II. Use of the knowledge base

1. Data processed and purposes of processing

The NRW knowledge base is a unique state-wide information and presentation database for the business location of North Rhine-Westphalia which you can access via our website and which you can log into. Via this database, North Rhine-Westphalia's partners, such as the state government, state initiatives and municipal and regional economic development agencies, have access to current economic and location data. We ask you to enter the data listed below to create an account:

• Preferred user name (required later for login)
• Password (required later for login)
• Form of address
• First name
• Surname
• Company
• Street or PO box
• Town/city
• Postcode
• Telephone
• E-mail address

2. Information about automated individual decisions

No automated individual decisions are made.

3. Legal bases for using your data

1. We process the above-mentioned data for the activation and use of the NRW knowledge base in the context of a quasi-contractual relationship of trust (Art. 6 (1) (b) GDPR). If you would like to make use of this service, we need the specified data to provide this service.

4. Deletion deadlines (or storage time)

• To conserve evidence, we retain data within the scope of the legal statutes of limitations provisions in accordance with sections 195 et seq. BGB (German Civil Code).
• Your personal data will be deleted within 14 days after the account is closed.

5. Source of the data

There is no third party data collection.

III. Making contact and other services

1. Data processed and purposes of processing

Below, we would like to explain the purposes for which your data are processed if you have a request or use our services.

• Dealing with enquiries, including contact forms: we process the data you give us when you have a question or request. This also includes the data which you have entered on the contact form or sent by e-mail or fax.
• Newsletter: you can subscribe to our newsletter and we need an e-mail address for this.
• Map service: in order to help you find NRW.Global Business more easily and to enable you to plan your journey, we provide you with a map from the Google Maps service. Use of the map means data are collected and processed by Google Inc. You can obtain further information in the Google Maps terms of use. We have no influence on data collection and processing by Google Inc.
• Use of social plugins: our website uses social plugins for the Twitter, Xing and LinkedIn social networks to enable you to use the interactive facilities of the social networks you use on our Internet pages as well. Using a social plugin means the relevant operator is informed that you have accessed the corresponding page on our website. NRW.Global Business does not itself record any personal data via the social plugins or through their use, provided that you do not enable the plugin. In order to prevent data from being communicated to service providers in the USA without the user's knowledge, NRW.Global Business uses something known as the Shariff solution. The solution ensures that no personal data are initially passed on to the providers of the individual social plugins when you visit our website. Data are not passed on until you click on one of the social plugins. For example, if you are logged in to the operator, they can assign the visit to your account. If you interact with the plugins, for example press the "like" button or make a comment, the corresponding information is communicated to the operator directly from your browser and stored there. You can obtain further information in the Twitter, Xing and LinkedIn terms of use.
• Showing videos: we incorporate YouTube videos into our online offering. These are stored on the YouTube servers and can be played directly from our website.

2. Information about automated individual decisions

No automated individual decisions are made.

3. Legal bases for using your data

1. Furthermore, we process your data to safeguard our legitimate interests (Art. 6 (1) (f) GDPR):
2. We process your data as stated under "Dealing with enquiries, including contact forms", "Newsletter", "Map service" and "YouTube videos" in the context of a quasi-contractual relationship of trust (Art. 6 (1) (b) GDPR). If you would like to make use of these services, we need the specified data to provide these services.

• We provide you with social plugins for the Twitter, Xing and LinkedIn social networks in order to make it easier for you to exchange ideas about our content on social media and so as to design our website in an attractive way.

1. We use your e-mail address to send our newsletter with information about our offers and services on the basis of the consent received from you (Art. 6 (1) (a) GDPR).

4. Deletion deadlines (or storage time)

• Your personal data are deleted within 14 days after receipt of your enquiry.
• Your e-mail address is deleted as soon as you unsubscribe from our newsletter or withdraw your consent.
• To conserve evidence, we retain data within the scope of the legal statutes of limitations provisions in accordance with sections 195 et seq. BGB (German Civil Code).

5. Source of the data

There is no third party data collection.

Other processing purposes

In addition, the above-mentioned data are used for the following purposes in the context of a balance of interests (Art. 6 (1) (f) GDPR). The interests are described below

1. Should a security incident occur in our company that affects your data, we are   obliged to report the case to our data protection supervisory authority (Article 33 GDPR). Since our legitimate interest is to comply with this statutory reporting obligation as quickly as possible, it may happen that in the context of the investigation of the corresponding security incident data about you are processed. Reports of these security incidents to data protection supervisory authorities do not contain any of your personal data.
2. As it is in our interest to ensure the security of our systems, we regularly conduct security and efficiency tests that allow us to process your above-mentioned data.
3. Since it is our interest to solve legal disputes, we process your data in that specific case. It is also in our interest, in the event of litigation, to keep evidence until all relevant statutory limitation periods pursuant according to sections 195 and fallowing of the German Civil Code, have expired. For this purpose, we retain the relevant data about you in accordance with these limitation periods. The retention periods cannot be globally predicted, since they depend on the particular matter in dispute and the respective statutory limitation period, which can be up to 30 years. The regular limitation period is three years.
4. In addition, it is in our interest to investigate suspected cases and to hand over relevant information to law enforcement authorities in case of a specific criminal suspicion.
5. We perform (internal) audits and other control activities (e.g. data protection officer’s monitoring activities), because it is our legitimate interest to comply with legal provisions, to obtain transparency about our business processes, to constantly optimise these processes and to prevent and identify harmful acts against our business. In doing so, documents or data sets with your personal data may be processed.
6. We process your data for testing IT systems and software products and for migrations. The processing is necessary for satisfying our legitimate interest in evaluating if new products are correct and if migrations are complete.

Which organisations receive your data?

The following list shows which organisations ("data recipients") receive your data in which cases. In order to see which specific data this involves, you can read through the relevant sections of this policy. Your data are sometimes passed on due to statutory reporting requirements. In other cases, we use selected agents and service providers who operate on our behalf as processors (in accordance with Art. 28 GDPR) and may be given access to your data to the extent required in each case. Processors are subject to numerous contractual obligations and must in particular only process your personal data acting on our instructions and exclusively for the fulfilment of orders received from us.

• Auditors
• Data protection officer
• Service providers for mass file destruction
• Service providers for maps
• Service providers for newsletter distribution
• Service providers for optimisation of our website
• Service providers for mailing and logistics
• Recipient’s e-mail provider (for communication via e-mail)
• IT service providers
• Lawyers, law enforcement agencies, public prosecutor, courts, opposing lawyers, state or federal criminal police (for legal disputes or actual suspicious cases only)
• Social media
• Service providers for telecommunication

Data recipients in non-EU countries

• This website uses a map service by Google Inc. ("Google") to display our company and its international offices on an interactive map. Use of Google Maps may mean that the data specified under "Map service" in the table above is transferred to a Google server in the USA and stored there. The EU Commission specifies which non-EU countries have an appropriate level of data protection.
• Our website uses social plugins ("plugins") for the Twitter social network. Use of the plugin means that Twitter receives the data specified in the above table under "Use of social plugins (after activation)".
• Our website uses social plugins ("plugins") for the LinkedIn social network. Use of the plugin means that LinkedIn receives the data specified in the above table under "Use of social plugins (after activation)".
• We incorporate YouTube videos into our online offering. These are stored on the YouTube servers and can be played directly from our website. The videos are embedded in "enhanced data protection mode", which means that no data about you as a user are communicated to YouTube if you do not play the video. YouTube does not receive the data specified in the above table under "YouTube videos" until you play the videos. This is the case irrespective of whether YouTube provides a user account via which you are logged in or if no user account exists. If you are logged in with Google, your data are assigned directly to your account. If you do not wish them to be assigned to your profile, you have to log out before you play a video. Please consult YouTube's privacy notice for information on the purpose and scope of data collection, further processing and use of the data by YouTube, along with your rights associated with this and the setting options available for protecting your privacy.

The EU Commission specifies which non-EU countries have an appropriate level of data protection. The EU Commission recognises companies in the USA which participate in the EU-US Privacy Shield as data recipients with an appropriate level of data protection. This agreement between the USA and the EU ensures that data protection regulations comply with the level of data protection required in the European Union when data are processed by US companies subject to the EU-US Privacy Shield. According to their own statements, Google LLC, YouTube LLC, Twitter Inc. and LinkedIn Inc. are contracted into the EU-US Privacy Shield.

Information about the appropriate or reasonable guarantees for the level of data protection with Google LLC, Twitter Inc., LinkedIn Inc. and YouTube LLC as data recipients and how to obtain a copy of these guarantees or where they are available, can for instance be requested from:

NRW.Global Business GmbH
Trade & Investment Agency
of the German State of North Rhine-Westphalia (NRW)
The Data Protection Officer
Völklinger Strasse 4
40219 Düsseldorf, Germany

datenschutz@nrwglobalbusiness.com

Our IT service providers have affiliates or subcontractors outside the EU who can access your data. The transfer uses the EU standard contract according to Commission Decision 2010/87/EU, the model of which can be found on the websites of the European Commissioner for Justice and in the Official Journal of the EU.

Your rights | You have the right to:

• Access the personal data stored about you (Art. 15 GDPR)
• Data portability (Art. 20 GDPR)
• Rectification and completion of the data we have about you (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Objection to the processing of your data to safeguard our legitimate interests or the legitimate interests of third parties (Art. 21 GDPR) – You have the right, on the basis of reasons related to your particular situation, to object to processing of this kind at any time; this also applies to profiling based on these provisions within the meaning of Art. 4 (4) GDPR.
• Objection to direct marketing – You have the right to object to the processing of your data for the purpose of direct marketing at any time without giving reasons.
• Withdrawal of consent that has been given (Art. 7 GDPR) with future effect for:
• Newsletters: you can cancel the storage and use of your e-mail address and your name for sending out newsletters at any time with future effect. In order to unsubscribe from our newsletter, you can for example use the unsubscribe link within the newsletter.

To exercise these rights, you can in particular contact us via

NRW.Global Business GmbH
Trade & Investment Agency
of the German State of North Rhine-Westphalia (NRW)
The Data Protection Officer
Völklinger Strasse 4
40219 Düsseldorf, Germany

datenschutz@nrwglobalbusiness.com

If you do not want data about your visit to our website to be recorded for the purpose of optimising our Internet offering, you can check here : "6. Cookies and tracking" in section "I. Your visit to our website"  to see how recording can be disabled.

You also have the right to make a complaint to a data protection supervisory authority.