I. Name and Address of the Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws of the member states as well as other data protection regulations is:

Designliga GmbH & Co. KG
Hans-Preißinger-Str. 8 / Hall A
81379 Munich
Germany

T +49 (0)89 624 219 41
hello@designliga.com
https://www.designliga.com

---

II. Name and Address of the Data Protection Officer

The data protection officer of the controller is:

nextwork GmbH
Marco Peters
sicherheit@designliga.com

---

III. General Information on Data Processing

a) Scope of Processing of Personal Data

We process personal data of our users only to the extent necessary to provide a functional website as well as our content and services. The processing of personal data of our users usually takes place only after the user’s consent. An exception applies in cases where obtaining prior consent is factually not possible and the processing of data is permitted by legal regulations.

b) Legal Basis for Processing Personal Data

If processing is necessary to protect a legitimate interest of our company or a third party and the interests, fundamental rights and freedoms of the data subject do not outweigh this interest, Article 6(1)(f) GDPR serves as the legal basis for processing.

c) Data Deletion and Storage Duration

The personal data of the data subject will be deleted or blocked as soon as the purpose of storage no longer applies. Further storage can occur if it is required by European or national legislation in Union regulations, laws or other provisions to which the controller is subject. Blocking or deletion also occurs when a storage period prescribed by these regulations expires unless there is a necessity for further storage for contract conclusion or performance.

d) Data Transfer to Third Parties

We use service providers for communication purposes, billing, and project work. Whenever possible, we select service providers based within the European Union (EU) or European Economic Area (EEA). If personal data is processed by a service provider outside the EU/EEA, we ensure that appropriate safeguards are taken according to GDPR requirements. This includes the use of standard contractual clauses approved by the European Commission to ensure an adequate level of data protection.

---

IV. Provision of the Website and Creation of Log Files

a) Description and Scope of Data Processing

Each time our website is accessed, our system automatically collects data and information from the computer system of the requesting computer. The following data is collected:

1. Information about the browser type and version used

2. The IP address of the user

3. Date and time of access

4. Websites from which the user's system accessed our website

To make our website attractive to you, we use a web font. Since the licenses are click-based, the company Monotype records visits to our homepage using a tracking pixel. Monotype relies on Article 6(1)(f) GDPR, citing a legitimate interest in temporary processing of the IP address to enable counting and prevent misuse of their counter. The log data is deleted after 30 days and no further personal data is processed thereafter. Monotype's privacy policy is available here: https://www.monotype.com/legal/privacy-policy/web-font-tracking-privacy-....

b) Legal Basis for Data Processing

The legal basis for temporary data storage is Article 6(1)(f) GDPR.

c) Purpose of Data Processing

Temporary storage of the IP address by the system is necessary to deliver the website to the user’s computer. The IP address must be stored during the session. Our legitimate interest in data processing according to Article 6(1)(f) GDPR lies in this purpose.

d) Duration of Storage

Data is deleted as soon as it is no longer necessary for the purpose of collection. In the case of website provision, this is when the session ends.

e) Right to Object and Removal Possibility

Collecting data for website provision is mandatory for website operation. Therefore, there is no right of objection for the user.

---

V. Use of Cookies

a) Description and Scope of Data Processing

We use cookies on this website—small text files stored on your computer via your browser. These cookies may contain a unique cookie ID, enabling assignment of websites and servers to the storing browser. Cookies provide information that allows us to optimize our websites for visitors. Some cookies are session cookies and expire when you leave the website. All cookies contain purely technical information, no personal data. Use of our offerings is possible without cookies, though not always with full functionality. Most browsers automatically accept cookies, but you can disable cookie storage or set your browser to notify you when cookies are sent.

This website also stores and transmits whether the user’s browser executes JavaScript.

Information about individual cookies can be viewed and changed via the Consent Manager under "Privacy Settings."

b) Legal Basis for Data Processing

The legal basis for processing personal data using cookies is Article 6(1)(f) GDPR, based on our legitimate interest in providing an appealing web presence. Processing requiring consent is based on Article 6(1)(a) GDPR and can be changed via the Consent Manager.

c) Purpose of Data Processing

Technically necessary cookies do not create user profiles. Analysis cookies are used to improve website quality and content by showing how the website is used, allowing us to optimize continuously. This also represents our legitimate interest in processing personal data under Article 6(1)(f) GDPR.

d) Duration of Storage, Objection, and Removal Possibility

Cookies are stored on the user's device and sent back to our site. You control cookie use via browser settings. You can disable or restrict cookie transmission and delete stored cookies anytime. If cookies are disabled, some website functions may no longer be fully available.

---

VI. Tracking and Maps

a) Description and Scope of Data Processing

This website uses Google Maps, a service from Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google"). This application uses "cookies" that are stored on your computer and enable analysis of website usage. Information created by cookies about your use of this website (including a truncated IP address) is generally transmitted to and stored on a Google server in the USA.

You can prevent cookie storage by adjusting your browser software but note that this may restrict website functionality. You can also prevent Google from collecting data about your website use (including IP address) and processing this data by installing the browser plugin available at: https://tools.google.com/dlpage/gaoptout?hl=de

b) Legal Basis for Data Processing

The legal basis for processing personal data using cookies is Article 6(1)(a) GDPR.

c) Purpose of Data Processing

Analysis cookies are used to improve the quality and content of our website. Google Maps content improves findability.

d) Duration of Storage, Objection, and Removal Possibility

Data linked to cookies sent by us is deleted automatically after 14 months. Data exceeding the retention period is deleted once a month automatically.

Recipients

Possible recipients of data in connection with Google services include:

• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (processor under Article 28 GDPR)

• Alphabet Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA

Access by US authorities to data stored by Google cannot be excluded.

Data processing in third countries:
If data is processed outside the EU/EEA or transferred to third parties without legal basis or to countries without an adequacy decision by the EU Commission, we use standard contractual clauses and take adequate measures to ensure data protection.

---

VII. Email Contact

a) Description and Scope of Data Processing

Contact is possible via email addresses on our website under Contact and for job applications. Personal data sent by email is stored. Your email is forwarded internally to the responsible contact for your concern. Applications are stored on a secure server accessible only to a select group of employees responsible for processing your request.

No data is passed on to third parties. Data is used only to process the conversation. Legal basis for data processing of emails is Article 6(1)(f) GDPR. If email contact aims to conclude a contract, Article 6(1)(b) GDPR applies additionally.

b) Purpose of Data Processing

Data processing serves only to handle your contact. In email contact, this is also our legitimate interest.

c) Duration of Storage

Data is deleted once it is no longer necessary. For emails, this is when the conversation is finished, i.e., the matter is conclusively settled. To request deletion of applicant data, contact the recipient or sicherheit@designliga.com.

d) Right to Object and Removal

Users contacting us by email may object to data storage at any time. Then, the conversation cannot continue, and all stored personal data will be deleted.

---

VIII. Rights of the Data Subject

If personal data about you is processed, you are a data subject under GDPR and have the following rights against the controller:

a) Right of Access

You can request confirmation of whether personal data concerning you is processed. If yes, you may request information about:

1. Purposes of processing

2. Categories of personal data processed

3. Recipients or categories of recipients of your data

4. Planned storage duration or criteria for storage period

5. Existence of rights to correction, deletion, restriction, or objection

6. Right to lodge a complaint with a supervisory authority

b) Right to Rectification

You have the right to have incorrect or incomplete personal data corrected or completed without delay.

c) Right to Restriction of Processing

You may request restriction of processing if:

1. You dispute accuracy for a period allowing verification

2. Processing is unlawful and you refuse deletion but want restriction

3. Controller no longer needs data but you require it for legal claims

4. You objected under Article 21(1) GDPR and it is unclear whose interests prevail

Restricted data may only be processed with your consent or for legal claims or important public interest.

d) Right to Erasure ("Right to be Forgotten")

1. You may demand deletion without undue delay if:

• Data is no longer needed

• Consent is withdrawn and no other legal basis exists

• You object to processing and no overriding reasons exist

• Data was unlawfully processed

• Deletion is legally required

• Data was collected from children under Art. 8(1) GDPR

1. Controller must inform other controllers if data was made public and deletion is required.

2. Exceptions exist if processing is necessary for freedom of expression, legal obligations, public interest in health, archival/scientific/historical/statistical purposes, or legal claims.

3. Controller must inform recipients of correction/deletion/restriction unless impossible or disproportionate.

4. Right to Data Portability

You may receive your data in structured, common, machine-readable format and transfer it to another controller if processing is based on consent or contract and uses automated means.

1. Right to Object

You may object at any time for reasons related to your situation against processing based on Art. 6(1)(e) or (f) GDPR, including profiling.

Processing stops unless controller proves overriding legitimate reasons or for legal claims.

For direct marketing, you have absolute objection rights.

You can exercise objection rights by automated means regarding information society services.

1. Right to Lodge Complaint with Supervisory Authority

You have the right to complain to a supervisory authority, especially in your member state of residence, workplace, or alleged infringement site, if you believe processing violates GDPR.

The authority informs you of complaint status and outcomes including judicial remedies under Art. 78 GDPR.