Data Pro­tec­tion Dec­la­ra­tion

GTÜ Prüfmittelservices GmbH Data protection information for customers in accordance with Art. 13 GDPR and Art. 14 GDPR

1. Data protection controller

The controller under dato protection law is GTÜ Prüfmittelservice GmbH, Vor dem Lauch 25, 70567 Stuttgart (hereinafter also referred to as "we" or "GTÜ-PMS").

2. Contact details of the dato protection officer

You can reach our dato protection officer at the following e-mail address: datenschutz@gtue.de

We would like to point out that when using this e-mail address, the content will not be taken note of exclusively by our dato protection officer. lf you would like to exchange confidential information, we therefore ask you to contact us directly via this e-mail address without a more detailed description of the facts.

3. Purposes of dato processing, type of dato and legal basis/legitimate interests

We collect and process your personal dato as a customer, which we receive on your behalf, for the purpose of carrying out the activity you have commissioned from time to time.

a. Contacting us by e-mail/fax/telephone/contact form

You have the option of contacting us by e-mail, fax, contact form or telephone. Your personal dato transmitted in the contact will be stored by us. The dato will not be passed on to third parties. The dato will be processed exclusively for the purpose of processing your contact. The legal basis for the processing of your personal dato is Art. 6 para. 1 sentence 1 lit. f GDPR. The dato will be stored until it is no langer necessary to achieve the purpose of the conversation with you and the purpose of your contact has been comprehensively clarified.

lf your contact is aimed at concluding a contract with us, the additional legal basis for the processing of your personal data is Art. 6 (1) sentence 1 (b) GDPR. This data will be stored for as long as it is necessary for the performance of the contract. In addition, we only store your data in order to comply with contractual or legal obligations (e.g. tax obligations).

lf you use this option, we will process the data collected in your contact:

• Email address (to contact you)
• Name and address
• Company
• Your message

b. Offers

We collect and process your personal data, which we receive as part of your request, for the purpose of carrying out the quotation process. The legal basis for this data processing is Art. 6 para. 1 sentence 1 lit. b GDPR (contractual relationship).

Furthermore, we regularly check your creditworthiness when concluding contracts and in certain cases where there is a legitimate interest. To this end, we work together with Creditreform Stuttgart Strahler KG, Theodor-Heuss-Straße 2, 70174 Stuttgart, from which we receive the necessary data. For this purpose, we transmit your name and contact details to Creditreform. Further information on data processing at Creditreform can be found in the detailed information sheet "Creditreform information pursuant to Art. 14 EU GDPR at www.creditreform-ORT.de/EU-DSGVO.

We process the following categories of personal data:

• Name and address of the customer
• E-mail address
• Phone number
• Location and specification of test equipment/measurement technology
• lnventory ldentifiers

c. Assignment

We collect and process your personal data, which we receive in the context of your commission, for the purpose of carrying out the activities commissioned byyou in each case as weil as their documentation and billing.

We process the following categories of personal data:

• Name and address of the customer
• E-mail address
• Phone number
• Location and specification of test equipment/measurement technology
• lnventory ldentifiers

We transfer your personal data to the categories of recipients listed under 4. The legal basis for this data processing is Art. 6 para. 1 sentence 1 lit. 1 b GDPR (fulfilment of the order/contract), Art. 6 para. 1 sentence 1 lit. c GDPR (fulfilment of legal obligations to which we are subject, such as DIN ISO 17025) and Art. 6 para. 1 sentence 1 lit. f GDPR (legitimate interest).

d. Reminder of upcoming test equipment due dates

lf the legal requirements are met and you have provided us with your e-mail address, GTÜ Prüfmittelservice GmbH will voluntarily remind the client of upcoming test equipment due dates. The service is non-binding and does not constitute an obligation for GTÜ Prüfmittelservice GmbH to monitor deadlines. The responsibility for timely inspections lies exclusively with the client. The legal basis for this is Section 7 (2) and (3) UWG and Article 6 (1) sentence 1 (f) GDPR (legitimate interest). Our interests are advertising interests as weil as the endeavour to support the client by reminding them in good time to have the test equipment calibrated on time.

You have the right to object at any time to the processing of your personal data for the purpose of such marketing. lf you object to the processing of your personal data for direct marketing purposes, we will no longer process it for these purposes.

You can send an objection to pms@gtue.de, for example, by e-mail.

In doing so, we process the following categories of personal data:

• E-mail address
• Name and address of the customer
• Location and specification of test equipment/measurement technology
• Date of next exam

4. Categories of recipients

The recipients of your data are:

• The GTÜ-PMS test equipment officer commissioned to carry out the activity
• The GTÜ-PMS partner company or subcontractor for third-party services and calibration activities in the field of GTÜ-PMS
• The competent supervisory authorities
• Credit Bureaus
• GTÜ Gesellschaft für Technische Überwachungs mbH if, in addition to the contractual relationship with GTÜ Prüfmittelservice GmbH, a contractual relationship with GTÜ Gesellschaft für Technische Überwachungs mbH is also entered into
• Other recipients, insofar as we are legally obliged to do so Suppliers/contractors with whom we have entered into data processing agreements in accordance with the GDPR

As a matter of principle, your data will not be transferred to a body in a third country outside the EU/EEA. However, it cannot be ruled out that data may be transferred to a third country on the basis of legal regulations or requirements.

5. Storage period

We are subject to various statutory retention obligations and periods regarding your data, for example from statutory, tax and commercial law periods. Due to this, the data can be stored for up to 10 years.

6. Your rights

When we process your personal data, you are a "data subject" within the meaning of the GDPR. lf the legal requirements are met, you are entitled to the following rights: right to information, right to rectification, right to restriction of processing, right to erasure, right to information and right to data portability. In addition, you have a right of objection, a right of withdrawal and the right to complain to the supervisory authority.

Below are some details about each of the rights:

a. Right of access

You have the right to request confirmation from us as to whether we are processing your personal dato. lf we process your personal dato, you have the right to receive information about the processed dato, processing purposes, categories of personal dato, recipients or categories of recipients and, if applicable, the storage period.

b. Right of correction

You have the right to rectify and/or complete the personal dato we hold about you if that personal dato is inaccurate or incomplete. We will make the correction or completion without undue delay.

c. Right to restriction of processing

Under certain conditions, you have the right to ask us to restrict the processing of your personal dato. An example of this is that you contest the accuracy of your personal dato and we need to verify its accuracy for a certain period of time. For the duration of the audit, your personal dato will only be processed to a limited extent. Another example of the restriction is that while we no langer need your personal dato, you need it for litigation.

d. Right to erasure

In certain situations, you have the right to request that we delete your personal dato without undue delay. This is the case, for example, where we no langer need your personal dato for the purposes for which we collected the personal dato or where we have unlawfully processed your personal dato. Another example would be that we process your personal dato on the basis of your consent, you withdraw your consent and we do not process the personal dato on any other legal basis. However, your right to erasure does not always exist. For example, we may process your personal dato in order to comply with a legal obligation or because we need it for a legal dispute.

e. Right to information

lf you have exercised your right to rectification, erasure or restriction against us, we are obliged to notify all recipients to whom we have disclosed your personal dato of the correction, deletion or restriction of the processing of your personal data, unless this proves impossible or involves disproportionate effort.

f. Right to data portability

You have the right, under certain conditions, to receive the personal data that you have provided to us in a structured, commonly used and machine-readable format and the right to have this personal data transmitted to another controller. This is the case where we process the personal data either on the basis of your consent or on the basis of a contract with you and where we process the personal data by automated means.

You have the right to request that we transmit your personal data directly to another controller, insofar as this is technically feasible and does not impair the freedoms and rights of other persons.

This right to data portability does not apply if the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.

g. Right of withdrawal

You can revoke your consent to us at any time with effect for the future. A withdrawal of consent does not affect the lawfulness of the data processing carried out on the basis of the consent up to the revocation.

You can send a revocation to datenschutz@gtue.de, for example, by e-mail.

h. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority, without prejudice to any other administrative or judicial remedy. In particular, you can assert your right to lodge a complaint in the Member State of your place of residence, your place of work or the place of the alleged infringement if you believe that the processing of your personal data violates the GDPR.

An overview of the respective state data protection commissioners of the federal states and their contact details can be found on the website of the Federal Commissioner for Data Protection and Freedom of Information (www.bfdi.bund.de).

7. Up-to-dateness and modification of this dato protection policy

As of: February 2026

Version: 2.3