Website: www.beisheim-center.de

We are delighted to see you on our website. Data protection and data security for our users are a top priority for us. We adhere to the data protection provisions, especially those of the Swiss Data Protection Act (“DPA”) as well as of the EU General Data Protection Regulation (“GDPR”).

In this privacy policy, we explain which information and personal data we process during your visit and your use of our Internet offer mentioned above (“website”).

I. Who is responsible for the data processing?

The data controller responsible for processing your personal data is IMMAGO-RENT AG, Neuhofstrasse 4, CH-6340 Baar, Switzerland, phone: +41 41 768 7272, email: info@beisheim-center.de. Any mention of ‘we’ or ‘us’ in this data privacy notice refers to this company.

II. Which principles do we observe?

In compliance with data protection regulations, we only process your personal data if we are permitted to do so by law or if you have given your consent.

On this website, we may also collect information that in itself does not allow us to draw any direct conclusions about your person. In certain cases, especially when combined with other data, this information may nevertheless be considered "personal data" in the sense of data protection law. Furthermore, we may also collect information on this website that does not allow us to identify you directly or indirectly; this is the case, for example, with aggregated information about all users of this website.

III. Which data do we process?

You can access our website without directly providing personal data (such as your name, postal address or e-mail address). Even in this case, we must collect and store certain information in order to allow you the access to our website. In addition, we use an analysis procedure on our web pages and have integrated links to other websites, whose operators possibly process other (personal) data. For certain functionalities on our web pages, the indication of personal data is necessary.

1. Server log files: When you visit this website, our web server automatically collects and stores the information listed below in so-called server log files, which are transmitted to us by your web browser:

a) the domain name or IP address of the requesting computer (usually your Internet access provider);

b) the applications and terminals used by you;

c) the date and time of the server query, as well as the duration of your visit;

d) the website (referrer) last visited before your visit to our website as well as the sub-pages that you access on our website; and

The information in the server log files cannot be assigned to a particular person, and this data is not merged with other data sources. The log files are stored in order to guarantee the functionality of the website and to ensure the safety of our information technology systems.

2. Website analysis via Matomo: On our website, we use the open-source software tool Matomo to analyse your usage behaviour. When you visit our website, the following data is stored on the servers of our website using Matomo:

a) the domain name or IP address of the requesting computer (usually your Internet access provider);

b) the website (referrer) last visited before your visit to our website as well as the sub-pages that you access on our website;

c) the dwell time on the website and the individual sub-pages; and

d) the frequency of calling up the website.

We have disabled the use of tracking cookies when using Matomo. Thus, personal data of the users is only stored on the servers of our website. The data is not forwarded to third parties. Matomo is also set in such a way that the IP address used by you is not stored fully, but the last two bytes of the IP address are masked. Thus, personal assignment of the IP address is no longer possible.

3. Cookies: Information on the cookies used by us can be found in our cookie declaration under https://www.cookiebot.com/de/cookie-declaration/.

4. Contact: When you contact us using the ways specified on our website, we collect the personal data that you have provided in connection with your contact, e.g. your name, your e-mail address, your address, telephone and/or fax number.

IV. For which purposes and on which legal bases do we process your data?

1. The processing of any personal data contained in the log files is carried out in order to enable you to use our website; this is done on the basis of Section 15(1) TMG or Article 6(1()f) GDPR.

2. The processing of the possibly personal IP address for geolocation is carried out in order to be able to display the relevant version of our website to you or to enable you to make a corresponding selection; this is carried out on the basis of Article 6 (1) f) GDPR to protect our legitimate interest in a user-friendly design of our offer.

3. The processing of personal data collected in the context of the use of Matomo for the purposes of web analysis as well as for the continuous improvement of our website is based on your consent in accordance with Article 6 (1) a) GDPR.

4. The processing of personal data transmitted in the context of the enquiry addressed to us via the contact channels shown on the website is carried out for the purpose of processing the respective enquiry in order to safeguard our legitimate interest in carrying out our other business activities on the basis of Article 6 (1) f) GDPR.

5. We may also process data related to your use of our website in order to comply with legal obligations to which we are subject; this is done on the basis of Article 6(1)(c) GDPR.

6. Where necessary, we also process your data beyond the aforementioned purposes in order to protect our further legitimate interests or the interests of third parties; this is done on the basis of Article 6(1) f) GDPR. Our legitimate interests include

a) the assertion of legal claims and the defence during legal disputes;

b) the prevention and investigation of criminal offences;

c) the control and further development of our business activity including the risk control.

V. I am obliged to provide data?

1. The provision of personal data is mandatory in the following cases:

a) The storage of the server log files is absolutely necessary for the operation of the website. You therefore do not have the option of objecting to the storage of the said information in the server log files.

b) To respond to a request made to us via the contact ways provided on our website, we require your contact details (e.g. e-mail address, address, telephone and/or fax number); without the provision of at least one contact detail, we cannot respond to your request.

2. If we collect further personal data from you in connection with the further development of our website (in particular in the case of supplementary functionalities), we will inform you at the time of collection whether the provision of this information is required by law or contract or is necessary for the conclusion of a contract. In doing so, we generally mark the information whose provision is voluntary and is not based on one of the aforementioned obligations or is not required for the conclusion of a contract.

VI. Who receives my data?

Your personal data is basically processed within our company. Depending on the type of the personal data, only certain departments / organisational units have access to your personal data. By means of a role and authorisation concept, the access within our company is limited to the functions and to the extent necessary for the respective purpose of the processing.

We may also transmit your personal data to third parties outside of our company to the legally permissible extent. In particular, these external recipients can include

companies or authorities of the Beisheim Groups in Germany and Switzerland, to which we transmit personal data for internal administration purposes;

the service providers engaged by us that provide services for us on a separate contractual basis, which can also include the processing of personal data, as well as the subcontractors of our service providers engaged with our consent;

non-public and public bodies, as far as we are obliged for the transmission of your personal data due to legal obligations.

VII. Is automated decision-making used?

In connection with the operation of our website, we generally do not use automated decision-making (including profiling) within the meaning of Art. 22 GDPR. If we use such procedures in individual cases, we will inform you of this separately to the extent provided by law.

VIII. Is data transmitted to countries outside of the EU / the EEA?

The processing of your personal data is generally carried out within Switzerland and the EU or the European Economic Area.

Information may be transmitted to recipients in so-called "Third countries” only in connection with the collaboration between the companies of the Beisheim Groups in Germany and Switzerland and/or the provision of IT services associated with the operation of the website (e.g. the use of applications for website analysis). “Third countries” are countries outside of Switzerland and the European Union or the Agreement on the European Economic Area, where a level of data protection comparable with that in the European Union cannot be readily assumed.

If the transmitted information also includes personal data, we ensure before such a transmission that the required adequate level of data protection is guaranteed in the respective third country or with the recipient in the third country. Alternatively, we can also base the data transmission on the so-called “EU standard contractual clauses” agreed upon with a recipient (more information: http://eur-ex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2010:039:0005:0018:DE:PDF). We would be glad to provide you with additional information on the appropriate and adequate guarantees for the compliance with a reasonable level of data protection on request; the contact details can be found at the beginning of this privacy policy.

Your personal data is generally processed within the EU or the European Economic Area or Switzerland.

Only in connection with the cooperation between the companies of the Beisheim Groups in Germany and Switzerland and/or the provision of IT services in connection with the operation of the website (such as the use of applications for website analysis) may information be transferred to recipients in so-called "third countries". "Third countries" means countries outside the European Union or the European Economic Area in which a level of data protection comparable to that in the European Union cannot readily be assumed.

If the information transferred also includes personal data, we ensure prior to such transfer that the required adequate level of data protection is guaranteed in the respective third country or at the recipient in the third country. In the case of the companies of the Beisheim Group Switzerland located in Switzerland, the adequate level of data protection results from a so-called "adequacy decision" of the European Commission, which establishes an adequate level of data protection for Switzerland as a whole. Further information on this and other adequacy decisions can be found on the websites of the European Commission (https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en). Alternatively, we may also base the data transfer on the so-called "EU Standard Contractual Clauses" agreed with a recipient (further information on https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2010:039:0005:0018:DE:PDF) or – in the case of recipients in the USA – on compliance with the principles of the so-called "EU-US Privacy Shield" (more information on the participants on https://www.privacyshield.gov/list) and take the necessary supplementary measures. We will be happy to provide you with further information on the appropriate and adequate safeguards to ensure an adequate level of data protection upon request; the contact details can be found at the beginning of this privacy information.

IX. How long is my data stored for?

We generally store your personal data as long as we have a legitimate interest in this storage and your interests in not continuing the storage do not outweigh this.

Even without a legitimate interest, we may continue to store the data if we are legally obliged to do so (e.g. to comply with retention obligations). We also delete your personal data without your intervention as soon as knowledge of it is no longer necessary to fulfil the purpose of the processing or the storage is otherwise legally inadmissible.

As a rule

a) the log data will be deleted within seven days, unless further storage is required for purposes provided for by law, such as the detection of misuse and the detection and elimination of technical faults;

b) the data collected in connection with a contact will be deleted after processing and expiry of any applicable statutory retention periods.

Those personal data that we have to store in order to comply with retention obligations are stored until the end of the respective retention obligation. Insofar as we store personal data exclusively for the fulfilment of retention obligations, this data is generally blocked so that it can only be accessed if this is necessary with regard to the purpose of the retention obligation.

X. What rights do I have?

Right of objection under Art. 21 GDPR

A data subject shall have the right to object at any time, on grounds relating to his or her particular situation, to processing of personal data concerning him or her which is carried out on the basis of Article 6(1)(e) or (f) of the GDPR; this shall also apply to any profiling based on those provisions. In the event of such an objection, we shall no longer process the personal data concerning that person, unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the assertion, exercise or defence of legal claims.

Other rights

As a data subject, you have the right

to information on the personal data stored about you, Art. 15 GDPR;

to rectification of inaccurate or incomplete data, Art. 16 GDPR;

to erasure of personal data, Art. 17 GDPR;

to restriction of processing, Art. 18 GDPR;

to data portability, Art. 20 GDPR.

To exercise these rights, you can contact us at any time - e.g. via one of the contact channels indicated at the beginning of this Data Privacy Statement.

If you have any questions about the processing of your data, you can also contact our data protection officer.

You also have the right to lodge a complaint with a competent data protection supervisory authority, Art. 77 GDPR.

* * *

Berlin, 31.05.2021

BRISTOL-MYERS SQUIBB

INFORMATION