are necessary for the functioning of the website as such or certain functions. They ensure, for example, that you can switch between pages without losing information entered in a form. They also ensure that you remain logged in. These cookies only exist temporarily ("session cookies"). If you block them, the website may not work. Other cookies are necessary so that the server can store decisions or entries made by you beyond one session (i.e. one visit to the website), if you request this function (e.g. selected language, given consent, the function for an automatic login etc.). These cookies have an expiration date of up to 24 months.

Performance cookies: in order to optimize our website and corresponding offers and better adapt them to the needs of users, we use cookies to record and analyze the use of our website, possibly even beyond the session. We do this through the use of third-party analytics services. We have listed these below. Before we use such cookies, we ask for your consent. Performance cookies also have an expiration date of up to 24 months. Details can be found on the websites of the third-party providers.

Marketing Cookies: We and our advertising contractors have an interest in targeting advertising, i.e., displaying it as much as possible only to those we want to target. We have listed our advertising contractors below. For this purpose, we and our advertising partners - if you consent - also use cookies that can be used to record the content accessed or contracts concluded. This allows us and our advertising contractors to display advertisements that we think you will be interested in, on our website, but also on other websites that display advertisements from us or our advertising contractors. These cookies have an expiration period ranging from a few days to 12 months, depending on the situation. If you consent to the use of these cookies, you will be shown appropriate advertising. If you do not consent to these cookies, you will not see less advertising, but simply any other advertising.

In addition to marketing cookies, we use other techniques to control online advertising on other websites and thereby reduce wastage. For example, we may transmit the e-mail addresses of our users, customers and other persons to whom we want to display advertising to operators of advertising platforms (e.g. social media). If these persons are registered there with the same e-mail address (which the advertising platforms determine by matching), the operators show the advertising we have placed to these persons in a targeted manner. The operators do not receive personal e-mail addresses of persons who are not already known. In the case of known e-mail addresses, however, they learn that these persons are in contact with us and what content they have accessed.

We may also integrate further third-party offers on our website, in particular from social media providers. These offers are deactivated by default. As soon as you activate them (e.g. by clicking a button), the corresponding providers can determine that you are on our website. If you have an account with the social media provider, they can assign this information to you and thus track your use of online offers. These social media providers process this data under their own responsibility.

We currently use offers from the following service providers and advertising contract partners (insofar as they use data from you or cookies set at your site for advertising purposes):

Google Analytics: Google Ireland (based in Ireland) is the provider of the "Google Analytics" service and acts as our order processor. Google Ireland relies on Google LLC (based in the USA) as its order processor (both "Google") for this purpose. Google thereby tracks the behavior of visitors to our website (duration, frequency of pages viewed, geographic origin of access, etc.) through performance cookies (see above) and creates reports for us on the use of our website on this basis. We have configured the service so that the IP addresses of visitors are shortened by Google in Europe before being forwarded to the USA and thus cannot be traced. We have turned off the "Data Forwarding" and "Signals" settings. Although we can assume that the information we share with Google is not personal data for Google, it is possible that Google can draw conclusions about the identity of visitors from this data for its own purposes, create personal profiles and link this data to the Google accounts of these individuals. If you consent to the use of Google Analytics, you explicitly agree to such processing, which also includes the transfer of personal data (in particular usage data about the website and app, device information and individual IDs) to the USA and other countries.

We may operate pages and other online presences ("fan pages", "channels", "profiles" etc.) on social networks and other platforms operated by third parties and collect the data about you described in section 3 and below there. We receive this data from you and the platforms when you come into contact with us via our online presence (e.g., when you communicate with us, comment on our content or visit our presence). At the same time, the platforms evaluate your use of our online presences and link this data with other data about you known to the platforms (e.g., about your behavior and preferences). They also process this data for their own purposes under their own responsibility, in particular for marketing and market research purposes (e.g. to personalize advertising) and to control their platforms (e.g. which content they show you).

We process this data for the purposes described in section 4, in particular for communication, marketing purposes (including advertising on these platforms, see section 12) and market research. You will find information on the relevant legal basis in section 5. We may ourselves disseminate content published by you (e.g. comments on an announcement) (e.g. in our advertising on the platform or elsewhere). We or the operators of the platforms may also delete or restrict content from or to you in accordance with the usage guidelines (e.g. inappropriate comments).

For more information about the edits of the operators of the platforms, please refer to the privacy notices of the platforms. There you will also learn in which countries they process your data, which rights of access, deletion and other data subjects you have and how you can exercise these or obtain further information. We currently use the following platforms:

Facebook: Here we operate the page www.facebook.com/rugenbraeuag. The responsible party for operating the platform for users from Europe is Facebook Ireland Ltd, Dublin, Ireland. Their privacy policy is available at www.facebook.com/policy. Some of your data will be transferred to the USA in the process. With regard to the data collected and processed when visiting our site for the creation of "Page Insights", we are jointly responsible with Facebook Ireland Ltd, Dublin, Ireland. Page Insights compiles statistics about what visitors do on our site (comment on posts, share content, etc.). It helps us understand how our site is used and how we can improve it. We only receive anonymous, aggregated data in the process.

Instagram: Here we operate the site www.instagram.com/rugenbrau1866. The responsible party for operating the platform for users from Europe is Facebook Ireland Ltd, Dublin, Ireland. Their privacy policy is available at www.privacycenter.instagram.com/policy. Some of your data will be transferred to the USA in the process. With regard to the data collected and processed when visiting our site for the creation of "Page Insights", we are jointly responsible with Facebook Ireland Ltd, Dublin, Ireland. Page Insights compiles statistics about what visitors do on our site (comment on posts, share content, etc.). It helps us understand how our site is used and how we can improve it. We only receive anonymous, aggregated data in the process.

This privacy policy is not part of any contract with you. We may revise this privacy statement at any time without prior notice. The current version published on our version published on our website shall apply. Insofar as the data protection declaration is part of an agreement with you, we will inform you in the event of an update about the inform you of the change by e-mail or other suitable means.