Your data is important to us! On the basis of the provisions of the European General Data Protection Regulation (hereinafter "GDPR"), we are happy to comply with our obligation to provide you with comprehensive information about the processing of your personal data in the context of the video consultation.

If you have any further questions about the processing of your personal data, please do not hesitate to contact our data protection officer at any time.

**1\. important terms**

In this section of the privacy policy, you will find information on the scope of application, the data controller, its data protection officer and data security. We also explain the meaning of important terms used in the privacy policy in advance.

Browser: Computer program for displaying websites

Cookies: Text files that the web server called up places on the user's computer by means of the browser used. The stored cookie information may contain both an identifier (cookie ID), which is used to recognize the user, and content information such as login status or information about websites visited. The browser sends the cookie information back to the web server on subsequent, new visits to this page with each request. Most browsers accept cookies automatically. You can manage cookies using the browser functions (usually under "Options" or "Settings"). This allows the storage of cookies to be deactivated, made dependent on your consent in individual cases or otherwise restricted. You can also delete cookies at any time.

Third countries: Third countries are countries outside the European Union ("EU") or the European Economic Area ("EEA").

GDPR: Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), available here.

Personal data: Any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Processing: Any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Access data:

Services: Our offers to which this privacy policy applies (see scope of application).

Tracking: The collection of data and its evaluation with regard to the behavior of visitors to our services.

Tracking technologies: Tracking can take place both via the activity logs stored on our web servers (log files) and by means of data collection from your end device via pixels, cookies and similar tracking technologies.

**2 Scope of application**

This data protection information applies to the following services - myPIMA Portal (as the basis for the following services) - Video consultation - Examination appointments - Company doctor hotline - Webinars **3\. responsible person** Responsible for the processing of your personal data in the context of service provision is:

**PIMA Health & Safety GmbH**
Anna-Birle-Str.1
55252 Mainz-Kastel

**4\. data protection officer**

PIMA Health & Safety GmbH has appointed a data protection officer in accordance with the legal requirements. You can reach the data protection department at

**PIMA Service & Solutions GmbH**
Anna-Birle-Str. 1
55252 Mainz-Kastel
eMail [datenschutz@pima.de]()
Phone +49 6134 5006 160

**5\. data processing**

**a. Voluntariness** \- **No obligation to provide and consequences of non-provision**

The provision of personal data in our portal is not required by law or contract. You are not obliged to provide your personal data. We will inform you during the input process if the provision of personal data is required for the respective service (e.g. by labeling it as a "mandatory field"). In these cases, the requested service cannot be provided without processing your personal data. In all other cases, the non-provision of your personal data may have an impact on the form and quality of the services.

**b. Consent**

In various cases, you have the option of giving us your consent in connection with the processing described below. In this case, we will inform you separately in connection with the submission of the respective declaration of consent about all modalities, about the scope of the consent and about the purposes that we pursue with this processing.

**c. Transfer of personal data to third countries**

PIMA does not transfer personal data to third countries outside the EU.

**d. Place of processing**

The place of processing is the EU.

**e. Housing/hosting with external service providers**

When processing your personal data, we also use "hosting service providers" who provide us with storage space and processing capacities in their data centers. The "hosting service providers" used process your personal data exclusively on the basis of individually agreed order processing contracts in accordance with Art. 28 GDPR, whereby it is ensured in particular that data processing is carried out exclusively on the basis of our instructions.

**f. Transmission to state authorities**

We transfer your personal data to state authorities (including law enforcement authorities) if this is necessary to fulfill a legal obligation to which we are subject (Art. 6 para. 1 sentence 1 lit. c GDPR). In addition, we also process your personal data if the processing is necessary for the establishment, exercise or defense of legal claims. In this case, your personal data will be processed on the basis of our overriding legitimate interests in the enforcement of rights within the meaning of Art. 6 para. 1 sentence 1 lit. f GDPR.

**g. Duration of storage**

The "Storage period" section indicates how long we process your personal data for the respective purpose or the respective functionality. If the processing of your personal data is no longer necessary for the respective purpose, we will delete your personal data, unless we are obliged to retain it for a longer period due to legal obligations.
I.** Processing of personal data myPIMA Portal**

Each time the PIMA portal and its subpages are accessed, technically necessary access data is automatically transmitted by the browser used on your end device without any action on your part and stored in log files (web server log files) until it is automatically deleted. This may include - Information about the browser type and version used - the user's operating system - the user's internet service provider - abbreviated IP address of the requesting device - Date and time of access - Websites from which the user's system accesses our website - Websites that are accessed by the user's system via our website - Online identifiers (e.g. device identifiers, session IDs) The information stored in the web server log files does not allow any direct conclusions to be drawn about your person - in particular, we only store the IP addresses in abbreviated, anonymized form. The web server log files rotate daily, i.e. a new log file is created each time and the previous one is stored in compressed form and deleted after 14 days.

**a) Legal basis for processing your data.**

If we obtain consent for the processing of personal data, Art. 6 para. 1 sentence 1 lit. a GDPR serves as the legal basis.

For the fulfillment of a contract . 6 para. 1 sentence 1 lit. b GDPR as the legal basis. This also applies to processing operations that are necessary for the implementation of pre-contractual measures.

Insofar as the processing of personal data is necessary to fulfill a legal obligation to which our company is subject, Art. 6 para. 1 sentence 1 lit. c GDPR serves as the legal basis.

**b) Deletion **

We process and store your personal data processed via the PIMA portal only for as long as is necessary to fulfill the purpose (provision and use of services). In addition, personal data processed via our website will be stored if a statutory or contractually agreed retention period makes this necessary.

**c) Data security **

We implement technical and organizational measures to ensure data security, which protect your data against accidental or intentional manipulation, partial or complete loss, destruction or unauthorized access. These measures are constantly being improved in line with technological developments. Personal data that you transmit via the PIMA portal and the Internet is transmitted in encrypted form using SSL technology.

**d) Visiting the myPIMA portal**

The data processing of this technically necessary access data serves to deliver the contents of our PIMA portal to ensure the functionality of our information technology systems and optimization.
**III Webinars** PIMA live webinars are realized via the edudip® platform. The following participant data is collected/processed: - Mandatory fields (first and last name, e-mail address) - User information (webinar data, including display name, chat history, webinar attendance time(s) and duration of participation) - Technical data (IP addresses) - Recordings of webinars All personal data is transmitted to edudip® in encrypted form (AES 256Bit/TLS 1.2 protocol). The edudip® servers are all located in Germany, France and Poland and are all ISO 27001 certified. The participant data is stored for a period of 3 months and then automatically deleted. To protect privacy and data protection, individual participants are not visible to other participants. Chat messages are also only displayed to the moderators and not to the participants. In addition, participants are not addressed by name when questions are asked. Webinars are recorded and then made available in the media library of the PIMA portal.
[**edudip privacy policy**]()

**IV. Media libraries** 1. **Webinar recordings: **The webinar recordings are provided by the Mux® platform. Mux® is a video platform for the provision of video streaming. The IP address (shortened), geolocation data, Autonomous Systems Number, viewer ID, device information and details of video content viewed are stored for a period of 100 days and then automatically deleted. The viewer data is not used for advertising or to sell user-identifiable data. The Mux® servers are located in Germany.
2. **Provision and archive of health rad **ars: Health radars are provided via Flowpaper® **. **
**V. Video consultation **
**a. Purpose of processing, legal basis including designation of legitimate interests, storage period**

Data category		Intended purpose	Legal basis	Legitimate interest, if applicable		Storage duration
Health data		Implementation of occupational health advice, precautions and measures as well as psychological counseling and assessment.	GDPR Art. 9 para. 2 lit. h BDSG § 22 para. 1 lit. b. See also our privacy policy on occupational medicine	-/-		10 years to 40 years.
Surname, first name, date of birth, e-mail address	Provision of our services for employees, identification, checking authorization to access the offer, prescribed documentation by practitioners/consultants		Art. 9 para. 2 lit. a GDPR BDSG § 22 para. 1 lit. b.	-/-	The video consultation is not recorded or stored. The health data is subject to the statutory documentation requirements and retention periods
Access data, login data (temporary log files)	Provision of our services, prescribed documentation by practitioners/consultants, contract fulfillment, presentation of the contents of the service, detection of attacks on our site based on unusual activities, error diagnosis		Art.9 para.2 lit.a GDPR, Art. 6 para.1 p.1 lit.f Alt. 2 GDPR, BDSG § 22 para. 1 lit. b.	The processing of the aforementioned data categories ensures the proper functionality and, in particular, the security of our services. In addition, the processing of your personal data in this context serves to prevent misuse, prevent damage and optimize our services in your interest. This also constitutes our overriding interest in the processing of your personal data.	7 days
Appointment data	Provision of our services, documentation as part of the contractual relationship, prescribed documentation by practitioners, contract fulfillment		Art. 6 para. 1 sentence 1 lit. b GDPR	-/-	The appointment data is stored for a period of 6 months and then automatically deleted.

**b. Recipients of personal data **

Recipients

Data category

PIMA IT Security Department

Access data

Art. 6 para. 1 sentence 1 lit. f GDPR. By using our internal IT security department and external IT service providers, we can ensure the integrity and confidentiality of our services, in particular by identifying security gaps, closing vulnerabilities and defending against attacks. This also constitutes our overriding legitimate interest.

Billing office

Billing data without medical data such as (medical history, diagnosis or measures)

The processing of data by PIMA for the purposes of the offer.

This also includes the collection of all data relevant for billing your employer or self-payers. In addition, however, it is necessary for the administration and billing of the services on the basis of Art. 9 para. 2 h) in conjunction with Art. 9 para. 3 GDPR in conjunction with. § 22

para. 1 b) BDSG or your consent and, if applicable, the collection of these claims, data to

to PIMA Service & Solutions GmbH for processing.

**VI Analysis and system tools **

The tracking measures listed below and used by us are carried out on the basis of Art. 6 para. 1 sentence 1 lit. f GDPR. With the tracking measures used, we want to ensure a needs-based design and the continuous optimization of our website. On the other hand, we use the tracking measures to statistically record the use of our website and to evaluate it for the purpose of optimizing our offer for you.

**a) Constent Manager \| Strapi**

Strapi is a consent management service from Usercentrics GmbH that is installed on our server and does not transmit any data to unauthorized third parties. The purpose of the tool is consent management to comply with legal obligations such as consent to cookies and consent to data storage. The stored HTTP cookies are deleted after 180 days.

**b) Cookie technology **

*matamo®* is used on the PIMA portal as a secure Google Analytics alternative. Data is collected and stored for marketing, market research and optimization purposes on the basis of PIMA's legitimate interests (Art. 6 (1) (f) GDPR).

Matomo is an open source software tool for web analysis. Web analysis is the collection, compilation and evaluation of data on the behavior of visitors to web portals. Among other things, a web analysis tool collects data about the web portal from which a data subject has accessed a web portal (so-called referrer), which pages of the web portal were accessed or how often and for how long a subpage was viewed. The tool is operated on the servers operated by PIMA. The log files, which are sensitive under data protection law, are stored exclusively on the PIMA server and deleted after 6 months.

Matomo places a cookie on the data subject's IT system. The setting of the cookie enables an analysis of the use of our web portal. As part of this technical process, PIMA obtains knowledge of personal data, such as the IP address of the data subject, which is used to trace the origin of visitors and clicks. The cookie is used to store personal information, such as the access time, the location from which the access was made and the frequency of visits to our website. Each time our web portal is visited, this personal data, including the IP address of the Internet access used by the data subject, is transmitted to our server. This personal data is stored by us. We do not pass this personal data on to third parties.

**VII Rights of data subjects**

**Right to object**

You have the right to object, on grounds relating to your particular situation, at any time with future effect to processing of personal data concerning you which is based on point (e) or (f) of Article 6(1) GDPR.

You can exercise your right to object free of charge. To process your request more quickly, please use the email address [datenschutz@pima.de]()

**Right to information**

You have the right to request confirmation from us as to whether personal data concerning you is being processed and, if so, to request information about this personal data and the other information listed in Art. 15 GDPR.
**Right to rectification** You have the right to obtain from us without undue delay the rectification of inaccurate personal data concerning you (Art. 16 GDPR). Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement. **Right to erasure ("right to be forgotten")** You have the right to obtain from us the erasure of personal data concerning you without undue delay where one of the grounds specified in Art. 17 (1) GDPR applies and the processing is not necessary for one of the purposes specified in Art. 17 (3) GDPR. **Right to restriction of processing** You are entitled to request the restriction of the processing of your personal data if one of the conditions set out in Art. 18 (1) (a) to (d) GDPR applies.

**Right to data portability**

You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from us, subject to the conditions set out in Art. 20 (1) GDPR. When exercising the right to data portability, you have the right to have the personal data transmitted directly from us to another controller, where technically feasible.

**Right to withdraw consent**

If the processing is based on your consent, you have the right to withdraw your consent at any time. This does not affect the lawfulness of the processing carried out on the basis of the consent until revocation.

**Right to lodge a complaint**

You have the right to lodge a complaint with the supervisory authority responsible for our company. The supervisory authority responsible for our company is

The Hessian Commissioner for Data Protection and Freedom of Information P.O. Box 3163 65021 Wiesbaden Telephone: +49 611 1408 - 0

Data protection