DATA PRIVACY POLICY FOR VISITORS OF OUR LINKEDIN SITE

We, the MHP Management- und IT-Beratung GmbH (hereinafter “we” or “MHP”), appreciate your interest in our company.

Your privacy is important to us. We therefore take the protection of your personal data and its confidentiality very seriously. Your personal data is processed only within the scope of the statutory provisions of data protection law, in particular the EU General Data Protection Regulation (hereinafter “GDPR”) and the German Federal Data Protection Act (hereinafter “BDSG” or “Bundesdatenschutzgesetz”).

In this privacy policy, we provide you as a visitor of our LinkedIn site with information about the processing of your personal data and your data protection.

1. Joint Controllers and Data Protection Officer; contact data

The Data Controller within the meaning of data protection laws, rules, and regulations is:

MHP Management- und IT-Beratung GmbH
Film- und Medienzentrum
Königsallee 49
71638 Ludwigsburg

Germany
Phone: +49 (0)7141 7856-0
Email: info@mhp.com

If you have any questions regarding data protection, please contact our data protection officer at dataprivacy(at)mhp.com.

With regard to data processing within the framework of our LinkedIn site, we and LinkedIn Ireland Unlimited Company (Wilton Place, Dublin 2, Ireland) are jointly responsible as joint controllers.

LinkedIn's privacy policy can be found here:

https://www.linkedin.com/legal/privacy-policy?trk=homepage-basic_footer-privacy-policy

Furthermore, there is a data processing agreement between us and LinkedIn Ireland Unlimited Company which you can access here: https://legal.linkedin.com/dpa

2. Subject matter of data protection

The subject matter of data protection is the protection of personal data. This is all the information that relates to an identified or identifiable natural person (“data subject”).

3. Purposes and legal bases for data processing

An overview of the purposes of and legal bases for data processing is provided below.

3.1 Safeguarding legitimate interests/processing purposes

The purpose of data processing on our LinkedIn site is to provide information about our products and services, combined with the possibility for users to interact with us in a targeted manner. Data is processed on the basis of Article 6 (1) (f) GDPR. We process the personal data that is required to safeguard legitimate interests, unless this is outweighed by your interest in the protection of your personal data. Our legitimate interest is in particular our business interest in sharing information with our users and being able to communicate with them.

We anonymize or delete the data when the purposes for which the data was required no longer apply, unless other legal grounds apply. If the latter is the case, we anonymize or delete the data once the other legal grounds cease to apply. After anonymization, you can no longer be identified.

3.2 Use of insight-data

We place advertisements on LinkedIn and use insight-data provided by LinkedIn to evaluate the behavior of our target audience in the interaction with our site. The target-group-specific control of advertising is a legitimate interest of our company. The users of LinkedIn are informed about this; the responsibility for data collection lies primarily with LinkedIn.

Users' opposing interests worthy of protection (display of individual target-group-optimized advertising) are not predominant. The legal basis for the data processing is Article 6 (1) (f) GDPR.

3.3 Publication of Pictures

If we publish pictures of persons, this is done via consent (legal basis: Article 6 (1) (a) GDPR), on the basis of a contractual agreement (legal basis: Article 6 (1) (b) GDPR) and in exceptional cases on the basis of legitimate interests (legal basis: Article 6 (1) (f) GDPR in conjunction with Section 23 (1) (no. 3) Kunsturhebergesetz).

3.4 Use of Lead Gen Forms

We use so-called "Lead Gen Forms" (forms for the purpose of lead generation) in order to be able to inform you, for example, about products, services or events that may be of interest to you. In this context, selected information already stored by you on LinkedIn is transmitted to MHP for further processing for marketing and sales purposes. We use the data transmitted in this way to subsequently send you further information, products or invitations to events. Furthermore, the data received may be passed on to cooperation partners (e.g. co-organizers of events or companies participating in studies).

In particular, the following types of data may be processed by us in this context:

• Contact data: First and last name, e-mail address, URL of LinkedIn profile, telephone number, city, state/province, country/region, postal code, business e-mail address, business telephone number.
• Qualification Data: Education, degrees, fields of study, college/vocational school, start or graduation date.
• Employer information: company name, company size, industry sector
• Occupation data: job title, areas of activity, career level

The relevant legal basis for this is your consent in accordance with Art. 6 Para. 1 lit. a GDPR. You can revoke your consent at any time via the above-mentioned contact options, so that no further processing of the data received via LinkedIn will take place in the future. The processing activities carried out until then remain unaffected.

4. Recipients of personal data

Internal recipients: Within the company the only individuals who have access are those who need it for the specified purposes.

External recipients: We will only forward your personal data to external recipients if this is necessary for the specified purposes, if another legal authorization or obligation exists or if we have obtained your consent.

External recipients may include:

a) Processors

Group companies of Porsche AG or external service providers that we use to provide services, for example, in the areas of technical infrastructure and maintenance for the Porsche AG service or the provision of content. We carefully select and inspect these processors on a regular basis to make sure that the security and confidentiality of your personal data are safeguarded. The service providers may use the data only for the purposes specified by us and in accordance with our instructions.

b) Public bodies

Public authorities and governmental institutions such as fiscal authorities, public prosecutors or courts to which we (are required to) transfer personal data for compelling legal reasons or for safeguarding legitimate interests. In that case, the transfer will be based on Article 6 (1) (c) and/or (f) GDPR or on Section 26 (1) (2) German Federal Data Protection Act (BDSG – Bundesdatenschutzgesetz).

c) Companies of the group

Companies of the Porsche AG Group, to which data is transferred based on consent in order to carry out the application procedure or to safeguard legitimate interests. The data is transferred on the basis of Article 6 (1) (a) and/or (f) GDPR or on Section 26 (1) German Federal Data Protection Act (BDSG – Bundesdatenschutzgesetz). You can find a list of Group companies at: http://www.porsche.com/germany/aboutporsche/service/.

5. Transfer to third countries

It is not excluded that data of users may be processed on systems outside the European Union. LinkedIn has been certified under the Privacy Shield and is committed to complying with EU data protection standards. You can find out more at: https://www.linkedin.com/help/linkedin/answer/62533?trk=microsites-frontend_legal_privacy-policy&lang=

6. Storage duration

For the storage duration of personal data, please refer to the relevant section on data processing. In addition, as a general rule, we store your personal data only for the length of time necessary to fulfill the intended purposes, or – if consent has been granted – until you withdraw your consent (and no other legal grounds apply). If you object, we delete your personal data unless its further processing is permitted by the relevant legal provisions. We also delete your personal data if we are obliged to do so for legal reasons.

7. Rights of data subjects

As a data subject you have numerous rights. Specifically:

Right of access: You have the right to obtain information from us about the data that we have stored about you.

Right to rectification and erasure: You have the right to demand that we rectify incorrect data and – provided the legal requirements are met – that we erase your data.

Restriction of processing: You have the right – provided the legal requirements are met – to demand that we restrict the processing of your data.

Data portability: If you have provided us with data based on a contract or consent and if the statutory requirements are met, you have the right to obtain the data provided by you in a structured, commonly used and machine-readable format or you may demand that we transfer this data to another controller.

Objection to the processing of data on the legal basis of “legitimate interest”: You have the right to object at any time, on grounds relating to your particular situation, to our processing of your data, provided this objection is based on the legal basis of “legitimate interests”. If you exercise your right to object, we will discontinue the processing of your data unless we can – pursuant to the legal requirements – prove compelling legitimate reasons for further processing overriding your rights.

Withdrawal of consent: If you have given us consent to process your data, you may withdraw this consent at any time with effect for the future. The lawfulness of the processing of your data prior to the withdrawal remains unaffected.

Right to lodge complaints with the supervisory authority: You may also lodge a complaint with the competent supervisory authority if you believe the processing of your data to breach applicable laws. To do so, you may contact the data protection authority that is competent for your habitual residence or country or the data protection authority that has competence over us.

Contacting us and exercising your rights: Furthermore, if you should have any questions on the processing of your personal data, your rights as a data subject or any consent that may have been given, you may contact us free of charge. If you wish to exercise any or all of your rights mentioned above, please contact the address specified in Section 1. In that case, please ensure that we will be able to accurately identify you. If you wish to withdraw your consent, you can use the method of contact that you used when you gave your consent.

If your rights must be asserted against LinkedIn, we will forward your request to LinkedIn.

For further information regarding the assertion of your data subject rights against LinkedIn, please visit LinkedIn's data protection declaration under section 4.2: https://www.linkedin.com/legal/privacy-policy?trk=homepage-basic_footer-privacy-policy and https://www.linkedin.com/help/linkedin/answer/50191?trk=microsites-frontend_legal_privacy-policy&lang.

8. Version

The latest version of this Privacy Policy applies.

Version date: 2022-12-02