PERSONAL DATA PROTECTION AND PRIVACY POLICY for Customers, Suppliers and other Business Partners

      1. PURPOSE AND SCOPE

      This Personal Data Protection and Privacy Policy explain the principles adopted by Geberit Tesisat Sistemleri Ticaret Limited Şirketi (Geberit or Company) regarding the protection, confidentiality, and processing of personal data. It has been prepared to ensure compliance with Law No. 6698 on the Personal Data Protection (“KVKK”) and other applicable national and international regulations. This Policy applies to the processing of personal data belonging to natural persons other than Geberit Employees.

      In this Policy;

      • Categories of data subject whose personal data are processed
      • Categories of personal data and examples of the types of processed
      • Methods of collecting personal data
      • Principles relating to the processing of personal data
      • Legal Bases for the processing of personal data
      • Purposes for which personal data are processed
      • Profiling and segmentation activities
      • Recipients and purposes of personal data transfers
      • Administrative and technical measures implemented to ensure the security of personal data
      • Storage periods for personal data
      • Procedures for erasure, destruction and anonymization of personal data, and
      • Data subjects’ rights regarding their personal data and the procedures for exercising such rights.

      2. DEFINITIONS

      Explicit consent: Freely given, specific and informed consent,

      Anonymization: Rendering personal data impossible to link with an identified or identifiable natural person, even though matching them with other data,

      Data subject: The natural person, whose personal data is processed,

      Law: Law No. 6698 on Personal Data Protection

      Personal Data: Any information relating to an identified or identifiable natural person,

      Processing of Personal Data: Any operation which is performed on personal data, wholly or partially by automated means or non-automated means which provided that form part of a data filing system, such as collection, recording, storage, protection, alteration, adaptation, disclosure, transfer, retrieval, making available for collection, categorization, preventing the use thereof,

      Board: Personal Data Protection Board,

      Special Categories of Personal Data: Personal data relating to the race, ethnic origin, political opinion, philosophical belief, religion, religious sect or other belief, appearance, membership to associations, foundations or trade-unions, data concerning health, sexual life, criminal convictions and security measures, and biometric and genetic data are deemed to be special categories of personal data.

      Policy: Geberit Personal Data Protection and Privacy Policy

      Data Processor: the natural or legal person who processes personal data on behalf of the data controller upon its authorization.

      3. CATEGORIES OF DATA SUBJECTS

      i. Customer

      - Shareholders and Executives of Customers
      - Employees of Customers
      - Family Members and Relatives of Customers

      ii. Potential Customer

      - Shareholders and Executives of Potential Customers
      - Employees of Potential Customer

      iii. Supplier

      - Family Members and Relatives of Supplier
      - Shareholders and Executives of Supplier
      - Family Members or Relatives of Supplier’s Shareholders/Executives
      - Employees of Supplier
      - Family Members and Relatives of Supplier’s Employees

      iv. Potential Supplier

      - Shareholders and Executives of Potential Supplier
      - Employees of Potential Supplier

      v. Visitor

      The categories of data subjects may expand depending on the nature of data processing activities.

      4. CATEGORIES OF PERSONAL DATA PROCESSED

      Geberit processes different categories of personal data for each data processing activity, depending on the nature of its relationship with the data subject. In this context, and in line with the principle of data minimization, Geberit processes only the personal data necessary and relevant for the purposes of maintaining the Company’s management activities, conducting the relationship between the parties, and fulfilling its legal obligations.

      For detailed information regarding the categories of personal data and examples of data types, please refer to the explanations provided under Annex-1 of this Policy.

      5. METHODS OF PERSONAL DATA COLLECTION

      Geberit collects personal data from suppliers, data subjects themselves, their employers, family members or relatives, intermediaries and customers. Personal data may also be obtained through e-mail, fax, mail, call centers, websites, security cameras, cookies, and from notifications or correspondence received from administrative or judicial authorities, as well as through other communication channels. Such data collected visually, audibly, electronically, or in written form, in compliance with the personal data processing conditions set forth under the Law.

      6. PRINCIPLES RELATING TO THE PROCESSING OF PERSONAL DATA

      Personal data are processed in accordance with the principles set forth in Article 4 of the Law, as explained below:

      6.1. Personal data are processed lawfully and in accordance with the principle of good faith. In every stage of its data processing activities, the Company acts in compliance with the applicable legal provisions, limits processing to the specific purposes pursued, and takes into account the interests and reasonable expectations of data subjects.

      6.2. The Company ensures that personal data are accurate and, where necessary, kept up to date. Appropriate measures are taken to verify the accuracy and currency of the personal data processed. Data subjects are also entitled to request the rectification or erasure of any personal data that is inaccurate or outdated, and this right is duly safeguarded by the Company.

      6.3. The Company ensures that all data processing activities are carried out for specific, explicit, and legitimate purposes. Each processing activity is clearly defined in advance, and the purposes of processing are made transparent and understandable to the data subject.

      6.4. The Company collects and processes personal data only to the extent necessary and proportionate for the relevant data processing activities. Personal data are processed solely for purposes that have been clearly defined and are not used in a manner incompatible with those purposes.

      6.5. Personal data is retained only for as long as required by the relevant legislation or for the purposes of processing. Once the purpose of processing no longer exists, or upon expiry of the statutory storage period, such personal data are erased, destroyed, or anonymized by the Company in accordance with applicable procedures.

      7. LEGAL BASES FOR PROCESSING PERSONAL DATA

      In accordance with Article 5 (2) of the Law, Geberit processes personal data based on the following legal grounds:

      - Your explicit consent, where required (e.g., processing of your personal data for profiling, analytics, marketing, or advertising purposes);

      - Where the processing of personal data is expressly provided by the Law (e.g., processing your name, surname, and signature as stated in commercial communication consent forms);

      - Where processing is necessary for the performance of a contract to which you are a party, or in order to take steps prior to entering into such a contract (e.g., processing identification data during the contract initiation phase);

      - Where processing is necessary for the data controller to comply with a legal obligation (e.g., use of security cameras to ensure the safety of the workplace, employees, and visitors);

      - Where the personal data have been made public by the data subject (e.g., contacting you through communication details you have shared on publicly available social media platforms or websites for the purpose of establishing a business relationship);

      - Where processing is necessary for the establishment, exercise, or protection of a legal right (e.g., retaining personal data that may be required within the statute of limitations period for legal claims);

      - Where processing is necessary for the legitimate interests of Geberit, provided that such processing does not prejudice the fundamental rights and freedoms of the subject of the data (e.g., providing documents containing personal data, such as payment records, to relevant parties or authorities during merger, division, or acquisition processes);

      - Where processing is necessary to protect the life or physical integrity of the data subject or another person who is unable to give consent due to actual impossibility or whose consent is not legally valid.

      8. PURPOSE OF PROCESSING PERSONAL DATA

      Personal data may be processed for different purposes in relation to each data processing activity, in accordance with the legal bases set out in Article 7 of this Policy. Within this scope, the personal data you share may be used by different departments of the Company for different processing purposes during distinct operational processes.

      For instance, your name and surname processed by the Sales Department for the purpose of “Conducting Marketing Processes for Products/Services” during the product/service procurement process may also be processed by the Finance Department for the purpose of “Conducting Finance and Accounting Affairs” during the invoicing process.

      In cases where explicit consent is required, the relevant information will be duly provided, and the related personal data will be processed only upon receipt of such consent. For example, in parallel with the above, if identification data collected during the product/service sales process are to be processed by the Marketing Department for the purpose of “Managing Advertisement / Campaign / Promotion Processes” explicit consent will be obtained from the data subject for that purpose.

      For detailed information on the purposes of processing personal data, please refer to the explanations provided under Annex-2 of this Policy.

      9. PROFILLING and SEGMENTATION

      Geberit may use the personal data it processes to conduct profiling and segmentation activities for the following purposes:

      i. For data subjects who have granted commercial electronic communication consent:

      - Preparing content, advertisements, promotional materials, and discounts tailored to the preferences and interests of the data subject;
      - Sending communications regarding new products or services, as well as updates and news concerning existing products or services;
      - Sending greetings, invitations, announcements, promotional or advertising materials, and similar content.

      ii. For data subjects who have not granted commercial electronic communication consent:

      - Conducting analyses and activities aimed at enhancing the appeal and marketability of products;
      - Carrying out profiling and segmentation studies without using any personal data directly. In such cases, operations are performed through unique codes assigned to each customer, ensuring the protection of personal data. These customer codes are accessible only to authorized individuals or departments in accordance with the “need-to-know” principle.

      10. TRANSFER OF PERSONAL DATA

      Geberit may transfer personal data to domestic and international recipients solely for the purposes outlined in this Policy, and in accordance with the provisions of Articles 8 and 9 of the Law.

      Within this scope, personal data transfers are carried out through secure environments and communication channels. Depending on the nature and scope of the services received from third parties, pseudonymous data are used for such transfers in all cases where it is not necessary to transfer identifiable personal data of the data subject.

      Geberit ensures that all domestic and international data transfers are carried out under appropriate administrative and technical safeguards, consistent with technological advancements and proportional to cost-benefit balance. Geberit continuously updates its security measures in compliance with applicable legislation and decisions of the Board. As a part of these administrative and technical measures, specific agreements are executed with the parties to whom personal data are transferred, and the necessary undertakings are obtained regarding the processing and protection of personal data.

      Pursuant to Article 9 of the Law, as a rule, personal data may not be transferred abroad without the explicit consent of the data subject. However, where the conditions set forth in Article 7 of this Policy are met, personal data may be transferred to countries providing an adequate level of protection, or, in cases where adequate protection is not available, to recipients in foreign countries provided that a written undertaking ensuring adequate protection is signed with the recipient and approved by the Data Protection Authority, and, where necessary, additional safeguards are implemented. Additionally, data transfers abroad may be carried out using Standard Contractual Clauses (“SCCs”) or Binding Corporate Rules (“BCRs”) as mechanisms ensuring an adequate level of protection. In such cases, where adequate safeguards are duly implemented and, where required, approved by the Data Protection Authority, the transfer of personal data abroad may take place without obtaining the explicit consent of the data subject.

      For detailed information regarding the purposes and recipients of personal data transfers, please refer to the explanations provided under Annex-3 of this Policy.

      11. ADMINISTRATIVE AND TECHNICAL MEASURES FOR ENSURING THE SECURITY OF PERSONAL DATA

      Geberit is committed to taking all administrative and technical measures necessary to ensure the confidentiality, integrity, and security of your personal data at every stage of processing. To prevent misuse, unlawful processing, unauthorized access, disclosure, alteration, or destruction of personal data, Geberit implements internal authorization and access control procedures and, where necessary, obtains professional support from external service providers. In this context, Geberit prioritizes compliance with the applicable legislation, as well as with the guidelines and decisions published by the Data Protection Authority.

      For detailed information on the measures taken to protect your personal data, please refer to the explanations provided under Annex-4 of this Policy.

      12. STORAGE PERIODS FOR PERSONAL DATA

      Geberit retains the personal data it processes in compliance with the Law for the periods prescribed by the applicable legislation or for as long as required for the purposes of processing.

      For information on the approximate storage periods, please refer to the explanations provided under Annex-5 of this Policy.

      13. CONDITIONS FOR ERASURE, DESTRUCTION, AND ANONYMIZATION OF PERSONAL DATA

      Geberit retains the personal data collected and processed within the scope of its business activities for the periods prescribed under Articles 17 and 7 of the Law and Article 138 of the Turkish Criminal Code, and/or for as long as required by the purposes of processing.

      Upon the expiry of these periods, personal data are erased, destroyed, or anonymized in accordance with the provisions of the Regulation on the Erasure, Destruction, or Anonymization of Personal Data and the Guideline on the Erasure, Destruction, or Anonymization of Personal Data published by the Data Protection Authority.

      Within this scope:

      - Erasure of Personal Data refers to the process by which personal data are rendered inaccessible and unusable for the relevant users under any circumstances.

      - Destruction of Personal Data refers to the process by which personal data are rendered completely inaccessible, irretrievable, and unusable by anyone.

      - Anonymization of Personal Data refers to the process by which personal data are altered in such a way that the data subject can no longer be identified, even when the data are matched with other datasets.

      Geberit Personal Data Storage and Disposal Policy is available on the Company’s official website. In accordance with the relevant Regulation, the periodic disposal interval specified in the Policy has been determined as six (6) months.

      14. DATA SUBJECT RIGHTS UNDER ARTICLE 11 OF THE LAW

      As data subjects, you have the following rights under Article 11 of the Law:

      a) To learn whether your personal data are being processed,
      b) To request information if your personal data have been processed,
      c) To learn the purpose of processing and whether your personal data are being used in accordance with such purpose,
      d) To learn the third parties to whom your personal data are transferred, whether within the country or abroad,
      e) To request the correction of your personal data if they are incomplete or inaccurate,
      f) To request the erasure or destruction of your personal data within the framework of the conditions set forth in Article 7 of the Law,
      g) To request that the third parties to whom your personal data have been transferred be notified of the actions taken under subparagraphs (d) and (e),
      h) To object to the occurrence of a result against you that arises from the analysis of your personal data exclusively through automated systems,
      i) To request compensation for damages incurred due to the unlawful processing of your personal data.

      In order to submit your requests and exercise your rights regarding your personal data, you are required to complete the “Contact Form  (297 KB)” available on Geberit’s official website and send it to the Company through one of the application methods listed below.

      You may submit the completed Contact Form to the Company using one of the following application methods:

      - In-Person Application: The Contact Form may be delivered in person to the Company’s headquarters. In this case, the applicant is required to present an identity document. The envelope must be labeled “Application Under the Law on the Protection of Personal Data.
      - Notification via Notary Public: The Contact Form may be sent through a notary public. The subject of the notification must be “Application Under the Law on the Protection of Personal Data.”

      - Via Registered Electronic Mail (KEP): The Contact Form, signed with a secure electronic signature as defined under Electronic Signature Law No. 5070, may be sent to the Company’s registered electronic mail (KEP) address. The e-mail subject line must read “Application Under the Law on the Protection of Personal Data.”

      - By E-Mail: The Contact Form may be sent to Geberit’s official e-mail address (sales.tr@geberit.com). The subject line of the e-mail must state “Application Under the Law on the Protection of Personal Data”

      For the purpose of verifying the applicant’s identity, additional documents may be requested. In such cases, the application shall be deemed to have been duly submitted only after the requested documents are provided by the applicant. When you submit your requests using the methods specified above, the Company will conclude your application as soon as possible and within thirty (30) days at the latest, depending on the nature of your request, free of charge. However, if processing your request requires additional cost, a fee may be charged in accordance with the tariff determined by the Personal Data Protection Authority.

      15. AMENDMENTS TO THE POLICY

      Geberit may amend this Policy at any time. Such amendments shall become effective immediately upon the publication of the revised Policy. You will be duly informed of any changes made to this Policy through appropriate notifications.

      DOCUMENT HISTORY
      VersionPublication DateDescription of Change

      ANNEX 1 DATA CATEGORIZATION

      The main categories of personal data processed by Geberit are generally as follows:

      Category of DataCategory Description
      IdentitiyAny information that enables the identification of the data subject Such as name-surname, mother’s and father’s names, mother’s maiden name, date of birth, place of birth, marital status, ID card serial number, national identification number
      Contact InformationAny data that enable communication with the data subject. Such as address number, email address, communication address, registered email address (KEP), telephone number
      Family and Relatives InformationPersonal data relating to the family members and relatives of the data subject (Such as name-surname, profession, date of birth, mobile phone number)
      Personnel RecordsPersonal data that may be found in the personnel file of the data subject or their employees. Such as payroll information, disciplinary investigation records, employment entry and exit document records, asset declaration information, resume information, performance evaluation reports
      Legal ProceduresPersonal data processed for the protection of the Company’s receivables and legal rights. Such as information in correspondence with judicial authorities, information in court files
      Supplier TransactionPersonal data collected within the scope of the relationship between the Company and the supplier. Such as invoices, promissory notes, checks, teller receipts, order information, request information
      Customer TransactionPersonal data collected within the scope of the relationship between the Company and the customer. Such as call center records, invoices, promissory notes, checks, teller receipts, order information, request information
      Physical Space SecurityPersonal data relating to records and documents obtained during entry to and stay within the physical premises. Such as entry and exit records of employees and visitors, camera records
      Transaction SecurityPersonal data processed to ensure the technical, administrative, legal, and commercial security of the Company. Such as IP address information, website login and logout information, password and passcode information
      Risk ManagementPersonal data processed for the management of commercial, technical, and administrative risks. Such as information processed for the management of commercial, technical, and administrative risks
      FinancialAll kinds of financial information, documents, records, numbers, and results that may be processed within the scope of the relationship between the Company and the data subject. Such as balance sheet information, financial performance information, credit and risk information, asset information
      Professional ExperiencePersonal data relating to the data subject’s professional background and development. Such as diploma information, attended courses, in-service training information, certifications, transcript information
      MarketingPersonal data collected for the purpose of increasing the recognition and visibility of the Company’s activities. Such as purchase history information, survey records, cookie records, information obtained from marketing campaigns
      Visual and Audio RecordsRecords containing the data subject’s moving or still images or audio, in printed or electronic media. Such as visual and audio recordings
      Special Categories of Personal DataPersonal data relating to the race, ethnic origin, political opinion, philosophical belief, religion, religious sect or other belief, appearance, membership to associations, foundations or trade-unions, data concerning health, sexual life, criminal convictions and security measures, and the biometric and genetic data are deemed to be special categories of personal data.

      Data Categorization by Data Subject Category

      Category of Data SubjectExample of Processed Data Catagories
      CustomerIdentity, Contact Information, Personnel Records, Legal Procedures, Customer Transaction, Physical Space Security, Transaction Security, Risk Management, Financial, Professional Experience, Marketing, Visual and Audio Records, Special Categories of Personal Data
      Potential CustomerIdentity, Contact Information, Personnel Records, Customer Transaction, Physical Space Security, Professional Experience, Visual and Audio Records
      SupplierIdentity, Contact Information, Personnel Records, Legal Procedures, Supplier Transaction, Physical Space Security, Transaction Security, Risk Management, Financial, Professional Experience, Visual and Audio Records, Special Categories of Personal Data
      Potential SupplierIdentity, Contact Information, Personnel Records, Supplier Transaction, Physical Space Security, Professional Experience, Visual and Audio Records
      VisitorIdentity, Contact Information, Personnel Records, Physical Space Security, Risk Management, Visual and Audio Records

      The categories and types of personal data processed may vary depending on the nature of each legal or commercial relationship. To determine which personal data concerning you are being processed, please refer to the Policy provided to you.

      ANNEX 2

      Purposes of Personal Data Processing

      • Conducting Emergency Management Processes
      • Execution of Archiving and Data Storage Activities
      • Managing Information Security Processes
      • Conducting Employee Candidate / Intern / Student Selection and Placement Processes
      • Conducting Employee Candidate Application Processes
      • Managing Employee Satisfaction and Loyalty Processes
      • Fulfilling Contractual and Statutory Obligations for Employees
      • Managing Employee Benefits and Perks Processes
      • Conducting Audit / Ethical Activities
      • Conducting Training Activities
      • Managing Access Authorizations
      • Ensuring Activities Comply with Legislation
      • Conducting Finance and Accounting Affairs
      • Managing Company / Product / Service Loyalty Processes
      • Ensuring Physical Space Security
      • Managing Assignment Processes
      • Conducting Internal Audit / Investigation / Intelligence Activities
      • Conducting Communication Activities
      • Planning Human Resources Processes
      • Managing Business Activities / Supervision
      • Conducting Occupational Health and Safety Activities
      • Gathering and Evaluating Suggestions for Improvement of Business Processes
      • Conducting Business Continuity ActivitiesManaging Logistics Activities
      • Conducting Procurement Processes for Goods / Services
      • Providing After-Sales Support for Goods / Services
      • Managing Sales Processes for Goods / Services
      • Conducting Production and Operation Processes for Goods / Services
      • Managing Customer Relationship Processes
      • Conducting Customer Satisfaction Activities
      • Managing Organization and Event Activities
      • Conducting Marketing Analysis Studies
      • Conducting Performance Evaluation Processes
      • Conducting Risk Management Processes
      • Managing Storage and Archiving Activities
      • Managing Contract Processes
      • Tracking Requests / Complaints
      • Ensuring the Security of Movable Property and Resources
      • Conducting Supply Chain Management Processes
      • Ensuring the Security of Data Controller Operations
      • Providing Information to Authorized Persons, Institutions, and Organizations
      • Conducting Management Activities
      • Creating and Tracking Visitor Records

      ANNEX 3 DOMESTIC AND INTERNATIONAL TRANSFER OF PERSONAL DATA

      Data RecipientPurposeExample
      SuppliersEnsuring the Security of Information, IT Systems, and Personal DataTransfer of personal data to software service providers offering cloud computing or similar services for the purpose of monitoring and managing commercial processes relating to customers and suppliers
      Providing After-Sales Support for Goods / ServicesSharing personal data with banks, courier companies, consultants, call center service providers, security companies, and other supporting third parties within the scope of establishing or performing a contractual relationship
      Conducting Communication ActivitiesPersonal data is transferred to e-mail service providers utilizing server and cloud infrastructure in order to ensure secure communication through e-mail.
      Conducting Marketing Analysis StudiesSharing of personal data with third parties that provide services for sending commercial messages, announcing campaigns, and delivering product or service advertisements
      Managing Organization and Event ActivitiesSharing of personal data with service providers involved in the organization of travel, conferences, congresses, trainings, product launches, and similar events
      Conducting Legal AffairsSharing of personal data with lawyers or consultants providing legal or advisory services.
      CustomersProviding After-Sales Support for Goods / ServicesSharing of suppliers’ personal data with customers for the completion of sales, communication, logistics, installation, support, and similar processes carried out by the Company
      Affiliates and subsidiariesConducting Management ActivitiesTransfer of personal data to subsidiaries and affiliates for the purpose of fulfilling legal, financial, and administrative obligations and conducting reporting activities
      Ensuring the Security of Personal Data and the Data Controller’s OperationsStorage of personal data through secure servers, software, cloud computing, or similar systems allocated for use by the Company’s subsidiaries and affiliates, for the purpose of ensuring secure storage of personal data
      Authorized Persons, Institutions, and OrganizationsProviding Information to Authorized Persons, Institutions, and OrganizationsSharing of personal data with persons, institutions, and organizations authorized by law, within the scope of obligations arising from the applicable legislation

      ANNEX 4 ADMINISTRATIVE AND TECHNICAL MEASURES

      Geberit, in accordance with Article 12 of the Law, takes the following technical and administrative measures to prevent unlawful access to the personal data it processes, to avoid their unlawful processing, and to ensure the secure preservation of such data:

      1. Administrative Measures

      1.1. Establishment of Personal Data Security Policies and Procedures

      Geberit has established both general and process-specific policies and procedures regarding the protection of personal data. Within this scope, the Company has implemented the following main policies:

      • Personal Data Protection and Privacy Policy
      • Special Categories of Personal Data Protection Policy
      • Policy Personal Data Storage and Disposal Policy
      • Cookie Policy

      In addition, the Company has adopted internal guidelines containing more detailed instructions on personal data processing activities carried out by its employees and executives.
      The Company regularly updates its policies, procedures, and internal guidelines in line with legislative amendments and new decisions issued by the Board.
      Compliance of employees with the Company’s data protection policies and procedures is regularly audited.

      1.2. Identification of Existing Risks and Threats

      Geberit identifies all risks and threats that may compromise the security of personal data before any breach occurs. Within this scope, the Company conducts internal assessments to determine which data categories, processing activities, and tools or systems are associated with such risks and threats. Particular attention is given to whether these risks and threats relate to special categories of personal data.
      Geberit takes all necessary steps to minimize, prevent, and eliminate the risks and threats identified through these assessments.

      1.3. Employee Training and Awareness Activities

      Geberit provides training to its employees, both through its internal departments and via external legal and technical consultants, in order to raise awareness regarding various information security risks, ensure the lawful processing of personal data, and minimize the human factor in potential data breach incidents.
      To promote awareness of personal data protection, Geberit conducts regular training sessions, distributes informative materials and internal notices, and provides oral briefings and internal guidelines. Within this framework, employees receive detailed instructions covering all stages of the data lifecycle, from the collection to the destruction of personal data.
      Employee awareness activities continue throughout the term of employment and include updates on current legislative amendments and decisions of the Data Protection Authority concerning personal data protection.
      In addition to the confidentiality obligations contained in their employment contracts, all employees also sign a Personal Data Protection Undertaking.

      1.4. Data Minimization

      In line with the principles set forth in Article 4 of the Law, Geberit takes care not to process any personal data that are not necessary within the scope of the relevant processing activity.
      Before initiating any processing operation, the Company reviews the process in advance and requests from the data subject only the personal data necessary to fulfill its legal and commercial obligations.
      If a data subject provides personal data that have not been requested, such data are immediately erased or masked to ensure compliance with the principle of data minimization.

      1.5. Measures Regarding Data Processors

      When Geberit engages a sub-processor in connection with its data processing activities, it first assesses the competence and adequacy of the sub-processor with respect to personal data protection.
      Within this scope, the sub-processor is required to provide a written undertaking confirming that it will act in compliance with Geberit’s personal data protection policies and procedures, at a minimum.
      The Company monitors and audits the sub-processor’s data processing activities and its efforts to ensure the security and protection of personal data.

      2. Technical Measures

      2.1. IT Systems

      Geberit cooperates with specialized information technology service providers to ensure the security of personal data. Within this scope, the Company’s system requirements and potential vulnerabilities are regularly monitored, and technical support is obtained when necessary to maintain and strengthen data security.

      2.2.Cybersecurity Measures

      Geberit implements cybersecurity measures to ensure the security of personal data processed in electronic environments. Within this scope, and with the support of both the Company’s internal IT personnel and specialized external service providers, all necessary precautions are taken to prevent any cybersecurity vulnerabilities. Examples include:

      • Anti-Virus: All computers and servers within Geberit’s IT infrastructure are equipped with licensed anti-virus software, which is periodically updated.
      • Firewall: The Data Center and Disaster Recovery Centers hosting Geberit’s servers are protected by firewall systems with regularly updated software. These next-generation firewalls monitor all employee internet connections and provide protection against viruses and similar threats during such monitoring.
      • VPN: Connections to server systems are established through IP-SEC VPN, ensuring that the traffic between the two endpoints is encrypted. Suppliers may also access Geberit’s servers or systems through SSL-VPNs defined on the firewalls. A separate SSL-VPN is configured for each supplier, allowing access only to the systems that are necessary or authorized.
      • User Access Definitions and Need-to-Know Principle: Geberit employees’ access rights to the Company’s systems are restricted to the extent necessary for their job descriptions. In the event of any change in roles or responsibilities, system authorizations are immediately updated to reflect the new access requirements.

      2.3. Monitoring of Personal Data Security

      Geberit regularly monitors the effectiveness of its technical and administrative measures to ensure the security of personal data. This includes periodic audits, system monitoring, access log reviews, and vulnerability assessments to identify and address any potential weaknesses. In the event of a potential or actual personal data breach, necessary actions are taken in line with internal procedures and legal obligations.
      Geberit conducts regular audits to ensure the protection of personal data processed in physical environments. For example, during periodic office inspections, it is verified whether employees comply with the “clean table & clean desk” principle and whether documents containing personal data in physical form are securely stored under lock and key.
      Geberit also performs tests and assessments to ensure the security of personal data processed electronically. Within this scope, the Company continuously monitors whether protective software systems are functioning properly and whether electronic authorizations are carried out in compliance with internal procedures through log records.
      These controls are also supported through periodic technical tests, examples of which are provided below.
      Phishing E-Mail Tests: To raise awareness among Geberit system users, phishing e-mails are regularly sent to employees. Based on the results of these tests, relevant training programs are assigned to users through the Geberit User Portal.
      Penetration Testing: Manual penetration tests are periodically conducted by an external service provider on Geberit’s servers, computers, and a sample store system. Any security vulnerabilities identified during these tests are promptly addressed, and a verification test is carried out to confirm that the vulnerabilities have been remediated. In addition, automated penetration tests are performed by the Information Security Threat and Incident Management System.
      Information Security Threat and Incident Management: Events occurring on Geberit’s servers and firewalls are transmitted to the Information Security Threat and Incident Management System. This system alerts the responsible personnel in the event of a security threat and enables an immediate and effective response.

      2.4. Ensuring the Security of Environments Containing Personal Data

      Geberit implements specific security measures to ensure the protection of personal data stored in physical environments. For example:

      • Physical environments where personal data are stored are kept under lock and key, and access rights are strictly limited to authorized personnel.
      • Necessary precautions are taken against risks such as fire, flood, or theft.
      • Additional safeguards are implemented for the transfer of personal data in paper form. In this context, personal data transmitted on paper are sent using the sealed envelope method.
      • Access to server and archive rooms is protected through additional physical security measures.

      2.5. Backup of Personal Data

      Geberit eliminates the risk of data loss by utilizing backed-up copies of personal data in cases where such data are damaged, destroyed, stolen, or lost for any reason. The security of backed-up personal data is also ensured at the highest level through appropriate technical and administrative safeguards.

      2.6. Other Examples

      • All sections of the website through which personal data are collected are protected by SSL encryption.
      • For all secondary data processing activities beyond the primary purpose, pseudonymization methods are applied (e.g., Ahmet Yılmaz → “A… Y…”).
      • Personal data in paper form are stored exclusively in locked cabinets and accessed only by authorized personnel.
      • In cases where personal data are processed through third-party cookies, such data are erased from third-party systems once the user’s membership is terminated.
      • A closed network system is used, and network and software security are ensured through up-to-date licensed programs and data loss prevention software.
      • User access definitions and authorization matrices are maintained for all networks and software systems.
      • Software systems and cloud storage platforms are used in encrypted form and accessed based on employee authorization levels.
      • Log records are maintained in a manner that prevents any user interference or alteration.
      • Data masking techniques are applied where necessary to enhance the protection of personal data.

      3. SPECIFIC MEASURES FOR THE PROTECTION OF SPECIAL CATEGORIES OF PERSONAL DATA

      In accordance with the Decision of the Board dated 01/01/2018 and numbered 2018/10:

      • Periodic training sessions are provided for employees regarding the processing of special categories of personal data.
      • In contractual processes where special categories of personal data are processed, confidentiality agreements and undertakings specific to such data are executed.
      • The authorization scopes and durations of employees who have access to special categories of personal data are clearly defined and periodically audited.
      • The security of electronic environments in which special categories of personal data are stored is ensured through cryptographic keys, while physical environments are secured in locked areas where access is granted in accordance with authorization matrices.
      • Log records are regularly maintained.
      • Software systems containing special categories of personal data are continuously updated.
      • If remote access to special categories of personal data is required, such access is granted only through two-factor authentication mechanisms.
      • The transfer of special categories of personal data is carried out:
      • In electronic environments through encrypted portable devices, registered electronic mail (KEP), VPN connections, or sFTP methods; and
      • In physical environments through sealed and personalized envelopes delivered securely to the recipient.

      For more detailed information regarding the protection of special categories of personal data, please refer to the Geberit Special Categories of Personal Data Protection Policy.

      ANNEX 5 STORAGE PERIODS FOR PERSONAL DATA

      Type of DataStorage PeriodLegal BasisDisposal Period
      Personal Data of Customers10 years following the termination of the legal relationshipLaw No. 6563, Law No. 6102, Law No. 6098, Law No. 213, Law No. 6502During the first periodic disposal period following the expiry of the storage period
      Personal Data of Suppliers10 years following the termination of the legal relationshipLaw No. 6102, Law No. 6098 and Law No. 213During the first periodic disposal period following the expiry of the storage period
      Personal Data of Potential Customers/Suppliers2 yearsConducting Retrospective and Prospective AnalysesDuring the first periodic disposal period following the expiry of the storage period
      Personal Data of Online Customers10 years following the termination of the legal relationship; 3 years pursuant to Law No. 6563 and the relevant secondary legislationLaw No. 6563, Law No. 6102, Law No. 6098, Law No. 213, Law No. 6502During the first periodic disposal period following the expiry of the storage period
      Personal Data of Online Visitors (Log Records)2 yearsLaw No. 5651 and relevant secondary legislationDuring the first periodic disposal period following the expiry of the storage period
      Commercial Electronic Message RecordsRecords relating to commercial electronic message consents shall be retained for 3 years following the date of withdrawal or invalidation of the consent, while other records relating to commercial electronic messages shall be retained for 3 years from the date of collection.Law No. 6563; Regulation on Commercial Communication and Commercial Electronic MessagesDuring the first periodic disposal period following the expiry of the storage period
      Records Regarding Commercial Electronic Messages3 yearsLaw No. 6563 and the relevant secondary legislationDuring the first periodic disposal period following the expiry of the storage period
      Personal Data of Visitors (Camera Recordings)35 daysEnsuring SecurityDuring the first periodic disposal period following the expiry of the storage period

      Annex 6 1. Automatic data collection and processing on Geberit websites

      Our websites use certain technologies and tools, which are outlined below. If there are any that you do not want us to use, provided these are optional, we have provided various options and settings for each one that will prevent it from being used.

      1.1 Server log files

      1.1.1 As with every website, our server automatically and temporarily collects information transmitted by your browser in server log files, provided you have not disabled this feature. If you intend to view our website, we require certain types of data on a technical level so that we can display our websites whilst also ensuring stability and security. This data is as follows:

      • IP address of the computer sending the request
      • file request of the client
      • http response code
      • the web page that linked you to our website (referrer URL)
      • time of the server request
      • browser type and version
      • operating system used by the computer sending the request

      1.1.2 The data in these server log files will not be analysed in a way that identifies individual persons. In cases where the information listed above contains personal data (particularly the IP address), the legal basis for collecting this data is point (f) of Article 6(1) of the General Data Protection Regulation (GDPR). The legitimate interest we pursue when collecting this data is to ensure the proper functioning of our websites. If you require further information about the balancing of interests that must be carried out in accordance with point (f) of Article 6(1) of the GDPR, please contact us using the details provided in Section 2. It is necessary for us to temporarily save your personal data to ensure that the website appears on your computer. To achieve this, your personal data must be saved for the duration of your visit to our website. Your personal data is saved in log files in order to ensure the operability of the website. Your personal data also ensures the security of our IT systems. Your personal data is not processed further. Your personal data is deleted as soon as it is no longer required for the purpose for which it was processed. In the case of your personal data being collected for the provision of the website, this applies as soon as you leave the website. If your personal data is saved in log files, these are deleted after 14 days at the latest. If the data is saved for reasons beyond these, your personal data is anonymised so that you cannot be associated with or identified from this data.

      1.2 Improving quality, optimising the website, user behaviour analysis and playing personal-ised adverts

      1.2.1 The legal basis for storing information on your PC or mobile device or accessing information already stored on your PC or mobile device is your consent in accordance with the national laws implementing Directive 2002/58/EC (Directive on privacy and electronic communications).The legal basis for processing your personal data as part of using cookies or comparable technologies – such as pixels, tags, web beacons or browser fingerprinting (known as ‘tracking cookies’) – for improving quality, optimising the website, user-behaviour analysis and playing personalised adverts after merging with your contract master data and your purchase history, is your declaration of consent in accordance with point (a) of Article 6(1) of the GDPR.

      1.2.2 Processing your personal data allows us to optimise the user experience on our website and to promote sales by selling goods or services.

      1.2.3 Your personal data is deleted as soon as it is no longer required for the purpose for which it was processed or if you withdraw your consent.

      1.2.4 You can find an overview of the cookies used on our website in the cookie details of our cookie banner under “Change cookie settings“. You will find this in the footer of the homepage. There you can adjust your settings for the cookies set on our websites at any time. You may withdraw your consent to the processing of your personal data using tracking cookies at any time with future effect by:

      (1) Changing your consent settings on our website

      On our website, you can simply withdraw your consent to the processing of your personal data using tracking cookies. To access this setting, click on the link in the website footer (‘Change cookie settings’) to open the cookie banner. Revoking your consent places a further cookie on your computer, which indicates to us that no tracking cookies can be used. If you delete this cookie, you will be asked to submit your declaration of consent again the next time you open our website.

      (2) Changing your browser settings

      Alternatively, you can change your browser settings to deactivate or limit the transfer of cookies in general. You can delete saved cookies at any time. This process can also be automated. If technically necessary cookies are disabled on our website, it may cause certain functions to cease, or may stop you from fully utilising all functions on our website.

      (3) Google Analytics, Google Signals and Google Consent Mode API

      As part of the integration of Google Analytics, Google Signals and Google Consent Mode API, we use so-called “server-side tagging“. In this case, a server is switched from our side between the collection by us and the transmission to Google. This ensures that no personal data is transmitted to Google. If you do not want your personal data to be processed by Google Analytics, you can additionally install a browser add-on to deactivate it. This add-on instructs the Google Analytics JavaScript (ga.js, analytics.js and dc.js) on websites not to collect your personal data.

      For more information on terms of use and data protection, please visit: or

      1.3 MS Clarity

      1.3.1 We use MS Clarity from Microsoft Ireland Operations Limited One Microsoft Place, South County Business Park, Leopardstown, Dublin 18 D18 P521, Ireland („Microsoft“) to determine the popularity of products/services and online activities, as well as to analyse and improve the user-friendliness of our website. We use behavioural metrics, heatmaps and session replay to understand how you use and interact with our website. We collect specific website usage data, such as IP addresses, access times and cursor and scrolling activity. Your IP address is anonymised, replaced by a random ID and only then transmitted to Microsoft.

      1.3.2 The legal basis for the processing of your personal data is your consent in accordance with point a of Art. 6(1) of the GDPR. Your personal data will be deleted as soon as you withdraw your declaration of consent, or your personal data is no longer required for the purpose of its processing. The cookies will be deleted by MS Clarity after 30 days.

      1.3.3 When using MS Clarity, data may be transferred to the USA. It is ensured that appropriate guarantees for the protection of data in accordance with Art. 44 et sqq of the GDPR are in place. Microsoft is a participant in the EU-US Data Privacy Framework and uses standard contractual clauses to ensure an adequate level of data protection.

      1.3.4 We have no influence on how Microsoft uses the data it receives from you internally. Microsoft is solely responsible for this data processing. For more information on how Microsoft collects and uses your data, please visit https://privacy.microsoft.com/de-de/privacystatement and https://learn.microsoft.com/en-us/clarity/faq#privacy.

      1.4 Google Analytics and Google Signals

      1.4.1 We use the Google Analytics and Google Signals services provided by Google to analyse and optimise the use of our website. The responsible party is Google Ireland Limited, Google Building Gordon House, 4 Barrow St., Dublin, D04 E5W5, (“Google“).

      1.4.2 Google Analytics stores cookies in your web browser for a period of 2 years since your last visit, unless you delete the cookies beforehand. These cookies contain a randomly generated user ID with which you can be recognised during future website visits. The recorded data, together with the randomly generated user ID, is usually transferred to a Google server in the USA and stored there by Google, which enables the evaluation of pseudonymous user profiles. Google provides us with aggregated, anonymous information about this.

      1.4.3 Google Signals is a function of Google Analytics that allows us to view demographic data and aggregated data on user interests and behaviour. If you have given your consent to the cookies, Google will use other information that you have provided to Google for other reasons to provide this information to us in anonymous form.

      1.4.4 The legal basis for the processing of your personal data in the context of the use of Google Analytics incl. Google Signals is your consent in accordance with point a of Art. 6(1) of the GDPR. Your personal data will be deleted as soon as you withdraw your consent or your personal data is no longer required to achieve the purpose of its processing. The data sent by us and linked to cookies will be automatically deleted by Google after 14 months. The maximum lifespan of Google Analytics cookies is 2 years.

      1.4.5 Further information on the terms of use and data protection of Google Analytics can be found at: , at and at . Further information on Google Signals can be found here: .

      1.5 Google Consent Mode API

      1.5.1 We use the Google Consent Mode API by

      1.5.2 Google Ireland Limited, Google Building Gordon House, 4 Barrow St., Dublin, D04 E5W5, Ireland (“Google“). The Google Consent Mode API is an interface (API = Application Programming Interface) via which our website can inform Google whether you have made a cookie selection and, if so, which one, in order to activate only those cookies to which you have consented. If you agree to Google Analytics/Signals, the Google Consent Mode API sends anonymised information (so-called pings) about certain actions on the website to Google for the purpose of data modelling, which we use to optimise our website.

      1.5.3 The legal basis for the processing of your personal data in the context of the use of the Google Consent Mode API is our legitimate interest in accordance with point f of Art. 6(1) of the GDPR in managing consents to cookies and similar technologies and, in the case of sending pings, your consent in accordance with point a of Art. 6(1) of the GDPR. Your personal data will be deleted as soon as you withdraw your declaration of consent or your personal data is no longer required to achieve the purpose of its processing.

      1.5.4 Further information on Google Consent Mode can be found here: .

      1.6 Google AdWords

      1.6.1 We use the services of Google AdWords (including Google AdWords remarketing) so that we can place advertisements (called “Google AdWords”) on external websites for the purpose of drawing attention to attractive offers. Using the data gathered from these advertising campaigns, we are able to determine how effective individual advertisements are. We use this tool to show you advertisements that might interest you, to make our website more appealing to your specific interests, and to calculate our advertising costs in a fair manner.

      1.6.2 These advertisements are delivered by Google via what are known as ad servers. For this purpose, we use ad server cookies that enable us to gauge success by means of a number of metrics, such as how often advertisements are displayed and how many times they are clicked by users. If you are linked to our website by a Google advertisement, Google AdWords will save a cookie on your PC. These cookies will normally expire after 90 days and are not used to identify you personally. A cookie of this type will normally contain data for analysis such as the unique cookie ID, the number of ad impressions for each placement (frequency), last impression (relevant for post-view conversions) and opt-out information (a flag specifying that the user no longer wishes to be shown advertisements).

      1.6.3 These cookies allow Google to recognise your Internet browser. If a user visits specific pages on the website of an AdWords customer and the cookie saved on the user’s computer has not yet expired, Google and the customer are able to discern that the user has clicked on the advertisement and was linked to this page. A different cookie is assigned to each AdWords customer. It is therefore not possible to track cookies via the websites of AdWords customers. We do not collect or process any personal data ourselves in the aforementioned advertisements. Rather, we simply receive statistical analyses of the data from Google. Based on these analyses, we are able to determine which of the advertisements placed are particularly effective. We do not receive any further data from the use of advertising, nor in particular are we able to use this information to identify users.

      1.6.4 The legal basis for processing your personal data as part of the ‘Google Adwords’ service is your declaration of consent in accordance with point (a) of Article 6(1) of the GDPR. Your personal data is deleted as soon as it is no longer required for the purpose for which it was processed or if you withdraw your consent. As a general rule, the relevant cookies are deleted after 90 days.

      1.6.5 You can find an overview of the cookies used on our website for Google Adwords purposes in the cookie details of our cookie banner under “Change cookie settings“. You will find this in the footer of the homepage. There you can withdraw your consent to the processing of your personal data for Google Adwords purposes at any time with future effect.

      1.7 Google Enhanced Conversions

      1.7.1 We use the Enhanced Conversions tracking technology provided by Google Ireland Limited, Google Building Gordon House, 4 Barrow St., Dublin, D04 E5W5, Ireland (“Google“). This is a data interface through which we establish a direct connection with Google's server and transmit certain data about your behaviour on our website to Google for evaluation.

      1.7.2 If you provide your e-mail address on our website (e.g. when registering for the newsletter or using a tool, collectively referred to as “event“), certain information (the website accessed, the event name, the event ID and your user agent as well as your e-mail address) will be recorded and hashed, i.e. pseudonymised, transmitted to Google. Google will assign the hash value back to you if you were logged in to a Google account when you used the event. We receive an anonymized report from Google on the effectiveness of our advertising efforts. Otherwise, we have no influence on the scope and further use of the data collected by Google through the use of this tracking technology. We cannot therefore rule out the possibility that Google may know and store your IP address and other identifiers, even if you are not logged in or registered with a Google service.

      1.7.3 The legal basis for the processing of your personal data in the context of our use of Enhanced Conversions is your consent in accordance with point (a) of Art. 6(1) of the GDPR. This processing of your personal data enables us to promote sales through the sale of goods or services.

      1.7.4 Google is solely responsible for the data processing that takes place after the data collected via Enhanced Conversions has been forwarded to Google.

      1.7.5 Further information on data processing by Google, the legal basis for data processing and the exercise of your rights as a data subject can be found under and .

      1.8 DoubleClick by Google

      1.8.1 Our websites use the tool DoubleClick by Google. DoubleClick uses cookies in order to show relevant advertisements to users, to improve reporting on campaign performance, and (if the frequency capping feature is enabled) to prevent users from seeing the same advertisements multiple times. Using a cookie ID, Google can register which advertisements have been shown in which browser, preventing users from seeing the same advertisement multiple times. Furthermore, DoubleClick can use cookie IDs to record what are known as conversions, which are related to ad requests. A conversion happens if, for example, a user sees a DoubleClick advertisement and then later visits the advertiser’s website and makes a purchase using the same browser. According to Google, DoubleClick cookies do not contain any personal information.

      1.8.2 Due to the use of Google AdWords and DoubleClick by Google, your browser will automatically establish a direct connection to the Google server. We have no control over the scope and further use of data collected by Google through the use of these tools, so the information in this privacy policy reflects our current understanding of the matter. As DoubleClick has been integrated into our web services, Google will be notified when you visit the relevant part of our website or click on one of our advertisements. If you are registered with a Google service, Google may be able to attribute the visit to your individual account. Even if you are not registered with or logged into Google, it may be possible for Google to identify and save your IP address.

      1.8.3 Further information on DoubleClick by Google can be found at: and on data protection at Google in general at:.

      1.8.4 The legal basis for processing your personal data as part of the ‘DoubleClick by Google’ service is your declaration of consent in accordance with point (a) of Article 6 (1) of the GDPR. Your personal data is deleted as soon as it is no longer required for the purpose for which it was processed or if you withdraw your consent.

      1.8.5 You can find an overview of the cookies used on our website for purposes relating to the Google DoubleClick service in the cookie details of our cookie banner under “Change cookie settings“. You will find this in the footer of the homepage. There are a number of ways in which you can opt out of participation in Google AdWords and DoubleClick:

      You may withdraw your consent to the processing of your personal data as part of the Google DoubleClick service at any time and with future effect by opening our cookie banner via the footer on our home page and adjusting your settings:

      • by making the appropriate settings in your browser; in particular, suppressing third-party cookies means that you will not receive advertisements from third parties
      • by disabling the cookies for conversion tracking by setting your browser to refuse cookies from the domain: www.googleadservices.com – see . This setting will be undone once you delete your cookies
      • by disabling interest-based advertising by providers that participate in the About Ads self-regulatory programme at . This setting will be undone once you delete your cookies
      • by permanently opting out at http://www.google.com/settings/ads/plugin when using Firefox, Internet Explorer or Google Chrome. Please note that you may not be able to use all of the functions on this website if you do this

      1.9 Xandr, Adform, Plista, Sizmek

      1.9.1 Our websites also use tools from Xandr, Adform, Plista and Sizmek.

      1.9.2 These tools use cookies in order to show relevant advertisements to users, to improve reporting on campaign performance, and to prevent users from seeing the same advertisements multiple times. Using a cookie ID, the tools can register which advertisements have been shown in which browser, and (if the frequency capping feature is enabled) prevent users from seeing the same advertisement multiple times. According to these third-party providers, the cookies used by the tools do not contain any personal information.

      1.9.3 Due to the use of these tools, your browser will automatically establish a direct connection to the server of the relevant third-party provider. We have no control over the scope and further use of data collected through the use of these tools, so the information in this privacy policy reflects our current understanding of the matter. As these tools have been integrated into our web services, the third-party providers will be notified when you visit the relevant part of our website or click on one of our advertisements.

      1.9.4 The legal basis for processing your personal data as part of the service is your declaration of consent in accordance with point (a) of Article 6(1) of the GDPR. Processing your personal data allows us to promote sales by selling goods or services. In this context, we use cookies that display adverts relevant to you and reports to improve campaign performance. Use of the relevant cookies also prevents you from seeing the same adverts multiple times. Your personal data is deleted as soon as it is no longer required for the purpose for which it was processed or if you withdraw your consent.

      1.9.5 Further information on the tools referred to in this section can be found at , , and .

      1.9.6 You can prevent participation in the services from Xandr, Adform, Plista and Sizmek in a number of ways.

      1.9.7 You can find an overview of the advertising cookies used on our website for the tools described above in the cookie details of our cookie banner under “Change cookie settings“. You will find this in the footer of the homepage. You may withdraw your consent to the processing of your personal data at any time and with future effect by opening our cookie banner via the footer on our home page and adjusting your settings: - by making the appropriate settings in your browser; in particular, suppressing third-party cookies means that you will not receive advertisements from third parties - by disabling the cookies used for conversion tracking. This is done by setting your browser to refuse cookies from the domains www.appnexus.com, https://site.adform.com, www.plista.com and www.sizmek.com - by disabling interest-based advertising by providers that participate in the About Ads self-regulatory programme at . This setting will be undone once you delete your cookies - by permanently opting out at when using Firefox, Internet Explorer or Google Chrome. Please note that you may not be able to use all of the functions on this website if you do this

      1.10 Facebook Custom Audiences

      1.10.1 Our websites also use the Custom Audiences remarketing feature from Meta Platforms Inc., 1 Hacker Way, Menlo Park, CA 94025, USA (“Meta”). This allows users of our websites to receive interest-based advertising (known as Facebook ads) when visiting the social network Facebook or other websites that also use the feature. We use this tool to show you advertisements that might interest you and to personalise our websites to your interests.

      1.10.2 Due to the use of this marketing tool, your browser will automatically establish a direct connection to the Meta server. We have no control over the scope and further use of data collected by Meta through the use of these tools, so the information in this privacy policy reflects our current understanding of the matter. As Facebook Custom Audiences has been integrated into our web services, Meta will be notified when you visit the relevant part of our website or click on one of our advertisements. If you are registered with a Meta service, Meta will be able to attribute the visit to your individual account. Even if you are not registered with or logged into Facebook, it is possible for Meta to identify and save your IP address as well as other identifying features.

      1.10.3 The legal basis for processing your personal data for the ‘Custom Audiences’ remarketing function provided by Meta is your declaration of consent in accordance with point (a) of Article 6(1) of the GDPR. Processing your personal data using the ‘Custom Audiences’ remarketing function allows us to boost sales by selling goods or services. We use this tool to show you advertisements that might interest you and to personalise our websites to your interests. The tool allows you to receive interest-based advertising (known as Facebook ads) when visiting the social network Facebook or other websites that also use the feature.

      1.10.4 Your personal data is deleted as soon as it is no longer required for the purpose for which it was processed or if you withdraw your consent.

      1.10.5 You can find an overview of the cookies used on our website for the Facebook Custom Audiences tool in the cookie details of our cookie banner under “Change cookie settings“. You will find this in the footer of the homepage. You may withdraw your consent to the processing of your personal data for use for the Facebook Custom Audiences function at any time and with future effect by opening our cookie banner via the footer on our home page and adjusting your settings.

      1.10.6 The Facebook Custom Audiences feature can also be disabled by making the appropriate setting in your browser or – if you are logged into Facebook – at .

      1.10.7 Further information on data processing by Meta can be found at. .

      1.11 Meta Conversion API

      1.11.1 We use the tracking tool Conversion API (API = Application Programming Interface) of Meta Platforms Inc, 1 Hacker Way, Menlo Park, California 94025, USA (Meta). This is a data interface through which we establish a direct connection with Meta's server and transmit certain data about your behaviour on our website to Meta for evaluation.

      1.11.2 If you enter your e-mail address on our website (e.g. when registering for the newsletter or using a tool, hereinafter referred to as “event“), certain information (the website called up, the event-name, the event ID and Facebook Pixel ID, and your user agent and, if applicable, other specific data together with your e-mail address will be hashed, i.e. pseudonymised, and transmitted to Meta. Meta assigns the hash value back to you if you have a Meta account. We receive an anonymised report from Meta about the effectiveness of our advertising measures. Furthermore, we have no influence on the scope and further use of the data collected by Meta through the use of this tracking tool. We therefore cannot rule out the possibility that Meta may obtain and store your IP address and other identifying features, even if you are not logged in or registered with a Meta service.

      1.11.3 The legal basis for the processing of your personal data in the context of our use of the Conversion API is your consent in accordance with point a of Art. 6(1) of the GDPR. This processing of your personal data enables us to promote sales through the sale of goods or services.

      1.11.4 Insofar as personal data is collected on our website via the Conversion API and forwarded to Meta, we and Meta are jointly responsible for the data processing pursuant to Art. 26 of the GDPR. The obligations incumbent on us jointly can be found in the following agreement: . According to this agreement, we are responsible for the provision of the data protection information and the secure implementation of the Conversion API on our website and Meta is responsible for the data security of its products. You can assert data subject rights (e.g. deletion requests or access requests for information) directly with Meta. We will forward any data subject rights asserted against us to Meta.

      1.11.5 Meta is solely responsible for the data processing that takes place after the data collected via the Conversion API has been forwarded to Meta.

      1.11.6 Further information on data processing by Meta, the legal basis for data processing and the exercise of your data subject rights can be found at .

      1.12 Pinterest-Tag

      1.12.1 Our website also uses the conversion-tracking Pinterest tag from Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland. This allows users of our websites to receive interest-based advertising when visiting Pinterest or other websites that also use the feature. We use this tool to show you advertisements that might interest you and to personalise our website to your interests.

      1.12.2 Due to the use of this marketing tool, your browser will automatically establish a direct connection to the Pinterest server. We have no control over the scope and further use of data collected by Pinterest through the use of these tools, so the information in this privacy policy reflects our current understanding of the matter: As the Pinterest tag has been integrated into our web services, Pinterest will be notified when you visit the relevant part of our website or click on one of our advertisements. If you are registered with a Pinterest service, Pinterest may be able to attribute the visit to your individual account. Even if you are not registered with or logged into Pinterest, it is possible for Pinterest to identify and save your IP address as well as other identifying features.

      1.12.3 The legal basis for processing your personal data for conversion tracking using the ‘Pinterest tag’ is your declaration of consent in accordance with point (a) of Article 6(1) of the GDPR. Processing your personal data using the ‘Pinterest tag’ conversion tracking element allows us to boost sales by selling goods or services. We use conversion tracking to show you advertisements that might interest you and to personalise our websites to your interests. Conversion tracking allows you to receive interest-based advertising when visiting the social network Pinterest or other websites that also use the feature. Your personal data is deleted as soon as it is no longer required for the purpose for which it was processed or if you withdraw your consent.

      1.12.4 You can find an overview of the conversion tracking cookies used on our website using the Pinterest tag in the cookie details of our cookie banner under “Change cookie settings“. You will find this in the footer of the homepage. You may withdraw your consent to the processing of your personal data for conversion tracking purposes using the Pinterest tag function at any time and with future effect by opening our cookie banner via the footer on our home page and adjusting your settings.

      1.12.5 The Pinterest tag feature can be disabled by making the appropriate setting in your browser or – if you are logged into Pinterest – at .

      1.12.6 Further information on data processing by Pinterest can be found at .

      1.13 LinkedIn Insight-Tag

      1.13.1 Our websites also use LinkedIn Conversion Tracking and Insight Tag feature from LinkedIn Corporation, Sunnyvale, CA 94085, USA. This allows users of our websites to receive interest-based advertising when visiting linkedIn.com or other websites that also use the feature. We use this tool to show you advertisements that might interest you and to personalise our websites to your interests.

      1.13.2 Due to the use of this marketing tool, your browser will automatically establish a direct connection to the LinkedIn server. We have no control over the scope and further use of data collected by LinkedIn through the use of these tools, so the information in this privacy policy reflects our current understanding of the matter. As the LinkedIn Insight Tag has been integrated into our web services, LinkedIn will be notified when you visit the relevant part of our website or click on one of our advertisements. If you are registered with a LinkedIn service, LinkedIn will be able to attribute the visit to your individual account. Even if you are not registered with or logged into LinkedIn, it is possible for LinkedIn to identify and save your IP address as well as other identifying features.

      1.13.3 The legal basis for processing your personal data as part of the conversion tracking ‘Insight Tag’ is your declaration of consent in accordance with point (a) of Article 6(1) of the GDPR. Processing your personal data allows us to promote sales by selling goods or services. We use this tool to show you advertisements that might interest you and to personalise our websites to your interests. The tool allows you to receive interest-based advertising (known as LinkedIn ads) when visiting the social network LinkedIn or other websites that also use the feature.

      1.13.4 You can find an overview of the conversion tracking cookies used on our website using the Insight tag in the cookie details of our cookie banner under “Change cookie settings“. You will find this in the footer of the homepage. You may withdraw your consent to the processing of your personal data for conversion tracking purposes using the Insight tag function at any time and with future effect by opening our cookie banner via the footer on our home page and adjusting your settings.

      1.13.5 The LinkedIn Insight Tag feature can also be disabled by making the appropriate setting in your browser or – if you are logged into LinkedIn – at .

      1.13.6 Further information on data processing by LinkedIn can be found at and .

      1.14 Google Maps

      1.14.1 The legal basis for processing your personal data in relation to integrating Google Maps is your consent acc. to point (a) of Article 6(1) of the GDPR.

      1.14.2 The processing of your personal data for the integration Google Maps makes it easier for you to find our locations. Your personal data is deleted as soon as it is no longer necessary for the aforementioned purposes. In our case, this is as per 12 months.

      1.14.3 You can revoke your consent to the processing of your personal data for Google Maps at any time and with future effect by opening our cookie banner via the footer on our home page and adjusting your settings.. Additionally, you can apply the settings in your browser (for example by installing plug-ins or add-ons) to prevent your data from being transmitted to the Google servers. If your browser does not support Google Maps, there is no access to the Google server.

      For more information on terms of use and data protection, please visit:
      http://www.google.com/intl/en_GB/privacy/

      1.15 Geberit AquaClean Blog

      1.15.1 The legal basis for processing your personal data in relation to the commenting and blog function on the Geberit AquaClean blog is your consent in accordance with point (a) of Article 6(1) of the GDPR. We process your personal data as part of the commenting and blog function on the Geberit AquaClean blog to enable transparent and personalised communication between us and you. We also process your personal data to protect ourselves from liability claims by third parties if illegal comments are published. Your personal data is deleted as soon as it is no longer required for the purpose for which it was processed. In our case, this is as per 10 years.

      1.15.2 You can withdraw your consent to the processing of your personal data with regard to the commenting and blog function at any time with future effect. We will then delete the comment from our Geberit AquaClean blog or not publish it.

      1.16 LiveChat

      1.16.1 The legal basis for processing your personal data for provision of the “Geberit LiveChat” service is your declaration of consent in accordance with point (a) of Article 6(1) of the GDPR.

      1.16.2 The Geberit LiveChat function should offer you the opportunity to contact us quickly and easily using our electronic chat service. If you would like to make use of this service, the purpose of processing your data is for us to make this function available to you. Your personal data is deleted as soon as it is no longer required for the purpose for which it was processed. This usually occurs 3 years after processing your request.

      1.16.3 You can withdraw your consent for the purposes of using the Geberit LiveChat function at any time and with future effect. Doing so means you can no longer use the LiveChat function. All personal data that is saved when using the Chat function is deleted in this case

      1.17 ChatBot

      1.17.1 The legal basis for processing your personal data for provision of the ‘Chatbot’ service is your declaration of consent in accordance with point (a) of Article 6(1) of the GDPR.

      1.17.2 The Chatbot function offers you the opportunity to have your questions answered quickly and easily via an automatic chat machine. However, if you would still like to contact our customer service team, you can click on ‘Continue chatting’ to be transferred directly from the Chatbot to the LiveChat. Alternatively, you can choose to contact us by email or telephone. Your personal data is deleted as soon as it is no longer required for the purpose for which it was processed. This usually occurs 90 days after processing your request.

      1.17.3 You can withdraw your consent to data processing for the purposes of using the Chatbot function at any time and with future effect. Doing so means you can no longer use the Chatbot function. All personal data that is saved when using the Chat function is deleted in this case.

      1.18 Video centre

      1.18.1 The legal basis for processing your personal data in relation to integrating our videos is established in point (f) of Article 6(1) of the GDPR.

      1.18.2 We process your personal data for provision of the video centre in order to ensure that video content on our website is displayed in an appealing and uniform way, regardless of your end device.

      1.18.3 Your personal data is deleted as soon as it is no longer required for the purpose for which it was processed. This is, at the latest, after you leave our website.

      1.18.4 Processing your personal data is strictly necessary for integration of the video centre. It is therefore not possible for you to object to this.

      1.19 YouTube

      1.19.1 We use the video platform “YouTube“ of the company YouTube, LLC 901 Cherry Ave., 94066 San Bruno, CA, USA (»YouTube«), a company of Google Inc. to ensure an appealing, consistent presentation of video content on our website that is independent of your terminal device. We do this in the Enhanced Privacy Mode. Unless you agree to the cookie when visiting the website, no data is collected by YouTube when you visit the website. Only when you want to play the video and agree to the cookie, your data is transmitted to YouTube (such as IP address, referring page, device information (browser, device type), retrieved video). We ourselves record and store whether and which YouTube video you have played in order to be able to offer you a customized service.

      1.19.2 Your personal data is therefore deleted as soon as it is no longer required to achieve the purpose of its processing.

      1.19.3 The legal basis for the processing of your personal data is your consent according to point (a) of Article 6(1) GDPR. You have the right to withdraw your consent at any time. If you wish to do this, please contact us via the details specified above. The withdrawal of consent does not affect the lawfulness of any data processing that was carried out based on consent being obtained.

      1.19.4 We have no influence on the data processing by YouTube. Further information on data processing by You Tube can be found at https://policies.google.com/privacy?hl=en-GB.

      1.20 Vimeo

      1.20.1 We use the Vimeo video platform from Vimeo Inc., 555 West 18th Street, New York, NY 10011, USA (hereafter: ‘Vimeo’), to ensure that video content on our website is displayed in an appealing and uniform way, regardless of your end device. Unless you have already agreed to the cookie when visiting the website, no data is collected by Vimeo through your visit to the website. Your data (such as your IP address, device information – including browser and device type – and retrieved video) is only shared with Vimeo when you want to play the video and agree to the cookie. For our part, we record and store information on whether you have played a Vimeo video – and if so, which one – to offer you a more personalised service.

      1.20.2 We delete your personal data as soon as it is no longer required for the purpose for which it was processed.

      1.20.3 The legal basis for processing your personal data is established by your consent in accordance with point (a) of Article 6(1) of the GDPR. You have the right to withdraw your consent at any time. Please contact us via the details provided above if you would like to do so. The withdrawal of consent does not affect the lawfulness of any data processing that was carried out based on consent being obtained.

      1.20.4 We have no influence on how data is processed by Vimeo. Further information on data processing by Vimeo can be found at https://vimeo.com/privacy. https://vimeo.com/privacy

      1.21 Moving Image

      1.21.1 We use the “Moving Image“ service of the company movingimage EVP GmbH, Tempelhofer Ufer 1, 10961 Berlin, Germany, to optimise the integration of videos, livestreams and events provided on our website. Moving Image enables us to generate statistics about the videos we make available on the website by setting cookies and a local storage. The following personal data is processed for this purpose: IP address, date and time of your visit, time zone, operating system, browser used, ge-rat information, website URL, referrer URL.

      1.21.2 The legal basis for the processing of your personal data is your consent in accordance with point (a) of Article 6(1) of the GDPR. You can withdraw your declaration of consent to the processing of your personal data at any time in the future by calling up our cookie banner again via the footer of our homepage and adjusting your settings accordingly.

      You can find more information on data protection at: https://www.movingimage.com/de/agb/datenschutzerklarung-der-movingimage-evp-gmbh/

      1.22 Technically necessary cookies

      1.22.1 Our websites use technically necessary cookies besides the ones outlined in the sections above. Cookies are small text files that are saved on a local cache in your browser. The cookies specified below are used by us exclusively to ensure that we are able to implement or provide the service that you are using. This is based on point (f) of Article 6(1) of the GDPR. Some of our website functions cannot be provided without the use of cookies. For these functions, your browser needs to be identified again even after changing pages. Your personal data is not processed further. The legitimate interest that we pursue when processing data is to optimise the website settings for the device you are using and to adapt the user interface accordingly. If you require further information about the balancing of interests that must be carried out in accordance with point (f) of Article 6(1) of the GDPR, please contact us using the details provided above. We use transient and persistent cookies, the scope and functionality of which are detailed below.

      1.22.2 Transient cookies are automatically deleted once you close your browser. These include session cookies in particular. These save a session ID that makes it possible to attribute various request from your browser to a common session, allowing your computer to be recognised when you return to our website. Session cookies are deleted when you log out or close your browser.

      1.22.3 Persistent cookies are automatically deleted after a specified amount of time, which can vary depending on the cookie. You can delete the cookies at any time in your browser’s security settings.

      1.22.4 You can find an overview of the technically necessary cookies used on our website in the cookie details of our cookie banner under “Change cookie settings“. You will find this in the footer of the homepage. If permitted, cookies are saved on your computer and transferred from there to our website. This allows you full control over the use of cookies. You can change settings in your browser to deactivate or limit the transfer of cookies. You can delete saved cookies at any time. This process can also be automated. If cookies are disabled on our website, it may cause certain functions to cease, or may stop you from fully utilising all functions on our website

      2. Collection and processing of voluntarily provided data

      We collect and process personal data that has been shared with us voluntarily during the course of interacting with customers, suppliers and other business partners (for example, via email, telephone or our websites). The following overview provides you with information on the legal basis and purposes of the individual data processing activities.

      2.1 Online catalogue or online shop:

      The legal basis for processing your personal data for the online catalogue or online shop is established in point (b) of Article 6(1) of the GDPR. The purpose of processing your personal data is to fulfil a contract between you and us. Your personal data is deleted as soon as it is no longer required for the purpose for which it was processed. In the case of data processing for the online catalogue or online shop, this is when the contract has been fulfilled and all claims from the contract relationship lapse or legal retention periods have expired. The purpose of processing your personal data within the online catalogue or online shop is to fulfil a contract between you and us and is strictly necessary. It is therefore not possible for you to object to this.

      2.2 Account registration / Creating a new Geberit ID

      The legal basis for processing your personal data for customer account registration is established in point (b) of Article 6(1) of the GDPR. Registering or creating a Geberit ID allows, in particular, the conclusion of contracts as well as a customer service relationship. While creating your Geberit ID, we validate your telephone number by sending a confirmation SMS. Processing your personal data as part of the registration process is therefore necessary to fulfil a contract, carry out pre-contractual measures and maintain our customer relationship. Your personal data is deleted as soon as it is no longer required for the purpose for which it was processed. This is, at the latest, when your customer account is terminated. You may terminate the registration of your customer account at any time. If you do so, your personal data is deleted, provided that no legally binding retention periods apply.

      2.3 Contact form and email contact

      The legal basis for processing your personal data that is transferred during customer contact interactions is established in point (a) of Article 6(1) of the GDPR. If the aim of the contact is to conclude a contract, then point (b) of Article 6(1) of the GDPR is an additional legal basis for processing your personal data. For customer communications, we only process your personal data to handle your issues. Your personal data is deleted as soon as it is no longer required for the purpose for which it was processed. For personal data that is sent during customer communications, this is when your issues are fully processed and there is no legal retention period in effect. You can withdraw your consent to the processing of your personal data with regard to customer communications at any time with future effect. However, if you do so, we cannot continue to process your issues. All personal data that was saved during the interaction is deleted unless there is a legal retention period that prevents deletion.

      2.4 Contact person for contract negotiations

      The legal basis for the processing of your personal data as a contact person in the context of (pre-contractual) contract negotiations and the fulfilment of agreements is point b of Art. 6(1) of the GDPR. The purpose of processing your personal data is the fulfilment of a contract between you or the company in which you are employed and us. Your personal data will be deleted as soon as they are no longer required to achieve the purpose of their processing. This is the case when the contract has been fulfilled and all claims arising from the contractual relationship have lapsed or there are no longer any statutory retention periods. The processing of your personal data is absolutely necessary for the fulfilment of a contract. Consequently, you have no right of objection.

      2.5 Technik-Telefon

      The legal basis for processing your personal data that is transferred during customer interactions via the Technik-Telefon is established in point (a) of Article 6(1) of the GDPR. If the aim of the contact is to conclude a contract or continue with the fulfilment of a contract, then point (b) of Article 6(1) of the GDPR is an additional legal basis for processing your personal data. For customer interactions via the Technik-Telefon, we only process your personal data to handle your issues. Your personal data is deleted as soon as it is no longer required for the purpose for which it was processed. For personal data that is sent during customer communications, this is when your issues are fully processed and there is no legal retention period in effect. You can withdraw your consent to the processing of your personal data with regard to customer communications at any time with future effect. However, if you do so, we cannot continue to process your issues. All personal data that was saved during the interaction is deleted unless there is a legal retention period that prevents deletion.

      For customer interactions via telephone, some telephone conversations may be recorded in individual circumstances. You will be informed of this before the start of the conversation. As a general rule, the legal basis for processing your data in these cases is point (a) of Article 6(1) of the GDPR. If the legal system of a European member state provides for express consent, the legal basis is point (f) of Article 6(1) of the GDPR.

      2.6 Geberit customer bathroom consultation

      The legal basis for processing the personal data that you transfer as part of the bathroom consultation service is your declaration of consent in accordance with point (a) of Article 6(1) of the GDPR. If the aim of the contact as part of the consultation is to initiate, conclude or continue with the fulfilment of a contract, then point (b) of Article 6(1) of the GDPR is an additional legal basis for processing your personal data. If you use the optional, automatic appointment system and receive appointment information by e-mail, the legal basis is your consent in accordance with point (a) of Article 6(1) of the GDPR. Your data is processed for the purpose of handling your issues as well as providing a timely and competent consultation regarding our products. Your personal data is deleted as soon as it is no longer required for the purpose for which it was processed. For personal data that is sent as part of your request, this is when your issues are fully processed and there is no legal retention period in effect. You can can withdraw your consent to the processing of your personal data with regard to the requested consultation service at any time with future effect. However, if you do so, we cannot continue to process your issues. All personal data that was saved during the interaction is deleted unless there is a legal retention period that prevents deletion.

      2.7 Service & customer service

      The legal basis for processing your personal data that is transferred during the requested service and customer service interaction is generally established in point (b) of Article 6(1) of the GDPR. If you transfer additional information to us as part of your issue, your consent in accordance with point (a) of Article 6(1) of the GDPR is an additional legal basis for processing your personal data. Your personal data is processed for purposes of handling your service or customer service request and therefore serves to settle potential service and customer service requests. It is therefore necessary to process your personal data within the scope of handling your issues to ensure we provide the best possible service. Your personal data is deleted as soon as it is no longer required for the purpose for which it was processed. For personal data that is sent as part of your request, this is when your issues are fully processed and there is no legal retention period in effect. You can withdraw your consent to the processing of your personal data with regard to settling your service or customer service request at any time with future effect. However, if you do so, we cannot continue to process your issues. All personal data that was saved during your service or customer service request is deleted unless there is a legal retention period that prevents deletion.

      For customer interactions via telephone, some telephone conversations may be recorded in individual circumstances. You will be informed of this before the start of the conversation. As a general rule, the legal basis for processing your data in these cases is point (a) of Article 6(1) of the GDPR. If the legal system of a European member state provides for express consent, the legal basis is point (f) of Article 6(1) of the GDPR.

      2.8 Download centre

      The legal basis for processing your personal data within the Download Centre is established in point (a) of Article 6(1) of the GDPR. If the aim of the contact within the scope of the Download Centre is to conclude a contract, then point (b) of Article 6(1) of the GDPR forms an additional legal basis for processing your personal data. Your data is processed for the purposes of providing and sending documentation you have requested via our website. Processing your personal data in the Download Centre is therefore necessary to process your request or to supply documents you have requested. Your personal data is deleted as soon as it is no longer required for the purpose for which it was processed. For personal data that is sent as part of the order request, this is when your order is fully processed and there is no legal retention period in effect. You can withdraw your consent to the processing of your personal data with regard to the order process at any time with future effect. However, if you do so, we cannot continue to process your issues. All personal data that was saved during the order process is deleted unless there is a legal retention period that prevents deletion.

      2.9 Streaming services

      You can register for and take part in our digital events (known as streaming services) via our home page. The legal basis for processing your personal data for streaming services, for example in the context of the ‘Geberit NeuheitenTreff’ innovation meeting, is established in point (a) of Article 6(1) of the GDPR. The registration process relating to this and the processing of your personal data is necessary to enable you to use the digital streaming services. Your personal data is processed for the purposes of providing and carrying out the streaming services you have requested. Your personal data is deleted as soon as it is no longer required for the purpose for which it was processed. For personal data that is processed as part of the streaming service, this is when the digital event ends and there are no legal retention periods preventing deletion. You can withdraw your consent to the processing of your personal data with regard to our streaming service at any time with future effect. However, if you do so, you can no longer take part in the digital event All personal data that was saved during your registration for or participation in our digital streaming services is deleted unless there is a legal retention period that prevents deletion.

      2.10 Geberit Fire Test Laboratory

      The legal basis for processing your personal data for registration, logging into and participating in the ‘Geberit Fire Test Laboratory’ event is established in point (a) of Article 6(1) of the GDPR. The registration process relating to this and the processing of your personal data is necessary to enable you to take part in the Geberit Fire Test Laboratory. Your personal data is processed for the purposes of registering for and participating in the Geberit Fire Test Laboratory service. Your personal data is deleted as soon as it is no longer required for the purpose for which it was processed. For personal data that is required for registration for and signing in to the Geberit Fire Test Laboratory, this is when the event is finished and there is no legal retention period in effect. You can withdraw your consent to the processing of your personal data with regard to participating in the Geberit Fire Test Laboratory at any time with future effect. However, if you do so, you can no longer take part in the Geberit Fire Test Laboratory event All personal data that was saved during your registration for or participation in the ‘Geberit Fire Test Laboratory’ event is deleted unless there is a legal retention period that prevents deletion.

      2.11 Geberit Pro planner and Revit® plug-in

      The legal basis for processing your personal data for installation and use of the sanitary planning tool is established in point (a) of Article 6(1) of the GDPR. This processing is necessary to enable you to use the sanitary planning tool. Your personal data is deleted as soon as it is no longer required for the purpose for which it was processed. For personal data that is required for installation and use of the sanitary planning tool, this is when the tool is deleted and there is no legal retention period in effect. You can withdraw your consent to the processing of your personal data with regard to the use of the sanitary planning tool at any time with future effect. If you do so, you can no longer use the sanitary planning tool. All personal data that was saved during the installation and use of the tool is deleted unless there is a legal retention period that prevents deletion.

      2.12 Geberit press mailing list

      The legal basis for processing your personal data when subscribing to our press mailing list is your declaration of consent in accordance with point (a) of Article 6(1) of the GDPR. The purpose of processing your personal data is to send you mailshots as part of the press mailing list. The purpose of processing your personal data for sending mailshots as part of the press mailing list is to send you information and offers and, where applicable, to promote sales through the sale of goods or services. Your personal data is deleted as soon as it is no longer required for the purpose for which it was processed. Your data is therefore saved until you unsubscribe from our press mailing list. You can withdraw your consent to receive mailshots as part of the press mailing list at any time or click on the unsubscribe link within the mailshot to unsubscribe from further mailshots.

      2.13 Geberit media releases

      The legal basis for the processing of your personal data in the context of registering for our media releases is your declared consent in accordance with point (a) of Article 6(1) of the GDPR. The purpose of processing your personal data in the context of Geberit media releases is to send corporate communications relating to the Geberit Group. Your personal data will be deleted as soon as it is no longer required to achieve the purpose for which it was processed. Your personal data will therefore be stored until you have unsubscribed from our media releases. You can withdraw your consent to receive media releases at any time or use the unsubscribe link contained within the media releases.

      2.14 Geberit Newsletter or Useletter

      The legal basis for processing your personal data to send you the Geberit Newsletter (for end customers) or geberit Useletter (for business customers) is your declaration of consent in accordance with point (a) of Article 6(1) of the GDPR. Your personal data is processed so that we can send the Geberit Newsletter or Useletter to you. The purpose of processing your personal data for sending the Geberit Newsletter or Useletter is to send information and offers and, where applicable, to promote sales through the sale of goods or services. Your personal data is deleted as soon as it is no longer required for the purpose for which it was processed. Your data is therefore saved until you unsubscribe from our Geberit Newsletter or Useletter. You can withdraw your consent to receive the Geberit Newsletter or Useletter at any time or click on the unsubscribe link within the Newsletter or Useletter to unsubscribe from further newsletters.

      2.15 Direct marketing

      The legal basis for processing your personal data for direct marketing measures is either your declaration of consent in accordance with point (a) of Article 6(1) of the GDPR or our legitimate interests according to point (f) Article 6(1) of the GDPR or the respective regulation of Unfair Competition Law. The purpose of processing your personal data for direct marketing measures is to send information and offers and, where applicable, to promote sales through the sale of goods or services. Your personal data is deleted as soon as it is no longer required for the purpose for which it was processed and especially if we receive a withdrawal of consent or objection to its processing. You can withdraw your consent with future effect at any time and/or may object to the processing of your data for direct marketing measuring at any time, also with future effect.

      2.16 Competitions

      The legal basis for processing your personal data for competitions is established in point (b) of Article 6(1) of the GDPR. The purpose of processing your personal data for competitions is to fulfil a contract for participation in the competition between you and us. Your personal data is deleted as soon as it is no longer required for the purpose for which it was processed. For personal data processing within the scope of competitions, this is when the competition is completely finished. You can refuse to the processing of your personal data with regard to competition participation at any time with future effect. Doing so means you can no longer take part in the competition. All personal data that is saved during the competition is deleted in this case.

      2.17 Cashback offers and warranty extension

      The legal basis for processing your personal data for cashback offers and warranty extensions is established in point (b) of Article 6(1) of the GDPR. The purpose of processing your personal data for cashback offers or warranty extensions is to fulfil a contract between you and us. Your personal data is deleted as soon as it is no longer required for the purpose for which it was processed. In the case of data processing for cashback offers and warranty extensions, this is when the cashback offer is fully completed or the warranty period has expired. You can refuse to the processing of your personal data with regard to cashback offers or warranty extensions at any time with future effect. If you do so, you can no longer participate in the cashback offer or benefit from warranty extensions. All personal data that is saved in relation to cashback offers and warranty extensions is deleted in this case.

      2.18 Events

      The legal basis for processing your personal data for holding virtual or on site events (“event”) is established in point (b) of Article 6(1) of the GDPR. The purpose of processing your personal data for events is to fulfil a contract for holding the event between you and us. Your personal data is deleted as soon as it is no longer required for the purpose for which it was processed. You can refuse to the processing of your personal data with regard to the event at any time with future effect. Doing so means you can no longer take part in the event. All personal data that is saved for the event is deleted.

      Some events allow you to take and send photos of yourself. In this case, personal data is processed by Geberit and, if applicable, service providers. Your personal data is processed on the basis of your consent in accordance with point (a) of Art. 6(1) of the GDPR. You can withdraw your consent at any time for the future. The photos will be deleted immediately upon receipt of withdrawal, otherwise after 3 months. You can share the photos through different channels. You are responsible for complying with the data protection requirements of third parties.

      2.19 Data collection related to Covid-19 for in-person events/training

      The legal basis for processing your personal data for in-person events/training is established in point (c) of Article 6(1) of the GDPR in connection with the current regulations of the Infection Prevention Act and the infection prevention measures that can be derived from this, as well as other Covid regulations. The purpose of processing your personal data for in-person events and training is to comply with the legal regulations for infection prevention. Your personal data is deleted as soon as it is no longer required for the purpose for which it was processed.

      Your personal data is processed when holding in-person events or training to comply with legal obligations. It is therefore not possible for you to object to this besides not participating in the in-person event or training.

      2.20 GEBERIT-HOLTZMANN GIS/DUOFIX

      The legal basis for the processing of your personal data when using the GEBERIT-HOLTZMANN GIS/DUOFIX calculator is your consent in accordance with point a of Art. 6(1) of the GDPR. The purpose of processing your personal data is to forward your request for a quotation with the details required for the construction project to the HOLTZMANN company and to confirm the forwarding to you. Your personal data will be deleted as soon as it is no longer required to fulfil the purpose for which it was processed. Independently of this, we store any uploaded images and the project name you enter. These must not contain any personal information. You can withdraw your consent to the processing of your personal data at any time. In this case, however, you will not be able to send a request for quotation via the GEBERIT-HOLTZMANN GIS/DUOFIX calculator.

      2.21 Geberit Campus

      The legal basis for the processing of your personal data for course participation and in the Geberit Campus dashboard is point b of Art. 6(1) of the GDPR. The purpose is the fulfilment of the contract on the course participation between you and us. In addition, we store your course participation in the customer history of our customer management system on the basis of our legitimate interest in accordance with point (b) of Art. 6(1) of the GDPR. Your personal data will be deleted as soon as it is no longer required to achieve the purpose for which it was processed. This is the case if the course participation has been successfully completed or cancelled and the data is no longer relevant to your customer history. You have the option at any time to object to the processing of your personal data in the context of course participation for the future. In this case, you will no longer be able to participate in the course, and all personal data will be deleted, provided that no legal retention periods prevent deletion. In this case, the data will be deleted after the legal retention obligations have ceased to apply.

      2.22 Feedback forms

      The legal basis for the processing of your personal data in the context of the use of feedback forms is your consent in accordance with point a of Art. 6(1) of the GDPR. The purpose of processing is to evaluate your feedback in order to improve our offer and our online presence. Your personal data will be deleted as soon as it is no longer required to achieve the purpose for which it was processed, i.e. your feedback has been fully evaluated. You can withdraw your consent to the processing of your personal data at any time. In this case, however, your feedback cannot be processed any further.

      3. Further data processing besides our website

      In addition to our website, further data processing by third-party providers takes place in individual cases and depending on your settings, about which you can find out here.

      3.1 Facebook Insights (Facebook-Fanpage)

      We operate our Facebook fan page together with Meta Platforms Inc. 1 Hacker Way, Menlo Park, California 94025, USA (hereafter ‘Meta’). For this purpose, we have concluded an agreement with Meta regarding which party has which obligations concerning the GDPR. You can view the essential content of this agreement at https://www.facebook.com/legal/terms/page_controller_addendum. Information about how Meta processes your personal data can be found at https://www.facebook.com/legal/terms/information_about_page_insights_data. The legal basis for processing your personal data is established in point (f) of Article 6(1) of the GDPR. By processing your personal data using Facebook Insights, we can analyse your user behaviour. We evaluate the captured data and use it to collate information about our Facebook fan page activity. This helps us to design our Facebook fan page in a more user-friendly way that meets the needs of our target audience. The personal data that is collected from our Facebook fan page is provided to us by Meta. Your personal data is deleted as soon as it is no longer necessary for the aforementioned purposes. If you do not want your data to be collected by Facebook Insights, you can object to the processing of your personal data by Facebook Insights at any time and with future effect. If you do so, we refer your objection to Meta.

      3.2 Instagram

      Instagram is a product belonging to Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2 Ireland (hereafter ‘Meta’). We run our Instagram page together with Meta. For this purpose, we have concluded an agreement with Meta regarding which party has which obligations concerning the GDPR. You can find the detailed information on the processing of your personal data by the Instagram service at: https://help.instagram.com/519522125107875. Information about how Meta processes your personal data can be found at https://help.instagram.com/519522125107875. The legal basis for processing your personal data is established in point (f) of Article 6(1) of the GDPR. The processing of your personal data by Meta via the Instagram service helps us analyse your user behaviour. We evaluate the captured data and use it to collate information about activity on our Instagram page. This helps us to design our Instagram page in a more user-friendly way that appeals to our target audience. The personal data that is collected from our Instagram page is provided to us by Meta. Your personal data is deleted as soon as it is no longer necessary for the aforementioned purposes. If you do not want your data to be collected by Meta, you can object to the processing of your personal data by Instagram/Meta at any time and with future effect. If you do so, we refer your objection to Meta.

      3.3 YouTube channel

      To ensure we design our social media offering to meet customers’ needs, we use a YouTube channel which is operated by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (hereafter ‘Google’). YouTube is a video platform that enables users to upload and publish their videos for public viewing. You can find more information on how Google processes your personal data athttps://policies.google.com/privacy?hl=en&gl=en#infocollect. If you wish to use our YouTube channel, we remind you that you use this service at your own risk. This applies especially to the features offered within the YouTube platform, such as the comment, like and share features under each video. We have no influence over the type and scope of the data processed by Google in relation to the YouTube channel. By using the YouTube channel, your personal data is processed by Google and, in doing so, will be transferred to the United States, Ireland and any other country in which Google does business, regardless of your place of residence, and may be further processed there. The legal basis for processing your personal data is established in point (f) of Article 6(1) of the GDPR. Your personal data is processed for the purposes of designing an appealing and user-friendly YouTube channel that meets the needs of our viewers. In this context, we only process your personal data within the YouTube channel insofar as it is necessary for providing information on our offers and services. We also process personal data in relation to this YouTube channel for the purposes of communicating with users and potential interested parties. The personal data that is collected from our YouTube channel is provided to us by Google. Your personal data is deleted as soon as it is no longer necessary for the aforementioned purposes. If you do not want your data to be collected by Google, you can object to the processing of your personal data in relation to this YouTube channel at any time. If you do so, we refer your objection to Google.

      3.4 X

      X is a product of Twitter International Unlimited Company, One Cumberland Place, Fe-nian Street, Dublin 2, D02 AX07, Ireland (hereinafter “Twitter Inc“). We operate our X site together with Twitter Inc. For this purpose, we have concluded an agreement with Twitter Inc. on which of us fulfils which obligation in accordance with the GDPR. You can view the main content of the processing of your personal data by Twitter Inc. at https://twitter.com/en/privacy. The legal basis for the processing of your personal data is point (f) of Article 6(1) of the GDPR. The processing of your personal data by Twitter Inc. enables us to analyse your usage behaviour. By evaluating the data obtained, we are able to compile information about the attractiveness of our X page. This helps us to make our X page more user-friendly and tailored to your needs. Your personal data collected in the course of operating our X page is made available to us by Twitter Inc. Your personal data will be deleted as soon as it is no longer required for our aforementioned purposes. If you do not wish your data to be collected by Twitter Inc., you have the option at any time to object to the processing of your personal data within the framework of use by Twitter Inc. for the future. In this case, we will forward your request for objection to Twitter Inc.

      3.5 Google Customer Match

      3.5.1 We use the retargeting product “Customer Match“ from Google Ireland Limited, Google Building Gordon House, 4 Barrow St., Dublin, D04 E5W5, Ireland (“Google“) to serve targeted advertising when using Google products on the Internet.

      3.5.2 In doing so, we transmit the first and last name, e-mail addresses as well as the country and zip code of our customers who have actively consented to advertising measures to Google. With the exception of the country and the postal code, the transmission is hashed, i.e. pseudonymised. Google assigns the hash value to known Google accounts whose data has been hashed using the same hashing way by Google. With the help of this information, Google determines a target group of interest to us, including our customers and other people, to whom we can address personalized advertising. Google also conducts compliance checks to ensure that the guidelines for this product have been adhered to. Once this has been done and the creation of the target group has been completed, the data will be deleted by Google.

      3.5.3 Otherwise, we have no influence on the scope and further use of the data collected by Google through Customer Match. We therefore cannot rule out the possibility that Google knows and stores other identifiers.

      3.5.4. The legal basis for the processing of your personal data in the context of our use of Customer Match is your consent in accordance with point (a) of Art. 6(1) of the GDPR. This processing of your personal data allows us to promote sales through the sale of goods or services. You can withdraw your consent at any time with effect for the future.

      3.5.5 Google is responsible for the data processing that takes place after the data collected via Customer Match has been forwarded to Google.

      3.5.6 Further information on data processing by Google, the legal basis for data processing and the exercise of your rights as a data subject by Google can be found under https://policies.google.com/privacy and https://support.google.com/displayvideo/answer/7370835.

      4. Further data processing, data transfer to third countries, data erasure

      In individual cases, we need your data for specific, non-standard data processing, which you can find out about here.

      4.1 Data subject information in accordance with Article 12 ff. of the GDPR

      The legal basis for processing your personal data as part of processing your data protection enquiries (data-subject information) is established in point (c) of Article 6(1) of the GDPR in connection with Article 12 ff. of the GDPR. The legal basis for the subsequent documentation of the legally compliant processing of the data-subject information is established in point (f) of Article 6(1) of the GDPR. The purpose of processing your personal data for processing the data-subject information is to answer your data protection enquiry. The legally compliant processing of the relevant data-subject information is subsequently documented to fulfil legal obligations regarding accountability according to Article 5(2) of the GDPR. Your personal data is deleted as soon as it is no longer required for the purpose for which it was processed. In the case of processing data-subject information, this is three years after the end of the process. You can object to the processing of your personal data with regard to processing data-subject information at any time with future effect. However, if you do so, we cannot continue to process your data-protection enquiry. It is strictly necessary to document the legally compliant processing of the affected data-subject information. It is therefore not possible for you to object to this.

      4.2 Legal defence and enforcement

      The legal basis for processing your personal data for legal defence and enforcement is established in point (f) of Article 6(1) of the GDPR. The purpose of processing your personal data for legal defence and enforcement is to prevent unjustified claims and the legal enforcement and assertion of claims and rights. Your personal data is deleted as soon as it is no longer required for the purpose for which it was processed. It is strictly necessary to process your personal data for legal defence and enforcement. It is therefore not possible for you to object to this.

      4.3 Sharing your data with third parties

      Personal data is provided within our company to the appropriate positions and departments which require it for fulfilling the previously mentioned purposes. We also sometimes use various service providers and transfer your personal data to other trustworthy recipients. These may include:

      • other Geberit companies for the purpose of centralised customer administration and order processing

      • other Geberit companies for the purpose of providing centralised IT and other services

      • logistics providers

      • External speakers and organizers of training courses

      • banks and other payment service providers for the purpose of processing any payments

      • service providers for the purpose of organising, carrying out and handling of possible installation work and after-sales services

      • scanning services

      • printers

      • IT service providers

      • lawyers and court

      4.4 Transfer to third countries

      4.4.1 In the course of processing your personal data, we may transfer your personal data to trusted service providers in third countries. Third countries are countries that are outside the European Union (EU) or the European Economic Area (EEA). We only work with service providers who can provide us with suitable guarantees for the security of your personal data and who can guarantee that your personal data will be processed in accordance with strict European data protection standards. A copy of these suitable guarantees can be inspected at our premises.

      4.4.2 If we transfer personal data to third countries, this will be done on the basis of a so-called adequacy decision of the European Commission, or, in the absence of such a decision, on the basis of so-called standard contractual clauses, which have also been issued by the European Commission, and if required further measures.

      4.4.3 Before using certain tools, you may also be asked to consent to a data transfer on a case-by-case basis in accordance with Art. 49 of the GDPR if the service provider responsible for the tool is based in a third country and the above guarantees are not applicable. By using the tool, a data transfer of at least your IP address to this third country takes place or access to your personal data is possible from this third country. Please note that such third countries may not have a level of data protection that is adequate for the GDPR and that legally compliant access to data and the assertion of your data subject rights cannot be guaranteed there. Before using the respective tool, we will inform you separately which third country is involved and that your consent is required in accordance with Article 49 of the GDPR.

      4.5 Erasure of your data

      Generally speaking, we erase or anonymise your personal data as soon as it is no longer needed for the purposes for which we collected or used it in accordance with the sections above. If data needs to be retained for legal reasons, it will be blocked. This means that it will no longer be available for further processing. If you require further information regarding our erasure and retention periods, please contact the controller specified in Section 2 using the relevant contact data.

      4.6 Changes of purpose

      Your personal data will only be processed for purposes other than those described if a legal provision requires this course of action or if you have given your consent to the changed purpose of the data processing. In cases of further processing for purposes other than those for which we originally collected the data, we will notify you of these other purposes prior to the data being processed further, and will provide you with all other information that relates to this.

      4.7 Automated individual decision-making or profiling

      We do not use any automated processing systems for coming to specific decisions – including profiling.

      5. Your rights

      As regards your personal data processed by us, you are entitled to the rights outlined below. In order to exercise any of these rights, please send us a written request using the contact details specified above or send an email to the following address: dataprotection@geberit.com.

      5.1 Right to access

      You have the right to request that we provide access to the personal data concerning you that we have processed. You may exercise this right within the scope outlined in Article 15 of the GDPR.

      5.2 Right to rectification

      In accordance with Article 16 of the GDPR, you have the right to obtain from us without undue delay the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

      5.3 Right to erasure

      Subject to the prerequisites specified in Article 17 of the GDPR, you have the right to request from us the erasure of personal data concerning you. The prerequisites provide for a right to erasure in particular where the personal data is no longer necessary for the purposes for which it was collected or otherwise processed. The ability to exercise this right is restricted in accordance with Article 17(3) of the GDPR, particularly in cases where we require your data in order to meet a legal obligation or to process legal claims.

      5.4 Right to restriction of processing

      You have the right to request from us restriction of processing under the terms specified in Article 18 of the GDPR. This right exists in particular (a) where the accuracy of personal data is contested by you, for a period enabling us to verify the accuracy of the personal data, (b) where you oppose the erasure of the personal data (in cases where the right to erasure applies) and request the restriction of its use instead, (c) where we no longer need the personal data for the purposes for which it was being processing, but it is required by you for the establishment, exercise or defence of legal claims, and (d) where the successful exercise of an objection is still contested between you and us. If the processing of your data has been restricted on any of these bases, such data may only be processed in exceptional cases; for example, where you have given your consent to this or where such processing is necessary for the enforcement of legal claims.

      5.5 Right to object to processing

      In accordance with Article 21 of the GDPR, you have the right to object, on grounds relating to your particular situation and at any time, to the processing of personal data concerning you on the basis of point (e) or (f) of Article 6(1) of the GDPR. We will no longer process your personal data unless we can demonstrate compelling legitimate grounds for processing that override your interests, rights and freedoms, or unless the circumstances involve the establishment, exercise or defence of legal claims.

      5.6 Right to data portability

      You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format under the terms specified in Article 20 of the GDPR. This requires that the data processing has been based on you having given your consent and has been carried out by automated means.

      5.7 Right to lodge a complaint with the relevant data protection supervisory authority

      You have the right to lodge a complaint with a supervisory authority – in particular, within the EU member state of your habitual residence, your place of work or the location of the alleged infringement – if you believe that the processing of personal data relating to you infringes the applicable data protection legislation.

      Version: September 2024