§ 1 Information on the collection of personal data

(1) In the following, we provide information about the collection of personal data when using our website. Personal data is all data that can be related to you personally, e.g. name, address, e-mail addresses, user behaviour.

(2) The controller pursuant to Art. 4 (7) of the EU General Data Protection Regulation (GDPR) is W. & L. Jordan GmbH, Horst-Dieter-Jordan-Straße 7-10, 34134 Kassel, Tel.: +49 / (0) 5 61 / 9 41 77-0, Fax: +49 / (0) 5 61 / 9 41 77-111, Web: www.joka.de, Mail: info@joka.de. You can reach our data protection officer at datenschutz@joka.de or at our postal address with the addition "the data protection officer".

Data Protection Officer:

Gesellschaft für Personaldienstleistungen mbH
- Mr Nils Gustke
Pestalozzistraße 27
34119 Kassel
Phone: 0561 78968-93

(3) When you contact us by e-mail or via a contact form, the data you provide (your e-mail address or your full name) will be stored by us in order to answer your questions. We delete the data arising in this context after storage is no longer required, or restrict processing if there are statutory retention obligations.

(4) If we use contracted service providers for individual functions of our offer or would like to use your data for advertising purposes, we will inform you in detail below about the respective processes. We will also state the specified criteria for the storage period.

§ 2 Your rights

(1) You have the following rights vis-à-vis us with regard to your personal data:

• Right of access,
• Right to rectification or erasure,
• Right to restriction of processing,
• Right to object to processing,
• right to data portability.

(2) You also have the right to complain to a data protection supervisory authority about the processing of your personal data by us. To be addressed to: The Hessian Commissioner for Data Protection and Freedom of Information, P.O. Box 3163, 65021 Wiesbaden, poststelle@datenschutz.hessen.de

§ Section 3 Collection of personal data when visiting our website

(1) When using the website for information purposes only, i.e. if you do not register or otherwise provide us with information, we only collect the personal data that your browser transmits to our server. If you wish to view our website, we collect the following data, which is technically necessary for us to display our website to you and to ensure stability and security (legal basis is Art. 6 para. 1 sentence 1 lit. f GDPR):

• IP address
• Date and time of the enquiry
• Time zone difference to Greenwich Mean Time (GMT)
• Content of the request (specific page)
• Access status / HTTP status code
• Amount of data transferred in each case
• Website from which the request originates
• browser
• Operating system and its interface
• Language and version of the browser software.

(2) In addition to the aforementioned data, cookies are stored on your computer when you use our website. Cookies are small text files that are stored on your hard drive assigned to the browser you are using and through which certain information flows to the body that sets the cookie (in this case us). Cookies cannot execute programmes or transfer viruses to your computer. They are used to make the website more user-friendly and effective overall.

(3) Use of cookies:

a) This website uses the following types of cookies, the scope and function of which are explained below:

• Transient cookies (see b)
• Persistent cookies (see c).

b) Transient cookies are automatically deleted when you close the browser. These include session cookies in particular. These store a so-called session ID, with which various requests from your browser can be assigned to the joint session. This allows your computer to be recognised when you return to our website. The session cookies are deleted when you log out or close the browser.

c) Persistent cookies are automatically deleted after a specified period, which may vary depending on the cookie. You can delete cookies at any time in the security settings of your browser.

d) You can configure your browser settings according to your wishes and, for example, refuse to accept third-party cookies or all cookies. We would like to point out that you may not be able to use all the functions of this website as a result.

e) We use cookies to identify you for subsequent visits if you have an account with us. Otherwise you would have to log in again for each visit.

f) The Flash cookies used are not recorded by your browser, but by your Flash plug-in. We also use HTML5 storage objects, which are stored on your end device. These objects store the required data independently of the browser you use and do not have an automatic expiry date. If you do not want Flash cookies to be processed, you must install an appropriate add-on, e.g. "Better Privacy" for Mozilla Firefox(https://addons.mozilla.org/de/firefox/addon/betterprivacy/) or the Adobe Flash Killer cookie for Google Chrome. You can prevent the use of HTML5 storage objects by setting your browser to private mode. We also recommend that you regularly delete your cookies and browser history manually.

§ 4 Newsletter

(1) With your consent, you can subscribe to our newsletter, with which we inform you about our current interesting offers. The advertised goods and services are named in the declaration of consent.

(2) We use the so-called double opt-in procedure to subscribe to our newsletter. This means that after you have registered, we will send you an e-mail to the e-mail address you have provided in which we ask you to confirm that you wish to receive the newsletter. If you do not confirm your registration within 48 hours, your information will be blocked and automatically deleted after one month. In addition, we store the IP addresses you use and the times of registration and confirmation. The purpose of this procedure is to be able to prove your registration and, if necessary, to clarify any possible misuse of your personal data.

(3) The only mandatory information for sending the newsletter is your e-mail address. The provision of further, separately marked data is voluntary and is used to be able to address you personally. After your confirmation, we will save your e-mail address for the purpose of sending you the newsletter. The legal basis is Art. 6 para. 1 sentence 1 lit. a GDPR.

(4) You can revoke your consent to receive the newsletter at any time and unsubscribe from the newsletter. You can declare your cancellation by clicking on the link provided in every newsletter e-mail, by e-mail to datenschutz@joka.de or by sending a message to the contact details given in the imprint.

(5) We would like to point out that we evaluate your user behaviour when sending the newsletter. For this analysis, the emails sent contain so-called web beacons or tracking pixels, which are one-pixel image files stored on our website. For the analyses, we link the data mentioned in § 3 and the web beacons with your email address and an individual ID. Links received in the newsletter also contain this ID.

(6) We use the data obtained in this way to create a user profile in order to tailor the newsletter to your individual interests. In doing so, we record when you read our newsletters, which links you click on in them and deduce your personal interests from this. We link this data to the actions you take on our website. You can object to this tracking at any time by clicking on the separate link provided in each e-mail or by informing us via another contact channel. The information will be stored for as long as you are subscribed to the newsletter. After you unsubscribe, we store the data purely statistically and anonymously. Such tracking is also not possible if you have deactivated the display of images in your e-mail programme by default. In this case, the newsletter will not be displayed in full and you may not be able to use all the functions. If you display the images manually, the above-mentioned tracking will take place.

§ 5 Data processing for advertising purposes

As a customer of W. & L. Jordan GmbH, you will receive product recommendations and customer satisfaction surveys by email, regardless of whether you have subscribed to our newsletter. We adhere strictly to the legal requirements. Unless you have given your specific consent, we will only use the e-mail address you provide when placing an order in accordance with Section 7 (3) of the German Act Against Unfair Competition (UWG) for our own similar products that are similar to those that you have already purchased from us on the basis of an order you have already placed. The legal basis for this is Art. 6 para. 1 lit. f GDPR. Our legitimate interest is to send you advertising in the form of direct marketing. You can object to these advertising emails at any time free of charge and with effect for the future at

datenschutz@joka.de and/or at the end of each advertising email. If you object to this advertising measure, your data will be deleted from the corresponding (e-mail) distribution lists.

§ 6 Use of Google Analytics

(1) This website uses Google Analytics, a web analysis service of Google Inc ("Google"). Google Analytics uses "cookies", which are text files placed on your computer, to help the website analyse how users use the site. The information generated by the cookie about your use of this website is usually transferred to a Google server in the USA and stored there. However, if IP anonymisation is activated on this website, your IP address will be shortened by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area beforehand. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there. Google will use this information on behalf of the operator of this website to analyse your use of the website, to compile reports on website activity and to provide the website operator with other services relating to website activity and internet usage.

(2) The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data.

(3) You may refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of this website. You can also prevent Google from collecting the data generated by the cookie and relating to your use of the website (including your IP address) and from processing this data by Google by downloading and installing the browser plug-in available at the following link: https: //tools.google.com/dlpage/gaoptout?hl=de.

(4) This website uses Google Analytics with the extension "_anonymiseIp()". This means that IP addresses are further processed in abbreviated form so that they cannot be linked to a specific person. If the data collected about you is personally identifiable, it is immediately excluded and the personal data is deleted immediately.

(5) We use Google Analytics to analyse and regularly improve the use of our website. We can use the statistics obtained to improve our offering and make it more interesting for you as a user. For the exceptional cases in which personal data is transferred to the USA, Google has submitted to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework. The legal basis for the use of Google Analytics is Art. 6 para. 1 sentence 1 lit. f GDPR.

(6) Information from the third-party provider: Google Dublin, Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001. Terms of use: https: //www.google.com/analytics/terms/de.html, overview of data protection: https: //support.google.com/analytics/answer/6004245?hl=de, as well as the privacy policy: https: //policies.google.com/privacy?hl=de&gl=de.

(7) This website also uses Google Analytics for a cross-device analysis of visitor flows, which is carried out via a user ID. You can deactivate the cross-device analysis of your usage in your customer account under "My data", "Personal data".

§ 7 Use of Hotjar

(1) This website uses the web analysis service Hotjar to analyse and regularly improve the use of our website. We can use the statistics obtained to improve our offering and make it more interesting for you as a user. The legal basis for the use of Hotjar is Art. 6 para. 1 sentence 1 lit. f GDPR.

(2) No cookies are stored on your computer for this analysis. Only anonymised behaviour on the website is tracked. This tracking does not at any time record personal information or entries in fields with the exception of the search terms entered. We store the following data anonymously:

• Browser type and version
• browser language
• Monitor resolution
• Device type
• Date and time of collection
• Country of origin
• URL accessed
• Page origin

(3) Data is only collected on selected pages and forms.

(4) Information from the third-party provider Hotjar on data protection can be found at https://www.hotjar.com/privacy

§ 8 Use of Salesforce Marketing Cloud

(1) We use the "Marketing Cloud" from Salesforce(https://www.salesforce.com/de/) to send the newsletter you have ordered from this website

(2) We only store the data provided by you as listed in §1, §2 and §3 of this privacy policy. The data is stored exclusively for the purpose of sending the newsletter.

(3) Behavioural patterns are evaluated anonymously in order to improve the newsletter service. In order to offer you an optimised offer in the newsletter in the long term, we analyse personally clicked content and control the sending of subsequent newsletters according to these findings, so you will receive successively less comparable information from content that you did not click on in previous newsletters.

Information from the third-party provider: Salesforce.com Germany GmbH, Erika-Mann-Straße 31, 80636 Munich, Germany; https://www.salesforce.com/de/company/privacy/ The legal basis for the processing of your data is Art. 6 para. 1 sentence 1 lit. f GDPR

§ 9 Use of eTracker

(1) This website uses technologies from etracker GmbH (https://www.etracker.com/) to collect and store data for marketing and optimisation purposes. This data can be used to create user profiles under a pseudonym. Cookies (more details in § 3) can be used for this purpose. Cookies are small text files that are stored locally in the cache of the website visitor's Internet browser. Cookies make it possible to recognise the Internet browser. The data collected using eTracker technologies will not be used to personally identify the visitor to this website and will not be merged with personal data about the bearer of the pseudonym without the separately granted consent of the person concerned. The collection and storage of data can be cancelled at any time with effect for the future.

Please exclude me from the eTracker count [Link](Please click on the objection button in the "Web analysis" section)

(2) We use eTracker to analyse and regularly improve the use of our website. We can use the statistics obtained to improve our offer and make it more interesting for you as a user. The data collected is stored permanently and analysed pseudonymously. The legal basis for the use of eTracker is Art. 6 para. 1 sentence 1 lit. f GDPR.

(3) Information from the third-party provider: etracker GmbH, Erste Brunnenstraße 1, 20459 Hamburg, Germany; https://www.etracker.com/de/datenschutz.html. The legal basis for the use of eTracker is Art. 6 para. 1 sentence 1 lit. f GDPR.

§ 10 Use of social media plug-ins

(1) We currently use the following social media plug-ins: Facebook, Google+, Twitter, Xing, LinkedIn.1 We use the so-called two-click solution. 2 This means that when you visit our website, no personal data is initially passed on to the providers of the plug-ins. You can recognise the provider of the plug-in by the marking on the box above its initial letter or the logo. We give you the option of communicating directly with the provider of the plug-in via the button. Only if you click on the marked field and thereby activate it will the plug-in provider receive the information that you have accessed the corresponding website of our online offering. In addition, the data mentioned under § 3 of this declaration will be transmitted. In the case of Facebook and Xing, according to the respective providers in Germany, the IP address is anonymised immediately after collection. By activating the plug-in, your personal data is therefore transmitted to the respective plug-in provider and stored there (for US providers in the USA). As the plug-in provider collects data via cookies in particular, we recommend that you delete all cookies via your browser's security settings before clicking on the greyed-out box.

(2) We have no influence on the data collected and data processing procedures, nor are we aware of the full extent of the data collection, the purposes of the processing or the storage periods. We also have no information on the deletion of the data collected by the plug-in provider.

(3) The plug-in provider stores the data collected about you as usage profiles and uses these for the purposes of advertising, market research and/or customising its website. Such an evaluation is carried out in particular (even for users who are not logged in) to display customised advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles, whereby you must contact the respective plug-in provider to exercise this right. We offer you the opportunity to interact with the social networks and other users via the plug-ins so that we can improve our offering and make it more interesting for you as a user. The legal basis for the use of the plug-ins is Art. 6 para. 1 sentence 1 lit. f GDPR.

(4) Data is passed on regardless of whether you have an account with the plug-in provider and are logged in there. If you are logged in with the plug-in provider, your data collected by us will be assigned directly to your existing account with the plug-in provider. If you press the activated button and, for example, link the page, the plug-in provider also saves this information in your user account and shares it publicly with your contacts. We recommend that you log out regularly after using a social network, but especially before activating the button, as this way you can avoid being assigned to your profile with the plug-in provider.

(5) Further information on the purpose and scope of data collection and its processing by the plug-in provider can be found in the data protection declarations of these providers provided below. There you will also find further information on your rights in this regard and setting options to protect your privacy.

(6) Addresses of the respective plug-in providers and URL with their data protection notices:

(a) Facebook Inc, 1601 S California Ave, Palo Alto, California 94304, USA; https://www.facebook.com/policy.php; further information on data collection: "https://www.facebook.com/help/186325668085084, https://www.facebook.com/about/privacy/your-info-on-other#applications and https://www.facebook.com/about/privacy/your-info#everyoneinfo. Facebook has submitted to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework.

b) Google Inc, 1600 Amphitheater Parkway, Mountainview, California 94043, USA; https://www.google.com/policies/privacy/partners/?hl=de. Google has submitted to the EU-US Privacy Shield, https://www.google.com/policies/privacy/partners/?hl=de.

c) Twitter, Inc, 1355 Market St, Suite 900, San Francisco, California 94103, USA; https://twitter.com/privacy. Twitter has submitted to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework.

d) Xing AG, Gänsemarkt 43, 20354 Hamburg, DE; https://www.xing.com/privacy.

e) LinkedIn Corporation, 2029 Stierlin Court, Mountain View, California 94043, USA; https://www.linkedin.com/legal/privacy-policy. LinkedIn has submitted to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework.

§ 11 Integration of YouTube videos

(1) We have integrated YouTube videos into our online offering, which are stored on https://www.youtube.com/ and can be played directly from our website. These are all integrated in "extended data protection mode", i.e. no data about you as a user is transferred to YouTube if you do not play the videos. Only when you play the videos will the data mentioned in paragraph 2 be transmitted. We have no influence on this data transfer.

(2) By visiting the website, YouTube receives the information that you have accessed the corresponding subpage of our website. In addition, the data mentioned under § 3 of this declaration will be transmitted. This occurs regardless of whether YouTube provides a user account through which you are logged in or whether no user account exists. If you are logged in to Google, your data will be assigned directly to your account. If you do not wish your data to be associated with your YouTube profile, you must log out before activating the button. YouTube stores your data as usage profiles and uses them for the purposes of advertising, market research and/or customising its website. Such an evaluation is carried out in particular (even for users who are not logged in) to provide customised advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles, whereby you must contact YouTube to exercise this right.

(3) Further information on the purpose and scope of data collection and its processing by YouTube can be found in the privacy policy. There you will also find further information on your rights and setting options to protect your privacy: https: //www.google.de/intl/de/policies/privacy. Google also processes your personal data in the USA and has submitted to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework.

§ 12 Integration of Google Maps

(1) We use the Google Maps service on this website. This allows us to show you interactive maps directly on the website and enables you to use the map function conveniently.

(2) When you visit the website, Google receives the information that you have accessed the corresponding subpage of our website. In addition, the data mentioned under § 3 of this declaration will be transmitted. This occurs regardless of whether Google provides a user account through which you are logged in or whether no user account exists. If you are logged in to Google, your data will be assigned directly to your account. If you do not wish your data to be associated with your Google profile, you must log out before activating the button. Google stores your data as usage profiles and uses them for the purposes of advertising, market research and/or customising its website. Such an analysis is carried out in particular (even for users who are not logged in) to provide customised advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles, whereby you must contact Google to exercise this right.

(3) Further information on the purpose and scope of data collection and its processing by the plug-in provider can be found in the provider's privacy policy. There you will also find further information on your rights in this regard and setting options to protect your privacy: https: //policies.google.com/privacy?hl=de&gl=de. Google also processes your personal data in the USA and has submitted to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework.

§ 13 Use of Google Adwords Conversion6

(1) We use Google Adwords to draw attention to our attractive offers on external websites with the help of advertising material (so-called Google Adwords). We can determine how successful the individual advertising measures are in relation to the advertising campaign data. In this way, we pursue the interest of showing you advertising that is of interest to you, making our website more interesting for you and achieving a fair calculation of advertising costs.

(2) These adverts are delivered by Google via so-called "ad servers". For this purpose, we use ad server cookies, through which certain parameters for measuring success, such as the display of adverts or clicks by users, can be measured. If you access our website via a Google advert, Google Adwords will store a cookie on your PC. These cookies generally lose their validity after 30 days and are not intended to identify you personally. The unique cookie ID, number of ad impressions per placement (frequency), last impression (relevant for post-view conversions) and opt-out information (marking that the user no longer wishes to be addressed) are usually stored as analysis values for this cookie.

(3) These cookies enable Google to recognise your internet browser. If a user visits certain pages of an Adwords customer's website and the cookie stored on their computer has not yet expired, Google and the customer can recognise that the user clicked on the ad and was redirected to this page. A different cookie is assigned to each Adwords customer. Cookies can therefore not be tracked via the websites of Adwords customers. We ourselves do not collect and process any personal data in the aforementioned advertising measures. We only receive statistical analyses from Google. These analyses enable us to recognise which of the advertising measures used are particularly effective. We do not receive any further data from the use of the advertising material; in particular, we cannot identify users on the basis of this information.

(4) Due to the marketing tools used, your browser automatically establishes a direct connection with the Google server. We have no influence on the scope and further use of the data collected by Google through the use of this tool and therefore inform you according to our level of knowledge: Through the integration of AdWords Conversion, Google receives the information that you have accessed the corresponding part of our website or clicked on an advert from us. If you are registered with a Google service, Google can assign the visit to your account. Even if you are not registered with Google or have not logged in, it is possible that the provider will find out your IP address and store it.

(5) You can prevent participation in this tracking process in various ways: a) by setting your browser software accordingly, in particular by suppressing third-party cookies so that you do not receive any ads from third-party providers; b) by deactivating cookies for conversion tracking by setting your browser to block cookies from the domain www.googleadservices.com, https://www.google.de/settings/ads, whereby this setting will be deleted if you delete your cookies; c) by deactivating the interest-based ads of the providers that are part of the "About Ads" self-regulation campaign via the link http://www.aboutads.info/choices, whereby this setting will be deleted if you delete your cookies; d) by permanently deactivating them in your browsers Firefox, Internet Explorer, Microsoft Edge or Google Chrome under the link https://support.google.com/ads/answer/7395996. We would like to point out that in this case you may not be able to use all functions of this offer to their full extent.

(6) The legal basis for the processing of your data is Art. 6 para. 1 sentence 1 lit. f GDPR. Further information on data protection at Google can be found here: https: //policies.google.com/privacy?hl=de and https://services.google.com/sitestats/de.html. Alternatively, you can visit the website of the Network Advertising Initiative (NAI) at https://www.networkadvertising.org Google has submitted to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework.

§ 14 Remarketing

In addition to Adwords Conversion, we use the Google Remarketing application. This is a procedure with which we would like to address you again. This application allows our adverts to be displayed to you when you continue to use the internet after visiting our website. This is done by means of cookies stored in your browser, which are used by Google to record and evaluate your user behaviour when you visit various websites. This enables Google to recognise your previous visit to our website. According to its own statements, Google does not merge the data collected in the context of remarketing with your personal data, which may be stored by Google. In particular, according to Google, pseudonymisation is used for remarketing.

§ Section 15 Facebook Custom Audiences

(1) Furthermore, the website uses the remarketing function "Custom Audiences" of Facebook Inc ("Facebook"). This allows users of the website to be shown interest-based adverts ("Facebook Ads") when they visit the Facebook social network or other websites that also use the process. We are interested in showing you adverts that are of interest to you in order to make our website more interesting for you.

(2) Due to the marketing tools used, your browser automatically establishes a direct connection with the Facebook server. We have no influence on the scope and further use of the data collected by Facebook through the use of this tool and therefore inform you according to our level of knowledge: Through the integration of Facebook Custom Audiences, Facebook receives the information that you have accessed the corresponding website of our Internet presence or have clicked on an advert from us. If you are registered with a Facebook service, Facebook can assign the visit to your account. Even if you are not registered with Facebook or have not logged in, it is possible for the provider to find out and store your IP address and other identifying features.

(3) You can deactivate the "Facebook Custom Audiences" function [here and] for logged-in users at https://www.facebook.com/settings/?tab=ads#_.

(4) The legal basis for the processing of your data is Art. 6 para. 1 sentence 1 lit. f GDPR. Further information on data processing by Facebook can be found at https://www.facebook.com/about/privacy/.

§ 16 Google reCAPTCHA

We use Google reCAPTCHA on our website to check and prevent interactions on our website through automated access, e.g. by so-called bots. This is a service provided by Google LLC, Gordon House, Barrow Street, Dublin 4, Ireland, hereinafter referred to as "Google".

Through certification in accordance with the EU-US Privacy Shield ("EU-US Privacy Shield")

https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active

Google guarantees that the data protection requirements of the EU will also be complied with when processing data in the USA.

This service enables Google to determine from which website a request is sent and from which IP address you are using the so-called reCAPTCHA input box. In addition to your IP address g this service is necessary.

The legal basis is Art. 6 para. 1 lit. f) GDPR. Our legitimate interest lies in the security of our website and in the defence against unwanted, automated access in the form of spam or similar.

Google offers under

https://policies.google.com/privacy

for further information on the general handling of your user data.

Google Fonts (local)

We use "Google Fonts" on our website, a service provided by Google Ireland Limited (hereinafter referred to as "Google"). The service enables us to use external fonts, so-called Google Fonts. The Google Fonts are installed locally on our server. There is no connection to Google servers.

W. & L. Jordan GmbH / Privacy Policy 2019-06-24-V1.5