1.1Scope, Data Subject and data fiduciary/controller

This Privacy Notice exclusively applies to the collection and processing of Personal Data of users of the Website with the domain hydac.com or affiliated Websites of HYDAC International GmbH.

The responsible data fiduciary/controller for any Personal Data collected and processed in connection with the use of the Website is HYDAC. Should another data fiduciary/controller process Personal Data about how you use this Website, you will be provided with a separate privacy notice.

1.2 How to contact Us and Our Data Protection Officer

You can contact Us via mail at HYDAC International GmbH, Industriestraße, 66280 Sulzbach/Saar, Germany, or at the following email address: info@hydac.com.

You can contact Our data protection officer via mail at the following address: HYDAC Verwaltung GmbH, Data Protection Department, Industriestraße, 66280 Sulzbach/Saar, Germany or at the following e-mail address: privacy@hydac.com.

1.3Categories of Personal Data, purposes of processing and legal bases

Appendix 1 "Personal Data" to this Privacy Notice contains detailed information on (i) the categories of Personal Data We collect from you; (ii) the purposes for which We process these Personal Data; and (iii) the legal bases for the collection and processing of your Personal Data. If processing for another purpose takes place, We will provide you with additional information.

For details, please refer to 2.1.

1.4Recipients and categories of recipients of the Personal Data

We share your Personal Data with other entities of the HYDAC Group. We use internal and third-party service providers to provide services and products on Our behalf and We will share your Personal Data with them for the provision of the services and products. Within HYDAC and such recipients any access to your Personal Data in relation to your use of the Website is restricted to those individuals who have a ‘need to know’ in order to fulfill their job responsibilities.

We share your Personal Data with governmental authorities, courts, external advisors.

For details, please refer to 2.2.

1.5Data transfers outside the European Economic Area ("EEA") or India

Some of the recipients of your Personal Data are located outside the EEA or India (e.g., USA). By way of entering into appropriate data transfer agreements or by other adequate means, We have established that all such recipients located outside the EEA or India will provide an adequate level of protection for the Personal Data and that appropriate technical and organizational security measures are in place to protect Personal Data. Any onward transfer is subject to appropriate onward transfer requirements as required by applicable law.

For details, please refer to 2.3.

1.6Scope and duration of storage

Your Personal Data are stored by HYDAC and/or Our service providers, strictly to the extent necessary for the performance of Our obligations to you respectively the performance of the service providers' obligations to Us and strictly for the time necessary to achieve the purposes for which the Personal Data are processed, in accordance with applicable data protection laws. When HYDAC and/or Our service providers no longer need to process your Personal Data, the Personal Data will be erased from the systems and/or records and/or steps will be taken to properly anonymize the Personal Data so that you can no longer be identified from the Personal Data unless We and/or Our service providers need to keep your information

• to comply with legal or regulatory obligations to which HYDAC and/or Our service providers are subject; and/or
• with regard to a judicial action; and/or
• are otherwise authorized to retain Personal Data.

For details, please refer to 2.4.

1.7Your rights

Under the conditions set out under applicable data protection law (e.g., the GDPR), you may have the following rights, which We have categorized based on the applicable data protection law where the right is stipulated:

• Stipulated under the GDPR and under the DPDP Act: (i) the right of access; (ii) the right to obtain a copy of your Personal Data undergoing processing; (iii) the right to rectification; (iv) the right to erasure (which is in addition referred to as the "right to be forgotten" in the GDPR); (v) the right to lodge a complaint with the competent data protection supervisory authority;
• Stipulated specifically under the GDPR: (vi) the right to restriction of processing; (vii) the right to data portability; (viii) the right to object;
• Stipulated specifically under the DPDP Act: (ix) the right of grievance redressal; and (x) the right to nominate an individual to exercise your rights.

If you have given your consent to the processing of Personal Data, you may withdraw such consent at any time. Such withdrawal will not affect the lawfulness of the processing that took place prior to the withdrawal of consent.

For details, please refer to 2.5.

1.8Use of cookies and similar technologies on the Website

We use cookies and similar technologies on Our Website. You can find detailed information about this in Our Cookie Notice.

1.9Personal Data required for the conclusion or fulfillment of the contract

You only have to provide the Personal Data that are marked as mandatory in the respective forms on Our Website. Without this Personal Data, the envisaged contract cannot be concluded or an existing contract can no longer be performed and may have to be terminated. Personal Data that are not marked as mandatory in the corresponding forms on Our Website do not have to be provided.

For details, please refer to 2.6.

2.1Categories of Personal Data, purposes of processing and legal bases

In Appendix 1 "Personal Data" to this Privacy Notice, you will find detailed information on:

• the categories of Personal Data We collect from you in addition to other Personal Data that you actively provide to Us (e.g., when you send an email to Us)
• the purposes for which We process those categories of Personal Data; and
• the legal bases for the collection and processing of your Personal Data.

We also use cookies and similar technologies on Our Website. You can find detailed information on this in Our Cookie Policy:

Please note that We process your Personal Data for other purposes only if:

• We are obligated to do so on the basis of legal requirements (e.g., transfer to courts or criminal prosecution authorities);
• if you have consented to the respective processing; or
• if the processing is otherwise lawful under applicable law.

If processing for another purpose takes place, We will provide you with additional information.

2.2Recipients and categories of recipients of the Personal Data

HYDAC transfers your Personal Data for the respective purposes and limited to the extent necessary to the recipients and categories of recipients listed below:

Within the HYDAC group

We share your personal information with other HYDAC Group companies for the following purposes:

• For the implementation of marketing measures. Such data transfers are based on Art. 6 (1)(a) or (f) GDPR.
• For the (pre-)contractual performance and fulfillment of your request to the establishment responsible for you on the basis of Art. 6 (1)(f) GDPR

  
  

(A list of these other HYDAC Group companies can be found here: https://www.hydac.com/en/locations)

Service providers (internal and external)

We use both external and internal service providers to provide services and products on Our behalf and share your Personal Data with them for this purpose. Our service providers are contractually obliged to process this Personal Data on HYDAC’s behalf under appropriate instructions to the extent necessary for the relevant processing purposes and to appropriately protect your Personal Data. Our service providers may not otherwise process or share your Personal Data except as permitted by law.

We share your Personal Data with the service providers listed in Appendix 2 "Service providers" to this Privacy Notice.

Governmental authorities, courts, outside counsel and similar third parties

to the extent required or permitted by applicable law in order to:

• ensure compliance with applicable laws;
• respond to governmental inquiries or requests;
• comply with applicable legal obligations;
• protect the rights, privacy, safety or property of HYDAC, website visitors, guests, employees or the public;
• enable Us to pursue potential legal remedies or prevent or limit potential bad debts or damage that We may suffer;
• enforce the Terms of Use of Our Websites https://netiquette.hydac.com/en.html; and
• respond to an emergency. Such data transfers are based on Art. 6 (1)(a), (c) or (f) GDPR.

Within HYDAC and its service providers, access to your personal information in connection with your use of the Website is limited to those individuals who have a compelling need to know that information in order to perform their professional tasks.

2.3Data transfers outside the European Economic Area ("EEA") or India

Some of the recipients of your Personal Data are located outside the EEA or India (e.g., USA); data protection laws there may provide a different level of protection than the laws in your jurisdiction. We will take necessary measures under applicable data protection law to ensure that transfers from the EEA are adequately protected.

By way of entering into appropriate safeguards based on the Standard Contractual Clauses (2021/914/EU) as referred to in Art. 46 (2)(c) GDPR, or by other adequate means, which are accessible upon request under the contact details provided in Section 2.7 below, We have established that all recipients located outside the EEA will provide an adequate level of protection for the Personal Data and that appropriate technical and organizational security measures are in place to protect Personal Data against accidental or unlawful destruction, accidental loss or alteration, unauthorized disclosure or access, and against all other unlawful forms of processing. Any onward transfer (including to Our affiliates outside the EEA) is subject to appropriate onward transfer requirements as required by applicable law.

2.4Scope and duration of storage

Your Personal Data are stored by HYDAC and/or Our service providers, strictly to the extent necessary for the performance of Our obligations to you respectively the performance of the service providers' obligations to Us and strictly for the time necessary to achieve the purposes for which the Personal Data are processed, in accordance with applicable data protection laws.

When HYDAC and/or Our service providers no longer need to process your Personal Data, the Personal Data will be erased from the systems and/or records and/or steps will be taken to properly anonymize the Personal Data so that you can no longer be identified from the Personal Data. However, We and/or Our service providers need to keep your information to comply with legal or regulatory obligations to which HYDAC and/or Our service providers are subject. Further, if a judicial action is initiated, the Personal Data will be stored until the end of such action, including any potential periods for appeal.

Insofar as a more detailed description is possible, you will find detailed information in Appendix 1 "Personal Data" to this Privacy Notice.

2.5Your statutory rights

If you have declared your consent to any Personal Data processing activities, you can withdraw this consent at any time with future effect. Such a withdrawal will not affect the lawfulness of the processing prior to the consent withdrawal.

In accordance with applicable data protection laws (such as the GDPR), you may have the following rights, which We have categorized based on the applicable data protection law where the right is stipulated, and which you may exercise by contacting Us as stated in in Section 2.7:

Stipulated under the GDPR and under the DPDP Act:

Right of access:You have the right to obtain confirmation from Us as to whether or not Personal Data concerning you is processed, and, where that is the case, to request access to the Personal Data. Depending on the legal basis of processing, the access information includes – inter alia – the purposes of the processing, the categories of Personal Data concerned, summary of Personal Data which is being processed by Us and the processing activities undertaken with respect to your Personal Data and the identities of the recipients or categories of recipients to whom the Personal Data have been, or will be disclosed, including a description of the Personal Data which has been or will be disclosed. However, this is not an absolute right and the interests of other individuals may restrict your right of access.

You also have the right to obtain a copy of the Personal Data undergoing processing. For further copies requested by you, We may charge a reasonable fee based on administrative costs.

Right to rectification: Depending on the legal basis of the processing, You have the right to obtain rectification of inaccurate or misleading Personal Data concerning you from Us, as well as the right to have incomplete Personal Data completed, including by means of providing a supplementary statement.

Right to erasure: (which is in addition referred to as the "right to be forgotten" in the GDPR): Under certain circumstances, you have the right to obtain the erasure of Personal Data concerning you from Us and We may be obliged to erase such Personal Data.

Right to file a complaint: In addition to the rights set out above, You also have the right to lodge a complaint with the competent data protection supervisory authority. If you are a resident of India, We request you to please reach out to Our data protection officer for any grievances or queries that you may have regarding your personal data, prior to filing a complaint with the Data Protection Board of India (the supervisory authority in India). A complaint may be filed to the Data Protection Board of India by [•].

Stipulated specifically under the GDPR:

Right to restriction of processing: Under certain circumstances, you have the right to obtain the restriction of processing your Personal Data from Us. In this case, the respective data will be marked and may only be processed by Us for certain purposes.

Right to data portability:Under certain circumstances, you have the right to receive the Personal Data concerning you, which you have provided to Us, in a structured, commonly used and machine-readable format, and you have the right to transmit those data to another entity without hindrance from Us.

Right to object: You have the right to object, on grounds relating to your particular situation, at any time to the processing of your Personal Data by Us and We can be required to no longer process your Personal Data. If you have a right to object and you exercise this right, your Personal Data will no longer be processed for such purposes by Us. Exercising this right will not incur any costs.

Such a right to object may not exist, in particular, if the processing of your Personal Data is necessary to take steps prior to entering into a contract or to perform a contract already concluded.

Stipulated specifically under the DPDP Act:

Right of grievance redressa: You may reach out to our data protection officer in the manner provided below in case you have any grievances or queries in respect of your personal data.

Right to nominate an individual to exercise your rights (DPDP Act): In addition to the rights set out above, you nominate any other individual, who will, in the event of your death or incapacity, be able to exercise the aforementioned rights vis-à-vis your personal data on your behalf.

2.6Personal Data required to enter into or perform the contract

You are only required to provide Personal Data that We need to establish and maintain a business relationship with you or that We are required to collect by law. Such Personal Data are marked as mandatory in the respective forms on Our Website. Without such Personal Data, We will not be able to enter into the requested contract or - should you remove such Personal Data at a later point in time - We will no longer be able to perform an existing contract and may have to terminate it.

Personal Data that are not marked as mandatory in the corresponding forms on Our Website do not have to be provided.

In the following cases, We can provide Our service and/or conclude a contract only if you provide Us with the relevant data records:

• Purchase/service orders: Company data (address, contact details, registration number or similar), contact person (salutation, surname, first name, telephone and extension, e-mail address, position, department, location);
• Newsletter subscriptions: Last name, first name; salutation; company data; company address; personal contact information (email address, phone number); country/region; language; consent status (opt-in for marketing); interests (industries, trends and topics).

For additional information regarding Our newsletter and purchase/service orders, please see Appendix 1 "Personal Data" to this Privacy Notice.

This privacy policy may be subject to change - e.g. due to the implementation of new technologies or the introduction of new services or functions. We reserve the right to amend or supplement this privacy policy at any time. We will publish the changes on https://www.hydac.com/privacy-policy.