(Last updated: 5 June 2018) Thank you for visiting our website and for your interest in our company. The protection of your personal data is a matter of great importance to us. Below we inform you according to art. 12, 13, and 21 of the General Data Protection Regulation (GDPR) about the handling of your personal data when visiting our website www.profitlich-schmidlin.de. Personal data are individual details about personal or factual circumstances of a specific or identifiable natural person. This includes information such as the civil name, address, telephone number and date of birth.

I. Responsible Body

Responsible Body according to GDPR ProfitlichSchmidlin AG Waidmarkt 11 50676 Köln E-Mail: kontakt@profitlich-schmidlin.de Telefon:+49 221 79077026

II. Purposes and Legal Basis of the Data Processing

1. Informational Use of the Website

You can visit our website without providing any personal information. If you use our website for informational purposes only, i.e. do not register for our newsletter or otherwise provide us with information about yourself, we do not collect any personal data, with the exception of the data that your browser transmits to enable you to visit the website. For the purpose of the technical provision of the website, it is necessary that we process certain automatically transmitted information about you so that your browser can display our website and you can use the website. This information is automatically collected for each visit of our website and stored in our server log files. This information refers to the computer system of the requesting computer. The following information is collected thereby:

• IP-adresse
• Browser type / -version (e.g.: Firefox 59.0.2 (64 Bit));
• Browser language (e.g.: German);
• Operating system (e.g.: Windows 10);
• Internal resolution of the browser window;
• Screen resolution;
• Javascript activation;
• Java on / off;
• Cookies on / off;
• Color depth;
• Time of access.

Furthermore, we use cookies to make our website available to you for use. Cookies are text files that are stored in the internet browser or by the internet browser when you visit a website on your computer system. A cookie contains a characteristic string of characters that enables a unique identification of the browser when the website is called up again. We use these cookies exclusively to provide you with our website and its technical functions. Some functions of our website may not be offered without the use of cookies. The following information is stored in the cookies and transferred to us:

• Language settings

Your information, collected by us through the aforementioned cookies, will not be used by us to create user profiles or to evaluate your browsing behavior. We process your personal data for the technical provision of our website on the following legal basis:

• for the fulfilment of a contract or for the implementation of pre-contractual measures pursuant to Art. 6 para. 1 letter b GDPR, provided you visit our website to obtain information about our consulting services; and
• to protect our legitimate interests pursuant to Art. 6 para. 1 letter f GDPR in order to make the website technically available to you. Our legitimate interest is to offer you an appealing, technically functioning and user-friendly website as well as to take measures to protect our website from cyber risks and to prevent our website from posing cyber risks to third parties.

2. Active Use of the Website

In addition to the merely informational use of our website, you can also actively use our website, for instance get access to our quarterly reports or to register for our newsletter. In addition to the above-mentioned processing of your personal data for merely informational purposes, we will also process other personal data that we require from you to deliver the afore-mentioned functions. a. User Requests In order to process and answer your inquiries to us, e.g. via the email address mentioned in the imprint, we process your personal data provided by you in this context. In any case, this includes your name and email address in order to send you an answer, as well as the other information that you send to us in the context of your message. We process your personal data in order to respond to user inquiries on the following legal basis:

• to protect our legitimate interests pursuant to art. 6 para. 1 lit f GDPR; our legitimate interest is to answer customer inquiries appropriately.

b. Newsletter In our newsletter we inform you about us and the ProfitlichSchmidlin Fund. If you would like to receive the newsletter, we need a valid email address from you and information that allows us to verify that you are the owner of the email address provided or that the owner of the email address has agreed to receive the newsletter. This data is only used for sending and evaluating the use of the newsletter. Further data such as first name and last name are used exclusively for personalized contact. The provision of this data is voluntary. When you register for the newsletter, we save your IP address and the date of registration. This data serves as proof in the event that a third party misuses an e-mail address and registers for receiving the newsletter without the knowledge of the authorised party. For sending our newsletter we use the email tool CleverReach, which was developed by CleverReach GmbH & Co. KG, Rastede, Germany. CleverReach also stores your data for this purpose. CleverReach offers evaluation options for how the newsletters are opened and used. Your data will not be passed on to other third parties for the purpose of receiving the IR newsletter and CleverReach does not acquire any right to pass on your data. You can withdraw your consent to the storage of the data, the email address as well as their use for sending the newsletter at any time. The withdrawal can take place via a link in the newsletters themselves or by contacting us under the information provided above. We process your data for the dispatch of newsletters etc. and the personalization of the address on the following legal basis:

• If you have given us your consent by double opt-in procedure, pursuant to Art. 6 para. 1 a DSGVO.

c. Subscription to our Blog You may subscribe to our blog and by that receive a notice via email when new articles have been released. When subscribing, you only receive the desired mails; we do not process your data in any other way. You may cancel the subscription at any time.

III. Links

Some sections of our web pages contain links to the web pages of third parties. These websites are subject to their own data protection principles. We are not responsible for their operation including the data handling. If you send information to or about such third party sites, you should review the privacy statements of those sites before you submit any information that may assigned to you.

IV. Categories of Recipients

Firstly, only our employees will be informed of your personal data. In addition, we share your personal data with other recipients who provide services to us in connection with our website, insofar as this is legally permitted or prescribed. We limit the transfer of your personal data to what is necessary, in particular to be able to complete your order. In some cases, our service providers receive your personal data as contract data processors and are then strictly bound by our instructions when handling your personal data. In some cases, the recipients act independently with your data, which we transmit to them. Below, we describe the categories of recipients of your personal data:

• IT service providers who administrate and host our website,
• Service providers for the distribution of the newsletter.

V. Transfer into Third countries

We do not transfer your personal data to countries outside the EU or the EEA or to international organisations.

VI. Duration of Storage

1. Informational Use of the Website

When using our website for information purposes only, we store your personal data on our servers exclusively for the duration of your visit to our website. After you have left our website, your personal data will be deleted immediately. Cookies installed by us are usually also deleted after leaving our website.

2. Active Use of the Website

If you actively use our website, we initially store your personal data for the duration of responding to your inquiry or for the duration of our business relationship. This also includes the initiation of a contract (pre-contractual legal relationship) and the execution of a contract. In addition, we will store your personal data until any legal claims arising from the relationship with you become time-barred, in order to use them as evidence if necessary. The limitation period is generally between 12 and 36 months, but can also be up to 30 years. Upon expiry of the limitation period, we delete your personal data, unless there is a legal obligation to store such data, for example from the German Commercial Code (sec. 238, 257 para. 4 HGB) or from the Tax Code (sec. 147 para. 3, 4 AO). These retention obligations can last from two to ten years.

VII. Your Rights as Data Subject

Under the legal provisions you are entitled to the following rights as data subject, which you can assert against us: Right to information: You are entitled to request confirmation from us at any time within the scope of art. 15 GDPR as to whether we are processing personal data relating to you; If this is the case, you are also entitled under art. 15 GDPR to receive information about such personal data as well as other specific information (inter alia, processing purposes, categories of personal data, categories of recipients, planned storage period, the origin of the data, the use of automated decision-making and, in the case of transfers to third countries, the appropriate guarantees) and a copy of the data. Right to correction: According to art. 16 GDPR, you are entitled to demand correction of the personal data stored about you if it is inaccurate or incorrect. Right to deletion: You are entitled, under the conditions of art. 17 GDPR, to request from us the deletion of personal data relating to you without delay. Among other things, there is no right of deletion if the processing of personal data is necessary for (i) the exercise of the right to freedom of expression and information, (ii) the fulfilment of a legal obligation to which we are subject (e.g. statutory retention obligations) or (iii) the assertion, exercise or defence of legal claims. Right to limitation of processing: Under the conditions of art. 18 GDPR you are entitled to request from us the limitation of the processing of your personal data. Right to data transferability:You are entitled, under the conditions of art. 20 GDPR, to request from us the provision to you of the personal data relating to you that you have submitted to us in a structured, current and machine-readable format. Right of revocation: You have the right to revoke your consent to the processing of personal data at any time with effect for the futurewithout incurring any costs other than the transmission costs according to the basic rates. Right to objection: You are entitled to object to the processing of your personal data under the conditions of art. 21 GDPR, meaning that we have to terminate the processing of your personal data. The right of objection exists only within the limits provided for in art. 21 GDPR. In addition, our interests may prevent the processing from being terminated, so that we are entitled to process your personal data despite your objection. Right of appeal to a supervisory authority: You are entitled to file a complaint with a supervisory authority, in particular in the Member State of your place of residence, work or suspected infringement, under the conditions laid down in Article 77 GDPR, if you believe that the processing of personal data concerning you infringes the GDPR. The right of appeal is not prejudicial to any other administrative or judicial remedy. The supervisory authority responsible for us is: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen Kavalleriestr. 2-4 40213 Dusseldorf Germany Phone: 0211/38424-0 Fax: 0211/38424-10 Email: poststelle@ldi.nrw.de However, we recommend that you always address a complaint to our data protection officer first. If possible, your applications for the execution of your rights should be addressed in writing to the above address or directly to our data protection officer.

VIII. Scope of your Obligations to provide Data

Generally, you are not obliged to provide us with your personal data. However, if you do not provide this information, we will not be able to make our website available to you, answer your questions and enter into a contract with you. Personal data which we do not necessarily require for the above-mentioned processing purposes are marked as voluntary information by a ” if applicable ” or another symbol.

IX. Automated Decision Making/ Profiling

We do not use automated decision making or profiling (an automated analysis of your personal circumstances).

X. Amendments

We reserve the right to change this privacy policy at any time. Any changes will be announced by publishing the amended privacy policy on our website. Unless otherwise specified, such amendments shall take immediate effect. Please check this privacy policy regularly to ensure you have the latest version. Last updated in June 2018