Data protection
The following data protection statement applies to the use of the www.mollimmobilien-holding.de website (hereinafter "website"). We place great importance on data protection. The collection and processing of your personal data takes place in compliance with the applicable data protection regulations, in particular the EU General Data Protection Regulation (GDPR). We collect and process your personal data to enable you to use our website. This statement describes how and for what purpose your data is collected and used and what options you have in relation to personal information. By using this website, you consent to the collection, use and transfer of your information in accordance with this data protection statement.

1 Responsible party
The following is the party responsible for the collection, processing and use of your personal data within the framework of the GDPR:

Leonhard Moll AG
Lindwurmstr. 129a
80337 Munich
Tel. +49 89 741148 21
Email: info@leonhard-moll.de

If you wish to object in whole or in part to the collection, processing or use of your data in accordance with this data protection statement, you can address your objection to the above-mentioned responsible party.
You can save and print this data protection statement at any time.

2 General use of this website
2.1 Access data
No access data is stored.

2.2 Cookies
Cookies are not used on our website.

2.3 Legal basis and duration of storage
The legal basis of the data processing according to the preceding paragraphs is Article 6 (1) (f) of the GDPR. Our interests in data processing include, in particular, ensuring the operation and security of the website, researching the way the website is used by visitors, and simplifying the use of the website. Unless specifically stated, we store personal data only as long as necessary to fulfill the pursued purposes.

3 Your rights as the data subject
Under applicable law, you have various rights to your personal information. If you would like to assert these rights, please send your request by e-mail or by post with a clear identification of your person to the address stated in section 1.
An overview of your rights is provided in the following.

3.1 Right to confirmation and information
You have the right at any time to obtain confirmation from us as to whether personal data relating to you are being processed. If this is the case, you have the right to obtain free information from us about the personal data stored along with a copy of this data. Furthermore, you have a right to the following information:
1. The purposes of the processing
2. The categories of personal data concerned
3. The recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations
4. Where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period
5. The existence of the right to request from us rectification or erasure of personal data or restriction of processing of personal data or to object to such processing
6. The right to lodge a complaint with a supervisory authority
7. Where the personal data are not collected from you, any available information as to their source
8. The existence of automated decision-making, including profiling, referred to in Article 22 (1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for you
Where personal data are transferred to a third country or to an international organization, you have the right to be informed of the appropriate safeguards pursuant to Article 46 of the GDPR relating to the transfer.

3.2 Right to rectification
You have the right to obtain from us, without undue delay, the rectification of inaccurate personal data. Taking into account the purposes of the processing, you are entitled to have incomplete personal data completed, including by means of providing a supplementary statement.

3.3 Right to erasure ('right to be forgotten')
You have the right to demand the erasure of your personal data without undue delay and we have the obligation to erase your data without undue delay when one of the following grounds applies:
1. The personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed
2. You withdraw your consent on which the processing is based according to point (a) of Article 6 (1), or point (a) of Article 9 (2), and where there is no other legal ground for the processing
3. You object to the processing of your data pursuant to Article 21 (1) and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Article 21 (2)
4. Your personal data have been unlawfully processed
5. Your personal data have to be erased for compliance with a legal obligation in Union or Member State law to which we are subject
6. Your personal data have been collected in relation to the offer of information society services referred to in Article 8 (1) of the GDPR
If we have made the personal data public and are obliged to erase the data, taking account of available technology and the cost of implementation, we will take reasonable steps, including technical measures, to inform data controllers that are processing your personal data that you have requested the erasure of any links to your personal data as well any copies or replications of your personal data.

3.4 Right to restriction of processing
You have the right to obtain restriction of processing by us when one of the following applies:
1. You contest the accuracy of your personal data for a period of time that enables us to verify the accuracy of your personal data
2. The processing is unlawful, and you oppose the erasure of your personal data and request the restriction of its use instead
3. We no longer need the personal data for the purposes of processing, but you require the data for the establishment, exercise or defense of legal claims
4. You have objected to processing pursuant to Article 21 (1) pending the verification whether our company's legitimate grounds override yours

3.5 Right to data portability
You have the right to receive the data related to your person that has been provided to us in a structured, commonly used and machine-readable format. You also have the right to have us transmit your data to another controller without hindrance, providing:
1. The processing is based on consent pursuant to Article 6 (1) (a) or Article 9 (2) (a) of the GDPR or based on a contract pursuant to Article 6 (1) (b), and
2. This processing is carried out by automated means
In exercising your right to data portability pursuant to paragraph 1, you are entitled to have your personal data transmitted directly from us to another controller, if this is technically feasible.

3.6 Right to object
On grounds relating to your particular situation, you have the right to object at any time to the processing of your personal data pursuant to Article 6 (1) (e) or (f) of the GDPR. This includes profiling based on those provisions. We no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or the processing is for the purpose of establishing, exercising or defending legal claims.
If your personal data are processed by us for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing, which includes profiling to the extent that it is related to such direct marketing.
On grounds relating to your particular situation, you have the right to object to the processing of your personal data for scientific or historical research purposes or statistical purposes pursuant to Article 89 (1) of the GDPR, unless the processing is necessary for the performance of a task carried out for reasons of public interest.

3.7 Automated decision-making, including profiling
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or significantly affects you in a similar way.

3.8 Right to withdraw your consent to data processing
You have the right to withdraw your consent to the processing of your personal data at any time.

3.9 Right to lodge a complaint with a supervisory authority
You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your residence, place of work or place of the alleged infringement, if you believe the processing of your personal data is in violation of the GDPR.

4 Data security
We make every effort to ensure the security of your data within the framework of applicable data protection laws and technical possibilities.
Your personal data is transmitted by us in encrypted form. This applies to orders as well as to the customer login. We use the SSL (Secure Socket Layer) coding system. However, we would like to point out that data transmission over the Internet (e.g. via e-mail) may be subject to security vulnerabilities. End-to-end data protection against access by third parties is not possible.
To safeguard your data, we implement technical and organizational security measures that are regularly updated to meet the latest technological standards.
We do not guarantee that our website will be available at all times. Disturbances, interruptions or failures cannot be excluded. The servers we use are regularly and securely backed up.

5 Automated decision-making
No automated decision-making is carried out based on collected personal data.

6 Disclosure of data to third parties/no data transfer to non-EU countries
Your personal data is fundamentally only used within our company.
In the event that we need to outsource certain aspects of the data processing (contract processing), we obligate the processor to use personal data only in accordance with the data protection laws and to ensure the protection of the data subject's rights. Except as outlined in point 2.3 of this statement, data transmission to agencies or persons outside the EU does not take place nor is it planned.

7 Reporting Office
As part of our compliance management system, we have set up a whistleblower hotline. You have the opportunity to submit information on matters that are subject to the German Whistleblower Protection Act (HinSchG) or that we otherwise have a legitimate interest in knowing about.

We have commissioned the law firm Heuking Kühn Lüer Wojtek as an outsourced internal reporting office (hereinafter: "reporting office") to receive and review such information.

Entries can be submitted to the reporting office via the web form, by telephone, by e-mail, by post or in person.

Reports to the reporting office can be made anonymously.

Use of the reporting office is voluntary.

When you submit a report to the reporting office, it collects the information you provide. This includes your personal data, if you disclose it, and usually the names and other personal data of the persons you name in your report. Further information on how the reporting office handles your personal data can be found in the data protection notices of the reporting office.

a) Categories of personal data that we process
Once the reporting office has checked the report, we will receive a report which may contain the following personal data:
In the course of further clarification of the reported matter and further processing, further personal data may be collected and processed by us.

b) Purposes of data processing, legal basis
The processing of the data transmitted to us by the reporting office serves to process and manage information on compliance violations, violations of legal regulations and violations in connection with our business operations by employees, customers, suppliers and other third parties.

The legal basis for the processing of your personal data as a whistleblower is your consent (Art. 6 para. 1 sentence 1 lit. a GDPR), provided that you disclose your identity and agree to your name being passed on to us by the reporting office.

Insofar as matters are concerned that are subject to the Whistleblower Protection Act (HinSchG), Section 10 HinschG is the legal basis for the processing of the personal data of you as the whistleblower and of the person(s) affected by the whistleblowing.

Outside the scope of the HinschG, the legal basis for processing the personal data of you and the persons affected by the report is our legitimate interest in the detection and prevention of legal violations and misconduct (Art. 6 para. 1 sentence 1 lit. f GDPR). We have a legitimate interest in detecting and preventing legal violations and misconduct insofar as we are legally obliged to do so in certain areas. In addition, such violations can not only cause considerable economic damage, but also lead to a considerable loss of reputation.

If the data subject is an employee of ours, the legal basis for processing in the course of processing or further investigation of the reported facts is also Art. 6 para. 1 sentence 1 lit. b GDPR (performance of a contract or implementation of pre-contractual measures) or § 26 para. 1 sentence 2 BDSG (processing for the detection of criminal offenses) and, if applicable, our legitimate interest described above (Art. 6 para. 1 sentence 1 lit. f GDPR).

c) Disclosure to third parties
The confidential treatment of all reports and data by the reporting office is ensured at all times and in every processing step. This applies in particular to the personal data of the person making the report and the person(s) affected by the report. Only individual, pre-defined, authorized persons who are obliged to maintain confidentiality have access to incoming reports and information about the processing of the report or follow-up measures.

If the report concerns another company in our group of companies, we will pass on the contents of the report and the results of the further clarification of the facts to this company in our group of companies.

We may pass on the contents of the report and the results of further clarification of the reported facts to courts, authorities and other public bodies. This may be the case if we are legally obliged to disclose the data or if this is necessary for the assertion, exercise or defense of legal claims. In the course of the clarification measures and in the assertion, exercise or defense of legal claims, we may also rely on the support of law firms or auditing companies.

In addition, we may involve (technical) service providers in the clarification and processing of the reported facts, who act for us as processors within the meaning of Art. 28 GDPR and on the basis of corresponding agreements. These service providers may also become aware of the content of the whistleblower report but are obliged to handle the data concerned confidentially.

Despite maintaining confidentiality, personal data of the informing persons and those affected may come to the attention of authorities, courts or third parties in exceptional situations. This is the case if it is obligatory for us to pass on this information, for example as part of an official investigation (e.g. as part of a preliminary proceeding) or if this is necessary for the assertion, exercise or defense of legal claims. In addition, under certain conditions, we must also disclose the reported information to the persons affected by the report.

d) Duration of data storage
The personal data will be stored for as long as is necessary for the clarification of the report and any subsequent measures, or for as long as we have a legitimate interest or as long as this is required by law. The data will then be deleted in accordance with legal requirements.



8 Data protection officer
Our data protection officer can be reached at the following email address: datenschutz@moll-betonwerke.de