1. Scope of the Privacy Policy At SOUL, (“Company” or “we” or “our”), we prioritize the respect for the privacy of your data. This privacy policy (“Policy”) describes how we collect and process information that can directly or indirectly identify you (“Personal Data”) when you interact with us through our digital offerings (including our websites and mobile applications (“Applications”), social media channels, stores, events, or other products and services). It also describes how your Personal Data is used, shared, and protected, the choices you have regarding your Personal Data, and how you can contact us. For some of our products or services, the way we may use or collect your Personal Data may differ from that set out in this Policy; in such cases, we will clearly link you to any dedicated policies within this Policy. We may change this Policy when necessary. If we make significant changes to this Policy (for example, changes that affect the Personal Data we collect or how or why we use it), we will inform you of these changes and the date of the changes at the beginning of this Policy. 2. Who is responsible for processing your Personal Data? The respective Company responsible for processing your Personal Data (“Data Controller”) will depend on how you interact with us and where you are located in the world. The respective Data Controller is included in each data processing activity in this Policy. For certain products or services, two Company entities or the Company and another third party may jointly determine how your Personal Data is used (“Joint Controllers”) for the purposes identified in this Policy. Whenever we act as Joint Controllers, we act based on a specific agreement that sets out the distribution of roles and responsibilities agreed upon by each party to fulfill their obligations. These joint controllership agreements govern in particular: •How and which Joint Controller will provide information to data subjects about the underlying data processing; •Which Joint Controller will be the designated point of contact for communication with data subjects and supervisory authorities; and, •Which Joint Controller will be responsible for notifying a Personal Data breach to supervisory authorities and data subjects. More details on Joint Controllership are provided in the specific section for the respective Personal Data processing activity. 3. How do we collect Personal Data from you? There are several ways we may collect your Personal Data, depending on how you interact with us. Below are several examples. However, for more detailed information on each category of Personal Data we collect, please visit the section “How and why do we use your Personal Data?”. Personal Data you provide to us directly: You may provide us with your Personal Data directly, for example, when you use our websites or applications, participate in our events or promotions, subscribe to our newsletters, purchase our products or services, create a user account, visit one of our restaurants, or communicate with us through one of our social networks. Personal Data we collect automatically: When you use our websites or applications, we may automatically collect certain types of information, such as information about your visit or interactions on the page. Personal Data we receive from other sources: We may also receive information about you from other sources if you use any of our websites, applications, or services. We also work closely with third parties (including, for example, subcontractors in technical, payment, and delivery services), credit agencies (for example, if you purchase from our online stores), business and sponsorship partners, and may receive information about you from them (including information that is publicly available). 4. How and why do we use your Personal Data? Here you will find detailed information about the different ways we process Personal Data when you use our products or services, in particular which categories of Personal Data we collect and with which third parties (if any) we share the Personal Data. A. OUR WEBSITES i. Provision of the Website (Creation of Log Files) Purpose of Data Processing You can visit or use our websites without needing to create a user account and actively disclose your Personal Data. However, each time you visit one of our websites, your browser automatically transmits some information to us. Such information is stored by us in so-called server log files (log files). We may process your Personal Data for the following purposes, including: •Providing and delivering our websites and ensuring their functionality; •Optimizing our websites (e.g., to improve loading times); •Ensuring the security and stability of our IT systems. Legal Basis for Data Processing The temporary storage and processing of this Personal Data are based on our legitimate interests to ensure the stability and functionality of our websites. Categories of Personal Data The following Personal Data may be collected: •Browser information (e.g., IP address, browser type and version, operating system and interface used, language and version of the browser software, etc.); •Date and time of access and time zone difference to Greenwich Mean Time (GMT); •Data volume transmitted in bytes; •Websites from which the user’s system accesses our websites; •Websites accessed by the user’s system through our websites; •Access status/HTTP status code. Recipient(s) of the Data Your Personal Data may be transferred to: •IT service providers (e.g., hosting providers, cloud service providers, etc.); •Backup and disaster recovery specialists. Data Controller The data controller for data processing is the company named in the imprint of the respective website. Storage Duration To the extent that Personal Data is stored in log files, these files will be kept only as long as necessary for the respective data processing. ii. Cookies and Similar Technologies When you visit our websites, we process Personal Data using cookies and similar technologies (e.g., tags, web beacons, local/session storage, and JavaScript) (hereinafter collectively “Cookies”). Cookies are small text files stored on your end device (PC, laptop, tablet, or smartphone). These text files are downloaded by your browser when you visit our websites for the first time. When you visit a website again with the same device or browser, the Cookie and the information stored in it are sent back to the website that created them (first-party Cookie) or sent to another website to which it belongs (third-party Cookie). As a result, the website “recognizes” that it is the same user and adjusts the display of content on the website. Our cookie settings appear automatically on the first visit to our websites. You can set your personal preferences in the cookie settings. Unless the use of a Cookie is absolutely necessary, for example, for technical reasons, you can accept or refuse the use of such Cookies. You can change your cookie settings at any time through the cookie settings in the footer of the respective website. Cookies already stored can be deleted at any time. If Cookies are disabled for our website, it is possible that you may not be able to use all the functions of the website. We use Cookies for the following purposes: •To provide basic functions of the websites and provide any services requested by you, for example, to save your cookie settings or offer secure areas for logged-in users (learn more in “Absolutely Necessary Cookies”); •For website usage analysis (“web statistics”), so that we can continuously improve our digital offerings and better tailor them to the needs and interests of our users (for more information, see “Performance Cookies”); •For the professional presentation of the content on our websites, for example, by integrating video services or map material (for more information, see “Third-Party Service Embeds”); •To personalize our offerings, for example, to display personalized advertising on the end device used (for more information, see “Marketing Cookies”). a. Absolutely Necessary Cookies Purpose of Data Processing We use Absolutely Necessary Cookies to: •Administer our websites for internal operations, including troubleshooting purposes and to understand any errors you may encounter on our websites; •Provide basic functions for our websites. Without such Cookies, we cannot provide essential services, such as shopping carts; •Keep our websites secure and protected and help manage and administer our IT systems; and, •Improve the use and content of our websites to ensure that the content is presented in the most effective way for you and your devices. Legal Basis for Data Processing The temporary storage and processing of Personal Data are based on our legitimate interests to: •Provide our products or services to you, including fully functional websites and the services you need; •Ensure that our websites and IT are secure and being used appropriately. Categories of Personal Data, Storage Duration, and Categories of Data Recipient(s) You can find more information about which absolutely necessary cookies we use, as well as which categories of Personal Data we process, how long we store them, and to which third parties we transfer them in the cookie settings of the respective website. Data Recipients Your Personal Data will be transferred to IT service providers (e.g., hosting providers, cloud service providers, consent management providers, login service providers). Data Controller The Data Controller for the processing of Personal Data is the company named in the imprint of the respective website. b. Performance Cookies Purpose of Data Processing Subject to your consent, we will process your information to measure and improve the performance of our websites (e.g., counting visits and traffic sources to help us understand which pages are the most and least popular and see how visitors move around the sites). If you do not consent to such processing, it will not have a direct effect on the functioning of the sites, but without the information obtained from Performance Cookies, it will be more difficult for us to develop our sites. You can find more information about which Performance Cookies we use, what they are for, and how long they are stored in the cookie settings on the respective site. Legal Basis for Data Processing The collection and processing of this Personal Data are based on your consent, where applicable in conjunction with the provisions of the E-Privacy Directive or its national implementation. You can withdraw your consent at any time without giving reasons. However, the withdrawal of consent does not affect the legality of the processing before the said withdrawal. Categories of Personal Data The following Personal Data may be collected, for example, Personal Data about: •Your visit, including the clickstream of URLs to, through, and from our sites; •Page views and app usage in a session (e.g., number of clicks, duration of visit to certain pages); •The origin of the first request; •Your device, operating system, and browser; •The location of the device; •Videos you have viewed, searched for, or accessed; •Download or playback errors; •Video player and playback mode; •Promotions placed on the sites. Recipient(s) of the Data Your Personal Data will be transferred to IT service providers (e.g., consent management providers, login service providers, and cloud hosting providers). Data Controller The Data Controller for data processing is the company named in the imprint of the respective website. Storage Duration Cookie data will be stored for 30 (thirty) minutes after processing the last hit, but for a maximum of 3.5 hours after being set (browser session). The “sessionStorage” and “localStorage” of your browser store data in the browser; “sessionStorage” is stored temporarily and session storage data disappears when you close the browser tab (also known as “browser session”). “localStorage” is persistent, meaning it has no expiration date. You can delete them by clearing your browser history or deleting local storage (depending on the browser you used). c. Third-Party Service Embeds On our websites, we integrate content from third-party providers to provide you with an engaging user experience. The following section provides information about the data processing activities resulting from the use of such embedded third-party content. In the first step, we provide general information about the use of third-party embeds applicable to various third-party embed providers. This is followed by more detailed information about the data processing activities related to specific third-party content, which are of particular importance to us. i. General Information about Third-Party Service Embeds Purpose of Data Processing On some of our websites, we integrate content, applications, or interactive plugins from third parties (collectively “Content”) to provide an engaging user experience. Examples of such Content include interactive maps, video players, social media plugins, or interactive functions such as comments or sharing. Subject to your consent, third parties providing the Content may collect Personal Data about your use of such Content and may process your information, which will be used by them in accordance with their own privacy policies. Therefore, we recommend that you also read the privacy notices and information of the respective third-party content provider, as detailed below. We process Personal Data in relation to the use of third-party embeds for the following purposes, including: •Improving the use and content of our websites to ensure that the content is presented in the most effective way for you and your devices; Provide a consistent experience across all devices and platforms. Third-party providers of this Content collect the mentioned Personal Data for advertising, market research, and/or design based on the needs of their site. Such evaluation is carried out (even for users who are not logged in or users without a corresponding account) to provide needs-based advertising and to inform other users of the social network about their activities on our sites. You have the right to object to the creation of these user profiles, although you must contact the respective third-party Content provider to exercise this right. Legal Basis for Data Processing The processing of this Personal Data is based on your consent. You can withdraw your consent at any time without giving reasons. However, the withdrawal of consent does not affect the legality of the processing before the said withdrawal. Third-party embeds set Cookies in your browser to store Personal Data. Therefore, we recommend that you read the section on Cookies in this Policy, as well as the cookie policy of the respective embed provider. Categories of Personal Data The Personal Data collected in relation to the use of third-party embeds may include: •IP address; •Referrer URL (the web page that sends visitors to our sites using a link); •Information about the operating system and its interface; •Cookie-based data (e.g., Cookies set to ensure the functionality of social plugins); •User device information (language settings, location, type and version of the browser); •Date and time of the request; •Time zone difference to Greenwich Mean Time (GMT); •Content of the request (specific page); •Access status/HTTP status code; •Location. Recipient(s) of the Data If you consent to the use of our third-party embeds, your Personal Data may be shared with the third party providing the embed. For an overview of the third-party embeds in use, refer to the cookie settings of the respective site. Data Controller Depending on the specific third-party embed, the company named in the imprint: •Acts as a Joint Controller with the respective company providing the third-party content for the collection and disclosure by transmission to the company providing the third-party content of the Personal Data. Regarding subsequent data processing activities, both data controllers act as independent data controllers, respectively. Concerning subsequent processing activities carried out by the company providing the third-party content, such as potential processing for market research purposes, this company acts as an independent data controller; for more information, refer to the privacy policy of the respective company; or, •Acts as an independent data controller for the data processing activities. The respective company providing the third-party content should act as independent Data Controllers for the data processing activities carried out by the company. For more information, refer to the privacy policy of the respective company. Storage Duration Regarding the storage duration of any third-party cookies set in the third-party embed, refer to the privacy policy of the respective company providing the third-party content. ii. Specific Third-Party Service Embeds This section provides information about third-party embeds from specific third-party providers. For more information, refer to the privacy policy of the third-party content provider as linked below. Facebook (Facebook Privacy Policy available here) Purpose of Data Processing On our sites, we integrate interactive third-party content from Facebook to provide an engaging user experience. This includes embedding Facebook posts, Facebook photos, Facebook videos, Facebook plugins (e.g., the “Like” or “Share” button), and Facebook pixel. We will process this information to: •Improve the use and content of our sites to ensure that the content is presented in the most effective way for you and your devices; •Provide a consistent experience across all devices and platforms. Subject to your consent, Facebook providing this content may collect data about your use of such Content and may process your information, which will be used in accordance with Facebook’s Privacy Policy. Therefore, we recommend that you also read Facebook’s privacy policy. Legal Basis for Data Processing Data Processing Data processing is based on your consent. You can withdraw your consent at any time without giving reasons; however, the withdrawal of consent does not affect the legality of the processing before the respective withdrawal. Cookies Facebook also sets cookies in your browser to store Personal Data, so we recommend that you read our Policy carefully and consult Facebook’s privacy policy. Categories of Personal Data The following Personal Data may be collected depending on the specific Facebook tool and whether you have a Facebook account or are logged in: •Facebook Account Data (Name, Preferences, Likes, etc.) •IP Address •Information about the operating system and its interface •Data based on cookies (for cookies set to ensure the functionality of posts, photos, videos, and plugins) •Date and time of the request •Content of the request (specific post, video, photo) •Access status/HTTP status code Data Recipients If you consent to the use of the respective Facebook integration, your Personal Data may be shared with Facebook Ireland Ltd., 4 Grand Canal Square Grand Canal Harbour, Dublin 2, Ireland. Data Controller If your Personal Data is collected and forwarded through our embedded Facebook components, the company named in the imprint of the respective site and Facebook Ireland Ltd. are Joint Controllers with respect to data processing. Joint commitments have also been established in a publicly available agreement here. Among other things, it states that we must clearly inform you about the use of Facebook tools on our site. We are also responsible for ensuring that the tools are securely integrated into our sites and comply with applicable privacy laws. Facebook, on the other hand, is responsible for the data security of Facebook products. If you have any questions about Facebook’s data collection and processing, please contact Facebook directly. If you direct the question to us, we are obliged to forward it to Facebook. However, if any additional processing occurs, Facebook will be solely responsible for such Personal Data. Data subjects can exercise their rights regarding their Personal Data processed by Facebook Ireland directly against Facebook Ireland. For more information on Facebook’s data processing, including the legal basis and the possibilities for asserting data subjects’ rights, please refer to Facebook’s privacy policy. Storage Duration Regarding Facebook’s storage duration, please refer to Facebook’s privacy policy. Instagram (Instagram Privacy Policy available here) Purpose of Data Processing On our sites, we integrate interactive features of Instagram, such as content including photos and videos, as well as plugins to provide an engaging user experience. We will process this information to: •Improve the use and content of our sites to ensure that the content is presented in the most effective way for you and your devices •Provide a consistent experience across all devices and platforms Legal Basis for Data Processing Data processing is based on your consent. You can withdraw your consent at any time without giving reasons; however, the withdrawal of consent does not affect the legality of the processing before its withdrawal. Instagram also sets cookies in your browser to store Personal Data, so we recommend that you read our Policy carefully and consult Instagram’s privacy policy. Categories of Personal Data The following Personal Data may be collected depending on whether you have an Instagram account or are logged into your Instagram account: •Instagram account data (e.g., name, addresses, phone numbers) •IP Address •Information about the operating system and its interface •Data based on cookies (for cookies set to ensure the functionality of posts, photos, videos, and plugins) •Date and time of the request •Content of the request (specific post, video, photo) •Access status/HTTP status code Data Recipients Data Controller If your Personal Data is collected and forwarded through our embedded Instagram components, the company named in the imprint of the respective site and Meta Platforms, Inc. are joint controllers with respect to data processing. Joint commitments have also been established in a publicly available agreement here. Among other things, it states that we must clearly inform you about the use of Instagram tools on our site. We are also responsible for ensuring that the tools are securely integrated into our site and comply with applicable privacy laws. Instagram, on the other hand, is responsible, for example, for the data security of Instagram products. If you have any questions about Instagram’s collection and processing of Personal Data, please contact Instagram directly. If you direct the question to us, we are obliged to forward it to Instagram. However, if any additional processing occurs, Instagram is solely responsible for such Personal Data. Data subjects can exercise their rights regarding their Personal Data processed by Instagram directly against Instagram. For more information on Instagram’s data processing, including the legal basis and the possibilities for asserting data subjects’ rights, please refer to Instagram’s privacy policy. Storage Duration The company does not store any Personal Data collected through Instagram integrations. Regarding Instagram’s storage duration, please refer to Instagram’s privacy policy. Google Maps (Google Privacy Policy available here) Purpose of Data Processing On our sites, we integrate Google Maps provided by Google LLC (1600 Amphitheatre Parkway Mountain View, CA 94043, USA) to allow for an engaging user experience. By using Google Maps, we can better show you locations and thus tailor our service to your needs. We will process this information to: •Provide a useful and meaningful experience on our sites •Improve the use and content of our site by offering essential information about various locations, for example, for route planning Subject to your consent, Google LLC may collect Personal Data about your use of Google Maps and may process your Personal Data, which will be used by Google in accordance with its privacy policy. Legal Basis for Data Processing The processing of Personal Data is based on your consent. If no consent is given, the Google Maps content is not loaded and therefore no Personal Data is transmitted or retained. You can withdraw your consent at any time without giving reasons; however, the withdrawal of consent does not affect the legality of the processing before the respective withdrawal. Google Maps also sets cookies in your browser to store Personal Data, so we recommend that you read our Policy carefully and consult Google’s privacy policy. Categories of Personal Data The following Personal Data may be collected depending on whether you are logged into your Google Account on your device: •IP Address •Referrer URL •Longitude and latitude coordinates (location data) •Starting address entered when using the route planner function •Search terms entered •Data based on cookies •Date and time of the request •Google Account information Data Recipients If you consent to the use of Google Maps, your Personal Data may be shared with: Google LLC 1600 Amphitheatre Parkway Mountain View, CA 94043 USA Data Controller The data controller for data processing is the company named in the imprint of the respective site. If your Personal Data is collected and forwarded through the embedded Google Maps API, Google LLC will act as an independent data controller for the subsequent data processing carried out by Google. If you have any questions about Google’s data collection and processing, please contact Google directly or refer to Google’s privacy policy. Storage Duration Regarding the storage duration of third parties, please refer to Google’s privacy policy. Google reCAPTCHA (Google Privacy Policy available here) Purpose of Data Processing On our sites, we integrate Google reCAPTCHA from Google LLC (1600 Amphitheatre Parkway Mountain View, CA 94043, USA) to provide the most secure and protected experience possible and to prevent unwanted bots or spam software. Therefore, we are doing everything we can to stay protected and offer you the greatest ease of use possible. By using reCAPTCHA, Personal Data is transmitted to Google to determine if you are genuinely human. reCAPTCHA thus ensures the security of our site and, consequently, yours. Without reCAPTCHA, it may happen, for example, that a bot registers as many email addresses as possible when registering, to later “spam” forums or blogs with unwanted advertising content. With reCAPTCHA, we can prevent such bot attacks. We will process this information to provide a secure and protected user experience. Legal Basis for Data Processing The processing of this Personal Data is based on your consent. If no consent is given, the Google reCAPTCHA content will not be loaded and therefore no Personal Data will be transmitted or retained. You can withdraw your consent at any time without giving reasons. However, the withdrawal of consent does not affect the legality of the processing before its withdrawal. Google reCAPTCHA also sets cookies in your browser to store Personal Data, so we recommend that you read our Policy carefully and consult Google’s privacy policy. Categories of Personal Data The following Personal Data may be collected depending on whether you are logged into your Google Account on your device: •IP Address •Referrer URL •Information about the operating system •Mouse and keyboard behavior •Data based on cookies •Date and language settings •All JavaScript objects •Screen resolution Data Recipients If you consent to the use of Google reCAPTCHA, your Personal Data may be shared with: Google LLC 1600 Amphitheatre Parkway Mountain View, CA 94043 USA Data Controller The data controller for data processing is the company named in the imprint of the respective site. If your Personal Data is collected and forwarded through the embedded Google reCAPTCHA API, Google will act as an independent controller for the data processing carried out by Google. If you have any questions about Google’s data collection and processing, please contact the company directly or refer to Google’s privacy policy. Storage Duration Regarding the storage duration of third parties, please refer to Google’s privacy policy. YouTube (Google Privacy Policy available here) Purpose of Data Processing On our sites, we integrate YouTube videos to provide an engaging user experience. With the help of our embedded videos, we can provide useful content in addition to our texts and images. YouTube is a video portal operated by Google LLC (1600 Amphitheatre Parkway Mountain View, CA 94043, USA). When you visit a page on our site that contains an embedded YouTube video, your browser automatically connects to YouTube/Google servers. Thus, certain data is transferred (depending on the settings). We will process this information to: •Provide a useful and meaningful experience on our sites •Improve the use and quality of our sites Subject to your consent, Google LLC, which provides this content, may collect and process your Personal Data in accordance with its privacy policy. Legal Basis for Data Processing The processing of this Personal Data is based on your consent. You can withdraw your consent at any time without giving reasons; however, the withdrawal of consent does not affect the legality of the processing before its withdrawal. YouTube also sets cookies in your browser to store Personal Data, so we recommend that you read our Policy carefully and consult Google’s privacy policy. Categories of Personal Data The following Personal Data may be collected depending on whether you are logged into your YouTube account: •IP Address •Referrer URL •Date, time, and language of the request •Access status/HTTP status code •YouTube account data (including session duration, approximate location, browser type) Data Recipients If you consent to the use of YouTube, your Personal Data may be shared with: Google LLC 1600 Amphitheatre Parkway Mountain View, CA 94043 USA Data Controller The data controller for data processing is the company named in the imprint of the respective site. If your Personal Data is collected and forwarded through the embedded YouTube content, Google LLC will act as an independent data controller for the data processing carried out by Google. If you have any questions about Google’s data collection and processing, please contact the company directly or refer to Google’s privacy policy. Storage Duration Regarding the storage duration of third parties, please refer to YouTube’s privacy policy from Google. Spotify (Spotify Privacy Policy available here) Purpose of Data Processing On our sites, we integrate Spotify embeds to provide an engaging user experience. With the help of our embedded Spotify podcasts, albums, artists, tracks, and playlists, we can provide useful content in addition to our texts, images, and videos. Spotify is an audio streaming and media services provider operated by Spotify AB, Regeringsgatan 19, 111 53 Stockholm, Sweden. When you visit a page on our sites that contains embedded Spotify content, you automatically connect to Spotify’s servers. Thus, certain data is transferred (depending on the settings). We will process this information to: •Provide a useful and meaningful experience on our sites •Improve the use and quality of our sites Subject to your consent, Spotify AB, which provides this content, may collect and process your Personal Data, which will be used by Spotify in accordance with its privacy policy. Legal Basis for Data Processing The processing of this Personal Data is based on your consent. You can withdraw your consent at any time without giving reasons. However, the withdrawal of consent does not affect the legality of the processing before its withdrawal. Spotify also sets cookies in your browser to store Personal Data, so we recommend that you read our Policy carefully and consult Spotify’s privacy policy. Categories of Personal Data The following Personal Data may be collected depending on whether you have a Spotify account or are logged in with your device: •Spotify account data (e.g., name, preferences) •IP Address •Information about the operating system and its interface •Data based on cookies (e.g., for cookies set to ensure functionality) •Date and time of the request •Content of the request (e.g., specific track, episode, playlist) •Access status/HTTP status code Data Recipients If you consent to the use of the Spotify embed, your data may be shared with: Spotify AB Regeringsgatan 19 111 53 Stockholm Sweden Data Controller The Data Controller is the company named in the imprint of the respective site. If your Personal Data is collected and forwarded through the embedded Spotify API, Spotify AB will act as an independent Data Controller for the data processing carried out by Spotify. If you have any questions about Spotify’s data collection and processing, please contact the company directly or refer to Spotify’s privacy policy. Storage Duration Regarding the storage duration of third parties, please refer to Spotify’s privacy policy. Vimeo (Vimeo Privacy Policy available here) Purpose of Data Processing On our sites, we integrate Vimeo videos to provide an engaging user experience. With the help of our embedded videos, we can provide useful content in addition to our texts and images. Vimeo is a video portal operated by Vimeo.com Inc., 555 West 18th Street New York, NY 10011 USA. When you visit a page on our site that contains an embedded Vimeo video, your browser automatically connects to Vimeo’s servers. Thus, certain Personal Data is transferred to Vimeo. We will process this information to: •Provide a useful and meaningful experience on our sites •Improve the use and quality of our site Subject to your consent, Vimeo.com Inc., which provides this content, may collect and process your Personal Data, which will be used by Vimeo.com in accordance with its privacy policy. Legal Basis for Data Processing The processing of this Personal Data is based on your consent. You can withdraw your consent at any time without giving reasons. However, the withdrawal of consent does not affect the legality of the processing before its withdrawal. Vimeo also sets cookies in your browser to store Personal Data, so we recommend that you read our Policy and consult Vimeo’s privacy policy. Categories of Personal Data The following Personal Data may be collected depending on whether you are logged into your Vimeo account: •IP Address •Referrer URL •Date, time, and language of the request •Technical information about your browser type, operating system, and device information •Access status/HTTP status code •Vimeo account data Data Recipients If you consent to the use of Vimeo, your Personal Data may be shared with: Vimeo.com Inc. 555 West 18th Street New York, NY 10011 USA Data Controller The Data Controller is the company named in the imprint of the respective site. If your Personal Data is collected and forwarded through the embedded Vimeo content, Vimeo.com will act as an independent Data Controller for the subsequent data processing carried out by Vimeo. If you have any questions about Vimeo’s data collection and processing, please contact the company directly or refer to Vimeo’s privacy policy. Storage Duration Regarding the storage duration of third parties, please refer to Vimeo’s privacy policy. User Accounts Purpose of Data Processing If you are a regular user of our sites, you may wish to create a user account (hereinafter “Account”) with us. An Account allows you to access certain services and may offer other functionalities (such as managing marketing communications or modifying your user setting preferences). Some accounts allow you to access other Company platforms (“Participating Platforms”) and view information from these Participating Platforms in your Account profile. Your Personal Data will be processed to: •Create and manage your account and manage our relationship with you. Additionally, to communicate with you about your account and our services •Improve the use and content of our sites to ensure that the content is presented in the most effective way for you and your devices Communicate with you and keep you updated on our activities and events (Subject to your prior consent, if legally required). For example, to inform you via email or social media about products and services that may interest you; Provide a consistent experience across all devices and platforms. Legal Basis for Data Processing The temporary storage and processing of this Personal Data are based on legitimate interests to provide you with an engaging and fully functional user account service. Categories of Personal Data The Personal Data you provide when setting up an Account includes: •First and last name •Email address •Social media credentials (if applicable) Data Recipient(s) Your Personal Data will be transferred to IT service providers (e.g., hosting providers, cloud service providers, customer access and identity management providers, customer relationship management providers, etc.). If you are using your Facebook, Google, or Apple account to log in to our sites or services, please refer to the respective section describing the social login function. Data Controller The Data Controller is the company named in the imprint of the respective site. Storage Duration We store your Account credentials until you close it or if it has been inactive for three consecutive years. You can close your account directly in your account profile settings. Social Login Function Purpose of Data Processing We offer you the option to use your existing social network credentials (e.g., Facebook, Twitter, or Google) for user authentication, to create or log in to your user account or any mobile application. By authenticating your user credentials through your social media account, you authorize us to collect, store, and use any login information you grant permission to provide, for example, to pre-fill some data fields in your account and profile pages. You can manage which Personal Data you would like to share with us through the privacy controls and settings on each third-party social network site or through the respective social network provider’s access authorization screen. However, we have no control over how the respective social network provider processes your Personal Data in connection with the login. Therefore, we recommend that you carefully read the Privacy Policy of the respective provider. Legal Basis for Data Processing The data processing carried out by the Company is based on your consent. You can withdraw your consent at any time without giving reasons; however, the withdrawal of consent does not affect the legality of the processing before its withdrawal. Depending on the social login of your choice, the data processing by the social login provider is based on your consent (Facebook, Apple, LinkedIn, Twitter) or on the legitimate interest in offering you a quick and easy registration process (Google). Categories of Data If you use a social network profile for user authentication, subject to your access permission, we may have access to the following categories of Personal Data, for example: Facebook: •First and last name •Email address •Age •Gender •Browser information (e.g., IP address, browser type and version, operating system, language) Google: •First and last name •Email address •Address •Browser information (e.g., IP address, browser type and version, operating system, language) LinkedIn: •First and last name •LinkedIn bio •LinkedIn interests •Browser information (e.g., IP address, browser type and version, operating system, language) Twitter: •Twitter name •Biographical data •Profile picture •Preferred language •Browser information (e.g., IP address, browser type and version, operating system, language) Apple: •First and last name •Email •Browser information (e.g., IP address, browser type and version, operating system, language) Additionally, if you decide to log in using your social network credentials, the respective social network provider may set several cookies in your browser to ensure that the social plugin works on our sites or applications, for example, identifying login activity and protecting users. Data Recipient(s) In connection with a social login, your Personal Data may be shared with the following recipients: Facebook: Your Personal Data will be transmitted to: •Facebook Ireland Ltd., 4 Grand Canal Square Grand Canal Harbour, Dublin 2, Ireland •Meta Platforms, Inc., 1 Hacker Way, Menlo Park, California, USA Facebook Ireland will process such Personal Data as a Joint Controller. Details on how Facebook processes such data can be found in Facebook’s privacy policy. Google: Your Personal Data will be transmitted to: Google LLC, Amphitheatre Parkway, Mountain View, CA 94043 USA Google LLC will process such Personal Data as a Joint Controller. Details on how Google processes such Personal Data can be found in Google’s privacy policy. LinkedIn: Your Personal Data will be transmitted to: LinkedIn Corporation 1000 W Maude Ave Sunnyvale CA 94085 USA Details on how LinkedIn processes such data can be found in LinkedIn’s privacy policy. Twitter: Your Personal Data will be transmitted to: Twitter Inc. 1355 Market Street Suite 900 San Francisco CA 94103 USA Details on how Twitter processes such data can be found in Twitter’s privacy policy. Apple: Your Personal Data will be transmitted to: Apple Inc. Apple Park Way Cupertino California USA Details on how Apple processes such data can be found in Apple’s privacy policy. Data Controller The Data Controller for data processing is the company named in the imprint of the respective site or application. This respective Company will act as a Joint Controller with Facebook for the collection and transfer of Personal Data to Facebook. Joint commitments have also been established in a publicly available agreement here. Among other things, it states that we must clearly inform you about the use of Facebook tools on our sites. We are also responsible for ensuring that the tools are securely integrated into our sites and comply with applicable privacy laws. Facebook, on the other hand, is responsible, for example, for the data security of Facebook products. If you have any questions about Facebook’s data collection and processing, please contact Facebook directly. If you direct the question to us, we are obliged to forward it to Facebook. However, if any additional processing occurs, Facebook is solely responsible for such Personal Data. Data subjects can exercise their rights regarding their Data processed by Facebook Ireland directly against Facebook Ireland. For more information on Facebook’s data processing, including the legal basis and the possibilities for asserting data subjects’ rights, please refer to Facebook’s privacy policy. If your Personal Data is collected and forwarded to LinkedIn, Twitter, Google, or Apple, such companies and their affiliates act as independent Data Controllers for the data processing they carry out. If you have any questions about data processing, please contact the companies directly or refer to the respective privacy policy for more information. Storage Duration The company does not store any Personal Data collected through social logins. Regarding the storage duration of third parties, please refer to the respective privacy policy. Promotions and Sweepstakes Purpose of Data Processing We offer you the opportunity to participate in our activations and/or promotions (hereinafter “Promotion(s)”). Such Promotions are organized by us or through a third-party cooperation partner. We process the Personal Data you provide when participating in the Promotion for the following purposes, including: •Administering and conducting the Promotion, such as drawing winners and sending prizes, or registering and participating in a Promotion •Communicating with you and keeping you updated on our activities and events (Subject to your prior consent, if legally required); for example, to inform you via email or social media about products and services that may interest you •Managing any concerns or requests on your behalf related to the Promotion Participation in our Promotions is always voluntary. However, to participate in our Promotions, you need to provide us with a minimum amount of Personal Data and we need to process such Personal Data. Such Personal Data may also include content you generate (User-Generated Content). Depending on what you decide to share with us, such Personal Data may include a photo or video of you and other people (subject to their consent) who are part of the published content. If we organize a Promotion through a third-party cooperation partner, we may also share your Personal Data with the cooperation partner, who may also process your Personal Data when administering and conducting the Promotion. Therefore, we recommend that you also read the Privacy Policy of the respective cooperation partner. Legal Basis for Data Processing The data processing for the execution of the Promotion is carried out based on the necessity of executing the contract. Categories of Data The Personal Data we may process in connection with participation in our Promotions may include: •First and last name •Email address •Postal address (for sending prizes) •Phone number •User-generated content, depending on what you decide to share with us (e.g., response options you chose, uploaded photos, videos, contributions, texts, social media posts, audios, etc.) •Any communication related to the Promotion Data Recipient(s) Depending on the type of Promotion, your Personal Data may be shared with the following recipients: •Cooperation partners (with whom we conduct joint Promotions or who provide us with prizes, so we recommend that you also read the privacy policies of the respective cooperation partner) •IT service providers •Transport providers Data Controller The Data Controller is the company named in the terms and conditions of the Promotion. To the extent that we act as a Joint Controller, we will inform you as part of the registration process. Storage Duration We only retain Personal Data for as long as necessary to achieve the purposes of data processing. Online Stores Purpose of Data Processing We operate several online stores where you can purchase a variety of items (e.g., clothing, merchandise). We process your Personal Data to: •Provide and improve our products or services offered in our online stores, for example, to supply and manage the products or services you requested and/or purchased •Provide customer service and manage any concerns or requests, for example, providing services to you after your order has been shipped (e.g., in the case of cancellations or refunds) Legal Basis for Data Processing The data processing to handle your order (this includes contract completion, pre-contractual obligations, and immediate contract fulfillment) is carried out based on contract execution. Data processing in connection with a credit check or address verification is based on our legitimate interest. Our legitimate interest is to request information about your credibility or address verification to better assess the risk associated with anticipated performance on our part. Data processing within the scope of fiduciary collection is carried out for the purpose of contract execution. Categories of Data The Personal Data we process in connection with our online stores includes: •First and last name •Postal address •Email address •Phone number •Order information, e.g., order content, clothing size, delivery receipt, etc. •Financial payment information •Any communication related to your purchase Data Recipient(s) In the context of your order in our online stores, your Personal Data may be shared with the following recipients: •IT service providers •Hosting service providers •Payment service providers •Transport/logistics providers •Collection service providers •Credit agencies (e.g., for credit assessment) •Debt collection service providers (in case of default) Data Controller The Data Controller is the company named in the imprint of the respective online store where you made your purchase. Note that the respective payment service providers and logistics partners act as independent data controllers for any Personal Data provided and processed as part of the payment process. Therefore, please refer to the privacy policies of the payment service provider and logistics partners for details on how your data is processed. Storage Duration Personal Data related to individual orders and transactions is stored in accordance with applicable tax and accounting retention obligations. Consumer Requests a. Chatbots Purpose of Data Processing We offer our Chatbot as a virtual assistance tool that helps consumers send us questions and/or comments about our products, services, and events. We will process your Personal Data to provide customer service and manage any concerns or requests, for example, providing services to you after your order has been shipped, in the case of cancellations or refunds. Legal Basis for Data Processing The data processing in connection with our Chatbot tool is based on our legitimate interest. Our legitimate interest is to: •Provide our products or services to you, including ensuring the highest possible functionality and usability of the Chatbot and the necessary interface software •Improve the functionality of our sites •Better understand how you use our products, services, sites, and applications and make improvements Categories of Data In connection with our Chatbot service, we may process the following categories of Personal Data, including: •First and last name •Email address •Postal address (depending on the nature of the request) •Phone number (if this is the preferred communication channel) •Content of the request Data Recipient(s) In connection with our Chatbot tool, your Personal Data will be transferred to: •IT service providers (e.g., hosting providers, cloud service providers, customer identity and access management providers, customer relationship management providers, etc.) Data Controller The Data Controller for data processing is the company named in the imprint of the respective site. This company will act as Joint Controllers with SOUL do Brasil, Ltda., Avenida Cidade Jardim, 314, 1a sobreloja, CEP 01454-000, São Paulo - SP, BRAZIL. The Joint Controllers have determined their respective responsibilities. Storage Duration We only retain Personal Data for as long as necessary to achieve the purposes of data processing. b. Contact Us Purpose of Data Processing If you need to contact us, for example, to obtain information, exercise your privacy rights, or submit a complaint, we offer several ways to get in touch, such as through the website contact form, email, mail, or phone. Your request will be forwarded to the responsible department. We will process your Personal Data to: •Provide efficient customer service and manage any concerns or requests on your behalf •Provide and improve our products and services that you requested Legal Basis for Data Processing The data processing in connection with contacting us for information, disclosure, or complaint purposes is based on our legitimate interest. Our legitimate interest is to: •Process your requests in a friendly and service-oriented manner •Provide our products and services to you •Better understand how you use our products, services, sites, and applications and make improvements •Make necessary disclosures in response to requests we are legally obliged to comply with from law enforcement or any authorities or regulatory bodies If you contact us in the context of contract conclusion, in a pre-contractual context, or in the context of direct contract fulfillment, the Personal Data will be processed for the purpose of contract execution. Data processing in connection with the exercise of your data subject rights is carried out to comply with a legal obligation. Categories of Data Contacting us is always voluntary. To properly process your request and thus be able to assist you, you must provide us with a certain minimum amount of Personal Data, and we must process this Personal Data. Without such necessary minimum data processing, we cannot process your request. Depending on how you contact us, we process the following categories of Personal Data: •First and last name •Email address •Content of the message or reason for contact Data Recipient(s) Depending on the form of contact and the request you have, your Personal Data may be shared with the following recipients: •IT service providers (e.g., hosting providers, cloud service providers) •Social media networks •Transport providers •Cooperation partners Data Controller The Data Controller is the Company entity you contacted. Storage Duration We only retain your Personal Data for as long as necessary to achieve the purposes of data processing.