Note: This is a non-binding English translation provided for convenience. The legally binding version of this privacy policy is the German version ("Datenschutzerklärung"). In case of any discrepancies or conflicts between this translation and the German original, the German version shall prevail.

1 Name and Address of the Controller

The controller within the meaning of the General Data Protection Regulation and other national data protection laws of the member states as well as other data protection provisions is:

• Company: Best4Tires GmbH (referred to as "B4T")

• Managing Directors: Armin Heß, Moritz Blum

• Address: Best4Tires GmbH, Rathausstraße 52-58, 56203 Höhr-Grenzhausen, Germany

• Contact: Website: https://www.best4tires.com/, Email: info@best4tires.com, Tel.: 02684 9450-0, Fax: 02684 9450-156

Competent Court:

• Local Court (Amtsgericht) Montabaur

• Commercial Register Number: 12794

• VAT ID: DE 157837971

2 Name and Address of the Data Protection Officer

The data protection officer of the controller is:

• Rudolf Schwaderlapp

• Address: Schwaderlapp Rechtsanwälte, Hubertusstr. 14, 56235 Ransbach-Baumbach, Germany

• Contact: Tel: +49 2623 98990, Email: datenschutz@schwaderlapp-ra.de

3 General Information on Data Processing

3.1 Scope of Processing of Personal Data

We collect and use personal data of our users only to the extent necessary to provide a functioning website and our content and services. The collection and use of personal data of our users regularly only takes place with the consent of the user. An exception applies in cases where obtaining prior consent is not possible for factual reasons and the processing of the data is permitted by legal provisions.

3.2 Legal Basis for the Processing of Personal Data

Insofar as we obtain the consent of the data subject for processing operations involving personal data, Art. 6 (1) lit. a of the EU General Data Protection Regulation (GDPR) serves as the legal basis.

When processing personal data that is necessary for the performance of a contract to which the data subject is a party, Art. 6 (1) lit. b GDPR serves as the legal basis. This also applies to processing operations that are necessary for carrying out pre-contractual measures.

Insofar as the processing of personal data is necessary to fulfill a legal obligation to which our company is subject, Art. 6 (1) lit. c GDPR serves as the legal basis.

In the event that vital interests of the data subject or another natural person require the processing of personal data, Art. 6 (1) lit. d GDPR serves as the legal basis.

After weighing whether the interest of the company (or a third party) or the interest, fundamental right, or fundamental freedom of the data subject prevails, Art. 6 (1) lit. f GDPR may be applied as the legal basis for the processing.

3.3 Data Deletion and Storage Period

The personal data of the data subject will be deleted or blocked as soon as the purpose of the storage no longer applies. Storage may also take place if this has been provided for by the European or national legislator in EU regulations, laws, or other provisions to which the controller is subject. Data will also be blocked or deleted if a prescribed storage period expires, unless further storage is necessary for the conclusion or performance of a contract or to safeguard legal claims.

4 Provision of the Website and Creation of Log Files

4.1 Hosting and Administration

Our homepage is hosted by external service providers. These service providers are:

Diva-e Digital Value Excellence GmbH – Hosting of the web shop (eBusiness Portal)

We are also supported by Diva-e Digital Value Excellence GmbH, St.-Martin-Straße 72, 81541 Munich, in administering our internet presence.

The necessary contracts have been concluded with the service providers.

4.2 Description and Scope of Data Processing

Every time our website is accessed, our system automatically collects data and information from the computer system of the accessing computer. The following data is collected:

1. The user's IP address (anonymized)

2. Directory protection users

3. Date and time of access

4. Websites accessed from the user's system via our website

5. Protocols

6. Status code

7. Amount of data

8. Referrer

9. User agent

10. Hostname accessed

11. The browser type and version used (if transmitted by the user)

12. The operating system

13. Number of visits

14. Time spent on the website

15. The previously visited website (if transmitted by the user)

This data is also stored in the log files of our system. This data is not stored together with other personal data of the user.

4.3 Purpose of Data Processing

The temporary storage of the IP address by the system is necessary to enable delivery of the website to the user's computer. For this, the user's IP address must remain stored for the duration of the session.

Storage in log files is carried out to ensure the functionality of the website. In addition, we use the data to optimize the website and to ensure the security of our information technology systems. The data is not evaluated for marketing purposes in this context.

4.4 Legal Basis for the Data Processing

The legal basis for the temporary storage of the data and the log files is Art. 6 (1) lit. f GDPR.

4.5 Duration of Storage

The data will be deleted as soon as it is no longer necessary for achieving the purpose for which it was collected. In the case of data collection for providing the website, this is the case when the respective session has ended. In the case of storage of data in log files, this is the case after seven days at the latest. Storage beyond this period is possible. In this case, the IP addresses of users are deleted or anonymized so that it is no longer possible to assign the requesting client.

4.6 Right to Object and Removal Options

The collection of data for providing the website and the storage of data in log files is mandatory for the operation of the website. Consequently, there is no possibility for the user to object.

5 Additional Functions and Offers of Our Website

In addition to purely informational use of our website, we offer various services that you can use if you are interested. We also use other common functions for analysis and marketing of our offers, which are presented in more detail below. As a rule, you will need to provide further personal data for this, or we process such further data that we use to carry out the respective services. The principles of data processing described in Section 3 apply to all data processing purposes described here.

In some cases, we use external service providers to process your data. We have concluded so-called data processing agreements with these providers in accordance with Art. 28 GDPR. The service providers are carefully selected by us, are bound by our instructions, and are regularly monitored.

Furthermore, we may pass on personal data to third parties if, for example, promotions, competitions, contract conclusions, or similar services are offered by us together with partners. Depending on the service, your data may also be collected by the partners under their own responsibility. Further information can be found when you provide your data or in the description of the respective offers and/or services.

To the extent our service providers or partners are located in a country outside the European Economic Area (EEA), we will inform you of the consequences of this circumstance in the respective description of the offer and/or service.

5.1 Use of Cookies and Other Technologies

5.2 Consent Management Technology

We use the Usercentrics service from Usercentrics GmbH (Sendlinger Str. 7, 80331 Munich, Germany) for consent management. This software enables us to obtain and manage the consent of website visitors for data processing.

Legal basis: The use of this tool is based on Art. 6 (1) lit. c GDPR (fulfillment of a legal obligation) in conjunction with Art. 7 (1) GDPR.

Necessity: Without this software, the functionality of the website cannot be guaranteed (technical cookie).

Processed data:

- Date and time of access

- Browser information

- Device information

- Geographic location

- Cookie preferences

- URL of the visited page

Usercentrics is the recipient of your personal data and acts as our processor. Processing takes place in the European Union.

Further information on options for objection and removal with respect to Usercentrics can be found at: Usercentrics privacy policy.

Storage period: The collected data will be deleted after a maximum of 3 years.

5.3 Use of Analytics and Tracking Tools

5.3.1 Hotjar

We use Hotjar to better understand the needs of our users and to optimize this service and experience. Hotjar is a technology service that helps us better understand our users' experiences (e.g., how much time they spend on which pages, which links they click, what users like and don't like, etc.) and enables us to build and maintain our service based on user feedback. Hotjar uses cookies and other technologies to collect data on the behavior of our users and their devices. This includes:

- IP address of a device (stored anonymized)

- Screen size of the device

- Device type (unique device identifiers)

- Browser information

- Geographic location (country only)

- Preferred language of the website

Hotjar stores this information in a pseudonymized user profile on our behalf. Hotjar is contractually prohibited from selling the data collected on our behalf.

Service provider: Hotjar Germany GmbH, Gontardstraße 11, 10178 Berlin, Germany.

Legal basis: Art. 6 (1) lit. a GDPR. You can withdraw your consent at any time for the future in the "cookie banner."

Further details can be found in the Hotjar privacy policy: https://www.hotjar.com/legal/policies/privacy/.

5.3.2 Google Analytics

We use the Google Analytics analysis service on our website and the Google Tag Manager necessary for this. The data obtained from this is used to optimize our website and improve it for you. Google Analytics is provided by Google Ireland Limited. Google processes the data on website usage on our behalf and is contractually obligated to take measures to ensure the security and confidentiality of the processed data.

Processed data:

- Pages visited

- Orders including revenue and products ordered

- Achievement of "website goals" (e.g., contact inquiries, newsletter sign-ups)

- Behavior on pages (dwell time, clicks, scrolling behavior)

- Approximate location (country and city)

- IP address (truncated)

- Technical information (browser, internet provider, device, screen resolution)

- Source of the visit (website or advertising medium)

- Website interactions

- Repeat visits

Data such as name, address, and general contact details are never transmitted to Google Analytics.

Data transfer: We take appropriate security measures, including the conclusion of EU Standard Contractual Clauses, when personal data is processed outside the EU and no adequacy decision by the European Commission is in place. These security measures serve the purpose of ensuring an adequate level of data protection in the third country.

Storage period: User-related data is automatically deleted after 14 months. Other data remains stored in aggregated form indefinitely.

Legal basis: Art. 6 (1) lit. a GDPR. You can object to this collection at any time by installing the browser add-on to disable Google Analytics or by rejecting cookies in the "cookie banner."

5.3.3 Google Tag Manager

We use the Google Tag Manager organizational tool on our website to use, integrate, and manage various tools. Google Tag Manager is provided by Google Ireland Limited. Google processes the data on our behalf and is contractually obligated to take measures to ensure the security and confidentiality of the processed data.

Data processing: Google Tag Manager itself does not collect any data. The data is collected and processed by the individual analytics tools.

Data transfer: The collected data is transmitted to servers in the USA. We take appropriate security measures, including the conclusion of EU Standard Contractual Clauses, when personal data is processed outside the EU and no adequacy decision by the European Commission is in place. These security measures serve the purpose of ensuring an adequate level of data protection in the third country.

Storage period: User-related data is automatically deleted after 14 months. Other data remains stored in aggregated form indefinitely.

Legal basis: Art. 6 (1) lit. a GDPR. You can object to this collection at any time by rejecting cookies in the "cookie banner."

Further information can be found in the Google Tag Manager FAQs: https://support.google.com/tagmanager/?hl=en#topic=3441530.

5.3.4 Sentry

We use the Sentry tool on our website to improve the quality and stability of our application. Sentry collects data generated through error reports and performance monitoring tools. Both data provided by the user and information collected by Sentry from devices and usage behavior are collected and processed. This includes:

- Device information: IP address, device type, unique device identification numbers, browser type, operating system, installed software, general location information, referring URLs.

- Usage data: Information about how the user and their device interact with the website or service (pages visited, features used, services purchased, links clicked, access times and duration).

- Cookies and similar tracking technologies: Sentry uses cookies to store preferences, collect aggregated data on website and service interactions, and offer personalized content.

- Error reports: Information about errors that have occurred, including stack traces, log data, and error metadata.

- Performance data: Information about application performance (loading times, response times, resource usage).

- Communication data: Content of inquiries and correspondence related to errors and performance issues.

The data is used for error analysis, performance monitoring, and to improve application stability. The data is stored on Sentry's servers.

Service provider: Sentry Inc., 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA.

Data transfer: Your personal data is transmitted to third countries, in particular the USA. We take appropriate security measures, including the conclusion of EU Standard Contractual Clauses, when personal data is processed outside the EU and no adequacy decision by the European Commission is in place. These security measures serve the purpose of ensuring an adequate level of data protection in the third country.

Further details can be found in the Sentry privacy policy: https://sentry.io/privacy/.

Legal basis: Art. 6 (1) lit. a GDPR. You can withdraw your consent at any time for the future in the "cookie banner."

5.4 Use of Marketing Tools

5.4.1 Google Ads & Remarketing

We use the Google Ads organizational tool on our website. Google Ads is an online advertising program of Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google"). In addition, the remarketing function within the Google Ads service is used. The remarketing function allows advertisements based on your interests to be shown to you on other websites within the Google advertising network. For this purpose, your browsing behavior on our website is analyzed, e.g., which offers you have viewed. As a result, individualized advertising, so-called "Google Ads," can be displayed to you even after your visit to our website on the Google search engine itself and on other websites. As a prerequisite for this, Google stores a cookie in your browser when you visit Google services or websites within the Google advertising network. Your visits are recorded via this cookie. The cookie serves to uniquely identify your web browser and not to identify you personally.

Further information on Google Remarketing and Google's privacy policy can be found at Google Privacy & Terms.

Processed data:

- Pages visited

- Orders including revenue and products ordered

- Behavior on pages (dwell time, clicks, scrolling behavior)

- IP address (truncated)

- Technical information (browser, internet provider, device, screen resolution)

- Source of the visit (website or advertising medium)

- Website interactions

- Repeat visits

Data transfer: The collected data is transmitted to servers in the USA. We take appropriate security measures, including the conclusion of EU Standard Contractual Clauses, when personal data is processed outside the EU and no adequacy decision by the European Commission is in place. You can obtain the text of the EU Standard Contractual Clauses and the adequacy decisions on the websites of the European Commission. These security measures serve the purpose of ensuring an adequate level of data protection in the third country.

Storage period: User-related data is automatically deleted after 14 months. Other data remains stored in aggregated form indefinitely.

Legal basis: Art. 6 (1) lit. a GDPR. You can disable Google's use of cookies and thereby withdraw the consent you gave for the use of the Google Ads & Remarketing service by following the link below and downloading and installing the plug-in provided there: www.google.com/settings/ads/plugin.

5.4.2 Microsoft Bing Ads

We use technologies from Bing Ads on our website, which are operated by Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA. The so-called Microsoft Conversion Tracking is used, whereby Microsoft places a cookie on your device if you reached our website via a Microsoft Bing advertisement or another route. In this way, Microsoft and we can recognize that you clicked on an advertisement, were redirected to the website, and reached a predetermined target page ("conversion site") that was linked via the advertisement. Furthermore, Microsoft and we can see that you accessed the website via another route and made a purchase or used a service defined as a conversion.

We also use Microsoft's retargeting technology, whereby information about your user behavior on our website is collected and stored. Cookies may be used for this. The cookies enable Microsoft to collect, process, and use information from the cookies to create user profiles from the data using pseudonyms. These user profiles serve to analyze visitor behavior, which allows us to show you, who have already shown interest in our website and our content/offers, relevant advertising and offers via Bing Ads. No personal information about the identity of the user is processed.

Data transfer and processing: Due to the marketing tool used, your browser automatically establishes a direct connection with Microsoft's server. We have no influence on the scope and further use of the data collected by Microsoft through the use of this tool beyond the purposes mentioned. The following are processes known to us:

- Through the integration of Microsoft, Microsoft receives the information that you have accessed the corresponding part of our website or clicked on an advertisement from us.

- If you are registered with a Microsoft service, Microsoft can assign the visit to your account.

- Even if you are not registered with Microsoft or have not logged in, it is possible that the provider will find out and store your IP address.

Processed data:

- Pages visited

- Orders including revenue and products ordered

- Behavior on pages (dwell time, clicks, scrolling behavior)

- IP address (truncated)

- Technical information (browser, internet provider, device, screen resolution)

- Source of the visit (website or advertising medium)

- Website interactions

- Repeat visits

Data transfer: The collected data is transmitted to servers in the USA. We take appropriate security measures, including the conclusion of EU Standard Contractual Clauses, when personal data is processed outside the EU and no adequacy decision by the European Commission is in place. You can obtain the text of the EU Standard Contractual Clauses and the adequacy decisions on the websites of the European Commission. These security measures serve the purpose of ensuring an adequate level of data protection in the third country.

Storage period: User-related data is automatically deleted after 13 months. Other data remains stored in aggregated form indefinitely. Microsoft retains your data from the UET tag for 180 days.

Further details on data processing can be found in Microsoft Corporation's privacy policy: www.microsoft.com/en-us/privacy/privacystatement.

Legal basis: Art. 6 (1) lit. a GDPR. You can withdraw your consent to data collection and storage at any time with effect for the future. To do so, click on the following link: account.microsoft.com/privacy/ad-settings.

5.4.3 Mailchimp

To keep you up to date, we use the service provider Mailchimp to send current information. Mailchimp belongs to The Rocket Science Group LLC, 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, Georgia 30308, which belongs to Intuit Inc. This service provider enables us to contact you directly and, if necessary, to optimize our offer through analysis of usage behavior. We use Mailchimp to inform customers and prospects about, for example, company events such as trade fairs, as well as to inform existing customers about offers, price changes, and other relevant news.

Processed data:

- First and last name

- Email address

Mailchimp also collects the following personal data:

- IP address

- Device information

- Information about the browser, operating system, and application used to read the email

- Further information on hardware and internet connection

- Date and time

Data transfer: The collected data is transmitted to servers in the United States. We take appropriate security measures, including the conclusion of EU Standard Contractual Clauses, when personal data is processed outside the EU and no adequacy decision by the European Commission is in place. These security measures serve the purpose of ensuring an adequate level of data protection in the third country.

Further information can be found at this link: www.intuit.com/privacy/statement/.

Legal basis: Art. 6 (1) lit. a GDPR. You have the right to object to the data processing or withdraw your consent. To do so, please contact us at privacy@best4tires.com.

5.4.4 Twilio Marketing Campaigns

Description and purpose

Twilio Marketing Campaigns is a tool that enables us to conduct targeted marketing campaigns across various communication channels such as SMS, email, and social media. With Twilio, we can send personalized messages to our customers and prospects to inform them about current offers, events, and news. The tool helps us increase the reach of our marketing measures and improve interaction with our customers.

Processed data:

- Contact data (e.g., phone number, email address)

- Communication content (e.g., messages, offers)

- Usage data (e.g., open and click rates)

Legal basis: Art. 6 (1) lit. a GDPR. Insofar as the processing is based on your consent, you can withdraw your consent at any time for the future in the "cookie banner."

6 Use of Our Portal, Orders, and Payment Methods

6.1 Registration and Use of Our Portal

For our business customers, there is the possibility to register in our portal and benefit from other services in addition to ordering in our online shop.

If you wish to use our portal, you must register by providing your first and last name, your email address, and a self-chosen password. Providing the aforementioned data as well as the company name and address is mandatory. All other information (including your bank details and VAT ID) can be provided voluntarily by using our portal. We use the so-called double opt-in procedure for this service, i.e., you receive an email in which you must confirm that you are the holder of the email address provided and wish to receive notifications. You can unsubscribe from the notifications at any time, e.g., by clicking on the link in the email or by contacting us using the contact details provided. Your provided data as well as the dates of your registration for the service and your IP address will be stored by us until you unsubscribe from the notification service.

When you use our portal, we store your data required for contract fulfillment, including payment method information, until you permanently delete your account. Furthermore, we store the voluntary data you have provided for the duration of your use of the portal, unless you delete it beforehand. You can manage and change all information in the protected customer area.

Legal basis: Art. 6 (1) sentence 1 lit. b GDPR.

To prevent unauthorized access by third parties to your personal data, in particular financial data, the connection is encrypted using TLS technology.

6.2 Order Process, Delivery, and Scope of Data Processing

Unless already collected as part of the registration process, we additionally collect the following data as part of the order process:

- Billing and delivery address

- Payment method

Legal basis: Contract performance pursuant to Art. 6 (1) lit. b GDPR.

6.2.1 Returns

In the case of returns, we offer you the option via our portal to contact us directly and create and submit return slips. In the event of contact, we process the data to the extent necessary to process the return.

6.2.2 Disclosure of Your Email Address to Shipping Service Providers

If you order via our online shop, you will receive an order and shipping confirmation via your email address, as well as, depending on the respective transport service provider, notification of package announcement and possible delivery options. If you do not want this, please contact us at privacy@best4tires.com to have your email address blocked from forwarding by us.

6.2.3 PTV Axylog

We use PTV Axylog as an interface to our shipping service provider. It enables us to have real-time transport visibility and control, which optimizes our delivery processes. The service provider is PTV Logistics GmbH, Stumpfstraße 1, 76131 Karlsruhe.

Legal basis: Legitimate interest pursuant to Art. 6 (1) lit. f GDPR and contract performance pursuant to Art. 6 (1) lit. b GDPR. You have the right at any time to object to the forwarding of your email address or to have it blocked. Please contact us at privacy@best4tires.com for this purpose.

6.3 Payment Methods

We use the payment service provider Payone, Payone GmbH, Lyoner Straße 9, 60528 Frankfurt am Main, to process our payment transactions. During the payment process, Payone processes the following data from you:

- Master data (name, address)

- Financial data (account number, bank code, credit card number)

- Invoice amount

Legal basis: Art. 6 (1) lit. b GDPR (performance of a contract).

You can object to the data storage at any time, although the functionality of the site is then limited. Data subject to retention periods will be deleted after the expiry of these periods.

6.4 Other Digital Services

As part of our customer relationship management, we use the tool "Salesforce." Your customer data, which you provided as part of your registration, is passed on to this service provider. This tool helps us manage and optimize our customer relationships efficiently. It helps us process customer inquiries faster, create personalized offers, and improve communication with our customers.

Provider: salesforce.com Inc., One Market Street, Suite 300, San Francisco, CA 94105, USA.

Data transfer to a third country: The data is transmitted to a server in the United States. We implement appropriate security measures, including the conclusion of EU Standard Contractual Clauses, when personal data is processed outside the EU and no adequacy decision by the European Commission is in place. The corresponding document can be found at: Salesforce Data Processing Addendum: https://www.salesforce.com/content/dam/web/en_us/www/documents/legal/Agreements/data-processing-addendum.pdf. These oblige the service providers to comply with European data protection standards when processing your personal data.

Legal basis: Art. 6 (1) lit. a GDPR. The disclosure of the data is based on the customer's consent given during registration. You have the right to object to the data processing or withdraw your consent. To do so, please contact us at privacy@best4tires.com.

6.5 Storage4Tires

In addition to the option of registering in our portal and ordering in our online shop, you have the option of using another digital service.

Via our portal, we offer a digital storage service for the efficient management and organization of tire storage. Data processing as part of this service includes all data related to the storage of tires and the associated processes. This includes, among other things, the collection, storage, and processing of customer data, relevant information about tire specifications, and storage locations.

This service can only be used after concluding a corresponding contract.

Legal basis: Contract performance pursuant to Art. 6 (1) lit. b GDPR.

7 Ways to Contact Us

7.1 Contact Form and Email Contact

Description and scope of data processing

Our website has a contact form that can be used for electronic contact. If a user makes use of this option, the data entered in the input mask is transmitted to us and stored. This data is:

- Gender (optional)

- Last name (mandatory)

- First name (mandatory)

- Phone number (optional)

- Email address (mandatory)

- Address (optional)

- Postal code (optional)

- Country (mandatory)

- Message/text

- File attachment (image)

At the time the message is sent, the following data is also stored:

- The user's IP address

- Date and time of registration

For the processing of the data, your consent is obtained as part of the sending process, and reference is made to this privacy policy.

Alternatively, contact can be made via the email address provided under Section 1. In this case, the personal data of the user transmitted with the email is stored. No disclosure of the data to third parties takes place in this context. The data is used exclusively for processing the conversation.

The processing of the personal data from the input mask serves solely to process your contact request. In the event of contact by email, this also constitutes the necessary legitimate interest in the processing of the data. The personal data processed as part of the sending process serves to prevent misuse of the contact form and to ensure the security of our information technology systems.

The data will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected. For the personal data from the input mask of the contact form and those sent by email, this is the case when the respective conversation with the user has ended. The conversation is ended when it can be inferred from the circumstances that the matter in question has been conclusively clarified. The personal data additionally collected as part of the sending process will be deleted after a period of seven days at the latest.

Legal basis: Art. 6 (1) lit. a GDPR for the processing of data via the contact form. Art. 6 (1) lit. f GDPR for the processing of data transmitted in the course of sending an email. If the email contact is aimed at concluding a contract, Art. 6 (1) lit. b GDPR serves as the legal basis for the processing.

You can withdraw your consent to the processing of personal data at any time via privacy@best4tires.com. If you contact us by email, you can object to the storage of your personal data at any time. In such a case, the conversation cannot be continued.

7.2 Newsletter & Pardot

Newsletter registration

You have the option to subscribe to our newsletter on our website and receive further information. We use the so-called double opt-in procedure for data protection-compliant registration. This means that after your registration you will receive an email at the address provided, where you must confirm that you wish to receive the newsletter. For this purpose, the respective IP address and the time of registration and confirmation are stored.

Legal basis: Your consent pursuant to Art. 6 (1) lit. a GDPR.

Data processing and storage

The data is deleted after the purpose has been achieved. Upon successful registration, the data is stored for the duration of the subscription.

Use of Pardot

We use the Salesforce tool Pardot to send our newsletter and the associated processing of your data. Pardot is provided by Salesforce Inc., a company from the USA (Salesforce Tower, 415 Mission Street, 3rd Floor, San Francisco, CA 64105). In addition to sending, the software also allows us to recognize users' reading habits and adjust the content accordingly.

Data transfer to the USA, legal basis

The collected data is transmitted to servers in the USA. We implement appropriate security measures, including the conclusion of EU Standard Contractual Clauses, when personal data is processed outside the EU and no adequacy decision by the European Commission is in place. These security measures serve the purpose of ensuring an adequate level of data protection in the third country.

8 Social Media and Referrals to Third Parties

8.1 Social Media Platforms

We have various presences on social media platforms, and our website contains corresponding links to these social media presences. Among others, we maintain online presences on Facebook, Instagram, LinkedIn, Xing, and YouTube (further information in the following list).

Use of social media platforms

We rely on the technical platform and services of the providers for these information services. Please note that you use our social media platform presences and their functions at your own responsibility. This applies in particular to the use of interactive functions (e.g., commenting, sharing, rating).

Collection and processing of data

When visiting our presences, the providers of the social media platforms collect, among other things, your IP address and other information present in the form of cookies on your device. This information is used to provide us, as operators of the accounts, with statistical information about interaction with us.

The data collected about you in this context is processed by the platforms and may be transferred to countries outside the European Union, in particular the USA. So-called Standard Contractual Clauses provided by the EU Commission have been concluded as the legal basis for the processing of personal data in third countries (with the exception of Xing, since this provider is based within the EU).

Unknown data processing by social media platforms

We do not know how the social media platforms use the data from your visit to our account and your interaction with our posts for their own purposes, how long this data is stored, or whether data is passed on to third parties. Data processing may differ depending on whether you are registered and logged in with the social network or visit the page as an unregistered and/or not logged-in user.

Measures to protect your data

When accessing a post or the account, the IP address assigned to your device is transmitted to the provider of the social media platform. If you are currently logged in as a user, a cookie on your device can be used to track how you have moved around the network. Through buttons embedded in websites, the platforms are able to record your visits to these websites and assign them to your respective profile. Based on this data, content or advertising can be tailored to you. If you want to avoid this, you should log out or deactivate the "stay logged in" function, delete the cookies on your device, and restart your browser.

Processing by us

As the provider of the information service, we furthermore only process the data from your use of our service that you provide to us and that requires interaction. If, for example, you ask a question that we can only answer by email, we will store your information in accordance with the general principles of our data processing described in this privacy policy.

Legal basis: Art. 6 (1) sentence 1 lit. f GDPR.

Exercising your rights as a data subject

To exercise your rights as a data subject, you can contact both us and the provider of the social media platform. If one party is not responsible for the response or the information must be obtained from the other party, we or the provider will forward your request to the respective partner. Please contact the operator of the social media platform directly for questions about profiling and the processing of your data when using the website. For questions about the processing of your interaction with us on our page, please write to the contact details provided above.

Further information

The providers describe in their privacy policies (link see in the following list) what information the social media platform receives and how it is used. There you will also find information about contact options as well as setting options for advertisements. Further information on social networks and how you can protect your data can also be found at www.youngdata.de.

8.2 Social Media Presences

8.2.1 Facebook

Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland

Facebook

https://www.facebook.com/about/privacy?tid=331684847184

8.2.2 Instagram

Instagram LLC, Building 14 First Floor Menlo Park, CA, USA

Best4Tires GmbH (@best4tires) – Instagram photos and videos

https://www.instagram.com/about/legal/privacy/

8.2.3 LinkedIn

LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland

LinkedIn

LinkedIn Privacy Policy

8.2.4 Xing

New Work SE, Am Strandkai 1, 20457 Hamburg

Best4Tires GmbH: Information and news | XING

Data protection at XING

8.2.5 YouTube

Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland

https://www.youtube.com/@best4tires

Privacy Policy – Privacy Policy & Terms of Use – Google

8.3 Social Media Marketing

Advertising with Facebook (Pixel and Conversion Tracking)

Via our social media presence on Facebook, we use the opportunity to advertise our products and services. The aim and purpose is to reach a broad network that we cannot reach through other traditional marketing channels (e.g., flyers).

Use of the Facebook Pixel

We use advertising measures from Facebook Inc. ("Facebook") on our website. By integrating the so-called "Facebook Pixel" on our website, we can show users of our website and the Facebook social network our advertising measures ("Facebook Ads") and measure and evaluate their success ("conversion tracking"). This connection between Facebook and our website takes place technically via the "Facebook Pixel."

Legal basis: The processing of your data is carried out in accordance with Art. 6 (1) sentence 1 lit. a GDPR, i.e., the integration only takes place with your consent.

Data transfer and processing

Due to the marketing tools used, your browser automatically establishes a direct connection with Facebook's server when you visit our website. We have no influence on the scope and further use of the data collected by Facebook through the use of this tool. The following are processes known to us:

- Through the integration of the Facebook Pixel, Facebook receives the information that you have accessed the corresponding page of our website or clicked on an advertisement from us.

- If you are registered with a Facebook service, Facebook can assign the visit to your account.

- Even if you are not registered with Facebook or have not logged in, it is possible that the provider will find out your IP address and other identifying features and use them for profiling.

Storage and data protection

The collected information is stored on Facebook's servers, including in the USA. We implement appropriate security measures, including the conclusion of EU Standard Contractual Clauses, when personal data is processed outside the EU and no adequacy decision by the European Commission is in place. These security measures serve the purpose of ensuring an adequate level of data protection in the third country.

Remarketing function "Custom Audiences"

We also use the "Custom Audiences" remarketing function, which also uses the Facebook Pixel. This function makes it possible to display interest-based advertisements when you visit our website or other websites that also have the Facebook Pixel integrated. In this way, we can show you advertising that is of interest to you, in order to make our website more interesting for you and to market our offer.

Withdrawal of your consent

Withdrawal of your consent is possible at any time, without affecting the lawfulness of the processing until the withdrawal. You can most easily withdraw your consent via our cookie banner or at www.facebook.com/ads/preferences (logged-in users only).

8.4 Integration of Third-Party Services

Integration of YouTube videos

We have integrated YouTube videos into our online offering, which are stored on YouTube.com and can be played directly from our website. These are all integrated in "extended data protection mode," which means that no data about you as a user is transmitted to YouTube if you do not play the videos. Only when you play the videos are the data mentioned above (such as IP address and timestamp) transmitted. We have no influence on this data transmission.

Legal basis: Art. 6 (1) lit. a GDPR, the integration therefore only takes place with your consent.

Google Maps

A link to our location on Google Maps is available on our website. This service is offered by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Ireland Limited is a subsidiary of the American company Alphabet Inc. Through this link, we enable you to conveniently use the map function. Here too, the extended data protection mode applies. Only when you click on the link and have given your consent in the cookie banner can data be processed. We have no knowledge of or influence on the possible collection and use of your data by Google.

Legal basis: Art. 6 (1) lit. a GDPR. Withdrawal of your consent is possible at any time, without affecting the lawfulness of the processing until the withdrawal. You can most easily withdraw your consent via our cookie banner.

OpenStreetMap

OpenStreetMap is a map provider we use to enable shipment tracking of deliveries for you. The provider of OpenStreetMap is the OpenStreetMap Foundation, 132 Maney Hill Road, Sutton Coldfield, West Midlands, B72 1JU, UK.

Legal basis: Art. 6 (1) lit. a GDPR. Withdrawal of your consent is possible at any time, without affecting the lawfulness of the processing until the withdrawal. You can most easily withdraw your consent via our cookie banner.

9 Rights of the Data Subject

If personal data about you is processed, you are a data subject within the meaning of the GDPR, and you have the following rights against the controller:

9.1 Right of Access

You can request confirmation from the controller as to whether personal data concerning you is being processed by us. If such processing exists, you can request information from the controller about the following:

1. The purposes for which the personal data is processed.

2. The categories of personal data being processed.

3. The recipients or categories of recipients to whom the personal data concerning you has been or will be disclosed.

4. The planned duration of storage of the personal data concerning you, or, if specific information on this is not possible, criteria for determining the storage period.

5. The existence of a right to rectification or erasure of the personal data concerning you, a right to restriction of processing by the controller, or a right to object to such processing.

6. The existence of a right to lodge a complaint with a supervisory authority.

7. All available information about the origin of the data, if the personal data is not collected from the data subject.

8. The existence of automated decision-making, including profiling, pursuant to Art. 22 (1) and (4) GDPR, and — at least in these cases — meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for the data subject.

You have the right to request information about whether the personal data concerning you is transferred to a third country or to an international organization. In this context, you can request to be informed about the appropriate safeguards pursuant to Art. 46 GDPR in connection with the transfer.

9.2 Right to Rectification

You have the right to rectification and/or completion vis-à-vis the controller if the personal data concerning you that is processed is inaccurate or incomplete. The controller must carry out the rectification without undue delay.

9.3 Right to Restriction of Processing

Under the following conditions, you can request the restriction of the processing of personal data concerning you:

1. If you dispute the accuracy of the personal data concerning you, for a period enabling the controller to verify the accuracy of the personal data.

2. The processing is unlawful and you refuse the erasure of the personal data and instead request the restriction of the use of the personal data.

3. The controller no longer needs the personal data for the purposes of processing, but you need it to assert, exercise, or defend legal claims.

4. If you have objected to the processing pursuant to Art. 21 (1) GDPR and it is not yet clear whether the legitimate grounds of the controller outweigh your grounds.

If the processing of the personal data concerning you has been restricted, this data may — apart from being stored — only be processed with your consent or for the assertion, exercise, or defense of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or a member state. If the restriction of processing has been restricted according to the above conditions, you will be informed by the controller before the restriction is lifted.

9.4 Right to Erasure

You can request that the controller delete personal data concerning you without undue delay, and the controller is obliged to delete this data without undue delay, provided one of the following reasons applies:

1. The personal data concerning you is no longer necessary for the purposes for which it was collected or otherwise processed.

2. You withdraw your consent on which the processing pursuant to Art. 6 (1) lit. a or Art. 9 (2) lit. a GDPR was based, and there is no other legal basis for the processing.

3. You object to the processing pursuant to Art. 21 (1) GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21 (2) GDPR.

4. The personal data concerning you has been processed unlawfully.

5. The erasure of the personal data concerning you is necessary to fulfill a legal obligation under Union law or the law of the member states to which the controller is subject.

6. The personal data concerning you was collected in relation to information society services offered pursuant to Art. 8 (1) GDPR.

9.5 Notification to Third Parties

If the controller has made the personal data concerning you public and is obliged to delete it pursuant to Art. 17 (1) GDPR, it shall, taking into account available technology and the cost of implementation, take reasonable steps, including technical measures, to inform controllers processing the personal data that you, as the data subject, have requested that they delete any links to, or copies or replications of, this personal data.

9.6 Exceptions

The right to erasure does not exist to the extent that processing is necessary:

1. To exercise the right to freedom of expression and information.

2. To comply with a legal obligation requiring processing under Union or member state law to which the controller is subject, or to perform a task carried out in the public interest or in the exercise of official authority vested in the controller.

3. For reasons of public interest in the area of public health pursuant to Art. 9 (2) lit. h and i as well as Art. 9 (3) GDPR.

4. For archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes pursuant to Art. 89 (1) GDPR, insofar as the right referred to under a) is likely to render impossible or seriously impair the achievement of the objectives of that processing.

5. For the assertion, exercise, or defense of legal claims.

9.7 Right to Notification

If you have exercised the right to rectification, erasure, or restriction of processing against the controller, the controller is obliged to notify all recipients to whom the personal data concerning you has been disclosed of this rectification or erasure of the data or restriction of processing, unless this proves impossible or involves disproportionate effort. You have the right vis-à-vis the controller to be informed about these recipients.

9.8 Right to Data Portability

You have the right to receive the personal data concerning you that you have provided to the controller in a structured, commonly used, and machine-readable format. You also have the right to transmit this data to another controller without hindrance from the controller to whom the personal data was provided, provided that:

1. The processing is based on consent pursuant to Art. 6 (1) lit. a GDPR or Art. 9 (2) lit. a GDPR, or on a contract pursuant to Art. 6 (1) lit. b GDPR, and

2. The processing is carried out using automated means.

In exercising this right, you further have the right to have the personal data concerning you transmitted directly from one controller to another, insofar as this is technically feasible. This shall not adversely affect the rights and freedoms of others. The right to data portability does not apply to processing of personal data that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

9.9 Right to Object

You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you which is based on Art. 6 (1) lit. e or f GDPR; this also applies to profiling based on these provisions.

The controller will no longer process the personal data concerning you unless it can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing serves to assert, exercise, or defend legal claims.

If personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for the purpose of such advertising; this also applies to profiling, insofar as it is related to such direct marketing.

If you object to the processing for direct marketing purposes, the personal data concerning you will no longer be processed for these purposes.

You have the option, in connection with the use of information society services — notwithstanding Directive 2002/58/EC — to exercise your right to object using automated procedures involving technical specifications.

9.10 Right to Withdraw Data Protection Consent

You have the right to withdraw your data protection consent at any time. The withdrawal of consent does not affect the lawfulness of processing carried out on the basis of the consent up until the withdrawal.

Data protection consents are voluntary and can be withdrawn at any time. You can also address a withdrawal to our data protection officer at the following contact: privacy@best4tires.com.

9.11 Automated Individual Decision-Making, Including Profiling

You have the right not to be subject to a decision based solely on automated processing — including profiling — which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision:

1. Is necessary for entering into or performing a contract between you and the controller.

2. Is authorized by Union or member state legislation to which the controller is subject and which lays down suitable measures to safeguard your rights and freedoms and your legitimate interests.

3. Is based on your explicit consent.

However, these decisions must not be based on special categories of personal data under Art. 9 (1) GDPR, unless Art. 9 (2) lit. a or g GDPR applies and suitable measures have been taken to protect your rights, freedoms, and legitimate interests.

With regard to the cases referred to in (1) and (3), the controller shall take reasonable measures to safeguard your rights and freedoms and your legitimate interests, including at least the right to obtain human intervention on the part of the controller, to express your point of view, and to contest the decision.

9.12 Right to Lodge a Complaint with a Supervisory Authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, place of work, or place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR.

The supervisory authority to which the complaint has been submitted shall inform the complainant of the progress and outcome of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 GDPR.

The competent supervisory authority is:

• Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz

• (State Commissioner for Data Protection and Freedom of Information Rhineland-Palatinate)

• Hintere Bleiche 34, 55116 Mainz

• Phone: +49 (0) 6131 8920-0

• Fax: +49 (0) 6131 8920-299

• Website: https://www.datenschutz.rlp.de/

• Email: poststelle(at)datenschutz.rlp.de

Changes to this Privacy Policy

We continuously develop our internal processes and review this Privacy Policy at regular intervals. We will amend it if our data processing activities or the legal framework change. We will inform you separately of any material changes, for example by email or by means of a notice in your customer account. Version of this Privacy Policy: 03 November 2026.