Data protection

Thank you for your interest in our website.

We at PAIR Finance – a service of PAIR Finance GmbH – (hereinafter: “PAIR Finance” or “we”) respect your privacy and take great care to protect your data and its confidentiality. With this privacy policy, we inform you which personal data we collect in the context of your use of our online offer as well as our services for clients, business partners, interested parties or customers (hereinafter also “you”) and for which purposes we use the data.

The terms used in the context of this Privacy Policy, such as “personal data” or “processing”, among others, have the meaning defined in Art. 4 of the EU General Data Protection Regulation (“GDPR”). Personal data are thus basically all detailed information about personal or factual circumstances of an identified or identifiable natural person, such as your name, your telephone number or your address.

1. Controller

The controller in the sense of the GDPR for the collection, processing and use of your personal data is PAIR Finance GmbH, Hardenbergstraße 32, 10623 Berlin. You can reach us via the contact details listed in the imprint.

You can contact our data protection officer by mail at the aforementioned address – Data Protection Department – or by e-mail at datenschutz@pairfinance.de.

2. Data processing

2.1 Visit our website

When you visit our website, we automatically collect certain data, e.g. date and time of access, name of the requested file, website from which the file was requested, access status (e.g. file transferred, file not found), the web browser, the operating system and the IP address of the requesting device.

The processing of this data is necessary to enable the visit of the website and to ensure the permanent functionality, availability and security of our systems. The legal basis for this data processing is Art. 6 para. 1 lit. b) GDPR.

The access data is temporarily stored in internal log files for the purposes described above, in order to create statistical information about the use of our website, to further develop our website with regard to the usage habits of our visitors, and for general administrative maintenance of our website. The legal basis for this data processing is Art. 6 para. 1 lit. f) GDPR, based on our legitimate interest in the proper optimization of our website.

The information stored in the log files does not allow any direct conclusions to be drawn about your person – in particular, we only store the IP addresses in shortened, anonymized form. The log files are stored for 7 days and then deleted.

2.2 Contact form

If you send us an inquiry about our service via a contact form, we regularly process your name and e-mail address so that we can reach and address you. To enable us to make a quick initial assessment of your inquiry, you can also provide additional information. Mandatory fields are marked as such.

We process the data you provide in order to answer your inquiry, to compile an individual offer for you and to be able to contact you for the purpose of further discussions. The legal basis for the data processing is Art. 6 para. 1 lit. b) GDPR.

The data collected when using the contact form will be deleted after processing your request, unless a collection contract has been concluded and you still need to be stored until it is completed due to the connection with another process, or unless you have given us permission to contact you in the future for further marketing measures.

2.3. Business partner

If you are our contractual partner, we regularly collect master data (e.g. names and addresses), contact data (e.g. e-mail and telephone numbers) as well as contractual data (e.g. contract contents, contractual communication, names of contact persons) and, if applicable, payment data (e.g. bank details, payment history) as part of our cooperation and communication with you for the purpose of providing our contractual or pre-contractual services and obligations.

As a contractual partner of PAIR Finance, you will receive access to our service platform. In order to use the service platform, you are required in particular to provide your name, an e-mail address and a password. As part of the use of the platform, we also collect the time of the first login, the last two logins with time and IP and the total number of all logins for the purpose of security checks as well as the language selection in the system for the purpose of displaying the content.

The data processed, the type, scope, purpose and necessity of the processing are determined by the underlying contractual relationship. The legal basis for the data processing is Art. 6 para. 1 lit. b) GDPR.

In the context of contract processing, we use PayPal (Europe) S.à r.l. et Cie, S.C.A. (“PayPal”) as a payment service provider. The integration of the payment service provider takes place on the basis of Art. 6 para. 1 lit. b) GDPR as well as on the basis of our legitimate interest according to Art. 6 para. 1 lit. f) GDPR, in order to be able to offer an effective and secure payment option. The data processed by PayPal may include master data, such as name and address, bank data, such as account numbers or credit card numbers, passwords, as well as the contract-, amount- and recipient-related information. These data are necessary to carry out the transactions. The data entered is processed and stored only by PayPal. PAIR Finance does not receive any account or credit card related information, only information about the receipt of a payment. For payment via PayPal, the terms and conditions and the data protection information of PayPal apply, together with the information provided therein on the assertion of revocation, information and other data subject rights (https://www.paypal.com/de/webapps/mpp/ua/privacy-full).

For the purpose of contact management, we use the customer relationship management system, CRM for short, of Pipedrive OÜ, Mustamäe tee 3a, 10615 Tallinn, Estonia (“Pipedrive”). In CRM, we record company contacts of clients, business partners and prospective clients. Pipedrive stores the processed for us within the European Union. The legal basis for the processing is Art. 6 para. 1 lit. f) GDPR, based on our legitimate interest to organize our corporate contacts efficiently using an external service provider.

2.4. Application

Furthermore, you have the opportunity to contact us via our website for the purpose of applying for an advertised position. As part of your application process at PAIR Finance we process your personal data you provided for us via our partner Greenhouse Software, Inc.; 18 West 18th Street, 11th Floor; New York, NY 10011 USA (hereinafter “Greenhouse”).

At PAIR Finance we process your personal data to review your application and qualification, as far as that is necessary for a decision in the application process (§ 26 BDSG).

Otherwise the data processing is mainly necessary for PAIR Finance to monitor and improve the recruitment process. This indicates our legitimate interest, Art. 6 (1) lit. f) GDPR.

Please find further information in the privacy policy of Greenhouse.

2.5 Payment reminder received?

If you have received a payment reminder from us by e-mail and open it, we store – depending on your e-mail settings – the information that you have received and opened an e-mail sent by us. For this purpose, we use a service provider that enables us to receive a “read confirmation” as soon as you open an e-mail. The reading confirmation is processed for the purpose of determining the suitability of e-mails as a communication channel and to be able to prove the receipt of the payment request. The legal basis for the processing is Art. 6 para. 1 lit. f) GDPR. You can prevent the collection of the read confirmation by blocking the loading of images in the settings of your email client.

If you write an e-mail to our customer service due to a payment reminder or call our hotline, we regularly collect your e-mail address, your telephone number and possibly your name, depending on the contact method. In order to process your request properly, we may require additional information (e.g. a casefile number, address or date of birth). We use this information to put you through to the relevant person in charge and to process your inquiry. The legal basis for data processing in the context of contacting our customer service is Art. 6 para. 1 lit. b) and lit. f) GDPR.

The data is generally deleted after the expiry of the statute of limitations of the underlying transaction, unless you need to be stored beyond this due to the connection with another transaction; otherwise, the statutory retention obligations apply.

In order to organize and process incoming requests, we use the web-based ticket system of Zendesk, Inc. , 1019 Market St., San Francisco, California 94103, USA, (“Zendesk”). Zendesk’s servers are located within the European Union. If you do not consent to Zendesk’s processing of your data, you may contact us by mail as an alternative method of contact. You can also find more information about Zendesk in Zendesk’s privacy policy. The legal basis for the integration of Zendesk and the associated data processing is Art. 6 para. 1 lit. f) GDPR, based on our legitimate interest in the efficient design of our internal processes and service.

To improve our customer service, we use the service provider MessageBird, MessageBird B.V., Trompenburgstraat 2C, 1079 TX Amsterdam, The Netherlands, to offer and initiate communication via WhatsApp, a service of WhatsApp, Inc., 1601 Willow Road, Menlo Park, California 94025, USA, privacy policy at whatsapp.com/legal/businesspolicy/. When we communicate with you via WhatsApp, we collect and store e.g. name and surname, telephone number and chat or message history. The legal basis for the data processing is Art. 6 para. 1 lit. f) GDPR, whereby our legitimate interests are better customer service and the efficiency of processing customer inquiries. The collected data and in particular the message history are stored in the file for the debt in question. After payment of the outstanding debt or termination of the collection procedure for other reasons, we will check after three years from the end of the year in which the payment or termination took place whether we still need your data or whether deletion is contrary to statutory retention obligations.

Finally, for training purposes and to improve our service quality, we may record incoming telephone calls if and to the extent that you have given your express consent before the recording. You will be informed of the possibility of recording and asked for your consent as part of a prior recorded announcement. You can, of course, also have a telephone conversation with us without recording without giving your consent. The legal basis for the recording and the associated data processing is Art. 6 (1) a) and Art. 7 GDPR, based on your consent. You have the right to revoke any consent given in accordance with Art. 7 (3) GDPR with effect for the future. The recordings will be deleted after evaluation for training and quality purposes, unless they still need to be stored until this is done due to an additional interest in preserving evidence.

3. Cookies and usage analysis

When you visit and use our website, various cookies are set. Cookies are small text files that are stored in the memory of your web browser and contain information that allows web servers to recognize you on subsequent visits. Cookies cannot execute programs or transfer viruses to your computer.

3.1 Use of own cookies

We use our own cookies to note that information placed on our website has been displayed to you, so that it will not be displayed again the next time you visit the website. The main purpose of our own cookies is to make the use of our services as time-saving and user-friendly as possible. The processing of the respective cookies is based on our legitimate interests in enabling a comfortable and individual use of our website. In this respect, the legal basis is Art. 6 para. 1 lit. f) GDPR.

You can prevent the storage of cookies by preventing the acceptance of cookies via this website in your browser settings. However, if you do not accept cookies, this may lead to significant functional restrictions of our website in individual cases.

3.2 Use of third-party cookies for usage analysis

We also use various approaches on our website to better understand the use of the website and to learn which content is particularly relevant for our users and via which type of end devices it was visited. This allows us to optimize our content and adapt the page design to the actual browser types and end devices used.

For these purposes, we use the services of various external providers, which are listed below. The legal basis for the described data processing is either Art. 6 para. 1 lit. a) and Art. 7 GDPR, based on your consent, or Art. 6 para. 1 lit. f) GDPR, based on our legitimate interest in the demand-oriented design and continuous optimization of our website.

a) Google Analytics

Our website uses the web analytics service Google Analytics, which is provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”). Google Analytics uses cookies valid for 14 months to collect your access data when you visit our website. The access data is compiled by Google on our behalf into pseudonymous usage profiles and transferred to a Google server in the USA. Before this, your IP address is anonymized. We are therefore unable to determine which usage profiles belong to a particular user. Based on the data collected by Google, we can therefore neither identify you nor determine how you use our website. In the event that, exceptionally, personal data is transferred to the USA in the process, we have agreed with Google that the EU standard contractual conditions for the processing of data will apply. Google has thus undertaken to guarantee the European data protection principles and the local level of data protection also in the context of data processing taking place in the USA.

Google will use the information obtained through the cookies on our behalf to evaluate the use of our website, compile reports on website activity and provide us with other services related to website activity and internet usage. You can also find more information on this in Google’s privacy policy.

You can object to web analysis by Google at any time. You have several options to do this: (1) You can set your browser to block cookies from Google Analytics. (2) You can adjust your settings for advertising with Google. (3) You can install the deactivation plug-in provided by Google at the following link in your browser (this variant does not work on mobile devices): Browser plug-in.

As an alternative to the browser plugin or for browsers in mobile devices, you can click this link to stop being tracked by Google Analytics on our site in the future (this decision only applies to

your current browser and this website). A cookie is stored on your device for this purpose, which means that you will have to click this link again if you delete your cookies. If cookies have been disabled, this may mean that not all offers on this website are available to you.

For more information about Google Analytics, please see Google’s privacy policy.

b) Google Tag Manager

Our website uses the Google Tag Manager, a service of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”). The Tag Manager is used to manage the tools for usage data analysis and other services, so-called website tags. A tag is an element that is stored in the source code of our website, for example, to record specified usage and interactions.

The Google Tag Manager tool itself (which implements the tags) is a cookie-less domain and does not collect any personal data. The tool provides for the triggering of other tags, which in turn may collect data and which are further explained in this Privacy Policy. Google Tag Manager does not access this data. If a deactivation has been made at the domain or cookie level, it will remain in place for all tracking tags implemented with Google Tag Manager. You can also read more about the Tag Manager in Google’s information on the Tag Manager.

4. Links to other websites and online offers

Our website may contain links to the websites and online offers of other providers not affiliated with us. When you activate these links, we naturally no longer have any influence on what data is collected by the respective providers and what data is collected by them. You can find detailed information on data collection and use in the privacy policy of the respective provider. Since the collection and processing of data by third parties is beyond our control, we cannot accept any responsibility for this.

We embed videos of the platform “YouTube” of the provider Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, on our website. By clicking on the YouTube videos, Google receives the information that you have called up a corresponding video on our website. This occurs regardless of whether or not you are logged in to Google or your YouTube account. If you are logged in, the information about the played video is directly assigned to your Google account and your YouTube account. If you do not want this, you must log out before playing the video. Google stores your data and may use it for purposes of advertising, market research and to tailor its own websites to your needs. Such an evaluation takes place even for users who are not logged in. Information on this can be found in the privacy policy, and you also have the option ofopting out.

PAIR Finance also presents itself within social networks and other online platforms in order to communicate with current and future clients, business partners, customers and interested parties as well as potential job applicants and to inform them about our services.

The processing of personal data that takes place in this context is based on our legitimate interests in effective information and communication pursuant to Art. 6 (1) f) GDPR. If the data subjects are asked by the respective providers of the platforms for consent to the aforementioned data processing, the legal basis of the processing is Art. 6 (1) a), Art. 7 GDPR. For a detailed description of the respective processing and the objection options, please refer to the linked information of the providers: Facebook (FacebookIrelandLtd., 4 GrandCanalSquare, GrandCanal Harbour, Dublin 2, Ireland): Agreement on Joint Processing of Personal Data, Privacy Policy. Twitter (Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA): Privacy policy. LinkedIn (LinkedInIrelandUnlimited Company Wilton Place, Dublin 2, Ireland): Privacy policy. Xing (XING AG, Dammtorstraße 29-32, 20354 Hamburg, Germany): Privacy policy.

5. Hosting

The operation of our online and service offering requires infrastructure services, computing capacity, storage space and database services, for which we use service providers. We and our service providers collect data on the basis of our legitimate interests in the efficient and secure provision of our online and service offerings pursuant to Art. 6 (1) f) in conjunction with Art. 28 GDPR. Art. 28 GDPR.

Your data is partially processed on servers provided by Amazon Web Services, a service of Amazon Web Services Inc, 410 Terry Avenue North, Seattle, Washington 98109, USA (“AWS”). AWS’s servers are used to connect your device to the content on our website. The servers we use are located within the European Union. However, for technical reasons, parts of your data may also be processed in countries outside the European Economic Area, in particular in the USA. In order to ensure the protection of your data in this case as well, we have agreed with AWS on the validity of the EU standard contractual conditions for the processing of data. AWS has thus undertaken to ensure the European data protection principles and the local level of data protection also in the context of data processing taking place in the USA. The legal basis is Art. 6 para. 1 lit. f) GDPR, based on our legitimate interest to store content of our website securely and reliably by external service providers and at the same time to reduce our own effort for the provision of the IT infrastructure of our website.

6. Disclosure of data

The data we collect will only be passed on if you have given your express consent to do so in accordance with Art. 6 (1) a) GDPR, if the transfer is necessary for the assertion, exercise or defense of legal claims in accordance with Art. 6 (1) f) GDPR and there is no reason to assume that there is an overriding interest worthy of protection in not passing on the data, if we are legally obligated to pass on the data in accordance with Art. 6 (1) c) GDPR or if this is legally permissible and necessary in accordance with Art. 6 (1) b) GDPR for the processing of contractual relationships with you or for the implementation of legal claims. 6 para. 1 lit. c) GDPR we are legally obliged to disclose the data or this is legally permissible and necessary according to Art. 6 para. 1 lit. b) GDPR for the processing of contractual relationships with you or for the implementation of pre-contractual measures that are carried out at your request.

Some of the data processing described in this privacy statement may be carried out by our service providers. In addition to the service providers mentioned in this privacy policy, this may include IT service providers who maintain our systems and consulting companies. If we pass on data to our service providers, they may only use the data to perform their tasks. The service providers have been carefully selected and commissioned by us. They are contractually bound to our instructions, have suitable technical and organizational measures to protect the rights of the data subjects, ensure an appropriate level of data protection and are carefully monitored by us.

In addition, disclosure may occur in connection with government inquiries, court orders and legal proceedings when necessary for law enforcement or prosecution.

7. Your rights

You have the right to request information about the processing of your personal data by us at any time. In the context of providing information, we will explain the data processing to you and provide an overview of the data stored about your person.

If any data we have stored is incorrect or no longer up to date, you have the right to have this data corrected. You can also request the deletion of your data. If deletion is exceptionally not possible due to other legal provisions, the data will be blocked so that it is only available for this legal purpose.

You can also have the processing of your data restricted, for example, if you believe that the data we have stored is incorrect. You also have the right to data portability, which means that we will provide you with a digital copy of the personal data you have provided upon request.

To exercise your rights as described here, you may contact us at any time using the contact details provided in section 1 above.

In addition, you have the right to object to data processing based on Art. 6 (1) (e) or (f) GDPR or for direct marketing purposes. Finally, you have the right to complain to the data protection supervisory authority responsible for us. You can assert this right at a supervisory authority in the member state of your residence, your workplace or the location of the alleged infringement.

In Berlin, the responsible supervisory authority is the Berlin Commissioner for Data Protection and Freedom of Information, Friedrichstr. 219, 10969 Berlin.

In accordance with Article 7 (3) GDPR, you have the right to withdraw your consent at any time. This has the consequence that we no longer continue the data processing based on this consent for the future. By revoking the consent, the

lawfulness of the processing carried out on the basis of the consent until revocation is not affected.

Insofar as we process your data on the basis of legitimate interests pursuant to Art. 6 (1) f) GDPR, you have the right to object to the processing of your data pursuant to Art. 21 GDPR and to provide us with reasons that arise from your particular situation and that you believe outweigh your interests worthy of protection. If it concerns an objection to data processing for direct marketing purposes, you have a general right of objection, which will also be implemented by us without giving reasons.

If you wish to exercise your right of revocation or objection, it is sufficient to send an informal message to the above contact details.

Status: July 2021