Privacy Policy of toleadoo GmbH

Dear user,

This competition is organized by toleadoo GmbH. We, from toleadoo GmbH (hereinafter referred to as “us” or “we” or “toleadoo”), care about your privacy and, in this privacy policy, we would like to ensure that you will be provided with all necessary information about your privacy according to the Data Protection Act 2018, including details about:

• the collection, usage and processing of your personal data,
• the communication and storage of your personal data, and
• your rights.

If you have any questions in regards to your personal data collection, processing and usage or interest to exercise your rights, you can reach us at any time, either by post or by email directly to our data protection officers: toleadoo GmbH Am Unisys-Park 1 65843 Sulzbach im Taunus Germany info[at]toleadoo.com c/o DPO: privacy[at]toleadoo.com Represented by managing director: Jürgen Böttcher According to Art. 27 Data Protection Act 2018, we are obliged to have a representative of toleadoo established in the UK. The appointed representative can be reached via email: c/o UK Representative privacy[at]toleadoo.com.

1. How we collect the information:

Among others, we collect, use and process personal data that you provide in the course of our relationship, as for example:

• Filling in any of our electronic forms,
• Participating in promotional offers from us,
• Visiting our websites, and
• Contacting our staff.

2. What information we collect, use and process:

Generally, the types of personal data collected, used and processed are:

• Personal details (e.g. first name, last name and date of birth)
• Contact details (e.g. email address, post address and telephone number),
• Interest details (e.g. preferences of offers chosen by you in our page), and
• Technical details (e.g. data relating to type of browser, Internet Service Provider (ISP), local time, location)

3. How the information is used:

All the information made available to us are used to one or more of the following purpose:

• Performance of our contract we are about to enter into or have entered into with you (e.g. participation in the competition solely)
• Meet our legitimate interests pursued by us (e.g. for our own marketing purposes),
• Meet our legal obligations, enforcing our rights and other legal uses, and
• Rely on your valid consent given (e.g. for third-party marketing purposes).

Possible sectors that you may expect to receive advertisement about are:

Industry Sector	include, but not limited to
Charity	e.g. animal welfare, disaster relief, children’s medical, elderly, environmental, health
Gaming	e.g. bingo, betting, competitions, lottery
Leisure	e.g. food & drink, events, museums, cinema
Financial Products	e.g. pensions, banking, credit cards, investments, loans, mortgages
Insurance	e.g. car, home, life, medical, pet, income protection, travel, warranty products
Health / Lifestyle	e.g. fitness, beauty, opticians, hearing, care homes, mobility, leisure, pharmaceuticals
Home Improvements	e.g. house moving, blinds & curtains, insulation, boilers, conservatories, doors & windows, extensions, gardens, solar panels.
Funeral Plans	e.g. to arrange and pay for a funeral in advance
Legal Services	e.g. claims, will writing, will reviews
Mail Order	e.g. catalogues, online retailers
Market Research	e.g. to gather information about consumers’ opinions and preferences
Media	e.g. online, television, radio, newspapers, magazines
Retail	e.g. online retail, electrical goods, comparison sites, discounts, FMCG, automotive, home improvement, Home Services
Telecoms	e.g. landline, mobile phones, broadband, digital TV
Travel	e.g. holidays, city breaks, airlines, UK breaks, accommodation
Utilities	e.g. gas & electricity switching, other household utilities such as water

We reserve the right to engage in the further processing of personal data, which we have collected for any of the foregoing purposes, including any other purposes that are consistent with the original purpose or which are permitted or prescribed by law (e.g. reporting obligations). We do not perform automated decision-making.

4. What our legal basis are and for which purposes we will use your data:

Our legal basis to collect, use and process the information in accordance with the provisions of the Data Protection Act 2018 are, at least, on one of the following legal bases, mentioned in a table format:

Purpose/Activity	Type of data	Lawful basis for processing
To perform the competition that you have entered in our page.	(a) Personal details (b) Contact details	(a) Performance of a contract with you
TTo communicate with you and to keep you informed of our latest updates: (a) Notifying you about changes to our Terms and Conditions or Privacy Policy (b) Notifying you in case you are the winner (c) Contact you in response to a contact request	(a) Personal details (b) Contact details	(a) Performance of a contract with you (b) Necessary to comply with a legal obligation (c) Necessary for our legitimate interests (to keep our records updated and to study how customers use our products/services)
To support and troubleshoot our Services and to respond to your queries	(a) Personal details (b) Contact details(c) Technical details	(a) Necessary for our legitimate interests: for running our business provision of administration and IT services network security to prevent fraud in the context of a business reorganization or group restructuring exercise
To perform a research or to conduct analytics in order to improve and customize our Services to your needs and interests	(a) Personal details (b) Contact details(c) Interest details (d) Technical details	(a) Necessary for our legitimate interests: to study how customers use our products/services to develop products/services to define types of customers for our products and services to keep our website updated and relevant
To inform you about our other websites and services via email, push notification, mail, telephone and/or text/SMS messages	(a) Personal details (b) Contact details(c) Interest details (d) Technical details	(a) Necessary for our legitimate interests: • to develop our products/services • to grow our business(b) Consent
To inform you about our partner offers and opportunities via email, push notification, mail, telephone and/or text/SMS messages	(a) Personal details (b) Contact details(c) Profile details (d) Technical details	(a) Consent
To investigate violations and enforce our policies, and as required by law, regulation or other governmental authority	(a) Personal details (b) Contact details(c) Profile details (d) Technical details	(a) Necessary to comply with a legal obligation

5. Where the information will be stored and for how long:

The personal data is stored by us according to the following aspects:

• Within the European Economic Area.
• We store your information on our secure servers.
• We store your personal information for as long as necessary to fulfil the purposes already outlined above – generally for 4 (four) years. Data is removed from the marketing database if either; a) you withdraw your consent, this process is outlined in the next point and/or b) If the personal information we hold is no longer needed for the intended purpose for at least 24 (twenty four) months
• Following any withdrawal of consent to the processing of your data and/or declaration of objection thereto, your data will be moved to our so-called “blocking list”. This means that your personal data is no longer used for our relationship basis purposes. We then store your data only for legal purposes (e.g. burden of proof obligations and the assertion or defense of claims), deleting it on expiry of a 4 (four)-year period, provided there are no compelling reasons to do otherwise or where, for other reasons – possibly in the way of renewed consent – an appropriate level of data processing is permitted.
• In case of transfer to third countries (outside the European Union), our contractual agreements with any 3rd parties or recipients of your data ensure a secure transmission within the framework of EU specifications on data protection and privacy is guaranteed. Please contact our DPO for further info on our security and processes.

6. How we protect your personal data:

We take the relevant precautions – administrative, organizational, technical and physical – to protect your personal data against loss, theft, misuse, unauthorized access, unauthorized transmission, unauthorized amendment and destruction. This means, that your data is protected by entry controls (securely located servers, access to which is only granted under defined security procedures), admission controls (128-bit encoded data transmission, individual password, menu and employee authorization, current virus software), access controls (individual employee access authorization via personal accounts, identification and authentication requirements), disclosure controls (constant supervision and guidance to authorized personnel, no local storage of data, recording of all data exports and transmission), input controls (account-related auditing, time-stamp and host logging), task auditing (constant supervision by managers and data protection officers, transparent contract structure in coordination with management and data protection officers) and availability checks (general security procedures of the host [UPS, halon gas systems, etc.], back-up streaming to other general security procedures [e.g. UPS, halon gas systems, etc.], back-up streaming to other locations [with all security measures, see access controls] nightly mirroring onto two hard discs, virus protection program). Despite these precautions and due to the insecure nature of the Internet, we are unable to guarantee the security of your data transmission to our website. Any transmission of your data to our website is, therefore, undertaken at your own risk.

7. What data protection rights you have:

According to the provisions of the Data Protection Act 2018, you have the following data protection rights:

• Right of access (art. 15, Data Protection Act 2018): you have the right to obtain information about the data stored about you as an individual, including the sources and recipients of your data, as well as the purposes of its subsequent processing.
• Right to rectification (art. 16, Data Protection Act 2018): you have the right to demand the rectification of any incorrect or inaccurate personal data we hold with respect to you.
• Right to erasure (art. 17, Data Protection Act 2018): you have the right to have your personal data erased if: (i) the data is no longer necessary in relation to the purposes for which it was collected or processed; (ii) you have withdrawn your consent; or (iii) the data have been unlawfully processed.
• Right to restriction of processing (art. 18, Data Protection Act 2018): you have the right to have your data with processing restriction by satisfying one of the prerequisites listed in Art. 18 (1) Data Protection Act 2018 (e.g. contesting the accuracy of your personal data).
• Right to withdraw consent (art. 7, Data Protection Act 2018): you are entitled to withdraw any declaration(s) of consent previously made and relating to the processing of your personal data with future effect by sending an email to privacy@toleadoo.com or by requesting it at the time you are contacted by email, phone, SMS or post. However, such withdrawal of consent does not affect the legitimacy of any processing operations previously executed.
• Right to data portability (art. 20, Data Protection Act 2018): you are entitled to demand the provision by us of all personal data communicated to us in a format, which allows its transmission to another controller.

Right to object (art. 21, Data Protection Act 2018): you have the right to object, on grounds relating to your particular situation, without any formal requirements, to the processing of personal data concerning you, if such processing is in the public interest or in pursuit of legitimate interests of the Company or a third party. You also have the right to object, without any formal requirements, to the use of personal data for marketing purpose (e.g. if you object to the processing of your personal data for direct marketing purposes, we will discontinue processing your personal data for this purpose). You should preferably submit any requests here listed in writing with the Data Protection Officer, who is the point of contact for any other data protection matters. Should you wish to assert any of the rights listed above in this section, please get in touch with us at toleadoo GmbH, Am Unisys-Park 1, 65843 Sulzbach im Taunus, Germany, or via the following email address: privacy@toleadoo.com Lastly, you are also entitled to lodge a complaint with the competent regulatory authority for toleadoo GmbH – the Data Protection Officers of the State of Hesse, Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Post-box 31 63, 65021 Wiesbaden, Germany – or with any other regulatory authority.

8. Usage data and cookies

You can view our internet pages without providing any personal information. However, when you visit our pages, certain technical data is generated, which is known as “usage data”. In addition, we may use one or more cookies and in some cases include social media plug-ins. The text below is also intended to provide you with information about this. Usage data: When you visit our web pages, the only items of information that we store by default are the website from which you reached our page, the name of your Internet service provider, which web pages you visited while on the Internet, and the date and duration of your visit. The data obtained is completely anonymous. For security reasons, your IP address and a time stamp are also stored. These data are used for internal purposes. The IP address is a machine-related code that provides information about the computer or Internet gateway used to access the Internet for online retrieval. A time stamp is a value in a specific format that assigns a specific time to an event (for example, sending or receiving a message, change of data, etc.). The purpose of a time stamp is to tell people or computers when events have occurred. For security reasons, your IP address and a time stamp are also stored. These data are used for internal purposes. The IP address is a machine-related code that provides information about the computer or Internet gateway used to access the Internet for online retrieval. A time stamp is a value in a specific format that assigns a specific time to an event (for example, sending or receiving a message, change of data, etc.). The purpose of a time stamp is to tell people or computers when events have occurred. Social media plugins We include “social media plug-ins” (also often known as “social media buttons”) in some areas of our web pages. These types of plug-ins are indicated on our pages by buttons (hence the term “buttons”), each of which indicates the provider of the plug-in via the corresponding colors and symbols. If you click on these buttons you can do things like notify your friends on the social networks you use that you like one of our pages or share a link to a website with other internet users depending on the button If you are browsing our website and access one of our web pages with a social media plug-in, your browser connects directly to the plug-in provider’s servers, and the plug-in from these servers be downloaded. During the process, the plug-in provider may be notified that the relevant web page has been accessed through our website. If you have a user account of which one or more social networks are managed by the providers of the plug-ins, and if you are logged in to the network (s) in question while on one of our web pages that contains one or more plug-ins of social media from the provider (s) in question, access to that page may also be linked to your existing user profile (s) with the provider (s) in question. If you subsequently click on built-in plug-ins and log in to one or more of the networks (or if you are already logged in), the shared or “recommended” information will usually be posted to your profile in an abbreviated form. This may allow the network provider to retrieve and store further usage data. In this way, the providers of the networks can create user profiles that contain more information than just what you yourself have directly and actively disclosed on the network. For more information about the collection and processing of data, see the privacy policy of the plug-in providers. Cookies We use so-called cookies as part of our internet pages. These are small files that are stored on your hard drive and which contain specific information that can be retrieved by the server that installed the cookie on your computer. The cookies used may be “session” cookies, which are automatically deleted when you close the browser window, and / or cookies that are valid for a longer period of time. In addition, our partner AppNexus places cookies ( click here for more information ) that enable tailor-made offers, for example by displaying so-called banners, also on other websites where the AppNexus technology is used. The information stored in cookies may relate to the login (your visit, if you log in), the date and time of your visit to our site, the cookie number and the URL of the website through which you reached our site. By using cookies we can guarantee the functionality of our websites and continuously improve it. In addition, cookies help us and our partner to recognize you and so we can optimally adapt our offers to your individual needs and wishes and thus show you the most relevant information, also on other websites where our partner is active. Finally, cookies also make it possible to record the statistical frequency of the retrieval of the various pages of our presence on the Internet and of the general navigation. However, if you wish to prevent the use of cookies – without affecting the performance of our prize draw or other offers linked to it by us – please adjust your browser settings before using our pages. You can prevent new cookies from being accepted and stored in these settings. Please refer to your browser’s help pages or contact the browser maker or provider for more information. Push notifications Sometimes you agree to receive our push notifications, with additional consent where applicable, for which we use the “Accengage” shipping service. Your personal data will therefore be processed on the basis of this (further) consent (Article 6 (1) (a) Data Protection Act 2018). Of course, the rights already stated in section 5 also apply to this consent. To withdraw your consent to push notifications, you can also change the setting for receiving push notifications in your browser. If you are using a desktop PC with Windows operating system, you can opt out of our push notifications by right-clicking on the relevant push notification on the settings displayed there. In order to be able to show you the push notifications, Accengage collects and processes on our behalf your browser ID and your device ID in case of mobile access. In addition, Accengage evaluates aggregated statistical, non-personal data based on push notifications. The following link directs you to detailed information about Accengage push notifications: Accengage_FAQ.pdf .

9. Delete cookies:

As a user, you can always determine yourself which cookies, including those for push notifications, you want to accept or delete. The individual settings for this can be configured directly in the settings of your internet browser. For more information, contact the provider of your internet browser.

10. Minors

This site, including the data protection and privacy policy and general business conditions, is not intended for minors. Personal data of minors is not knowingly collected, used and / or disclosed.