Data Privacy Information

This privacy statement informs you about how we treat your data. To make the processing of your data transparent, we would like to provide you with the following information to give you an overview of these processing operations. To keep things fair, we additionally want to inform you about your rights pursuant to the EU-General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG).

We will inform you in detail about:

• I. General Information
• II. Data Processing on our Website
• III. Further Data Processing

Ketolipix Therapeutics GmbH is the controller of the data processing (hereinafter referred to as ‘we’ or ‘us’).

I. General Information

1. Contact

If you have any questions or feedback concerning this information or wish to contact us to exercise your rights, please send your enquiry to:

Ketolipix Therapeutics GmbH
Herrengraben 31, 20459 Hamburg, Germany
Tel.: +49 (0) 40 280031 – 0
Email: info@ketolipix.com

2. Legal Basis

The legal term ‘personal data’ refers to all information relating to an identified or identifiable natural person.

We process personal data in compliance with the data protection regulations, in particular the GDPR and the BDSG. We solely process data based on law. We process personal data:

• solely with your consent (Art. 6 section 1 letter a) GDPR),
• to perform a contract to which you are a party or to take steps at your request prior to entering into a contract (Art. 6 section 1 letter b) GDPR),
• to comply with a legal obligation (Art. 6 section 1 letter c) GDPR), or
• where processing is necessary for the purposes of our legitimate interests or those of a third party, except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data (Art. 6 section 1 letter f) GDPR).

If you apply for an open position in our company, we will, additionally, process your personal data to decide on whether to hire you (section 26 para. 1 sentence 1 BDSG).

3. Period of Storage

In the absence of an alternative provision ensuing from the following statements, we will only store your data for as long as required to achieve the intended processing purpose or to fulfil our contractual or statutory obligations.

Such statutory retention requirements, in particular, result from commercial or tax law. From the end of the calendar year in which the data has been collected, we will store personal data used for accounting for ten years. Personal data contained in commercial letters and contracts will be stored for six years.

Apart from that, we will store personal data collected for the purpose of the performance of a contract, in particular data on complaints and requests, for a maximum of four years from the end of the procedure. Data stored for marketing purposes will be deleted when you object to processing for this purpose.

4. Recipients of Data

Unless otherwise stated in the following, the data is processed on the servers of service providers. For this, we commission processors. Processing activities conducted by the processors include e.g. hosting, maintenance and support of IT systems, customer and order management, order handling, accounting, marketing, or shredding of files and data carrier destruction. Processor means a natural or legal person, public authority, agency, or other body which processes personal data on behalf of the controller. Processors process data not for their own purposes but solely for the controller and are contractually obliged to implement appropriate technical and organizational measures ensuring data protection.

Apart from that, we transfer your data to postal and delivery services, our bank, tax consultants/auditors, or the fiscal authority if necessary. Should your data be transferred to further recipients, we will inform you via the respective processing activity.

5. Processing in the Exercise of your Rights pursuant to Art. 15 to 22 GDPR

If you exercise your rights pursuant to Art. 15 to 22 GDPR, we process the personal data transferred in order for us to grant you your rights and to acquire proof thereof. For the purpose of providing information and preparing such information, we will process the stored data only for this purpose as well as for purposes of data protection control and otherwise restrict processing in accordance with Art. 18 GDPR. These processing operations are based on Art. 6 section 1 letter c) GDPR in combination with Art. 15 to 22 GDPR and section 34 para. 2 BDSG.

6. Your Rights

As the data subject, you are entitled to exercise your rights against us. In particular, you have the following rights:

• Pursuant to Art. 15 GDPR and section 34 BDSG, you have the right of access to information confirming whether and, if so, to what extent we are processing personal data concerning you.
• Pursuant to Art. 16 GDPR, you have the right to rectification of your data.
• Pursuant to Art. 17 GDPR and section 35 BDSG, you have the right to erasure of your personal data.
• Pursuant to Art. 18 GDPR, you have the right to require us to restrict the processing of your personal data.
• Pursuant to Art. 20 GDPR, you have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used, and machine-readable format and the right to transfer such data to another controller.
• Where you have granted us specific consent to a processing activity, you can withdraw such consent at any time pursuant to Art. 7 section 3 GDPR. Any such withdrawal of consent shall not affect the lawfulness of processing based on that consent prior to its withdrawal.
• If you are of the view that the processing of your personal data infringes GDPR provisions, you have the right to lodge a complaint with a supervisory authority pursuant to Art. 77 GDPR.

7. Right to Object

Pursuant to Art. 21 section 1 GDPR, you have the right to object to processing activities based on Art. 6 section 1 letter e) or letter f) GDPR on grounds relating to your particular situation. If we process your personal data for the purpose of direct marketing, you may object to such processing pursuant to Art. 21 section 2 and section 3 GDPR.

8. Data Protection Officer

You can contact our data protection officer via the following address: datenschutz@ketolipix.de

II. Data Processing on our Website

1. Processing of Server-Log-Files

When using our website for informative purposes only, general information that your browser transfers to our server is initially stored automatically (not via registration). This includes by default: browser type/-version, operating system used, page called, the previously visited page (referrer URL), IP address, date and time of server request, and HTTP status code. The processing is carried out in pursuit of our legitimate interests and is based on Art. 6 section 1 letter f) GDPR. This processing serves the technical administration and security of the website.

The data collected will be deleted after fourteen days unless there is a justified suspicion of illegal use based on concrete indications and further examination and processing of the information is necessary for this reason. We are unable to identify you as a data subject based on the information collected. Art. 15 to 22 GDPR therefore do not apply pursuant to Art. 11 section 2 GDPR, unless you provide additional information to enable your identification in order to exercise the rights set out in these articles.

2. Data Transfer to Third Countries

Visiting our website may involve the transfer of certain personal data to third countries, i.e., countries where the DSGVO is not applicable law. Such a transfer shall be authorized if the European Commission has decided that an adequate level of data protection is ensured in such third country.

In the absence of such an adequacy decision by the European Commission, personal data will only be transferred to a third country if appropriate safeguards are in place in accordance with Art. 46 DSGVO or if one of the conditions of Art. 49 DSGVO is met. Unless otherwise stated below, we use as appropriate safeguards the EU standard contractual clauses for the transfer of personal data to processors in third countries: EU Standard Contractual Clauses.

3. Contact and Requests

When you send us a message via our contact email address, we will process the transferred data in order to process the request. We process this data in pursuit of our legitimate interest to reach out to persons submitting requests. The legal basis for this is Art. 6 section 1 letter f) GDPR.

III. Further Data Processing

1. Contact via Email

If you send us a message via our contact email address, we will process the transferred data in order to process the request. We process this data in pursuit of our legitimate interest to reach out to persons submitting requests. The legal basis for this is Art. 6 section 1 letter f) GDPR.

2. Contractual Relationship

In order to establish and execute the contractual relationship with our customers, suppliers, and business partners, it is regularly necessary to process the master, contract, and payment data provided to us. If we process personal data of our contact persons at commercial customers, suppliers, and business partners in the course of this, this happens in pursuit of our legitimate interests and is based on Art. 6 section 1 letter f) GDPR.

In addition, we process customer and potential customer data for evaluation and marketing purposes. This processing takes place on the legal basis of Art. 6 section 1 letter f) GDPR and serves our interest in further developing our product range and informing you specifically about products by Ketolipix Therapeutics GmbH. Further data processing can take place if you have consented (Art. 6 section 1 letter a) GDPR) or if this serves to fulfill a legal obligation (Art. 6 section 1 letter c) GDPR).