I. Preamble For us, a trustworthy collaboration begins with the small things. This naturally includes protecting your data from the very beginning. With this privacy policy, we would like to inform you about the nature, scope, and purpose of the processing of your personal data that occurs through visiting our website and is partially used by us to make our services as pleasant as possible for our customers. We align ourselves with the requirements of the European Union's General Data Protection Regulation (hereinafter: GDPR), the German Federal Data Protection Act (hereinafter: BDSG), and the German Telemedia Act (hereinafter: TMG).

II. General Information a. Controller The controller within the meaning of the GDPR is:

Marx Distribution Managing Directors: Maximilian Marx, Horrenbergerstraße 42, 69168 Wiesloch, Germany, +49 1709927010, info@marxdistribution.de

c. Terminology The terms used in this privacy policy correspond to those of the GDPR and BDSG. The essential ones are:

"Personal data": any information relating to an identified or identifiable natural person (hereinafter "data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person (Art. 4 No. 1 GDPR);

"Processing": any operation or set of operations performed upon personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction (Art. 4 No. 2 GDPR);

"Third party": a natural or legal person, public authority, agency, or other body other than the data subject, controller, processor, and persons who, under the direct authority of the controller or processor, are authorized to process personal data (Art. 4 No. 10 GDPR);

"Consent": any freely given, specific, informed, and unambiguous indication of the data subject's wishes by which they, by a statement or by a clear affirmative action, signify agreement to the processing of personal data relating to them (Art. 4 No. 11 GDPR).

d. Types of Data On our website, we process the following types of data in particular:

• Inventory data (data necessary for establishing, implementing, modifying, or terminating a contractual relationship; e.g., name and address)
• Contact data (data through which you or your company can be reached; e.g., email address or telephone number)
• Content data (contents of transmitted messages; e.g., texts you enter, images, videos)
• Usage data (technical information about e.g., access times and visited websites)
• Communication data (data that gives us information about the communication path, e.g., the browser you use, device information, and IP addresses)

In the context of business-related processing, the following additional types of data are collected:

• Contract data (contract text and subject matter, duration, etc.)
• Payment data (e.g., bank details and booking history)

e. Affected Groups of Persons & General Purpose of Processing Personal data is collected from users of this website. The data collected from you is processed to provide this website and to respond to contact requests. Furthermore, we collect some data for the purpose of measuring reach and making our offering even more attractive for our customers. Please refer to the specific explanations in the course of this privacy policy for details on which data is specifically collected, on what legal basis this occurs, and how we process it.

f. Right of Withdrawal You naturally have the right to withdraw your given consent at any time without stating reasons in accordance with Art. 7 Para. 3 GDPR with effect for the future. The withdrawal is not bound to any particular form and becomes effective regardless of the medium used upon receipt and will be observed by us. To make it easier for you and us, however, we request that you send the withdrawal to the following email address: info@marxdistribution.de

g. Cookies We also use so-called "cookies" on our website. We point this out at the beginning of the website in a corresponding notice. These are small text files that are stored locally on your device and can, in principle, also store data beyond your visit to the respective website. "Cookies" generally serve to recognize a user on a website again and thus save them from having to re-enter information or settings. However, they can also be stored as a so-called "session cookie" only for the duration of your visit to a website and, for example, serve the correct functionality of the shopping cart of a webshop. Such a "session cookie" is automatically removed when you close your browser. Please refer to the following explanations for which cookies are used, which data is stored, and for what purpose they are used. If you generally want to avoid the use of cookies, common browsers also offer this option. However, we point out that this may impair the functionality of this and other websites under certain circumstances. In addition, you also have the possibility to preventively object to the setting of a cookie by some larger providers for online marketing and tracking purposes. This possibility is offered by the European website http://www.youronlinechoices.com or the US website http://www.aboutads.info/choices/.

h. General (Advertising) Objection We point out that you naturally always have the right, independently of visiting our website, to object to the processing of your personal data in accordance with Art. 21 GDPR. You also have the right to object to the processing of your personal data for direct marketing purposes according to Art. 21 Para. 2 GDPR. The objection is also not bound to any particular form and becomes effective regardless of the medium used upon receipt and will be observed by us. To make it easier for you and us, however, we request that you send the withdrawal to the following email address: info@marxdistribution.de

i. General Deletion and Blocking Provision We delete or block your personal data in accordance with Art. 17 and 18 GDPR. The data will be deleted by us in particular as soon as the purpose for which we originally collected the data has ceased to exist and no legal retention obligations exist. For example, we are legally obligated according to § 257 Para. 1 HGB to retain commercial books, inventories, opening balance sheets, annual financial statements, individual financial statements according to § 325 Para. 2a, management reports, consolidated financial statements, group management reports as well as the work instructions and other organizational documents necessary for their understanding, commercial letters, and accounting documents for a period of 6 years. In the case of legal retention obligations, we block the data so that we will only process it for the legally prescribed purpose.

j. Data Security To ensure the security of your data, we use the common Secure Socket Layer procedure (SSL procedure) for transmitting the website contents as well as the data you enter. The data transmitted between you and our hosting provider is encoded with 256-bit encryption. If your browser does not support 256-bit encryption, we use 128-bit v3 technology instead.

III. Your Rights The purpose of our efforts to protect your data is always to ensure your complete control over the information you provide. Therefore, in addition to the rights already described above, you also have further rights regarding the personal data stored with us, which we would like to describe individually below.

a. Right to Confirmation of Processing According to Art. 15 GDPR, you have the right to receive confirmation from us about the processing of your personal data.

b. Right to Information If we process personal data from you, you also have the right according to Art. 15 GDPR to know which data we have. We will provide you with the information according to the requirements of Art. 15 GDPR.

c. Right to Completion & Correction According to Art. 16 GDPR, you have the right to demand from us the immediate correction of incorrect personal data concerning you. Furthermore, you have the right to complete incomplete data stored with us.

d. Right to Deletion According to Art. 17 GDPR, you have the right to demand from us the immediate deletion of your personal data if one of the following points applies and no exception regulation according to Art. 17 Para. 2,3 GDPR is given:

• The personal data are no longer necessary for the purposes for which they were collected or otherwise processed.
• The data subject withdraws their consent on which the processing was based according to Article 6(1)(a) or Article 9(2)(a), and there is no other legal ground for the processing.
• The data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2).
• The personal data have been unlawfully processed.
• The personal data must be erased for compliance with a legal obligation under Union or Member State law to which the controller is subject.
• The personal data have been collected in relation to the offer of information society services referred to in Article 8(1).

e. Right to Restriction of Processing According to Art. 18 GDPR, you have the right to demand from us the immediate restriction of the processing of your personal data if one of the following conditions is met:

• The accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data,
• The processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead,
• The controller no longer needs the personal data for the purposes of processing, but they are required by the data subject for the establishment, exercise, or defense of legal claims, or
• The data subject has objected to processing pursuant to Article 21(1) pending the verification whether the legitimate grounds of the controller override those of the data subject.

Where processing has been restricted under paragraph 1, such personal data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise, or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State. Before a restriction is lifted, we will inform you accordingly.

f. Right to Data Portability According to Art. 20 GDPR, you have the right to receive the personal data concerning you from us in a structured, commonly used, and machine-readable format and to request that these be provided to a third party without hindrance. Limitations of this right may arise from Art. 20 GDPR.

g. Right to Lodge a Complaint According to Art. 77 GDPR, you have the right to lodge a complaint with the competent supervisory authority. You can reach the competent authority at the following address: ULD – Independent State Center for Data Protection Schleswig-Holstein; Holstenstraße 98, 24103 Kiel; Tel.: 0431-9881200: Fax.: 0431-9881223; Email: mail@datenschutzzentrum.de.

IV. Processing for Technical Functionality a. Website Hosting To make this website available to you, we work with a hosting provider. This provider supplies the infrastructure for the smooth operation of this website and ensures through regular maintenance that your data is not lost. To ensure the protection of your data and compliance with data protection standards, we have also obligated our hosting provider within the framework of a data processing agreement according to Art. 28 GDPR to maintain our high data protection standards. This provider processes inventory, contact, content, contract, usage, and communication data of the users of this website on the basis of our legitimate interest according to Art. 6 Para. 1 lit. f GDPR in maintaining and operating, as well as the security of this website on our behalf. In addition, usage data is generated with each visit to our website. This includes in particular the name of the accessed website, downloaded files, date and time of access, respective amounts of data transferred, messages about successful access to the website, browser type & operating system used, the previously visited page, the IP address, and the provider used. We or our hosting provider process this on our behalf and on the basis of our legitimate interest according to Art. 6 Para. 1 lit. f GDPR in protection against misuse and for security reasons. The personal data is stored for a period of 7 days and then automatically deleted, except for data whose further storage is necessary for evidence purposes.

b. Webshop Cookie To enable you to log in to our webshop and to ensure a functioning shopping cart, we place a cookie on your device that assigns you a unique identifier. We use the resulting personal data on the basis of our legitimate interest according to Art. 6 Para. 1 lit f GDPR in a functioning webshop system. The cookie is a so-called session cookie that automatically loses its validity after leaving our website and closing your browser and is usually automatically removed by your browser.

c. Webshop Processing You can register in our webshop system either as a guest or with a user profile account. The data requested from you in the input mask is processed for the purpose of processing the order of articles from our webshop on the basis of Art. 6 Para. 1 lit b GDPR. We also pass on your address data to our shipping service provider for the purpose of delivery.

d. Contact If you would like to contact us, our contact form is available to you. We process the data collected there for the purpose of processing your contact request according to Art. 6 Para. 1 lit. b GDPR. Should we remain in business contact beyond this, your personal data may also be processed within the framework of Customer Relationship Management in a corresponding system. If the data is no longer necessary after answering your inquiry, we will delete it unless legal archiving obligations exist.

e. Newsletter If you wish to stay informed about current products and information in the future, we offer you the possibility to subscribe to our email newsletter. To ensure that no third party registers with your email address, the registration process is designed as a so-called "double opt-in" procedure. After you have entered your email address in the field provided and activated the corresponding button for registration, you will receive an email from us containing a link to confirm your registration. By confirming the link, you simultaneously give your consent to the further use of your personal data necessary for sending the newsletter. For the purpose of verifiability, we log this registration and process registration and confirmation time, IP address, and the provided email address on the basis of our legitimate interest in the verifiability of a registration according to Art. 6 Para. 1 lit. f GDPR. We use your provided email address and your name for sending the newsletters and personal address. We process these on the basis of your consent according to Art. 6 Para. 1 lit. a, Art. 7 GDPR in conjunction with § 7 Para. 2 No. 3 UWG, as well as on the basis of legal permission according to § 7 Para. 3 UWG. If you no longer wish to receive the newsletter in the future, you can cancel the subscription at any time. You will find a corresponding unsubscribe link at the end of each newsletter. Of course, you can also simply send us an email to the following address: info@marxdistribution.de After cancellation, we can store your name and email address on the basis of our legitimate interest in the verifiability of the formerly given consent according to Art. 6 Para. 1 lit. f GDPR for up to 3 years. The data is kept exclusively for this purpose and is blocked for use for other purposes.

V. Use of Third-Party Services - Technical Functionality and Information a. Google Analytics We use the "Google reCAPTCHA" service from Google on our website based on our legitimate interest in protecting against spam and protecting our form fields from misuse according to Art. 6 Para. 1 lit f GDPR. The use of this tool allows us to determine whether a human is making entries on our website or if this is happening through an automated process. For this purpose, automatically generated content from Google in the form of small picture puzzles is downloaded from Google servers and users are prompted to solve them. During this process, the original URL, IP address, website visitor behavior, information about the operating system used, browser, time spent, installed cookies, information about the website display, as well as user inputs and mouse movements in the reCAPTCHA checkbox area are transmitted to Google. Google uses the collected data to digitize text, support image recognition, and improve machine learning. Further information about data protection at Google can be found at: https://policies.google.com/privacy?hl=en.

VI. Use of Third-Party Services - Social Plugins Of course, our company is also represented on Facebook, Twitter, Youtube, Vimeo, and Instagram. To give you the opportunity to connect with us there, we have placed corresponding links to these social media platforms. We have deliberately avoided using plugins. Personal data is only transferred to these platforms after switching to the respective website.

VII. Status and Changes to this Privacy Policy This privacy policy is dated May 2018 and is the current version. However, due to the ongoing development of our website and services, as well as legal requirements, it may become necessary to modify this privacy policy at any time. The current privacy policy can always be accessed at https://marxdistribution.de › pages › privacy-policy