Challenge Business Consulting GmbH

1. Data Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is: Challenge Business Consult GmbH represented by: Dr. Alfred Fuhrmann O'Brien Strasse 2 D-91126 Schwabach Germany Email: office@cbc-partners.com Austrian Branch: Challenge Business Consult GmbH Zinkenbacherstrasse 1 A-5342 Sankt Gilgen Austria

2. General Information on Data Processing

We generally process our users’ personal data only to the extent necessary to provide a fully functional website and to deliver our content and services. As a rule, personal data is processed only with the user’s consent. An exception applies in cases where obtaining prior consent is not possible for practical reasons and the processing of the data is permitted by law.

3. Legal Basis for Data Processing

To the extent that we obtain the data subject’s consent for the processing of personal data, Article 6(1)(a) of the GDPR serves as the legal basis.

When processing personal data that is necessary for the performance of a contract to which the data subject is a party, Article 6(1)(b) of the GDPR serves as the legal basis.

If processing is necessary to safeguard a legitimate interest of our company or a third party, and the interests, fundamental rights, and fundamental freedoms of the data subject do not override that interest, Article 6(1)(f) of the GDPR serves as the legal basis for the processing.

4. Data Deletion and Retention Period

The data subject’s personal data will be erased or blocked as soon as the purpose for which it was stored no longer applies. Data may also be stored if this is provided for by European or national legislation in EU regulations, laws, or other provisions to which the controller is subject. The data will also be blocked or deleted when a retention period prescribed by the aforementioned standards expires, unless there is a need to continue storing the data for the conclusion or performance of a contract.

5. Provision of the Website and Creation of Log Files

Every time our website is accessed, our system automatically collects data and information from the computer system of the accessing device. The following data is collected: • Information about the browser type and version used • The user’s operating system • The user’s Internet service provider • The user’s IP address • Date and time of access • Websites from which the user’s system accesses our website • Websites accessed by the user’s system via our website The data is also stored in our system’s log files. This data is not stored together with other personal data of the user. The legal basis for the temporary storage of the data and log files is Article 6(1)(f) of the GDPR. The data is deleted as soon as it is no longer necessary to achieve the purpose for which it was collected. In the case of data collected for the purpose of providing the website, this occurs when the respective session ends.

6. Use of Cookies

Our website uses cookies. Cookies are text files that are stored in or by the web browser on the user’s computer system. When a user visits a website, a cookie may be stored on the user’s operating system. This cookie contains a unique string of characters that allows the browser to be uniquely identified when the website is visited again. We use cookies to make our website more user-friendly. Some elements of our website require that the visiting browser can be identified even after a page change. In addition, we use cookies that enable an analysis of users’ browsing behavior (see the Google Analytics section). The legal basis for processing personal data using technically necessary cookies is Article 6(1)(f) of the GDPR. The legal basis for processing personal data using cookies for analytical purposes is Article 6(1)(a) of the GDPR, provided the user has given their consent.

7. Google Analytics

This website uses Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Google Analytics uses "cookies," which are text files placed on your computer, to help the website analyze how users use the site. The information generated by the cookie about your use of this website is typically transmitted to and stored on a Google server in the United States. However, if IP anonymization is enabled on this website, your IP address will be truncated by Google within member states of the European Union or in other signatory states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the United States and truncated there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity, and to provide other services related to website and internet usage to the website operator. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data. You can prevent the storage of cookies by adjusting your browser settings accordingly; however, we would like to point out that in this case, you may not be able to use all functions of this website to their full extent. The legal basis for processing is Art. 6(1)(f) GDPR (legitimate interest in website analysis) or Art. 6(1)(a) GDPR (consent). Google LLC has joined the EU-US Data Privacy Framework. Data transfer to the United States is based on an adequacy decision by the European Commission (Art. 45 GDPR). For more information on how Google Analytics handles user data, please refer to Google’s Privacy Policy: https://policies.google.com/privacy

8. Google Search Console

We use Google Search Console, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to analyze and optimize our website’s performance in search results. This service processes technical data regarding the indexing and visibility of our website. This service does not collect any personal data from website visitors.

9. Rights of the Data Subject

If your personal data is being processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis the controller: • Right of access (Art. 15 GDPR) • Right to rectification (Art. 16 GDPR) • Right to erasure (Art. 17 GDPR) • Right to restriction of processing (Art. 18 GDPR) • Right to data portability (Art. 20 GDPR) • Right to object (Art. 21 GDPR) • Right to withdraw a declaration of consent under data protection law (Art. 7(3) GDPR) • Right to lodge a complaint with a supervisory authority (Art. 77 GDPR) To exercise your rights, please contact: office@cbc-partners.com

10. Competent supervisory authority

Competent data protection supervisory authority for Germany: Bavarian State Office for Data Protection Supervision (BayLDA) Promenade 18, 91522 Ansbach https://www.lda.bayern.de Competent data protection supervisory authority for Austria: Austrian Data Protection Authority Barichgasse 40–42, 1030 Vienna https://www.dsb.gv.at

11. Validity and Changes to This Privacy Policy

This Privacy Policy is currently in effect and is dated March 2026. Due to ongoing developments to our website and the services offered through it, or due to changes in legal or regulatory requirements, it may become necessary to amend this Privacy Policy. The most current version of the Privacy Policy can be viewed and printed from the website at any time.