Privacy statement

Heraeus Deutschland GmbH & Co. KG, Heraeusstraße 12 - 14, 63450 Hanau, Germany operates a B2B eCommerce platform (hereinafter referred to as "Heraeus HPM eCommerce Platform" or "Platform") at https://shop.heraeus-precious-metals.com on servers in the EU.

The Heraeus HPM eCommerce Platform serves Heraeus companies to offer services and/or products. "Heraeus Companies" means all companies in which Heraeus Holding GmbH directly or indirectly holds the majority of the shares. The Heraeus HPM eCommerce platform is operated exclusively by Heraeus Deutschland GmbH & Co. KG.

The person responsible within the meaning of the Basic Data Protection Regulation ("GDPR") is the Heraeus company to which you address your inquiry or whose products/services you order or with which you have a business relationship. Hereafter referred to as Heraeus.

This privacy policy explains to you the nature, scope and purpose of the processing of personal data within the Heraeus HPM eCommerce platform. This privacy policy applies regardless of the domains, systems, platforms and devices (e.g. desktop or mobile) from which you access the platform. In addition, we draw your attention to the data protection information for customers, which you can view, print or download at http://www.herae.us/store_hpm_data_privacy_policy

Heraeus processes personal data that Heraeus receives directly from you within the framework of a business relationship. Heraeus requires this data for the initiation, execution and processing of your orders via the HPM eCommerce platform. However, Heraeus also processes personal data that Heraeus collects about you in connection with the use of a product or service. Heraeus also processes data that you voluntarily provide, e.g. via the web forms within the platform.¹

1.1 Browsing the Heraeus HPM eCommerce Platform

When you browse through the Heraeus HPM eCommerce platform, you provide Heraeus with automatic information. The term "automatic information" refers to information provided by your web browser each time you visit the platform and automatically collected by our web server. Browsing data collected by Heraeus includes the website you are accessing, the time and duration of your visit, the pages you visit, your search queries, and temporarily your IP address1 and, if applicable, the products you have placed in your shopping cart2. Heraeus collects browsing data from users in order to compile aggregated statistics and to determine what users are interested in in order to improve various aspects of the platform and provide services such as troubleshooting. Heraeus also uses browsing data to study traffic patterns, to maintain or restore the security of our platform, or to identify and correct technical deficiencies and errors.

1.2 Providing the services you have requested

In order to provide you with access to some of the services offered on Heraeus websites, Heraeus will ask you for certain information such as your name or e-mail address so that you can register for an account on the platform. Heraeus uses your information to provide you with the information or services you have requested, such as information about specific products or services, or to answer questions about products or services.2 Heraeus may customize the content you request based on the information we collect about you so that Heraeus can provide you with the information you desire or may be interested in.1 Heraeus will use information such as your name, address, e-mail address, financial information, area of expertise or purchase history to process the relevant purchases when you purchase a product through the Platform or to provide you with the requested services.²

Please note that the provision of some information will be necessary in order for us to take action regarding an order for products or services that you have purchased. For example, we need your address to be able to send you the product you ordered. Our online forms clearly identify which fields are required in order for us to complete the transaction.

1.3 Customer management

Heraeus processes your personal data, such as your contact details, in order to provide you with a satisfactory customer management experience, such as after-sales service or answering your questions.2 To this end, Heraeus also processes your personal data as part of our management activities and to develop customer relationships so that we can offer you customized content and assess your needs as a customer.¹

2.1 Cookies & range measurement

Cookies are pieces of information that are transmitted from Heraeus web servers or third party web servers to the user's web browser where they are stored for later retrieval. Cookies may be small files or other types of information storage. You will be informed about the use of cookies in the context of pseudonymous range measurement in the context of this data protection declaration.

Detailed information about the cookies on the Heraeus website and for the Heraeus HPM eCommerce platform can be found on our cookie reference page.

If you do not wish cookies to be stored on your computer, you will be asked to deactivate the corresponding option in the system settings of your browser. Stored cookies can be deleted in the system settings of your browser. The exclusion of cookies can lead to functional restrictions of this online offer.

You may object to the use of cookies for range measurement and advertising purposes via the deactivation page of the Network Advertising Initiative (http://optout.networkadvertising.org/) and additionally the US website (http://www.aboutads.info/choices) or the European website (http://www.youronlinechoices.com/uk/your-ad-choices/).

2.2 Google Analytics

Based on our legitimate interests (i.e., our interest in the analysis, optimization and the efficient operation of our Website)1, we use Google Analytics, a web analysis services run by Google Ireland Limited (“Google”). Google uses cookies. The information generated by the cookie about your use of the website is generally transmitted to and stored by Google on servers in Ireland.

Google is certified under the Privacy Shield Agreement and thus offers a guarantee of compliance with European data protection law (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active).

Google will use this information on behalf of Heraeus to evaluate your use of our website, to compile reports on website activity, and to provide other services to Heraeus that are related to the use of the Website and the Internet. The data retrieved in this context may be used to create pseudonymized User profiles.

Heraeus only use Google Analytics with activated IP anonymization. This means that your IP address will be truncated by Google within the member states of the European Union or in other states party to the Agreement of the European Economic Area. Only in exceptional cases will the full IP address be transferred to a Google server located in the US and truncated there.

The IP address transferred from your browser will not be linked with other Google data. You may prevent the storage of cookies by selecting the appropriate system settings on your browser. You may also prevent the recording and processing by Google of data generated by cookies and data related to your use of the website by downloading and installing the browser plug-in available at: http://tools.google.com/dlpage/gaoptout?hl=en.

For further information on the use of data by Google, settings and opt-out options, please go to the following Google websites: https://www.google.com/intl/en/policies/privacy/partners ("How Google uses information from sites or apps that use our services”), http://www.google.com/policies/technologies/ads (" Advertising"), http://www.google.com/settings/ads ("Control the information Google uses to show you ads").

2.3 Target group formation with Google Analytics

We use Google Analytics to show the advertisements displayed within Google advertising services and its affiliates only to those users who have also shown an interest in our website or who have certain characteristics (e.g. interests in specific themes or products that are determined from the websites visited), which we submit to Google (so-called "remarketing" or "Google Analytics Audiences"). With the help of remarketing audiences, we also want to ensure that our advertisements match the potential interests of the user.

For more information on the use of data by Google, configuration and objection options, please refer to the following Google websites: https://www.google.com/intl/de/policies/privacy/partners (“Data usage by Google when you use websites or apps provided by our affiliates”), http://www.google.com/policies/technologies/ads (“Data usage for advertising purposes”),http://www.google.de/settings/ads (“Manage information that Google uses to show you advertising”).

2.4 LinkedIn

Features and content by LinkedIn, provided by LinkedIn Ireland Unlimited Company Wilton Place, Dublin 2, Ireland, may be incorporated within our website. This may include, for example, content such as images, videos, or text and buttons that allow users to share content from this website within LinkedIn. We use LinkedIn to show the advertisements displayed within LinkedIn advertising services and its affiliates only to those users who have also shown an interest in our website or who have certain characteristics (e.g. interests in specific themes or products that are determined from the websites visited), which we submit to LinkedIn(so-called "remarketing"). With the help of LinkedIn, we also want to ensure that our advertisements match the potential interests of the user. If the users are members of the platform LinkedIn, LinkedIn can assign accessing of the above-mentioned content and functions to the profiles of the users on the platform. LinkedIn is certified under the Privacy Shield Agreement, providing a guarantee to comply with European and Swiss data protection law ( https://www.privacyshield.gov/participant?id=a2zt0000000L0UZAA0&status=Active ). Privacy policy: https://www.linkedin.com/legal/privacy-policy , Opt-Out: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.

2.4 Advertising / Google Doubleclick

Heraeus use the online marketing practice Google “DoubleClick” to place advertisements in the Google Advertising Network (e.g. in search results, in videos, on websites, etc.). DoubleClick is characterized by displaying real-time advertisements based on the supposed interests of the user. This allows us to display advertisements for and within our website in a more targeted way, so that we only present advertisements to users which potentially suit their interests. If a user, for example, is shown advertisements for products that they have been looking at on other websites, this is called "remarketing". For these purposes, upon accessing our websites and other websites on which the Google Advertising Network is active, Google will immediately run a code and so-called (re)marketing tags (invisible graphics or code, also known as "web beacons") will be incorporated into the website. With their help, an individual cookie, i.e. a small file, will be saved on the user’s device (comparable technologies may also be used instead of cookies). This file keeps a record of which websites the user has visited, what content the user is interested in and what offers the user has clicked on, as well as technical information about the browser and operating system, websites that have referred the user, access duration, and other information regarding the use of our website.

The user's IP address is also recorded. It is shortened within Member States of the European Union or in other States which are party to the Agreement on the European Economic Area. It is only transmitted in full to a Google server in the USA and shortened there in exceptional cases. The above information may also be linked with such information from other sources by Google. If the user subsequently visits other websites, they may be shown advertisements tailored to their presumed interests on the basis of their user profile.

The user's data is processed pseudonymously within the Google Advertising Network. This means that Google does not save and process, for example, the user's name or email address, but processes the relevant data obtained by cookies within the pseudonymous user profile. This means that, from the perspective of Google, the advertisements are not managed and displayed for a person who has been specifically identified, but for the person to whom the cookie belongs, regardless of who they may be. This does not apply if a user has explicitly allowed Google to process the data without pseudonymization. The information that Google Marketing Services has gathered about the user is transmitted to Google and saved in Google servers in the USA.

The legal basis for the use of cookies for online marketing measures is your consent. Insofar as the cookies used by Heraeus are absolutely necessary for the technical functionality of the online platform, Heraeus' legitimate interest is to offer a user-oriented and economically efficient operation of the online platform.3

For more information about the use of data by Google, configuration and objection options and opportunity, please refer to the Google Privacy Policy (https://policies.google.com/technologies/ads) as well as to settings for the displaying of advertisements by Google (https://adssettings.google.com/authenticated).

2.5 Links to other websites

The Heraeus HPM eCommerce Platform may contain links to the websites of third parties. If you follow such a link and arrive at one of these websites, please note that their own privacy policies apply and you should review them. Heraeus is not responsible for the content or practices of such websites.

3.1 Data Transmission to Companies of the Heraeus Group

As part of a global group, Heraeus also relies on the services of other Heraeus companies. These companies process the data only for the purposes set out in this Privacy Policy.

3.2 Data Transfer to Third Parties

Data will only be passed on to third parties within the framework of legal requirements. Heraeus will only pass on your data to third parties if this is necessary, for example, for billing purposes or for other purposes if these are necessary in order to fulfil contractual obligations towards you or legal obligations.

If Heraeus uses subcontractors to provide services, Heraeus will take appropriate legal precautions and take appropriate technical and organizational measures to ensure the protection of personal data in accordance with applicable laws.

If, within the scope of this Privacy Policy, we use content, tools or resources of other providers (hereinafter collectively referred to as “Third-Party Providers“) whose registered office is in a third country, it must be assumed that data are transferred to such third countries.

Third countries are countries in which the GDPR is not directly applicable, i.e., in principle, countries outside the EU or the European Economic Area. Data may only be transferred to third countries if an adequate level of data protection is ensured, if our Users have given their consent or if the transfer of such data is permitted by law.

4.1 When you contact us (by contact form or e-mail), your data will be stored to process and handle your request.

4.2 User data may be stored in our Customer Relationship Management System ("CRM System") or in similar request management systems and - due to their legal categorization as business letters - are subject to a statutory retention period of 6 years.

Heraeus will not knowingly process personal data of children under the age of 16. Parents and other guardians must ensure that their children do not transmit any personally identifiable information through Heraeus' services or websites without their permission. If personal data has been transmitted by children, please inform Heraeus so that this personal data and, if applicable, an associated account can be deleted.

Right to information: In accordance with Article 15 GDPR, you can request confirmation as to whether data concerning you is being processed. If this is the case, you have a right to receive information regarding the information processed for free.

Right to revoke consent: If the processing of your personal data takes place on the basis of your consent, you have the right to revoke this consent at any time in accordance with Article 7 GDPR.

Right to object: If the processing of your personal data is necessary to safeguard the legitimate interests of our company, you can object to processing at any time in accordance with Article 21 GDPR.

Right to erasure: If you have revoked your consent, objected to the processing of your personal data (and there are no overriding legitimate reasons for processing), your personal data is no longer necessary for the purposes of processing, a legal obligation applies in this respect, or your personal information has been processed unlawfully, you have the right to request the erasure of your personal data in accordance with Article 17 GDPR.

Right of rectification: If your personal data has been processed while incorrect, you have the right to request that the data be corrected immediately according to Article 16 GDPR.

Right to restriction of processing: Under the conditions of Article 18 GDPR, you have the right to demand the restriction of the processing of your personal data.

Right to data portability: Under Article 20 GDPR, you have the right to receive personal data that you have provided in a structured, common and machine-readable format.

Right to file a complaint: According to Article 77 GDPR, you have the right to file a complaint with the supervisory authority responsible.

The data that we store is erased as soon as it is no longer required for the purpose for which is was collected and provided that its erasure does not breach any statutory storage requirements. If the user data is not erased because it is required for other legally permissible purposes, its processing is restricted. This means that the data is blocked and is not processed for other purposes. This applies, for example, to user data which must be retained for reasons relating to commercial or tax law.

8.1 Adjustments to the data protection declaration

Heraeus reserves the right to change the Privacy Policy in order to adapt to changes in the legal situation or to changes in our services and data processing. However, this only applies to policies regarding data processing. If the consent of the user is required or if elements of the Privacy Policy contain components of the contract agreed the user, the changes will only be made with the user's consent.

8.2 Up-to-dateness of the data protection declaration

Heraeus asks you to inform yourself regularly about the current content of the data protection declaration.

If you have any concerns or questions, please feel free to contact the Heraeus data protection officer:

Address:

Data Protection Officer of Heraeus Holding GmbH

Heraeus Street 12-14

63450 Hanau, Germany

E-mail: datenschutzbeauftragter@heraeus.com

The contact details of the individual Heraeus business units can be found here .

^1.legal basis: legitimate interests of Heraeus pursuant to Art. 6 para. 1 letter f) GDPR

^2. legal basis: fulfilment of a contract or implementation of pre-contractual measures pursuant to Art. 6 para. 1 letter b) GDPR

^3. legal basis: legitimate interests of Heraeus pursuant to Art. 6 para. 1 letter f) DSGVO; your consent pursuant to Art. 6 para. 1 letter a) GDPR