Boerse Stuttgart GmbH will not participate in a dispute settlement procedure before a consumer arbitration board in terms of the VSBG and is not obliged to do so.

Boerse Stuttgart Group is the sixth largest exchange group in Europe with strategic pillars in the capital market business as well as in the digital business. Boerse Stuttgart Group includes Baden-Württembergische Wertpapierbörse GmbH, blocknox GmbH, Boerse Stuttgart GmbH, Boerse Stuttgart cats GmbH, Boerse Stuttgart Commodities GmbH, Boerse Stuttgart Digital Exchange GmbH, Boerse Stuttgart Digital Holding GmbH, EUWAX Aktiengesellschaft, Sowa Labs GmbH as well as Vereinigung Baden-Württembergische Wertpapierbörse e.V. The protection of your personal data is an important concern for us. For this reason, our business processes are carried out in accordance with the applicable data protection regulations. In the following, we would like to inform you about how we use the personal data you provide, what information we may collect, how we handle it, and to whom we may make it available. I. RESPONSIBLE BODY IN THE SENSE OF THE BASIC DATA PROTECTION REGULATION Boerse Stuttgart GmbH, Börsenstraße 4, 70174 Stuttgart, Germany Tel.: +49 711 222985 - 0 E-mail: info@boerse-stuttgart.de Website: https://www.boerse-stuttgart-group.com II. CONTACT DATA DATA PROTECTION OFFICER Mr. Simon Böttinger (FCH Consult GmbH, Im Bosseldorn 30, 69126 Heidelberg) By mail: Data Protection Officer, Boerse Stuttgart GmbH, Börsenstraße 4, 70174 Stuttgart, Germany E-mail: dsb@boerse-stuttgart.de III. PURPOSES, LEGAL BASIS OF DATA PROCESSING, DELETION 1. Use of our website You can access our websites without identifying yourself or logging in. We then process log data on a technical level, in the context of which the following information is collected: IP address, date and time, page accessed/name of file accessed, amount of data transferred, HTTP referrer, byte size of server response, browser and version used, operating system and version used, time zone difference from Greenwich Mean Time (GMT), message as to whether access/retrieval was successful. This data is also stored in the log files of our system. This data is not stored together with other personal data of the user. Purpose of data processing The temporary storage of the IP address by the system is necessary to enable delivery of the website to the user's computer. For this purpose, the user's IP address must remain stored for the duration of the session. The storage in log files is done to ensure the functionality of the website. In addition, we use the data to optimize the website and to ensure the security of our information technology systems. An evaluation of the data for marketing purposes does not take place in this context. Legal basis of data processing The legal basis is Art. 6 para. 1 lit. f DSGVO in order to provide you with the website technically. Our legitimate interest is to be able to provide you with an attractive, technically functioning and user-friendly website, as well as to take measures to protect our website against cyber risks. The collection of data for the provision of the website and the storage of the data in log files is absolutely necessary for the operation of the website. Consequently, there is no possibility for the user to object. If the presentation serves the preparation of a contract, the legal basis for the data processing is Art. 6 para. 1 lit. b DSGVO. Duration of data storage The data is deleted when it is no longer required to achieve the purpose. In the case of the collection of data for the provision of the website, this is the case as soon as the respective session has ended. In the case of storage of data in log files, this is the case after seven days at the latest. Storage beyond this period is possible. In this case, the IP addresses of the users are deleted or alienated, so that an assignment of the calling client is no longer possible. A temporary storage of 7 days in log files is done to ensure the functionality of the website. In addition, we use the data to optimize the website and to ensure the security of our information technology systems. Server logs are stored for up to 3 months. Recipient of the data Your data will not be disclosed to third parties. 2. Your contact to us When you contact us, we collect your contact information. Your contact information may include, depending on how you contact us (e.g., by phone or email), your name, mailing address, phone number, email address, and the information you provide to us. We will only use your data to process your request or if we have any queries regarding your request. Legal basis of data processing The legal basis for processing your request is Art. 6 para. 1 lit. f DSGVO (legitimate interest to satisfactorily answer the requests of our customers or interested parties and thus based on your and our common interest or Art. 6 para. 1 lit. b DSGVO (requests in the course of a contractual relationship), or Art. 6 para. 1 lit. a DSGVO (based on your consent, if it is expedient to pass your requests to third parties). Recipient of the data When answering your inquiries, your data will be processed within the Boerse Stuttgart Group. If it is necessary to pass on your inquiry to contractual partners for processing, we will make your inquiry anonymous. If, in individual cases, the forwarding of your personal data appears to be expedient, we will inform you of this in advance and ask for your consent. We will not pass on your data to third parties for these purposes without your consent. Duration of data storage We store your data until the purpose of the contact has been achieved (end of the conversation). The conversation is ended when the circumstances indicate that the matter in question has been conclusively clarified. If your request contains information relevant to the contract, it may be necessary to store this personal data in order to fulfill contractual or legal obligations. 3. Application Personal data in the context of the application process is all data that can be (un)indirectly related to you personally. This includes information such as name, address, e-mail address, but also data about your career, etc. which can be assigned to a specific person with reasonable effort. The filling of positions is carried out in cooperation between employees of the personnel department and the responsible positions as well as the respective specialist department. Due to the group structure of the Boerse Stuttgart Group, your personal data may be passed on to the respective group company if the advertised position for which you have applied is located at another group company. The Boerse Stuttgart Group includes: • Baden-Württembergische Wertpapierbörse GmbH, Börsenstraße 4, 70174 Stuttgart, Germany • blocknox GmbH, Börsenstraße 4, 70174 Stuttgart, Germany • Boerse Stuttgart cats GmbH, Börsenstraße 4, 70174 Stuttgart, Germany • Boerse Stuttgart Securities GmbH, Börsenstraße 4, 70174 Stuttgart, Germany • Boerse Stuttgart Digital Exchange GmbH, Börsenstraße 4, 70174 Stuttgart, Germany • Boerse Stuttgart Digital Ventures GmbH, Börsenstraße 4, 70174 Stuttgart, Germany • EUWAX Aktiengesellschaft, Börsenstrasse 4, 70174 Stuttgart, Germany • Sowa Labs GmbH, Börsenstraße 4, 70174 Stuttgart, Germany • Association Baden-Württembergische Wertpapierbörse e.V., Börsenstraße 4, 70174 Stuttgart, Germany • Boerse Stuttgart Digital Holding GmbH, Börsenstraße 4, 70174 Stuttgart, Germany As part of the application process, we collect, process and store personal data from you. After submitting your application documents, we will check them and you will receive feedback from us. For feedback, we will use the contact data you have provided. This could be, for example, an invitation to a group or telephone interview or the sending of an offer or rejection letter. When you apply to us, we process the following data: • Your contact information such as name, address, email address and phone number. • Other personal data such as academic degree, gender, date of birth, nationality, marital status, current professional situation, salary data, desired salary and when you are available, as well as any attachments such as resume, cover letter, etc. • Information regarding your career and qualifications, as well as other information about yourself that you send us as part of your application. This may possibly include information about your health (e.g. indication of the degree of severe disability) or other special categories of personal data. • Internal assessments such as notes taken during telephone interviews or job interviews. • If you have registered with a public job-related social media profile (e.g. LinkedIn, Xing), the data you provide there may be transferred. The data transmitted as part of your application will be transmitted via TLS encryption and stored in a database. We use the career portal and the applicant management system of Boerse Group Stuttgart to process your data. P&I Personal & Informatik AG, Kreuzberger Ring 56, 65205 Wiesbaden is our order processor in this context in accordance with Art. 28 DSGVO. The privacy policy of P&I Personal & Informatik AG can be found at https://www.pi-ag.com/datenschutz/. Legal basis of data processing § 26 BDSG, for the decision on the establishment of an employment relationship. As special categories of personal data pursuant to Art. 9 (1) DSGVO, the indication of severe disability may be processed in the context of personnel selection. This is done on the basis of Art. 9 (2) lit b DSGVO. Art. 6 para. 1 lit a DSGVO, if you give us your consent, if applicable. Recipient of the data Your data will only be passed on to third parties if our company is legally obliged to do so or if this is necessary in the event of misuse or for clarification purposes. However, this requires concrete indications of illegal or abusive behavior. By order of a competent authority, we may provide information about this data (inventory data) in individual cases, in particular for the purposes of criminal prosecution. Duration of data storage Your documents will be automatically deleted 6 months after a rejection has been sent. If you have applied for several positions, your documents will be automatically deleted 6 months after the rejection for the last open application has been sent. In the event that you are hired, we will store, in addition to your application documents, the data required for the performance of the employment relationship until it is terminated. Invoices for any travel expense reimbursements as part of the application process will be archived in accordance with the requirements of tax law and deleted once the legal requirements have expired. After expiry of the period of storage of your data in the application process specified in this data protection declaration, all of your personal data will be automatically anonymized by our system. The anonymization no longer allows any conclusions to be drawn about your person. The meta data generated by the anonymization can be used by us for statistical evaluation (e.g. number of applications per period, etc.). 4. Use of Google Analytics 4 We use Google Analytics for the purpose of demand-oriented design and continuous optimization of our websites and for measuring the reach and user flows. Google Analytics is provided to us by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, (parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). We have concluded an order processing agreement with Google for the use of Google Analytics. Through this contract, Google assures that they process the data in accordance with the General Data Protection Regulation and ensure the protection of the rights of the data subject. In addition, we will only transfer your data if you expressly consent to the processing by Google. Web analytics records, among other things, data on which website a visitor came to a website from (so-called referrers), which subpages of the website were accessed or how often and for how long a subpage of the website was accessed or how often and for how long a subpage was viewed. In addition to web analysis, we may also use test procedures, for example, to test and optimize different versions of our online offering or its components. During your website visit, the following data is recorded, among others: Pages viewed, your behavior on the pages (for example, dwell time, clicks, scrolling behavior), your approximate location (country and city), your IP address with IP anonymization activated (in shortened form, so that no clear assignment is possible), technical information such as browser, Internet provider, terminal device and screen resolution, source of origin of your visit (i.e. via which website or via which advertising medium you came to us). No personal data such as name, address or contact details are ever transferred to Google Analytics. The information generated by the cookies set by Google Analytics about the use of our website is transmitted to Google servers in the USA and processed there. The transmitted data are only pseudonyms, a conclusion to your name is not possible. Google Analytics 4 also enables the creation of statistics with statements about the age, gender and interests of website users on the basis of an evaluation of interest-based advertising and with the involvement of third-party information via a special function known as "demographic characteristics". This makes it possible to determine and distinguish user groups of the website for the purpose of targeting marketing measures. However, data collected via the "demographic characteristics" cannot be assigned to a specific person and thus not to you personally. This data collected via the "demographic characteristics" function is retained for two months and then deleted. In connection with this website, the Google Signals service is also used as an extension of Google Analytics 4. With Google Signals, we can have Google create cross-device reports (so-called "cross-device tracking"). If you have activated "personalized ads" in your Google account settings and linked your Internet-enabled end devices to your Google account, Google can analyze usage behavior across devices and create database models based on this if you have given your consent to the use of Google Analytics 4 in accordance with Art. 6 (1) a DSGVO. The logins and device types of all website users who were logged into a Google account and executed a conversion are taken into account. The data shows, among other things, on which device you clicked on an ad for the first time and on which device the relevant conversion took place. We do not receive any personal data from Google in this regard, but only statistics compiled on the basis of Google Signals. You have the option of deactivating the "personalized ads" function in the settings of your Google account and thus turning off the cross-device analysis in connection with Google Signals. To do this, follow the instructions on this page: https://support.google.com/ads/answer/2662922?hl=de You can revoke your consent at any time for the future via our consent management tool. If you do not agree to the collection of data, you can also prevent it by installing the browser add-on to deactivate Google Analytics (https://tools.google.com/dlpage/gaoptout?hl=de) or by rejecting cookies via our cookie settings dialog. Legal basis of data processing The legal basis is your consent in accordance with Art. 6 para. 1 lit. a DSGVO. Google processes the information on our behalf in order to evaluate the use of the website, to compile reports on website activities and to provide us with further services related to website and internet use for the purposes of market research and demand-oriented design of these websites. Recipient of the data Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, (parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). Duration of data storage The data collected in the context of the use of Google Analytics 4 will be kept for 2 months and then deleted. 5. Youtube video integration Content from YouTube is embedded on this website. YouTube is operated by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google"). This is used to create posts, to advertise upcoming events and for other information purposes about and around Boerse Group Stuttgart. For videos from YouTube that are embedded on our website, the extended privacy setting is activated. This means that no information from website visitors is collected and stored by YouTube unless they play the video. Please note that when you start playback, your personal data (e.g. IP address) may also be accessible in non-EU/non-EEA countries ("third countries") where the level of data protection is lower than in Germany. In addition, after starting a video, YouTube may use cookies or other technologies to analyze usage behavior. The start of a YouTube video may trigger further data processing operations over which we have no control. The purpose and scope of data processing by YouTube, as well as the related rights and settings options for protecting the privacy of users, can be found at the end of this section (integration of YouTube videos). In order to prevent the setting of tracking cookies when playing the video, you can also prevent the storage of cookies by setting your browser software accordingly; however, we would like to point out that in this case you may not be able to use all functions of this website to their full extent. For more information on the purpose and scope of data collection and processing by YouTube, please refer to the provider's privacy policy. There you will also find further information about your rights in this regard and setting options for protecting your privacy. Address of YouTube: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Privacy policy of Google: https://policies.google.com/privacy?hl=de&gl=de Terms of use of YouTube: https://www.youtube.com/t/terms Google's cookie policy: https://policies.google.com/technologies/ads?hl=de YouTube Data Use Policy for your use of YouTube partner websites or apps: https://policies.google.com/technologies/partner-sites?hl=de . In addition, we use the service "YouTube API Services". We would like to point out that by using this service, you expressly agree to its terms of use. The data subject has the option of linking his YouTube channel to our website using a so-called OAuth2 procedure. The link allows us to query and process data from the YouTube Data API and the YouTube Analytics API within the scope of the Google Developer Policies using our API key provided by YouTube. These data include: • the name of the channel, the channel description, the profile picture, as well as the other publicly viewable channel information • The total number of videos on the channel, as well as their upload and publishing status. • the thumbnails, number of views, likes, dislikes, comments of individual videos • the demographic and geographic audience distribution of individual videos • the devices used to watch individual videos • the search terms and traffic sources through which individual videos were accessed, as well as the viewer engagement and playback time of subscribers and non-subscribers associated with those videos. Use of this link constitutes acceptance of the YouTube Terms of Use and Google Privacy Policy. Use of the YouTube Data API and YouTube Analytics API is subject to the YouTube API Terms of Use. You can find the relevant terms of use here: https://www.youtube.com/t/terms Legal basis of data processing Based on your consent to play YouTube videos on our website, the processing is based on Art. 6 (1) a DSGVO as well as Art. 6 (1) f DSGVO. Our legitimate interest is to provide you with video content about our group and to communicate with you. Recipient of the data YouTube is operated by Google Inc, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google"). Duration of data storage Activities older than 36 months are automatically deleted. 6. LinkedIn The LinkedIn pages of the Boerse Group Stuttgart are operated by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland and are part of the online platform operated by LinkedIn at https://www.linkedin.com/. Our LinkedIn company profile is used to create posts, promote upcoming events, advertise job opportunities, and for other informational purposes about and around Boerse Group Stuttgart. The Boerse Group Stuttgart is aware that LinkedIn processes user data for the purposes of services, communication, advertising, marketing, further development of services and research, customer support, analysis and security. The categories of personal data that LinkedIn processes in this regard are described in LinkedIn's data policy at https://www.linkedin.com/legal/privacy-policy. In the case of direct messages or comments on the site or under posts, we receive the message, the comments and the user name of the author. In addition, we receive anonymous statistics from LinkedIn about visitors to our own LinkedIn pages. Via the analysis function of the company pages, statistical data of different categories are retrievable for us. These statistics are not personal, as they do not allow any conclusions to be drawn about individual users. They are generated and provided by LinkedIn. As the operator of the pages, we have no influence on the generation and display. We cannot disable this function or prevent the generation and processing of the data. As part of the shared responsibility for providing and processing Page Insights, LinkedIn assumes responsibility to comply with and fulfill all applicable obligations under the GDPR - in particular Art. 12 - 22 and Art. 32 - 34). You can assert your data subject rights against us and LinkedIn. Legal basis of data processing The legal basis is our legitimate interest according to Art. 6 para. 1 lit. f DSGVO. Our legitimate interest here is the use of a timely and supportive information and interaction opportunity for and with the users and visitors of our LinkedIn pages. With the LinkedIn terms of use, users have agreed that we can identify them as a subscriber or fan of the page and view their profile and other shared information. Recipient of the data To the extent that LinkedIn processes personal data as part of its LinkedIn platform (including our LinkedIn pages), the categories of recipients (including recipients outside the EU) are described in LinkedIn's data policy at https://www.linkedin.com/legal/privacy-policy. LinkedIn processes data both inside and outside the U.S. and uses standard contractual clauses approved by the European Commission as the legal instrument for data transfers out of the European Union. We have no influence on these processing operations. We ourselves do not share any personal data that we receive via our LinkedIn profile. Duration of data storage All of your data collected by us on LinkedIn is stored and deleted on their servers in accordance with Instagram's privacy policy. We do not store any further data internally. 7. X (formerly Twitter) We use the technical platform and services of Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103 U.S.A. for the short message service X (formerly Twitter) offered. Our X company profile is used to create posts, to advertise upcoming events, to advertise job vacancies and for other information purposes about and around Boerse Group Stuttgart. The data controller for individuals living outside the United States is Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2 D02 AX07, Ireland. We would like to point out that you use the short message service offered here and its functions on your own responsibility. This applies in particular to the use of the interactive functions (for example, sharing or rating). In your own interest, please therefore check carefully what information you wish to disclose and share with other users. Information about which data is processed by Twitter, and for what purposes it is used and how long it is stored, can be found in Twitter's privacy policy: https://twitter.com/de/privacy. Through our account, we can view certain non-personal information about tweet activity, such as the number of profile or link clicks through a particular tweet, and statistically analyze these responses. The statistics only contain aggregated data that cannot be related to individual persons. You are not identifiable to us through this. We process personal data from you to the extent that we process the data entered by you on Twitter, in particular your user name and the content published under your account, re-tweet your tweets if necessary, reply to them if applicable or also write tweets from us that refer to your account. The data freely published and disseminated by you on Twitter will thus be included by us in our offer and made available to our followers. The information collected by the cookies of this provider is usually sent to a server in the USA and stored there. In the event that the data is transferred to the USA, the data transfer is based on the existence of standard contractual clauses. We have no influence on the type and scope of the data processed by Twitter, the type of processing and use or the transfer of this data to third parties. We also have no effective control options in this respect. With the use of Twitter, your personal data is collected, transferred, stored, disclosed and used by Twitter Inc. and thereby transferred to the United States, Ireland and any other country in which Twitter Inc. does business, and stored and used there, regardless of your place of residence. Twitter processes on the one hand your voluntarily entered data such as name and user name, email address, telephone number or the contacts of your address book when you upload or synchronize it. Twitter buttons or widgets embedded in websites and the use of cookies enable Twitter to record your visits to these websites and assign them to your Twitter profile. Based on this data, content or advertising can be offered tailored to you. Twitter also evaluates the content you share to determine what topics you are interested in, stores and processes confidential messages that you send directly to other users, and can determine your location using GPS data, wireless network information or your IP address in order to send you advertising or other content. For evaluation, Twitter Inc. may use analysis tools such as Twitter or Google Analytics. We have no influence on the use of such tools by Twitter Inc. and are not informed about such potential use. Twitter continues to receive information when you view content, for example, even if you have not created an account. This so-called "log data" can be the IP address, the browser type, the operating system, information about the website you visited previously and the pages you viewed, your location, your mobile provider, the terminal device you use (including device ID and application ID) or the search terms you used and cookie information. Options to limit the processing of your data are available within the settings of your Twitter account. In addition, you can restrict Twitter's access to contact and calendar data, photos, location data, etc. on mobile devices (smartphones, tablet computers) in the settings options there. You can find out about the possibility of viewing and protecting your own data on Twitter here: https://help.twitter.com/de/forms/fragments/privacy-helpful-articles. You also have the option of requesting information via the Twitter data protection form: https://help.twitter.com/de/forms/privacy. Legal basis of data processing If you use our X-profile to contact us (for example, by creating your own posts, responding to one of our posts or by sending us private messages), the data you provide us with will be processed by us solely for the purpose of being able to contact you and to process any request you may have. The legal basis is Art. 6 para. 1 lit. f DSGVO, our legitimate interest is to answer inquiries satisfactorily, Art. 6 para. 1 lit. a DSGVO your consent. Recipient of the data (X) Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland Duration of data storage All your data collected by us on X (Twitter) will be stored and deleted on their servers in accordance with the data protection provisions of X (Twitter). We do not store any further data internally. 8. Facebook We use the technical platform and services of Meta Platforms Ireland Ltd. (formerly Facebook Ireland Limited), 4 Grand Canal Square, Dublin 2, Ireland, for the information service offered. Our Facebook company profile is used to create posts, to advertise upcoming events, to advertise job vacancies and for other information purposes about and around Boerse Group Stuttgart. In connection with the operation of our Facebook page, we use the Page Insights function of Facebook to obtain statistical evaluations of the users of our Facebook page. The statistics only contain aggregated data that cannot be related to individual persons. You are not identifiable to us through this. We would like to point out that you use the Facebook page and its functions on your own responsibility. This applies in particular to the interactive functions (for example, commenting, sharing, rating). In your own interest, please therefore check carefully what information you wish to disclose and share with other users. When using Facebook, personal data and content is collected and processed, such as information and content you provide yourself, information about the end devices you use (such as your IP address or cookies for data collection, i.e. small files that are stored on your end devices) or information from partners who, for example, use Facebook's Like button on their page and thus provide Facebook with information about your activities. Facebook describes what information it receives and how it is used in its privacy policy: https://www.facebook.com/about/privacy. There you will also find information on how to contact Facebook, how to object and how to adjust the settings for advertisements. The information may be used by Facebook to provide us, as operators of the Facebook pages, with statistical information such as gender and age distribution about the use of the Facebook page. In addition, Facebook may show you further information or advertisements according to your preferences. Facebook provides more detailed information on this at the following link: https://www.facebook.com/help/pages/insights. The data collected about you in this context is processed by Meta Platforms Ireland Ltd. and may be transferred to countries outside the European Union. Facebook is the joint controller, together with us, of the joint processing of the data. As part of the joint responsibility for providing and processing Page Insights, Facebook assumes compliance with the obligations under the GDPR for the processing of Insights data (including, but not limited to, Articles 12 and 13 GDPR, Articles 15 to 21 GDPR, Articles 32, 33 and 34 GDPR). You can assert your data subject rights against us and Facebook. The information required under Section 13 (1) a) and b) DSGVO in Facebook's privacy policy can be found here: https://www.facebook.com/about/privacy/. If you are currently logged in to Facebook, there is a cookie with your Facebook ID on your end device. This enables Facebook to track that you have visited this page and how you have used it. This also applies to all other Facebook pages. Via Facebook buttons embedded in websites, it is possible for Facebook to record your visits to these websites and assign them to your Facebook profile. Based on this data, content or advertising can be offered tailored to you. If you want to avoid this, you should log out of Facebook or deactivate the "stay logged in" function, delete the cookies present on your device and close and restart your browser. In this way, Facebook information through which you can be directly identified will be deleted. This will allow you to use our Facebook page without revealing your Facebook identifier. When you access interactive features of the page (like, comment, share, message, etc.), a Facebook login screen will appear. After any login, you will be recognizable to Facebook again. For information on how to manage or delete information about you, please visit the following Facebook pages: https://www.facebook.com/about/privacy. Legal basis of data processing If you use our Facebook profile to contact us (for example, by creating your own posts, responding to one of our posts or by sending us private messages), the data you provide us with will be processed by us solely for the purpose of contacting you and processing any request you may have. The legal basis is Art. 6 para. 1 lit. f DSGVO, our legitimate interest is to answer inquiries satisfactorily, Art. 6 para. 1 lit. a DSGVO your consent. Recipient of the data Meta Platforms Ireland Ltd, 4 Grand Canal Square, Dublin 2, Ireland. Information controlled by Meta Platforms Ireland Limited is transferred to the United States and other third countries to provide the services set forth in the Meta Terms of Use and Facebook Terms of Use. The transfer is based on standard contractual clauses approved by the European Commission. We have no control over these processing operations. We do not ourselves pass on any personal data that we receive via our Facebook page. Duration of data storage When you access a Facebook page, the IP address assigned to your end device is transmitted to Facebook. According to Facebook, this IP address is anonymized (for "German" IP addresses) and deleted after 90 days. All of your data collected by us on Facebook is stored and deleted on their servers in accordance with Facebook's privacy policy. Further internal company storage by us does not take place. 9. Instagram We use the technical platform and services of Meta Platforms Ireland Ltd, 4 Grand Canal Square, Dublin 2, Ireland, for the information service offered. Our Instagram company profile is used to create posts, promote upcoming events, advertise job openings, and for other information purposes about and around Boerse Group Stuttgart. In connection with the operation of our Instagram profile, we use the Instagram Insights function to obtain statistical analyses of the users of our posts. The statistics only contain aggregated data that cannot be related to individual persons. You are not identifiable to us through this. We would like to point out that you use this Instagram page and its functions on your own responsibility. This applies in particular to the use of the interactive functions (for example, commenting or rating). Therefore, in your own interest, please check carefully what information you wish to disclose and share with other users. When you visit our Instagram page, Instagram collects, among other things, your IP address and other information that is present on your terminal device in the form of cookies. This information is used to provide us, as the operator of the Instagram pages, with statistical information about the use of the Instagram page. The data collected about you in this context is processed by Instagram and, if necessary, transferred to countries outside the European Union. What information Instagram receives and how it is used is described in general terms by Instagram in its privacy policy. There you will also find information on how to contact Instagram as well as on the settings options for advertisements. The privacy policy is available at the following link: https://privacycenter.instagram.com In what way Instagram uses the data from the visit of Instagram pages for its own purposes, to what extent activities on the Instagram page are assigned to individual users, how long Instagram stores this data and whether data from a visit to the Instagram page is passed on to third parties, is not conclusively and clearly stated by Instagram and is not known to us. If you are currently logged in to Instagram, there is a cookie with your Instagram ID on your end device. This enables Instagram to track that you have visited this page and how you have used it. This also applies to all other Instagram pages. Via Instagram buttons embedded in websites, it is possible for Instagram to record your visits to these websites and assign them to your Instagram profile. Based on this data, content or advertising can be offered tailored to you. If you want to avoid this, you should log out of Instagram or deactivate the "stay logged in" function, delete the cookies on your device and exit and restart your browser. In this way, Instagram information through which you can be directly identified will be deleted. This will allow you to use our Instagram page without revealing your Instagram identifier. When you access interactive features of the site (like, comment, message, and more), an Instagram login screen will appear. After any login, you will again be recognizable to Instagram as a specific user. Information on how to manage or delete information about you can be found in the Instagram help area. As the provider of the information service, we do not collect or process any other data from your use of our service. Legal basis of data processing If you use our Instagram profile to contact us (for example, by creating your own posts, responding to one of our posts or by sending us private messages), the data you provide us with will be processed by us solely for the purpose of contacting you and processing any request you may have. The legal basis is Art. 6 para. 1 lit. f DSGVO, our legitimate interest is to answer inquiries satisfactorily, Art. 6 para. 1 lit. a DSGVO your consent. Recipient of the data Meta Platforms Ireland Ltd, 4 Grand Canal Square, Dublin 2, Ireland. Information controlled by Meta Platforms Ireland Limited is transferred to the U.S. and other third countries to provide the services set forth in the Meta Terms of Use and Instagram Terms of Use. The transfer is based on standard contractual clauses approved by the European Commission. We have no control over these processing operations. We do not ourselves share any personal data that we receive through our Instagram page. Duration of data storage When you access an Instagram page, the IP address assigned to your end device is transmitted to Instagram. According to Instagram, this IP address is anonymized (for "German" IP addresses) and deleted after 90 days. All of your data collected by us on Instagram is stored and deleted on their servers in accordance with Instagram's privacy policy. Further internal storage by us does not take place. 10. XING We use the technical platform and services of New Work SE, Dammtorstraße 30, 20354 Hamburg, Germany (hereinafter: XING) for the information service offered. Our XING company profile is used to create posts, to advertise upcoming events, to advertise job vacancies and for other information purposes about and around the Boerse Group Stuttgart. In connection with the operation of our XING profile, we use statistical analyses of access to our company profile and job advertisements placed by us. This data is available in aggregated and anonymized form and does not allow us to draw any conclusions about individual visitors to the company profile. We would like to point out that you use this XING site and its functions on your own responsibility. This applies in particular to the use of interactive functions such as sharing. Therefore, in your own interest, please check carefully what information you wish to disclose and share with other users. If users are logged in to XING at the same time when they call up the company page, information about calling up the service can be assigned to the respective user account. In this use, personal data and information are visible and, if necessary, a direct personal assignment can be made. We have no influence on the interactive functionalities and the visibility of the user activities. The provision of information can be avoided by logging out of XING before accessing the company page. Please note that when using and calling up our company profile, processing is also carried out by XING. This data processing is carried out solely in accordance with NEW WORK SE, whose privacy policy can be found here: https://privacy.xing.com/de/datenschutzerklaerung. In this respect, we have no influence on the data collected and data processing operations, nor are we aware of the full extent of the data collection, the purposes of the processing, the storage periods. We also have no information on the deletion of the collected data. Legal basis of data processing We use statistical evaluations to make our company profile continuously attractive for our visitors and to align it with user interests. The legal basis is our legitimate interest according to Art. 6 para. 1 lit. f) DSGVO. If you use our XING profile to contact us (for example, by creating your own posts, responding to one of our posts, or by sending us private messages), the data you provide us with will be processed by us solely for the purpose of contacting you and processing any request you may have. The legal basis is Art. 6 para. 1 lit. f DSGVO, our legitimate interest is to answer requests satisfactorily. Recipient of the data (XING) New Work SE, Dammtorstraße 30, 20354 Hamburg, Germany. Duration of data storage All of your data collected by us on XING is stored on the XING servers and deleted in accordance with XING's data protection provisions. We do not store any further data internally. IV. YOUR RIGHTS AS A PERSON CONCERNED You are entitled to the following rights as a data subject under the legal conditions, which you can assert against us. As a data subject, you have the right to obtain information about the personal data concerning you in accordance with Art. 15 of the GDPR. You can have your data corrected in accordance with Art. 16 DSGVO or deleted if the requirements of Art. 17 DSGVO are met. You also have the right to restrict the processing of your data (Art.18 DSGVO). If you can claim a special personal situation, you can object to the processing of your data in general or in partial areas (Art.21 DSGVO). For data that you have provided to us, you may request the return of a copy in a common format (Art.20 DSGVO). Consents that you have given us for the processing of your data can be revoked at any time. To do so, please contact dsb@boerse-stuttgart.de. Further contact options are listed above under "Contact details data protection officer". Please note that the revocation will only take effect for the future and that processing that has taken place previously will not become unlawful as a result. You are also entitled to lodge a complaint with a supervisory authority, in particular in the Member State of your residence, workplace or the place of the alleged infringement, under the conditions of Article 77 of the GDPR, if you believe that the processing of personal data concerning you violates the GDPR. The right of appeal is without prejudice to any other administrative or judicial remedy. Right of objection You have the right to object at any time to the processing of your data that is carried out on the basis of Art. 6 (1) f DSGVO (balance of interests), if there are grounds for doing so that arise from your particular situation. If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims. We will observe this objection for the future. We will no longer process your data for direct marketing purposes if you object to processing for these purposes. The objection can be made form-free and should preferably be addressed to (alternatively to the above postal contact details of our data protection officer): Email: dsb@boerse-stuttgart.de. V. AUTOMATED DECISION MAKING / PROFILING We do not use automated decision making or profiling (an automated analysis of your personal circumstances). VI. CATEGORIES OF RECIPIENTS We refrain from any commercial disclosure of your data (sale, rental) to third parties. Only authorized employees have access to your personal data. These may also be authorized employees of our service providers who process the data on our behalf or have access to this data. We limit the transfer of your personal data to what is necessary and authorized employees of our service providers are strictly bound by our instructions when handling your personal data. Possible categories of recipients of your personal data may include: external service providers for programming and hosting the website; external service providers for the handling of events; telecommunication providers; insurance companies; insurers in the event of claims asserted against us; payment service providers and banks in the processing of payments; IT service providers / cloud providers; social media providers; legal advisors in the assertion of or defense against claims; management consultants / auditors / tax consultants; authorities / government agencies. VII. DATA TRANSFER TO A THIRD COUNTRY As a rule, our external service providers process your personal data within the European Union (EU) or the contracting states of the Agreement on the European Economic Area (EEA). However, in the context of the use of various tools, personal data is transferred to the USA. However, in the event that your personal data is transferred to a service provider located in a third country and processed there, we ensure the protection of your personal data by means of suitable guarantees, such as the conclusion of standard data protection clauses, or you have consented to the transfer of data. VIII. COOKIES We use so-called cookies on our websites to make our website technically available and to statistically record and evaluate the use of our website for the purpose of optimization. Legal basis of data processing The legal basis is Art. 6 para. 1 lit. f DSGVO. Our legitimate interest is the provision of essential basic functionalities, such as navigation on the website and the correct display in your internet browser. Without these cookies, our website cannot function and we assume that it is in your interest that our website is usable for you and that you consider certain services as provided on our website. In addition, we set cookies and process the data through the cookies used only on the basis of your consent pursuant to Art. 6 (1) lit. a DSGVO. You can revoke your consent at any time with effect for the future via our Consent Management Tool. You can access the consent management tool at any time via the link at the end of the website. IX. LEFT Links to content on third-party websites are subject to their own privacy policies. We are not responsible for their operation, including their data handling practices. If you send information to or through such third-party sites, you should review the privacy statements of those sites before sending them any information that can be identified to you. X. SECURITY We use technical and organizational security measures to protect the data we have under our control against manipulation, loss, destruction and against access by unauthorized persons. Our security measures are continuously improved in line with technological developments. These are adapted to the current state of the art in each case. To secure the personal data you provide on the website, we use the Secure Sockets Layer (SSL) standard, which encrypts the information you enter.