CELUS Design Platform

Privacy Policy

Version: October 2024

Download PDF version

Contents

1 Controller

2 Overview of our processing activities

3 Information on the Use of “Cookies”

4 Data Security

5 Involvement of third parties

6 Your data protection rights

Preamble

We ("Celus" or "we", "us", "our") collect, process and use your Personal Data in accordance with this privacy policy (“Privacy Policy”) and the applicable data protection regulations, especially the EU General Data Protection Regulation (GDPR), the Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG).

We ask you to read the following carefully. We may amend this Privacy Policy at any time with effect for the future. We therefore recommend that you check the Privacy Policy regularly.

1 Controller

The controller for the data processing in connection with the CELUS Design Platform, the CELUS website or as otherwise described in this policy is:

CELUS GmbH

Ridlerstraße 57

80339 Munich, Germany

E-Mail: support@celus.io

2 Overview of our processing activities

In the following sections, we inform you about the situations, in which we will process your Personal Data including the categories of Personal Data. We will also provide information on the purpose of processing, the respective legal basis, and on how we store your Personal Data including the retention periods.Copyright CELUS 2024 Page 2 of 10

2.1 CELUS Design Platform

We collect your Personal Data through interactions with you and on the CELUS Design Platform. You provide some of this Personal Data directly, and we get some of it by collecting data about your interactions with and use of the CELUS Design Platform.

(a) Registration process

(i) Description of processing and categories of Personal Data: To create an account on the CELUS Design Platform, you need to provide certain Personal Data including your name, email address, password and professional occupation. If you register for a Professional or Premium Account as defined in the Terms of Use, you may further need to provide payment (e.g., credit card) and billing information. We will collect and process this data together with the technical data we collect when you accept the Terms of Use of the CELUS Design Platform.

(ii) Purpose of processing: The processing serves the purpose of onboarding you as a new user to and enabling you to use the CELUS Design Platform.

(iii) Legal basis: Contract performance, art. 6 para. 1 lit. b GDPR and our legitimate interest to allow us to on-board you as a user, art. 6 para. 1 lit. f GDPR.

(iv) Retention period: We will retain this data for the subscription term and thereafter as is necessary to comply with statutory retention obligations.

(b) Log-in to the CELUS Design Platform

(i) Description of processing and categories of Personal Data: When you log in to the CELUS Design Platform and enter your Personal Data (particularly username or email address and password) in the input mask provided for this purpose, we collect and process such Personal Data to carry out the authorization check and, if necessary, provide new registration data.

(ii) Purpose of processing: The purpose of this processing is to ensure that only authorized users are able to use the CELUS Design Platform.

(iii) Legal basis: Contract performance, art. 6 para. 1 lit. b GDPR and our legitimate interest to securing our platform and protecting it from unauthorized users, art. 6 para. 1 lit. f GDPR.

(iv) Retention period: We retain the data collected as part of the login process for no longer than 30 days and will delete them thereafter.

(i) Description of processing and categories of Personal Data: When you use the CELUS Design Platform, we collect and process the following Personal Data that is technically necessary for the provision of the CELUS Design Platform and to ensure stability and security: IP address, date and time of the request, access Status/HTTP Status Code, amount of data transferred in each case, website from which the request comes, browser type, operating system and its interface, language and version of the browser.

(ii) Purpose of processing: The purpose of processing the aforementioned data is to accurately display the CELUS Design Platform and therefore provide our services to you.

(iii) Legal basis: Contract performance, art. 6 para. 1 lit. b GDPR and our legitimate interest to securely provide our services, art. 6 para. 1 lit. f GDPR.

(iv) Retention period: The IP addresses of the users are being deleted or anonymized when they are no longer required for the purpose for which they were collected. In the case of anonymization, the IP addresses are changed in such a way that the individual details of personal or factual circumstances can no longer be assigned to a specific or determinable natural person or can only be assigned to a specific or determinable natural person with a disproportionate expenditure of time, cost and manpower.

(d) Data you share on the CELUS Design Platform

(i) Description of processing and categories of Personal Data: We collect Personal Data from you when you upload or otherwise provide it to the CELUS Design Platform.

(ii) Purpose of processing: We process data you upload or otherwise provide to the CELUS Design Platform to enable you to use the platform as you intend. We may analyze, anonymize and further process these data for research and development purposes, training models, to improve our platform and to better understand our users' requirements.

(iii) Legal basis: Contract performance, art. 6 para. 1 lit. b GDPR and our legitimate interest to provide and improve our services, art. 6 para. 1 lit. f GDPR.

(iv) Retention Period: We retain the data collected during the use of the CELUS Design Platform for the term of the subscription term and may retain it to deal with any queries or claims thereafter.

2.2 Disclosure of data to third parties in connection with the CELUS Design

Platform

For the purposes of the CELUS Design Platform, we may disclose your Personal Data as set out in this section 2.2:

(a) Contributions of CELUS Partners

We may disclose Personal Data such as information regarding your activities

and projects on the CELUS Design Platform to our partners, which include but are not limited to component manufacturers, simulation companies or design houses ("CELUS Partners") to allow them to add value to the CELUS Design Platform, by contributing to projects of platform users and to support their design or production processes.

(i) Legal basis: Contract performance, art. 6 para. 1 lit. b GDPR and our legitimate interest to enable us to effectively provide our services on the CELUS Design Platform to you.

(b) Email contact with CELUS Partners

(i) Subject to your explicit and free consent, we may disclose your email address to CELUS Partners to allow them to contact you by email and offer support, e.g., for specific projects on the CELUS Design Platform with regards to the availability of components, design support, production or procurement-related information. You can withdraw your consent at any time with effect to the future by contacting us via the contact form on our website or under support@celus.io.

(ii) Legal basis: Your explicit consent, art. 6 para. 1 lit. a GDPR.

(c) We may further disclose your personal data as generally set out in section 5.1 below. In case the disclosure of the Personal Data to CELUS Partners implies the export of the Personal Data to countries outside the European Economic Area ("EEA"), please refer to section 5.2 below.

2.3 Visiting our website

(a) Description of processing and categories of Personal Data: When visiting our website, we collect various categories of Personal Data, including: personal information such as name, email address and contact details (when you choose to provide them, for example, by filling out forms or subscribing to our services); usage and technical data such as your interaction on our website, along with technical details about your device and browser such as browser type, language preference, referring site, and the date and time of each visitor request.

(b) Purpose of processing: The purpose of collecting this data is to understand how our visitors use our website to enhance your user-experience, tailor content and understand your interactions with us for better service and efficiency.

(c) Legal basis: When processing the aforementioned categories of Personal Data, we can rely on our legitimate interest to ensure optimal performance and correct display of our website as well as to analyse how visitors use our website, art. 6 para. 1 lit. f GDPR.

(d) Retention period: We retain your data as long as necessary to fulfill the purposes for which it was collected, provide our services, comply with our legal obligations, resolve disputes, and enforce our agreements.

2.4 Using our contact form or other direct correspondence

(a) Description of processing and categories of Personal Data: When using our contact form or emailing us directly, we process your name and your email address as well as any other Personal Data you disclose (e.g., your username, password, information on involvement in electronic design).

(b) Purpose of processing: This enables us to respond to your inquiries and provide you with support of information to your request. The processing of your Personal Data allows us to address your needs and feedback effectively.

(c) Legal basis: The legal basis for processing this data is your consent, which you provide by submitting your inquiry via our contact form, art. 6 para. 1 lit. a GDPR.

(d) Retention Period: We retain your data as long as necessary to fulfill the purposes for which it was collected, provide our services, comply with our legal obligations, resolve disputes, and enforce our agreements.

2.5 CELUS Newsletter

(a) Description of processing and categories of Personal Data: We use the contact information (name and email address) you provided when signing up and other Personal Data we collect when you use our Online Services to send you updates, insights, and information about our products or services that we believe may interest you. This enables us to keep you informed and tailor our communications to your preferences.

(b) Purpose of processing: The CELUS newsletter helps us to keep a large number of customers updated on new developments regarding our products and services as well as related topics.

(c) Legal basis: The legal basis for collecting and processing your Personal Data to this end is your explicit consent, art. 6 para. 1 lit. a GDPR. This consent you provided when signing to our newsletter, thereby agreeing to receive communication from us and acknowledging that your information will be processed as described.

(d) Retention Period: Your Personal Data will be retained until you close your account or the purpose of collecting and using your Personal Data is achieved, unless we are legally obliged to store your data for a longer period.

2.6 Recruitment and talent acquisition

(a) Description of processing and categories of Personal Data: By submitting an application via our careers website (https://www.celus.io/careers), we collect the Personal Data you provided to us in the process, in particular: Name (first and last name), email address, phone number, channel through which you found us. In addition to that, you have the possibility to upload documents in the course of your application such as a cover letter or a CV. Those documents may contain additional Personal Data such as date of birth, address etc.

(b) Purpose of processing: We process your data in order to assess your suitability for employment opportunities within our organization. The Personal Data you provide helps us to evaluate your qualifications, skills, and experience in relation to the positions for which you have applied. Your Personal Data may also be used to communicate with you during the recruitment process, such as scheduling interviews or providing updates on your application status.

(c) Legal basis: By submitting your application and providing your Personal Data, you explicitly consent to the collection, use, and disclosure of your data for the purposes outlined above, art. 6 para. 1 lit. a GDPR. The retention of Personal Data after the rejection of an application serves our legitimate interest in asserting and defending against legal claims, art. 6 para. 1 lit. f GDPR.

(d) Retention Period: If you apply for a role and are unsuccessful or if you reject an offer of employment, we will delete your Personal Data after 6 months following communication of the decision, unless you agree that we retain your Personal Data to consider you for potential future roles. If the recruitment process is successful and you accept our offer of employment, the relevant Personal Data collected during the recruitment process will become part of your personnel records and will be retained in accordance with our employee privacy policy.

2.7 CUBOt in Platform Chatbot

(a) Description of processing and categories of Personal Data: While deploying CUBOt, our Chatbot for retrieving Customer Unified Business Operations ("CUBO") information, we collect the following types of Personal Data: user ID and any Personal Data you provide to us in the course of user feedback and user questions.

(b) Legal basis: By submitting feedback or user questions to CUBOt, you explicitly consent to the collection, use, and disclosure of your data for the purposes outlined above, art. 6 para. 1 lit. a GDPR.

(c) Purpose of processing: We use the above mentioned data to identify the user for the purposes of personalizing their user experience, to gather feedback provided to us by users in order to improve our services and questions asked to retrieve CUBO information. With this data, we can enhance our services, improve operational efficiency and ensure that all customer-related data is unified and easily accessible.

3 Information on the Use of “Cookies”

Our websites as well as the CELUS Design Platform use cookies. Cookies are text files placed on your computer to collect standard Internet log information and visitor behaviour information. We use cookies to personalize content and ads, to provide social media features and to analyse our traffic. For detailed information on which cookies we use on which legal basis, on the respective retention periods and on how you can manage your cookie settings, please see our Cookie Declaration. If we base the right to use cookies on your consent, you have the right to withdraw the consent any time through your browser settings.

4 Data Security

Unless we are involving contractors or service providers as set out in section 5.1 below, we are storing your Personal Data on our own servers, ensuring appropriate measures are taken to protect it from unauthorized access, disclosure, or alteration. To this end, we have implemented a number of security measures to prevent unauthorized access and unneeded retention of Personal Data within our systems. These include pseudonymization, encryption, access, and retention policies.

5 Involvement of third parties

This section contains information on the instances we might disclose your Personal Data to third parties for the purpose of providing our services and to support you in any other inquiry you might have. Furthermore, we will inform you about possible transfers of your Personal Data to countries outside the European Economic Area ("EEA").

5.1 Disclosure of data to third parties

(a) Involvement of contractors and service providers

We may permit selected third parties such as service providers and contractors to use your Personal Data for the purposes set out in sections 2.1 and 2.3 to 2.7 above, who will be subject to obligations to process such information in compliance with the same safeguards that we deploy. We base this disclosure on contract performance, art. 6 para. 1 lit. b GDPR and our legitimate interest to provide the CELUS Design Platform to the users, art. 6 para. 1 lit. f GDPR.

(i) Our website pursuant to section 2.2 as well as our contact form pursuant to section 2.4 are hosted on HubSpot's secure platform. Furthermore, your direct contact details and newsletter subscription status pursuant to section 2.5 are managed and stored on HubSpot's secure platform. Data collected through our website is stored on HubSpot's servers, which employ robust security measures and encryption to protect your information. For more specific details on HubSpot's data handling practices, please refer to their data privacy documentation (under: https://legal.hubspot.com/privacy-policy).

(ii) In the context of recruitment and talent acquisition pursuant to section 2.6, we store your Personal Data with the help of Personio. Personio processes your Personal Data according to our documented instructions and does not process your data for his own purposes. To ensure the highest standard of data security and to comply with legal obligations, we concluded a data processing agreement with Personio.

(b) Law enforcement and court service

(i) We may disclose your Personal Data to third parties, the court service and/or regulators or law enforcement agencies in connection with proceedings or investigations anywhere in the world where compelled to do so. Where permitted, we will direct any such request to you or notify you before responding unless to do so would prejudice the prevention or detection of a crime.

(ii) Legal basis: Legal obligation, art. 6 para. 1 lit. c GDPR and our legitimate interest to defend against or make a claim or to cooperate with law enforcement and regulatory authorities art. 6 para. 1 lit. f GDPR.

5.2 Transfers of Personal Data outside the EEA

Occasionally, the processing of your Personal Data as set out in this Privacy Policy may imply the transfer of your Personal Data in a country outside of the EEA. In these instances, we ensure that appropriate safeguards are in place. These safeguards include contractual measures additional to our data processing agreements with the service provider (e.g., the conclusion of the Standard Contractual Clauses as approved by the European Commission) as well as technical and organizational measures such as encryption, data backups, etc.

5.3 Third party sources we receive your Personal Data from

We receive your Personal Data from third parties in case you decide to register for and login to our Online Services via your social media account. If you log in via different authentication methods such as logins via social media or SSO, different conditions may apply, including but not limited to data collection, retention and deletion. Please refer to respective authentication method providers for details. Furthermore, we receive your Personal Data through marketing and advertisement campaigns, e.g. via your interaction with our ads on social media.

6 Your data protection rights

If the relevant conditions are met, you have the following rights with regard to the processing of your Personal Data. To exercise these rights, you can contact us using the contact details given under section 1 above.

6.1 Right to Access

Pursuant to art. 15 GDPR, you have the right to obtain information concerning your Personal Data we may process, and to request a copy of Personal Data stored about yourself.

6.2 Right to Rectification, Erasure, or Restriction of Processing

Pursuant to art. 16 GDPR, you have the right to have Personal Data rectified if such data is not (or no longer) accurate, or to have it completed should it be incomplete. You may demand erasure of your Personal Data, subject to the conditions set out in art. 17 GDPR. Your right to erasure is conditional, for example, upon whether we require the data concerning yourself for compliance with a legal obligation. Subject to the conditions stipulated in art. 18 GDPR, you have the right to demand a restriction of the processing of your Personal Data.

6.3 Withdrawal of Consent

To the extent we process your Personal Data based on your consent, you have the right to withdraw such consent at any time. For this purpose, an informal message, e.g. by email, is sufficient. The withdrawal of consent does not affect the lawfulness of our processing based on consent before its withdrawal.

If you are subscribed to and do no longer wish to receive our CELUS newsletter, you can unsubscribe at any time by clicking the respective link in the newsletter itself or by contacting us via our contact form or under support@celus.io. If you withdraw your consent for the processing of your Personal Data, we might not be able to provide you the respective services.

6.4 Right to object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your Personal Data which is carried out on the basis of art 6 para. 1, lit. f GDPR. This also applies to profiling based on those provisions. In the event of such an objection, we will no longer process your Personal Data concerned, unless we can demonstrate compelling reasons for the processing which override your interests, rights and freedoms, or unless the processing serves to assert, exercise or defend legal claims.

You further have the right to object to the processing of your Personal Data for the purpose of direct marketing. This also applies to profiling, insofar as it is related to such direct marketing. If you object to processing for direct marketing purposes, we will no longer process your Personal Data for these purposes.

6.5 Complaint to supervisory authority

We take the security and the lawful processing very seriously and put our greatest efforts into complying with the applicable data protection law. Should you, despite our efforts, come across any problems, we kindly ask you to bring those to our attention. If you still wish to file a complaint or if you feel that we have not addressed your concern in a satisfactory manner, you may lodge your complaint with the competent supervisory authority. The competent supervisory authority for CELUS is:

Bayerisches Landesamt für Datenschutzaufsicht

Promenade 18

91522 Ansbach, Germany

E-Mail: poststelle@lda.bayern.de