1. This information sheet informs you about the collection of personal data insofar as it applies to you as our business partner or as an employee of our business partner. Personal data means any information that identifies you or can be used to identify you, e.g. name, address, e-mail addresses.
2. The controller pursuant to Article 4 (7) General Data Protection Regulation (GDPR) is:
   XI-MACHINES GmbH, Lokstedter Steindamm 35, 22529 Hamburg
   Tel.: +49(0)40-4666675-0, E-Mail: , Website: xi-machines.com/en
3. Our Data Protection Officer can be contacted at or by writing to us and addressing your letter c/o “The Data Protection Officer”.

1. You are entitled to the following rights towards us regarding your personal data:
   
   • Right to information,
   • Right to rectification or deletion,
   • Right to restriction of processing,
   • Right to object to the processing,
   • Right to data portability.
   To exercise your rights, you can contact the controller or the Data Protection Officer, using the above contact details.
2. You also have the right to complain to the data protection supervisory authorities about our    processing of your personal data.

1. If you have given your consent to the processing of your data, you have the right to withdraw this consent at any time. Such withdrawal of consent influences the permissibility of processing your personal data after you have expressed it towards us.
2. If we base the processing of your personal data on the pursuit of our legitimate interests, you have the right to object to such processing. This is the case if the processing is not necessary for the performance of a contract to which you are a party, but for other purposes, details of which we will provide in the description of those processes. When exercising such an objection, we ask you to explain the reasons why we should not process your personal data in that manner. In the event of your justified objection, we will examine the situation and either stop or adjust data processing or point out to you our compelling reasons worthy of protection, which form the basis of the processing.
3. If we process your data for direct marketing purposes, you have the right to object at any time to the processing of relevant personal data for the purpose of such advertising; this also applies to profiling, insofar as it is associated with such direct marketing. If you object to the processing for direct advertising purposes, we will no longer process your personal data for these purposes.

1. In the context of our business relationship, we will collect data for the following purposes:
   
   • Initiation and conclusion of our contractual relationship
   • Fulfillment of our contractual relationship
   • Preservation of evidence for potential post-contractual warranty and guarantee claims or for legal disputes
   • Payment transactions
   • Measures for the security of our premises and our systems (e.g. access controls)
   • Direct advertising for our products, insofar as you have not objected to it (see section 3.3)
   • Improvement of business management measures and internal processes and of our products
2. We will collect and process the following categories of personal data:
   
   • Employee data (e.g. name, business address, e-mail, phone number, department)
   • Communication data (e.g. e-mails, correspondence)
   • Where applicable, payment data (e.g. bank details)
   • Where applicable, invoicing data (e.g. tax number)
   
   The legal basis for the above processing of your personal data is the existing contractual relationship between us or the initiation of one (art. 6 para. 1 s. 1 lit b GDPR).
   
   With regards to other cases specified in section 4.1 the processing of your data will take place to protect our legitimate interest in the processing described above. The legal basis in this instance is art. 6 para. 1 s. 1 lit f GDPR.
   
   Insofar as the processing is based on statutory obligations (obligations to retain data, obligations to provide evidence to the tax authorities), the legal basis is art. 6 para. 1 s.1 lit c GDPR.
   
   Where you have given us your explicit consent to process your personal data, the legal basis is art. 6 para. 1 s.1 lit a GDPR.
3. We will store the data for a period of two years. Subsequently, processing will be limited to fulfilling any existing legal storage obligations. At the end of the obligatory period of statutory retention (e.g. 10 years for documents relevant to taxes or 6 years for general business correspondence) the data will be deleted in its entirety.
4. We routinely review personal contact data after 4 years at the end of the respective calendar year to determine whether further storage is required. Should no further storage be necessary, the data will be deleted. If we should become aware of your departure from the company, we will immediately delete your contact details or update them, if you so wish and if you provide us with updated contact details

You are only obliged to provide such personal data within the context of our business relationship as is necessary for the conclusion, execution and termination of the business relationship or which we are legally obliged to collect. Without this data we will ordinarily have to refuse the conclusion of the contract or the execution of the order or we will no longer be able to fulfil an existing contract and may have to terminate it.

• Your personal data will be disclosed to:
• Department of XI-MACHINES GmbH responsible for the supervision of your services
• Payment service providers
• External accounting (tax adviser)
• Any additional suppliers of XI-MACHINES GmbH involved in the services (where necessary)
• Tax authorities

We will transfer your personal data to third countries, insofar as this is required to fulfil a contract with you or our business partner or to conclude or fulfil a contract in the interest of the business partner.