Privacy policy 20220203

Personal data means any information that can be used to directly or indirectly identify you as an individual.

Protecting the security and privacy of your personal data is important for BioSolveIT; we conduct our business in compliance with applicable laws on data privacy policy and data security.

As a basic principle you may use this website anonymously. However, when you access our website, your computer automatically provides us with non-personal data (e.g. type of internet browser and operating system used, domain name of the website from which you came, pages viewed) as well as with personal identifiers (e.g. IP-address). Moreover, in some cases we can't take action without certain personal data (e.g. replying to your service request, offering specific downloads or email announcements).

This policy shall inform you how we use and process your personal data.

Personal information that has been provided to or gathered by www.biosolveit.de is controlled by BioSolveIT GmbH, An der Ziegelei 79, 53757 Sankt Augustin, Germany. The usage of "we", "our" or "us" in this statement, refers to BioSolveIT GmbH as indicated above.

Our data protection officer is Gloria Kraschinski (privacy@biosolveit.de, + 49 2241 2525 0).

Our website is hosted in Germany. As a basic principle no personal data will be made available to any third party, except (i) with your consent; (ii) as may be required by law or the competent governmental or judicial authorities; (iii) if it is necessary to establish or preserve a legal claim or defense or (iv) as otherwise stated in this document.

As a global acting company, we have distribution partners in United Kingdom, India, Japan and China as well as an US-based affiliate (BioSolveIT Inc.). If you request the usage of our software products (resp. our services) within or with a reference to one of the above named countries, we might transfer your data to our partners in order to respond to your inquiry, to establish, negotiate or perform a contract with you or provide you access to the requested information or other requested offers.

Please check this page for a list of our partners.

If we transfer your data to a country in which the statutory level of data protection is not comparable to the level applicable in the European Economic Area (EEA), such transfer bases on Standard Contractual Clauses (EU Commission Decision 87/2010/EC and future replacements). That ensures your personal data is subject to a level of data protection that applies within the EEA.

In order to verify our identity to your browser and to encrypt data given to us we use Transport Layer Security (TLS). That ensures that no third party can read along the data submitted from or to our website. If the address bar of your browser starts with "https://", the connection is encrypted. A closed padlock lock symbol in the browser line is also an indication for an encrypted connection.

When you access our website, your computer provides us with some information automatically. This information is temporarily stored in so called "server-log-files" until it is automatically deleted:

• type of internet browser and operating system used
• domain name of the web site which linked you to our page
• date and time of visit
• pages viewed
• size of files transferred
• status of data transfer
• IP address of the requesting computer

As a basic principle, we do not combine such information with other sources of data. We reserve the right to check the data retrospectively, if we become aware of specific indications for illegal use.

We use data collected in server-log-files to ensure the functionality of our website, in order to effectively manage our web server including troubleshooting in case of technical problems that may be occurring and to maintain website safety and security as well as for other administrative purposes.

We may also use those data in aggregate and anonymized form in order to improve our website, offers or services, e.g. to learn what are the most popular pages. In this case, any identification of an individual or any inference about the activities of an individual is impossible.

We process your data in the above described manner on the basis of Art. 6 para. 1 lit. f GDPR. Our legitimate interest follows the purposes listed above.

The collection of data for the provision of the website and the storage of the data in log files is essential for the operation of the website. Consequently, you can't object to BioSolveITs usage of data in the above described manner.

A cookie is a small data packet that your browser places on your computer's hard drive.

Our website uses cookies. They help us to make our website more user-friendly, effective and secure. With the exception of "Essential Cookies", cookies are only placed if you have expressly agreed to it.

"Essential Cookies" are required to enable basic functionality of our website, e. g. for form based step-by-step procedures as for our evaluation service. Most of them are session cookies. They expire at the end of a session when you close your web browser. The cookie, which remembers your cookie settings, is essential, but remains stored on your device until its specified expiry date, or until you delete it.

If you are a registered user, setting the "Auto Sign In cookie" avoids the necessity to sign in each time you visit our website. This cookie requires your consent. It will also be placed if you enable the "Keep me signed in” functionality in the sign in modal. It remains effective until you delete it (e. g. via your browser settings), until its expiration date, or until you revoke your consent.

If you sign out on our website, the cookie will not be deleted. The next time you visit the website, you will be automatically signed in again.

You may change your preferences for that cookie by ticking the checkbox below to provide your consent or by un-ticking the checkbox below to revoke your consent:

"Statistic Cookies" are used for anonymous analysis of user behavior in order to optimize our website. It also helps us to detect potential technical weaknesses on our website. The placement requires your consent. The "Statistic Cookie" remains stored on your hard drive until you delete it (e. g. via your browser settings), until its expiration date, or until you revoke your consent.
Please find further details and the possibility to change your settings in the "Matomo" section.

The placement of cookies, which are essential for the use of our website or necessary for specific functions, bases on Art 6 para. 1 lit. f GDPR, as we have a legitimate interest in storing cookies to provide a technically error-free and well-functioning web service.

The placement of cookies for statistical purposes and for an automatic sign in bases on your consent within the meaning of Art. 6 para. 1 lit. a GDPR.

Our website uses Matomo – an open source solution for web analysis which has the advantage that any data collected is stored on our own server and not transferred to third parties.

Matomo uses cookies. We store the information referred by cookies about the use of our website on our server. Before saving, your IP address will be anonymized. The Matomo cookies remain stored on your device until you delete them but no longer than 13 months.

Matomo cookies are only set when you have given your consent accordingly as described in the "Cookies” section. As the operator of this website, we have an interest in the anonymous analysis of user behavior in order to optimize our website. It also helps us detect potential technical weaknesses on our website.

You may change your preferences for the anonymized web analytics data collection via Matomo cookies. Simply tick or un-tick the checkbox below:

Our website embeds videos from Google's YouTube page. The operator of the pages is YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, USA.

YouTube videos are integrated with the extended data protection mode. If you visit one of our pages featuring a YouTube video, a connection to the YouTube servers will not be established until you start the video. When you start the video, you will be connected to YouTube's servers. The YouTube server will be informed which of our pages you have visited.

When you are logged in to your YouTube account, you YouTube can map your surfing behavior directly to your personal YouTube profile. You can prevent this by logging out of your YouTube account.

The use of YouTube is in the interest of an attractive online presentation of our products and service. This constitutes a legitimate interest within the meaning of Art. 6 para. 1 lit.f GDPR.

Further information about handling user data can be found in the data protection declaration of YouTube.

BioSolveIT offers news about its webinars, new development, events etc. via email announcements.

There are different ways how you can ask us for subscription. In most cases, an email will be involved in which we request your confirmation.

For example, when you have submitted a subscription request on our website, we will send a confirmation message to the email address you have filled-in this form.

In any case, you are not subscribed unless you click the respective button in the confirmation email. If you confirm your consent, we will store your email address as well as other data you give us requesting the subscription (your "subscription data"). For the purpose of evidence we will also store the date of confirmation as well as your IP address.

We will use your subscription data only for the purpose of sending you the relevant announcements. The legal basis for this processing is your consent within the meaning of Art. 6 para. 1 lit. a GDPR

You may revoke your consent at any time using our unsubscribe function or simply use the unsubscribe link at the foot of every announcement mail we send you. Alternatively, you can send an email.

In this case, we will delete your subscription data. That has no effect on personal data we have received from you for other purposes and in a different context.

A registration is required if you request an evaluation license, ask for a quote, for participating in a webinar or if you want to download a specific software.

Once you have registered your registration is valid for any subsequent request. We collect any personal data you provide us through this registration. We use this data to supply you with the requested services.

We are doing so on the basis of Art. 6 para. 1 lit. b GDPR which allows the processing of data to fulfill a contract or for measures preliminary to a contract. That includes:

• Allowing the evaluation of the software to find out whether or not it is suitable and to decide about a purchase
• Providing purchase options suitable to the requesting organization (some options depend on specific factors queried throughout the registration)
• Organizing and performing of webinars
• Allowing access to software for which a license has been signed

Your registration data will be stored as long as you are registered. You have the right to correct, amend or delete your data. Please contact us in any such case.

Your registration data will not be deleted as long as the information is required fulfill a contract or for measures preliminary to a contract or if deletion is not permitted by legal obligations.

Please note, in some circumstances we might not be able doing business with you if we can't process your personal data.

If the registration is used to download our software products from our website, we store this activity with the following data:

• your registration data
• date /time of download
• downloaded product
• your IP-address

If not otherwise mentioned in this statement, we process this data (i) in order fulfill our obligations based on a contract with you or for measures preliminary to a contract within the meaning of Art. 6 para. 1 lit. b GDPR and (ii) in order to protect the offered download service from abuse which constitutes a legitimate interest within the meaning of Art. 6 para. 1 lit.f GDPR.

You may evaluate our software products before you decide to move forward with a purchase. However, in order to provide you with an evaluation license, we need some personal data from you, e.g.:

• your name
• your email address (as license keys are issued by email)
• the host id of the computer on which the software shall be used (needed to protect the evaluation license us from abuse)

In addition, your browser automatically provides us with your IP address.

Beside the products(s) you would like to evaluate, we will also ask you for some information about the legal person for which you are requesting a license, especially:

• organization name
• location
• affiliation

Moreover, our evaluation license agreement has to be accepted. All that can be done online.

The personal data and other information (as listed above) gather during the evaluation procedure will be processed on the basis of Art. 6 para. 1 lit. b GDPR which allows the processing of data to fulfill a contract or for measures preliminary to a contract.

Our website offers contact forms for requesting support, quotes or service options. When you send us a message using such a form, we will store:

• the personal data you entered into the form (e.g. title, name, email-address, phone - depending on the specific form)
• content of your query (including information about the field of interest, product, product version and operating system as far as you provided us with such information through the form)
• subject of your query
• date and time of your query
• your IP-address

Alternatively, you may contact us via email. In this case we will store any personal data provided with this email as well as the content of the email.

The given personal data and other information (as listed above), will be processed on the basis of Art. 6 para. 1 lit. b GDPR which allows the processing of data to fulfill a contract or for measures preliminary to a contract.

We use LogMeIn as Software as a Service (SaaS) to hold webinars. Your email address and name (which you have provided through registration) will be used by LogMeIn on behalf of and according to our instructions. BioSolveIT and LogMeIn have a contract for order data processing. Please visit LogMeIn's privacy policy for details.

You may participate in one of our workshops to which we invite from time to time. You have to submit your participation request online using a specific form. We record the personal data you provide us using the form (e.g. your name, email address, organization).

In addition, your browser automatically provides us with your IP address.

The given personal data and other information (as listed above), will be used for the purpose of organization and performance of the workshop. We are doing this on the basis of Art. 6 para. 1 lit. b GDPR which allows the processing of data to fulfill a contract or for measures preliminary to a contract and on the basis of Art. 6 para. 1 lit. f GDPR. Our legitimate interest follows the purposes specified above.

You may apply for participation in our Scientific Challenge. You have to submit your proposal online using a specific form. We record the personal data you provide us using the form (e.g. your name, contact details (email address and telephone), location and institute).

In addition, your browser automatically provides us with your IP address.

Moreover, the terms and conditions of the challenge have to be accepted. Please note that challenge terms may contain further information concerning the protection of your data.

The given personal data and other information (as listed above), will be processed on the basis of Art. 6 para. 1 lit. b GDPR which allows the processing of data to fulfil a contract or for measures preliminary to a contract.

Some of our products can be purchased online using our web shop. If you decide to do so we are requesting a couple of data from you. Most of them relate to the legal organization for which you are processing the purchase like company's name, VAT reg. no., address and affiliation.

However, we also need the name and the email address of the individual that processes the purchase. In addition, your browser automatically provides us with your IP address.

When you use our web shop, we will store:

• the personal data and company date you have given to us
• date and time of the purchase
• purchased items (product, term of usage, charge etc.)
• Your IP-address
• Other information relevant for the purchase

The legal basis for processing your personal data and other information relevant for the purchase, is of Art. 6 para. 1 lit. b GDPR which allows the processing of data to fulfill a contract or for measures preliminary to a contract. Moreover, the data will temporarily be used in order to avoid the abuse of our web shop. We are doing this on the basis of Art. 6 para. 1 lit. f GDPR as we have a legitimate interest in protecting our web shop.

In order to finalize the purchase through our web shop, you have to pay by credit card. The payment will be processed through our payment service provider Concardis (ConCardis GmbH, Helfmann-Park 7, 65760 Eschborn, Germany). When you click the button 'confirm and pay', you will proceed to the external payment interface of ConCardis where you can make your payment using your credit card.

We do not transfer any personal data to ConCardis. Only the following information is forwarded for processing the payment:

• order id (Internal reference number which allow us to combine a payment with a purchase. ConCardis may not draw any conclusion to the an individual from the reference number)
• total amount to be payed (including currency)

As we do not process your payment by ourselves we are not aware and do not store your credit card number (including verification id). However, ConCardis informs us about any successful (and failed) payment and provides us with the following additional data:

• brand of the used credit card
• last 4 digits of the used credit card number
• Cardholder's name
• Transfer data
• Expiry date
• IP of the computer from which the payment has been processed

We process those data on the basis Art. 6 para. 1 lit. b GDPR, which allows the processing of data to fulfill a contract or for measures preliminary to a contract. Moreover, the data will temporarily be used in order to avoid the abuse of our web shop. We are doing this on the basis of Art. 6 para. 1 lit. f GDPR as we have a legitimate interest in protecting our web shop.

Further information about handling user data, can be found in the data protection declaration of ConCardis linked at the bottom of ConCardis' payment page.

Within an existing business relationship between you and us, we may inform you, as far as allowed by local law, about products or services (including webinars, workshops or other events) which are similar or relate to such products and services you have already purchased or used from us. Furthermore, where you have attended a webinar, workshop or other event of BioSolveIT or purchased products or services from us, we may contact you for feedback regarding the improvement of the relevant event, product or service.

We are doing so on the basis of Art. 6 para. 1 lit. f GPDR as this use case constitutes a legitimate interest of BioSolveIT to process or use your data.

You may object to BioSolveIT using your personal data in the above described manner as specified under "Right to objection".

If not stated otherwise in this document and unless

• we are required by mandatory law to keep your personal data or
• if we need your personal data to enforce a claim or defend against legal claims,

we process and use your personal data

• only for as long as is required to fulfil the purposes described in this statement or
• until you object to our use (if we have a legitimate interest in processing your personal data in the meaning of Art 6 para. 1 lit. f GPDR) or
• until you revoke your consent (if we process your personal data on the basis of your consent in the meaning of Art 6 para. 1 lit. a GPDR).

Otherwise, we will keep your personal data until the end of the relevant retention period or until the respective claims have been settled.

According to the General Data Protection Regulation you have the following rights:

You have the right to be provided at any time with information about any of your personal data that is stored. Amongst others, you may request information about the purposes of processing, recipients to whom your data have been (or will be) disclosed, how long we intend to store your data, your rights regarding the rectification, erasure, or restriction of usage of personal data, the right to file a complaint, the origin of your data if not collected directly from you and the existence of automated decision-making (including profiling).

You may request the correction or completion of incorrect or incomplete personal data stored by us. We have to comply with your request without undue delay.

You have the right to request the deletion of your personal data if one of the following cases applies and the processing is not necessary according to Art 17 para. 3 GDPR:

• the personal data are no longer necessary to fulfill the purposes for which they were processed;
• you revoke your consent, if we processed your personal data on the basis of your consent in the meaning of Art 6 para. 1 lit. a GPDR and if there is no other legal ground for the processing;
• you object to the processing pursuant to Art. 21 para. 1 GPDR and there are no overriding legitimate grounds for the processing;
• you object to the processing pursuant to Art. 21 para. 2 GDPR;
• we have processed your personal data unlawfully;
• your personal data have to be deleted for compliance with a legal obligation in Union or Member State law to which we are subject;
• the personal data have been collected in relation to the offer of information society services according to Art. 8 para. 1 GDPR;

You may request the restriction of processing your personal data if one of the following applies:

• you dispute the accuracy of the personal data for a period enabling us to verify the accuracy of the personal data;
• the processing is unlawful but you refuse its deletion, instead you request the restriction of their use;
• we no longer need the personal data for the purposes of the processing, but you need them for the establishment, exercise or defense of legal claims;
• you have objected to processing pursuant to Art. 21 para. 1 GDPR but the verification whether our legitimate override yours is pending.

Unless this proves impossible or mean disproportionate effort, we will inform each recipient to whom the personal data have been disclosed about any rectification or erasure of personal data or restriction of processing. You have the right to be informed about those recipients if you request it.

You have the right to receive the personal data which we process on the basis of your consent (Art. 6 para. 1 lit. a GPDR) or in fulfilment of a contract or for measures preliminary to a contract (Art. 6 para. 1 lit. b GPDR) in a structured, common and machine-readable format or to request its transfer to a third party. If you require the direct transfer of data to another responsible party, this will only be done to the extent technically feasible.

If we process your personal data on the basis of our legitimate interests (Art. 6 para. 1 lit. f GDPR), you have the right to object to the processing of your personal data if

• the objection is based on reasons arising from your specific situation. In this case, we will no longer process the personal data unless we can demonstrate legitimate reasons for the processing that overrides your interests or for the establishment, exercise or defense of legal claims.
• if you object against direct advertising (as defined under "Usage of data within an existing relationship"). In this case you have a general right of objection.

If no other option is mentioned in this statement, simply send an email at privacy@biosolveit.de to execute your right of objection.

If we process your data on the basis of your consent (Art. 6 para. 1 lit. a GPDR) you may revoke your consent at any time with future effect. The data processed before we receive your request may still be legally processed. If no other option is offered, simply send an email making this request at privacy@biosolveit.de.

If you believe that we are not processing your personal data in accordance with the requirements of data protection legislation, you may file a complaint with the competent regulatory authorities of (i) your usual place of residence or workplace or (ii) of the state of Germany in which our company is headquartered. Here you can find contact details of German data protection officers: https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html.

Our website, products and services are targeted at persons over the age of 18. If we believe that we store personal data of a person under 18, we will delete that personal data.

Our website includes hyperlinks to websites of other providers. In these cases you will be redirected from our website directly to those websites. You can recognize this, for example, by the change of the URL. We cannot assume any responsibility for and have no control over the confidential handling and privacy policy of third parties.

We might change this privacy policy from time to time at our sole discretion. Please check this page periodically for changes. Replaced policies are archived.

Revised: 10.12.2021