Data protection

You can generally use our website www.comix.de (hereinafter referred to as "the website") without providing any personal data. However, if a user or an individual wants to avail themselves of services through our website, processing of personal data may become necessary. If the processing of personal data is required and there is no legal basis for such processing, we will obtain consent from the affected person. The processing of personal data (e.g., name, address, email address of an affected person) always takes place in accordance with the General Data Protection Regulation (GDPR) and in compliance with the specific data protection regulations applicable to us.

With this privacy policy, we aim to inform you about the type, scope, and purpose of the personal data we collect, use, and process. As a user or affected individual, this privacy policy also informs you about your rights. As the data controller, we have implemented numerous technical and organizational measures to ensure the most comprehensive protection of personal data processed through our website. However, data transmissions over the internet may still have security vulnerabilities. Therefore, it is not possible to guarantee complete protection. As such, any affected person is also free to provide personal data through alternative means, such as by telephone. The following information also applies to this type of data collection and processing.

I. Name and Address of the Data Controller

The data controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws of the member states, as well as other data protection regulations, is:

COMIX Software GmbH Wagnerstraße 8, 80802 Munich, Germany Phone: +49.8105.7786-0 Email: kontakt@comix.de

Managing Director: Peter Wartelsteiner Commercial Register: Local Court of Munich, HRB 93810

II. Definitions

This privacy policy uses the definitions provided by the European legislator when issuing the GDPR. These can be found in Article 4 of the GDPR.

III. General Information about Data Processing

1. Scope of Personal Data Processing We generally process personal data of our users only to the extent necessary for providing a functional website and our services. The processing of personal data of our users usually occurs with their consent. An exception applies in cases where obtaining prior consent is not possible for factual reasons and the processing of data is permitted by statutory provisions.

2. Legal Basis for Personal Data Processing If we obtain the consent of the data subject for processing personal data, Article 6(1)(a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis.

For processing personal data necessary for the performance of a contract to which the data subject is a party, Article 6(1)(b) GDPR serves as the legal basis. This also applies to processing operations necessary for pre-contractual measures.

If the processing of personal data is necessary to fulfill a legal obligation to which our company is subject, Article 6(1)(c) GDPR serves as the legal basis.

In the event that vital interests of the data subject or another natural person require the processing of personal data, Article 6(1)(d) GDPR serves as the legal basis.

If processing is necessary for the purposes of the legitimate interests pursued by our company or a third party and such interests are not overridden by the interests or fundamental rights and freedoms of the data subject, Article 6(1)(f) GDPR serves as the legal basis for processing.

3. Data Erasure and Storage Duration Personal data of the data subject will be deleted or blocked as soon as the purpose of storage ceases to exist. Storage may continue if provided for by the European or national legislator in EU regulations, laws, or other provisions to which the data controller is subject. Data will also be blocked or deleted when a storage period prescribed by the aforementioned standards expires, unless there is a need for further storage of the data for the conclusion or performance of a contract.

IV. Provision of the Website and Creation of Log Files

1. Description and Scope of Data Processing You can generally use our website without disclosing your identity. However, our system automatically collects data and information from the computer system of the accessing device each time you visit our website. The following data is usually collected without your active involvement:

Information about the browser type and version The user's operating system The internet service provider of the user The IP address of the user Date and time of access Websites from which the user's system accesses our website Websites accessed by the user's system through our website This data is stored in log files by our system. The IP addresses of the user or other data that allows attribution to a user are not affected. This data is not stored together with other personal data of the user.

2. Legal Basis for Data Processing The legal basis for the temporary storage of data and log files is Article 6(1)(f) GDPR.

3. Purpose of Data Processing The temporary storage of the IP address by the system is necessary to deliver the website to the user's device. For this purpose, the IP address of the user must remain stored for the duration of the session.

The storage in log files is done to ensure the functionality of the website. In addition, the data serves to optimize the website and ensure the security of our information technology systems. No evaluation of this data for marketing purposes takes place in this context.

Our legitimate interest in data processing pursuant to Article 6(1)(f) GDPR lies in the stated purposes. Under no circumstances do we use the collected data to draw conclusions about the data subject.

4. Duration of Storage The data will be deleted as soon as it is no longer necessary to achieve the purpose of its collection. In the case of data collected for providing the website, this occurs when the respective session is terminated.

In the case of data stored in log files, this happens after seven days at the latest. Further storage is possible. In this case, the IP addresses of users are deleted or distorted so that assignment to the accessing client is no longer possible.

5. Objection and Removal Options The collection of data for providing the website and the storage of data in log files is mandatory for operating the website. Therefore, there is no possibility for the user to object to this.

V. Newsletter

1. Description and Scope of Data Processing aa) On our website, there is the possibility to subscribe to a free newsletter. When subscribing to the newsletter, the following data from the input mask is transmitted to us:

Title, First name, Last name, Company A valid email address Address Telephone number (landline and/or mobile) Additionally, the following data is collected during the registration:

IP address of the accessing computer Date and time of registration During the registration process, your consent will be obtained for the data processing, and reference will be made to this privacy policy.

bb) If you purchase goods on our website and provide your email address, it may be used by us to send newsletters. In such a case, the newsletter will only contain direct advertising for our own similar goods or services.

cc) The data will not be passed on to third parties in connection with the data processing for the newsletter distribution. This data will be used exclusively for sending the newsletter.

2. Legal Basis for Data Processing aa) The legal basis for data processing after the user subscribes to the newsletter is Art. 6(1)(a) of the GDPR, provided the user has given consent.

bb) The legal basis for sending the newsletter as a result of the sale of goods or services is § 7(3) of the German Unfair Competition Act (UWG).

3. Purpose of Data Processing The collection of the user's email address is for delivering the newsletter. The collection of other personal data during the registration process is to prevent misuse of the services or the email address used.

4. Duration of Storage aa) The data will be deleted as soon as it is no longer necessary for the purpose of its collection. The user's email address will be stored as long as the subscription to the newsletter is active.

bb) If the newsletter is sent based on the user's registration on the website, the other personal data collected during the registration process will generally be deleted after a period of seven days.

5. Right to Object and Removal Option aa) The newsletter subscription can be canceled by the user at any time. For this purpose, there is a corresponding link in each newsletter through which the cancellation or deactivation can be done.

bb) If the newsletter is sent based on the user's registration on the website or the use of a contact form, the revocation of consent for the storage of personal data collected during the registration process is also possible.

VI. Registration

1. Description and Scope of Data Processing On our website, we offer users the possibility to register or sign up as business partners by providing personal data or using passwords. Your data will be entered into an input mask on the website and transmitted to us online and then stored. Data will only be passed on to third parties in exceptional cases (see Sections IX and X).

The following data may be collected in individual cases during the registration or sign-up process:

Title First name, Last name, Company A valid email address Address Telephone number (landline and/or mobile) At the time of registration, the following data is also stored:

User's IP address Date and time of registration During the registration process, the user's consent to the data processing is obtained.

2. Legal Basis for Data Processing aa) The legal basis for data processing is Art. 6(1)(a) of the GDPR, provided the user has given consent.

bb) If the registration is for the fulfillment of a contract in which the user is a party or for the implementation of pre-contractual measures, the additional legal basis for data processing is Art. 6(1)(b) of the GDPR.

3. Purpose of Data Processing for Registration aa) Registration of user data may be required to provide certain content and services on our website, such as identifying the user on subsequent visits to the website and providing personalized offers.

bb) The registration may also be necessary to fulfill a contract with the user or to carry out pre-contractual measures. The collection of this data is particularly for the following purposes:

To identify you as our customer; To process, fulfill, and execute your order; To correspond with you; For billing purposes; For handling any liability claims and asserting any claims against you; To ensure the technical administration of our website; To manage our customer data; For direct advertising purposes.

4. Duration of Storage The data will be deleted as soon as it is no longer necessary for the purpose of its collection.

If the registration does not lead to the conclusion of a contract with the user, this applies to the data collected during the registration process when the registration on our website is canceled or modified.

If the registration serves the conclusion of a contract with the user or is for the execution of pre-contractual measures, this applies to the data collected during the registration process for the execution of a contract or the implementation of pre-contractual measures when the data is no longer required for the performance of the contract. Even after the conclusion of the contract, there may be a need to store the personal data of the contracting party to comply with contractual or legal obligations. Continuing obligations require the storage of personal data for the duration of the contract. For sales contracts, warranty periods must be observed. In addition, data storage also serves tax purposes. The storage periods required for this cannot be determined in a generalized way but must be determined for each contract and contracting party on a case-by-case basis.

5. Right to Object and Removal Option As a user, you have the option to dissolve your registration at any time. You can also have the stored data about you amended at any time. To do so, please follow the instructions on the website during the deletion process.

If the registration serves the conclusion of a contract with the user, and the data is necessary for the fulfillment of a contract or the implementation of pre-contractual measures, the premature deletion of the data is only possible to the extent that there are no contractual or legal obligations opposing the deletion.

VII. Contact Form and Email Contact

1. Description and Scope of Data Processing Our website provides an email address and a contact form, both of which can be used for electronic communication.

If a user takes advantage of this option, the data entered into the input mask of the contact form will be transmitted to us and stored. This data includes:

Title, First Name, Last Name, Company A valid email address Address Phone number (landline and/or mobile) At the time of sending the message, the following data will also be stored:

User's IP address Date and time of registration During the data processing, your consent will be obtained as part of the submission process, and reference will be made to this privacy policy.

If a user contacts us via the provided email address, the personal data transmitted with the email will be stored.

There is no disclosure of this data to third parties. The data is exclusively used for processing the communication.

2. Legal Basis for Data Processing The legal basis for data processing is Art. 6(1)(a) of the GDPR, provided the user has given consent.

The legal basis for processing data transmitted via email is Art. 6(1)(f) of the GDPR. If the email contact aims at concluding a contract, an additional legal basis for the processing is Art. 6(1)(b) of the GDPR.

3. Purpose of Data Processing The processing of personal data from the input mask solely serves the purpose of processing the contact request. In the case of contact via email, there is also a legitimate interest in processing the data for handling the communication. The other personal data processed during the submission process serves to prevent misuse of the contact form and ensure the security of our information technology systems.

4. Duration of Storage The data will be deleted as soon as it is no longer necessary for the purpose of its collection. For the personal data entered into the input mask of the contact form and the data sent via email, this is the case when the respective conversation with the user has ended. The conversation is considered ended when the circumstances indicate that the matter in question has been conclusively resolved.

The additional personal data collected during the submission process will be deleted after a period of seven days.

5. Right to Object and Removal Option The user has the option to revoke their consent to the processing of personal data at any time.

If the user contacts us via email, they may object to the storage of their personal data at any time. In such a case, the conversation cannot be continued.

To exercise the right to object or revoke consent, please follow the instructions on the website.

VIII. Disclosure of Data to Payment Service Providers

We may disclose your personal data to third parties, specifically to the payment service provider engaged for payment processing in the context of contract fulfillment. In such cases, the scope of transmitted data is limited to the necessary minimum. The legal basis for this disclosure is Art. 6(1)(b) of the GDPR.

If you choose to make a payment via PayPal, credit card, debit card, or instant bank transfer (Sofortüberweisung), we will share your payment data with the payment service provider as part of the payment processing.

For payment methods such as credit card via PayPal, direct debit via PayPal, or "purchase on account" via PayPal, PayPal reserves the right to conduct a credit check. The result of the credit check, which concerns the statistical probability of payment default, is used by PayPal to decide on the provision of the respective payment method. The credit check may include probability values (so-called score values). To the extent that score values are used in the credit check, they are based on a scientifically recognized mathematical-statistical method. Among other things, address data is used in the calculation of the score values. For further information regarding data protection, you can refer to PayPal's privacy policy:

https://www.paypal.com/us/webapps/mpp/ua/privacy-full

The transmission of your personal data to a payment service provider for any purpose other than the fulfillment of contractual obligations does not occur.

IX. Disclosure of Personal Data to Third Parties

Except in the cases mentioned above (registration for the members' area, subscription to a newsletter, etc.), we only disclose your personal data to third parties if:

You have given your explicit consent in accordance with Art. 6(1)(a) of the GDPR, It is necessary for the performance of a contract with you in accordance with Art. 6(1)(b) of the GDPR, There is a legal obligation to disclose the data in accordance with Art. 6(1)(c) of the GDPR.

The transmission of personal data to a third country (outside the EU) or an international organization is excluded.

X. Social Plugins

We use social plugins (plugins) from various social networks. These plugins are identifiable by their respective logos.

When you visit a page of our website that contains such social plugins, your browser establishes a direct connection to the servers of the respective operator of the logo (e.g., "facebook.com," "instagram.com," "pinterest.com," "twitter.com"). The content of the plugin is directly transmitted from the service provider to your browser and integrated into the website. Please note that data processing by the operators of the social networks may take place outside the European Union. We also have no control over the scope of data collected by the use of social plugins and inform you accordingly based on our current knowledge: By embedding social plugins, the providers receive the information that you have accessed the corresponding page of our website. If you are logged in to a social network such as Facebook, Instagram, etc., the provider can associate this visit with your user account. If you log out, the association with your user account will be prevented. If you interact with the plugin, e.g., by clicking the Facebook "Like" button or leaving a comment, the corresponding information will be directly transmitted from your browser to the respective service provider and stored there. Even if you are not a member of a social network, it is possible that the provider may obtain and store your IP address. For the purpose and scope of data collection, further processing, and use of the data by the service provider, as well as your rights in this regard, please refer to the privacy policy of the respective operator, e.g.:

https://www.facebook.com/policy.php
https://help.instagram.com/519522125107875
https://twitter.com/en/privacy
https://policy.pinterest.com/en/privacy-policy

XI. Rights of the Data Subject

If your personal data is processed, you are a data subject within the meaning of the GDPR, and you have the rights described below towards the data controller as set forth above and below.

You can exercise your rights as a data subject through the contact information provided in section I.

1. Right to Information You have the right to obtain confirmation from the data controller listed in section I above as to whether or not personal data concerning you is being processed.

If such processing is being carried out, you can request the following information from the data controller:

The purposes for which the personal data is being processed; The categories of personal data that are being processed; The recipients or categories of recipients to whom the personal data concerning you has been or will be disclosed; The planned duration of storage of the personal data concerning you or, if specific information about this is not possible, the criteria used to determine the storage period; The existence of the right to rectification or erasure of personal data concerning you, the right to restrict processing by the data controller, or the right to object to such processing; The right to lodge a complaint with a supervisory authority; All available information on the origin of the data if the personal data concerning you was not collected from you; The existence of automated decision-making, including profiling, according to Article 22(1) and (4) of the GDPR and, at least in these cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for you as the data subject. You have the right to obtain information as to whether the personal data concerning you will be transferred to a third country or an international organization. In this context, you can request to be informed about the appropriate safeguards pursuant to Article 46 of the GDPR in connection with such transfer.

2. Right to Rectification You have the right to obtain from the data controller without undue delay the rectification and/or completion of personal data concerning you if it is inaccurate or incomplete.

3. Right to Restriction of Processing Under the following conditions, you can request the restriction of processing of personal data concerning you:

If you contest the accuracy of the personal data concerning you for a period that enables the data controller to verify the accuracy of the personal data; If the processing is unlawful, and you oppose the erasure of the personal data and instead request the restriction of its use; If the data controller no longer needs the personal data for the purposes of processing, but you require it for the establishment, exercise, or defense of legal claims, or If you have objected to processing pursuant to Article 21(1) of the GDPR, pending the verification whether the legitimate grounds of the data controller override your interests. If the processing of personal data concerning you has been restricted, such data may, with the exception of storage, only be processed with your consent or for the establishment, exercise, or defense of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or of a Member State.

If the restriction of processing has been restricted according to the above conditions, you will be informed by the data controller before the restriction is lifted.

4. Right to Erasure (Right to be Forgotten) a) Obligation to Erase You have the right to demand from the data controller the erasure of personal data concerning you without undue delay, and the data controller is obliged to erase this data without undue delay if one of the following reasons applies:

The personal data concerning you is no longer necessary for the purposes for which it was collected or otherwise processed. You withdraw your consent on which the processing was based according to Article 6(1)(a) or Article 9(2)(a) of the GDPR, and there is no other legal ground for the processing. You object to the processing pursuant to Article 21(1) of the GDPR, and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Article 21(2) of the GDPR. The personal data concerning you has been unlawfully processed. The erasure of the personal data concerning you is necessary for compliance with a legal obligation under Union or Member State law to which the data controller is subject. The personal data concerning you has been collected in relation to the offer of information society services referred to in Article 8(1) of the GDPR. b) Information to Third Parties Where the data controller has made the personal data concerning you public and is obliged pursuant to Article 17(1) of the GDPR to erase it, the data controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that you, as the data subject, have requested the erasure by such controllers of any links to, or copy or replication of, that personal data.

c) Exceptions The right to erasure does not apply to the extent that processing is necessary

for exercising the right of freedom of expression and information; for compliance with a legal obligation that requires processing under Union or Member State law to which the data controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller; for reasons of public interest in the area of public health pursuant to Article 9(2)(h) and (i) and Article 9(3) of the GDPR; for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes pursuant to Article 89(1) of the GDPR, insofar as the right referred to in section a) is likely to render impossible or seriously impair the achievement of the objectives of that processing, or for the establishment, exercise, or defense of legal claims.

5. Right to Information If you have asserted the right to rectification, erasure, or restriction of processing against the data controller, the data controller is obliged to communicate any rectification or erasure of personal data or restriction of processing to each recipient to whom the personal data concerning you have been disclosed, unless this proves impossible or involves disproportionate effort.

You have the right to be informed about those recipients by the data controller.

6. Right to Data Portability You have the right to receive the personal data concerning you, which you have provided to the data controller, in a structured, commonly used, and machine-readable format. You also have the right to transmit this data to another data controller without hindrance from the data controller to which the personal data was provided, where:

The processing is based on consent pursuant to Article 6(1)(a) of the GDPR or Article 9(2)(a) of the GDPR or on a contract pursuant to Article 6(1)(b) of the GDPR, and The processing is carried out by automated means. In exercising this right, you also have the right to have the personal data concerning you transmitted directly from one data controller to another, where technically feasible. This must not adversely affect the freedoms and rights of others.

The right to data portability does not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller.

7. Right to Object You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Article 6(1)(e) or (f) of

1. Description and Scope of Data Processing

Our public web pages do not generate cookies, we do not identify users on the website, and we do not conduct tracking measures. However, our websites use cookies to manage access to the password-protected area. Cookies are text files that are stored in the internet browser or by the internet browser on the user's computer system. When a user visits a website, a cookie may be stored on the user's operating system. This cookie contains a unique character string that allows for the unique identification of the browser when the website is accessed again.

In the case of logging into the password-protected area, only temporarily valid session cookies are used in the browser's main memory, which are lost after closing the browser. These session cookies do not contain an IP address, and therefore, it is not possible to trace or identify visitors through these temporary session cookies.

To register in the password-protected area, we require your name, first name, and email address. The user data is stored on the web server, and access to the data is exclusively encrypted via https. After registration, you will be prompted to confirm the registration via email to the provided email address. After confirmation, you can access further information in the password-protected area, such as price lists.

2. Legal Basis for Data Processing

The legal basis for processing personal data using cookies is Article 6(1)(f) of the GDPR.

3. Purpose of Data Processing

Setting the cookie is necessary to ensure that only authorized individuals have access to the password-protected area without us having knowledge of which specific persons are accessing it. We require your data to verify whether you are entitled to access the protected area, especially as this area is intended for commercial customers, including existing customers and interested parties. Our legitimate interest in processing personal data lies in these purposes, according to Article 6(1)(f) of the GDPR.

4. Storage Duration, Objection, and Removal Options

Cookies are stored on the user's computer and transmitted from there to our site. Therefore, as a user, you have full control over the use of cookies. By changing the settings in your internet browser, you can disable or restrict the transmission of cookies. Already stored cookies can be deleted at any time, and this can also be done automatically. If cookies are disabled for our website, not all functions of the website may be fully usable. In the case of the session cookies used here, deletion occurs when the browser is closed.

The data provided during registration will be deleted after the purpose has been achieved. This is the case when we assume that you no longer wish to access the protected area.

Access to the protected area can be terminated by the user at any time. To do this, please contact us using the contact information provided in the imprint or via email at kontakt@comix.de. This will also allow for the revocation of consent for the storage of personal data collected during the registration process.