Code of Conduct

Introduction and General Information

Thank you for your interest in our website. The protection of your personal data is of great importance to us. The following information provides details on how we handle your data collected through your use of our website. Your data is processed in accordance with the applicable data protection laws..

How do we collect your data?

Your data is collected, on the one hand, when you provide it to us. This may include, for example, data that you enter into a contact form.

Other data is collected automatically by our IT systems when you visit the website. This primarily includes technical data (e.g. internet browser, operating system or time of page access). This data is collected automatically as soon as you access our website.

Controller within the Scope of the GDPR

AIF Capital AG

Börsenplatz 1, 70174 Stuttgart, Germany

info@aif.capital

+49 711 / 4905790

Contact Information of the Data Protection Officer

Proliance GmbH / www.datenschutzexperte.de

Data Protection Officer

Leopoldstr. 21 21

80802 Munich, Germany

datenschutzbeauftragter@datenschutzexperte.de

Definitions

We aim to make our Privacy Policy easy to understand and accessible to everyone. This Privacy Policy generally uses the official terminology of the General Data Protection Regulation (GDPR). The official definitions of these terms are set out in Article 4 of the GDPR.

Access to and storage of information on end-user devices

By using our website, information may be accessed (e.g. IP address) or stored (e.g. cookies) on your end-user devices. Such access or storage may involve further processing of personal data under the GDPR.

In cases where such access to or storage of information is strictly necessary for the technically error-free provision of our services, this is carried out on the basis of Section 25 (1) sentence 1 and Section 25 (2) no. 2 of the German Telecommunications and Telemedia Data Protection Act (TTDSG).

In cases where such a process serves other purposes (e.g. the needs-based design of our website), it is carried out on the basis of Section 25 (1) TTDSG only with your consent in accordance with Article 6 (1) (a) GDPR. Consent may be withdrawn at any time with effect for the future. The processing of your personal data is subject to the provisions of the GDPR and the German Federal Data Protection Act (BDSG).

Further information on the processing of your personal data and the relevant legal bases in this context can be found in the following sections on the specific processing activities on our website.

Web Hosting

This website is hosted by an external service provider (Strato). The hosting of this website takes place in Germany. Personal data collected on this website is stored on the servers of the hosting provider. This may include, in particular, IP addresses, contact enquiries, metadata and communication data, website access data and other data generated through the use of a website.

We collect the data listed above in order to ensure a smooth connection to the website and the proper technical provision of our services. The processing of this data is strictly necessary to make the website available to you. The legal basis for the processing of the data is our legitimate interest in the proper presentation and functionality of our website pursuant to Article 6 (1) (f) GDPR.

We have entered into a data processing agreement with the provider in accordance with the requirements of Article 28 GDPR, under which we require the provider to protect our customers’ data and not disclose it to third parties.

Server Log Files

When you access our website, it is technically necessary for data to be transmitted from your internet browser to our web server. The following data is recorded during an active connection for communication between your internet browser and our web server:

• Browser type and browser version
• Operating system used
• Referrer URL
• Hostname of the accessing computer
• Time of the server request
• IP address

We collect the data listed above to ensure a smooth connection to the website and to enable users to use our website conveniently. The log file also serves to evaluate system security and stability as well as for administrative purposes. The legal basis for the temporary storage of the data and log files is Article 6 (1) (f) GDPR.

Cookies

Our website uses so-called “cookies”. Cookies are small text files that are either stored temporarily on your end-user device for the duration of a session (session cookies) or permanently (persistent cookies). Session cookies are automatically deleted at the end of your visit. Persistent cookies remain stored on your end-user device until you delete them yourself or they are automatically deleted by your web browser.

Cookies serve various purposes. Many cookies are essential because certain website features would not work without them (e.g. the shopping cart function or language settings). Other cookies are used to analyse user behaviour or display advertising.

The processing of data through the use of strictly necessary cookies is based on a legitimate interest pursuant to Article 6 (1) (f) GDPR in the proper provision of our services. For details on the purposes of processing and the legitimate interests, please refer to the information provided on the specific data processing activities.

The processing of personal data through the use of other cookies is based on consent pursuant to Article 6 (1) (a) GDPR. Consent may be withdrawn at any time with effect for the future. If such cookies are used for analysis and optimisation purposes, we will provide you with separate information about their use in this Privacy Policy and obtain your consent in accordance with Article 6 (1) (a) GDPR.

You can adjust your browser settings to

• be informed about the setting of cookies,
• allow cookies on a case-by-case basis only,
• exclude the acceptance of cookies in specific cases or altogether,

• activate the automatic deletion of cookies when the browser is closed.

Cookie settings can be managed using the following links for the respective browsers:

• Google Chrome
• Mozilla Firefox
• Edge (Microsoft)
• Safari
• Opera

You can also manage cookies from many companies and advertising-related features individually. To do so, use the relevant user tools available at https://www.aboutads.info/choices/ or http://www.youronlinechoices.com/uk/your-ad-choices.

Most browsers also offer a so-called “Do Not Track” feature. Once enabled, the respective browser informs advertising networks, websites and applications that you do not wish to be “tracked” for the purposes of behaviour-based advertising or similar activities.

Information and instructions on how to change this feature can be found, depending on your browser provider, at the following links:

• Google Chrome
• Mozilla Firefox
• Edge (Microsoft)
• Safari
• Opera

In addition, you can prevent the loading of so-called scripts by default. “NoScript” allows JavaScript, Java and other plug-ins to be executed only on trusted domains of your choice. Information and instructions on how to configure this feature can be obtained from your browser provider (e.g. for Mozilla Firefox at: https://addons.mozilla.org/de/firefox/addon/noscript/).

Please note that disabling cookies may limit the functionality of our website.

You can withdraw or change your cookie settings at any time. To do so, simply access the cookie settings again using this link: cookies settings.

Contact Form and Contact by Email

If you contact us by email, the information you provide in your email, including your contact details, will be stored by us for the purpose of processing your request and in case of any follow-up questions. Providing an email address is required for contacting you; providing your name and telephone number is voluntary. We will not disclose this data to third parties under any circumstances without your consent. The legal basis for the processing of the data is our legitimate interest in responding to your request pursuant to Article 6 (1) (f) GDPR and, where applicable, Article 6 (1) (b) GDPR, insofar as your request is aimed at entering into a contract. Your data will be deleted once your request has been finally processed, unless statutory retention obligations prevent this. In cases where Article 6 (1) (f) GDPR applies, you may object to the processing of your personal data at any time.

Submission of Applications

When you apply to us, we collect personal data. This includes, in particular, your contact details (such as your first and last name, form of address, postal address, telephone number and email address) as well as other information you provide about your professional background (e.g. CV, qualifications, degrees and professional experience) and about yourself (e.g. cover letter, personal interests). This may also include special categories of personal data (e.g. information about a severe disability). Your personal data is generally collected directly from you as part of the application process and is encrypted during electronic transmission. The processing of your data serves the purpose of initiating an employment relationship. The primary legal basis for this is Section 26 (1) of the German Federal Data Protection Act (BDSG). In addition, consent pursuant to Article 6 (1) (a) and Article 7 GDPR in conjunction with Section 26 (2) BDSG may be used as a legal basis for the processing of personal data. If the processing of your data is based on consent, you have the right to withdraw your consent at any time with effect for the future. Within our company, only those persons and departments (e.g. Human Resources) have access to your personal data who strictly require it to carry out the application process or to fulfil our legal obligations. For this purpose, your applications may be forwarded to the respective responsible persons for review. Under no circumstances will your personal data be disclosed to unauthorised third parties. Your data relating to an application for a specific position will be stored and processed by us for the duration of the ongoing application process. After the application process has ended (e.g. in the form of an offer or rejection), the application record, including all personal data, will be deleted from the system six months after the end of the application process. In the event of an offer, we reserve the right to retain your application for a longer period if your start date is more than six months in the future.

Analytics Tools and Advertising

Google Tag Manager

This website uses Google Tag Manager provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). This service enables website tags to be managed via an interface. Google Tag Manager only implements tags. This means that no cookies are used and only the user’s IP address is transmitted to Google to establish the connection. Google Tag Manager triggers other tags, which may in turn collect data. However, Google Tag Manager does not access this data. If deactivation has been carried out at domain or cookie level, it remains in effect for all tracking tags insofar as they are implemented using Google Tag Manager.

We use Google Tag Manager on the basis of your consent pursuant to Article 6 (1) (a) GDPR.

As the IP address is transmitted to Google in the USA, additional safeguards are required to ensure a level of data protection equivalent to that provided under the GDPR. To ensure this, we have agreed on standard data protection clauses with the provider pursuant to Article 46 (2) (c) GDPR. These require the recipient of the data in the USA to process the data in accordance with the level of protection applicable in Europe. In cases where this cannot be ensured even through these contractual safeguards, we endeavour to obtain additional provisions and assurances from the recipient in the USA.

Google Analytics

Our website uses Google Analytics, an web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland (“Google”). Google Analytics uses so-called “cookies” and web beacons.

Google will use this information on behalf of the operator of this website to evaluate your use of the website and to compile reports on website activities. Google will also use this information to provide the website operator with further services related to the use of the website and the internet. The IP address sent by your browser as part of Google Analytics will not be combined with other data held by Google. The processing is carried out pursuant to Article 6 (1) (a) GDPR on the basis of your consent.

We use Google Analytics only with enabled IP anonymisation. This means that Google processes your IP address only in shortened form.

We have entered into a data processing agreement with the service provider, under which we require the provider to protect our customers’ data and not disclose it to third parties.

As personal data is transferred to the USA, additional safeguards are required to ensure a level of data protection equivalent to that provided under the GDPR. To ensure this, we have agreed on standard data protection clauses with the provider pursuant to Article 46 (2) (c) GDPR. These require the recipient of the data in the USA to process the data in accordance with the level of protection applicable in Europe. In cases where this cannot be ensured even through these contractual safeguards, we endeavour to obtain additional provisions and assurances from the recipient in the USA.

The Google Analytics Terms of Use and information on data protection can be accessed via the following links:

https://marketingplatform.google.com/about/analytics/terms/gb/

https://policies.google.com/?hl=en&gl=de

The data is deleted as soon as it is no longer required for the purpose for which it was collected. Data at user and event level that is linked to cookies, user identifiers (e.g. User ID) and advertising IDs (e.g. DoubleClick cookies, Android Advertising ID, IDFA [Apple Identifier for Advertisers]) is deleted no later than 14 months after its collection.

LinkedIn Analytics / LinkedIn Insight

Our website uses the conversion tracking technology and retargeting function of LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. This enables us to display personalised advertisements to visitors to our website on LinkedIn. For this purpose, a cookie, the LinkedIn Insight Tag, with a validity period of 120 days is set in your browser, which enables LinkedIn to recognise you when you visit this website while you are also logged in to your LinkedIn account. LinkedIn uses this data to generate anonymous reports on the performance of advertisements as well as information on interactions with the website. The information generated by the cookie is generally transmitted to a server in the USA and stored there.

The legal basis for the processing is your consent pursuant to Article 6 (1) (a) GDPR.

As personal data is transferred to the USA, additional safeguards are required to ensure a level of data protection equivalent to that provided under the GDPR. To ensure this, we have agreed on standard data protection clauses with the provider pursuant to Article 46 (2) (c) GDPR. These require the recipient of the data in the USA to process the data in accordance with the level of protection applicable in Europe. In cases where this cannot be ensured even through these contractual safeguards, we endeavour to obtain additional provisions and assurances from the recipient in the USA.

You can opt out of LinkedIn Insight conversion tracking and interest-based personalised advertising using the following link: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out. Further information on data protection at LinkedIn can be found at https://www.linkedin.com/legal/privacy-policy.

Plugins and Tools

YouTube

Our website embeds videos from “YouTube”, a social media platform operated by Google Ireland Limited, Google Building Gordon House, Barrow St, Dublin 4, Ireland (hereinafter referred to as “Google”).

The use of this service involves the transfer of personal data to the USA. The legal basis for the transfer of your personal data to the USA is your consent pursuant to Article 49 (1) sentence 1 (a) GDPR. Please note that such transfers of personal data without an adequacy decision and without appropriate safeguards entail a risk to you. This risk arises from the fact that, under US legislation, US authorities (in particular intelligence services) may gain access to personal data. Legal remedies or information regarding the handling of your data by US authorities are only available to a very limited extent, if at all. A level of data protection in accordance with the requirements of the GDPR cannot therefore be guaranteed.

If the playback of embedded YouTube videos is started with your consent, the provider “YouTube” uses cookies to collect information about user behaviour. According to information provided by “YouTube”, these cookies are used, among other things, to collect video statistics, improve user-friendliness and prevent abusive behaviour. If you are logged in to Google, your data will be directly associated with your account when you click on a video. If you do not wish your data to be associated with your YouTube profile, you must log out before activating the button. Google stores this data as user profiles and uses it for the purposes of advertising, market research and/or the needs-based design of its websites. Such analysis is carried out in particular (also for users who are not logged in) to display personalised advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles. To exercise this right, please contact Google directly.

Third-party provider information: Google Ireland Limited, Google Building Gordon House, Barrow St, Dublin 4, Ireland

Further information on data protection and the use of data by Google can be found on the following Google website: https://policies.google.com/privacy?hl=de&gl=de

Google Fonts

We use “Google Fonts” on our website, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter referred to as: “Google”). Google Fonts enables us to use external fonts. To this end, the required Google Fonts are loaded into your browser cache by your web browser when you access our website. This is necessary to enable your browser to display our texts with an enhanced visual appearance. If your browser does not support this function, a standard font on your computer will be used for display.

The fonts are hosted by us and are therefore not loaded from an external provider. The processing of your IP address is required for this purpose.

We use Google Fonts for optimisation purposes, in particular to improve your use of our website and to make its design more user-friendly. The legal basis for the processing of the data is our legitimate interest in this regard pursuant to Article 6 (1) (f) GDPR.

Data Disclosure and Recipients

Your personal data will not be disclosed to third parties, except:

• where we have expressly stated this in the description of the respective data processing activity,
• where you have given your explicit consent pursuant to Article 6 (1) sentence 1 (a) GDPR,
• where the disclosure is necessary pursuant to Article 6 (1) sentence 1 (f) GDPR for the establishment, exercise or defence of legal claims, and there is no reason to assume that you have an overriding legitimate interest in your data not being disclosed,
• where there is a legal obligation to disclose the data pursuant to Article 6 (1) sentence 1 (c) GDPR, and
• insofar as the disclosure is necessary pursuant to Article 6 (1) sentence 1 (b) GDPR for the performance of contractual relationships with you.

In addition, we use external service providers to provide our services. We carefully select these service providers and commission them in writing. They are bound by our instructions and are regularly monitored by us. Where required, we have entered into data processing agreements with them pursuant to Article 28 GDPR. These service providers include providers for web hosting, email delivery, and the maintenance and servicing of our IT systems, among others. The service providers will not disclose this data to third parties.

Retention Period for Personal Data

The retention period for personal data is determined by the applicable statutory retention periods (e.g. under commercial and tax law). Once the respective retention period has expired, the relevant data is routinely deleted. If data is required for the performance of a contract or for entering into a contract, or if we have a legitimate interest in retaining the data for a longer period, the data will be deleted once it is no longer required for these purposes or once you exercise your right to withdraw your consent or object to the processing.

Data Security

For security reasons and to protect the transmission of confidential information, such as orders or enquiries that you send to us in our role as website operator, this website uses SSL or TLS encryption. You can recognise an encrypted connection by the browser address changing from “http://” to “https://” and by the padlock symbol in your browser’s address bar.

When SSL or TLS encryption is enabled, the data you transmit to us cannot be read by third parties.

Your Rights

Below you will find information on the rights of data subjects granted to you under applicable data protection law with regard to the controller with regard to the processing of your personal data: The right, pursuant to Article 15 GDPR, to request access to your personal data processed by us. In particular, you may request information about the purposes of processing, the categories of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned retention period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, the source of your data where it was not collected by us, as well as the existence of automated decision-making, including profiling, and, where applicable, meaningful information about the details thereof. The right, pursuant to Article 16 GDPR, to request without undue delay the rectification of inaccurate personal data or completion of your personal data stored by us. The right, pursuant to Article 17 GDPR, to request the erasure of your personal data stored by us, unless processing is required for exercising the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise or defence of legal claims. The right, pursuant to Article 18 GDPR, to request the restriction of processing of your personal data where you dispute the accuracy of the data, the processing is unlawful but you oppose its erasure and request the restriction of its use instead, we no longer need the data but you require it for the establishment, exercise or defence of legal claims, or where you have objected to the processing pursuant to Article 21 GDPR. The right, pursuant to Article 20 GDPR, to receive your personal data that you have provided to us in a structured, commonly used and machine-readable format or to request that it be transmitted to another controller. The right, pursuant to Article 77 GDPR, to lodge a complaint with a supervisory authority. As a rule, you may contact the supervisory authority in the federal state in which our registered office specified above is located or, where applicable, the supervisory authority at your habitual place of residence or place of work. The right to withdraw consent pursuant to Article 7 (3) GDPR: You have the right to withdraw your consent to the processing of data at any time with effect for the future. In the event of withdrawal, we will delete the data concerned without undue delay, unless further processing can be based on another legal basis permitting processing without consent. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent prior to its withdrawal.

Right to Withdraw Consent

If your personal data is processed by us on the basis of legitimate interests pursuant to Article 6 (1) sentence 1 (f) GDPR, you have the right pursuant to Article 21 GDPR to object to the processing of your personal data where this is based on reasons arising from your particular situation. Where the objection relates to the processing of personal data for the purposes of direct marketing, you have a general right to object without having to provide reasons relating to your particular situation. If you wish to exercise your right to withdraw consent or your right to object, it is sufficient to send an email to info@aif.capital.

Competent Supervisory Authority

The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg

Lautenschlagerstraße 20, 70173 Stuttgart, Germany

Tel.: +49 711/61 55 41-0
Fax: +49 711/615541-15

Right to Make Changes

We reserve the right to amend or update this Privacy Policy where necessary in accordance with applicable data protection laws and regulations. This enables us to ensure that the Privacy Policy reflects current legal requirements and to take changes to our services into account, for example, when introducing new services. The version applicable at the time of your visit shall apply.

Last updated: 2 June 2022