Privacy Policy for Business Partners and Suppliers

1. Content and Scope

This Privacy Policy describes how the ABOUT YOU Group, i.e. ABOUT YOU SE & Co. KG, ABOUT YOU Holding SE (“ABOUT YOU”), SCAYLE Payments GmbH (“Scayle Payments”) as well as SCAYLE GmbH (“SCAYLE”) (hereinafter together referred to as “ABOUT YOU Group”) processes and protects the personal data of its business partners and suppliers.

ABOUT YOU Group is committed to transparency and respecting its business partners and suppliers’ (i.e. in particular their employees/contact persons) privacy rights in compliance with applicable data protection laws, including the GDPR (General Data Protection Regulation) and BDSG (Bundesdatenschutzgesetz).

This Privacy Policy applies to all employees and contact-persons of business partners and suppliers. It covers all activities regarding processing of personal data relating to the business relationship, including negotiations, onboarding, payments, IT access, security, termination, and post-contractual activities.

Business partners and suppliers are obliged to provide the information from this Privacy Policy to their respective employees and contact-persons. For, (i) specific security concerns around an ABOUT YOU Group’s processing of personal data, (ii) in the event that employees/contact-persons of business partners and suppliers feel they have not received proper attention to his/her personal data request, or (iii) have any other personal data privacy concerns, please contact ABOUT YOU Group by emailing:

• ABOUT YOU: [email protected]
• SCAYLE Payments: [email protected]
• SCAYLE: [email protected]

This Privacy Policy applies to all personal data that business partners and/or suppliers provide to ABOUT YOU Group or that is obtained from such data.

2. Name and Contact Details of the Controller

Each company of ABOUT YOU Group, with which suppliers and business partners interact are “Controller” for data processing in accordance with the GDPR, i.e.:

• ABOUT YOU Holding SE
  Domstraße 10, 20095 Hamburg
  as Controller, legally represented by the Management Board members Tarek Müller, Hannes Wiese and Sebastian Betz.
• ABOUT YOU SE & Co. KG
  Domstraße 10, 20095 Hamburg
  as Controller, legally represented by: ABOUT YOU Verwaltungs SE, which in turn is represented by the Management Board members Tarek Müller, Hannes Wiese and Sebastian Betz.
  Chairman of the Supervisory Board: Sebastian Klauke
• SCAYLE Payments GmbH
  Domstraße 10, 20095 Hamburg
  as the Controller, legally represented by Managing Directors Thomas Kremser and Martin Lemberg.
• SCAYLE GmbH
  Domstraße 10, 20095 Hamburg
  as Controller, legally represented by the Managing Directors Tobias Ring, Fabian Wesner and Christopher Metz

3. Contact Details of the Data Protection Officer

You can contact the company Data Protection Officer of the controller at

• ABOUT YOU
  Attn. Sebastian Herting – Datenschutzkanzlei
  Domstraße 10, 20095 Hamburg, Germany
  Email: [email protected]

or

• SCAYLE Payments GmbH
  Attn. Sebastian Herting – Datenschutzkanzlei
  Domstraße 10, 20095 Hamburg, Germany
  Email: [email protected]

or

• SCAYLE GmbH
  Attn. Sebastian Herting – Datenschutzkanzlei
  Domstraße 10, 20095 Hamburg, Germany
  Email: [email protected]

4. Categories of Personal Data Collected

ABOUT YOU Group processes the following personal data:

• Contact information: such as a partner’s/supplier employee/contact-person full name, business address, phone number, mobile number, fax number and email address;
• Payment details: such as all data required to process payments and prevent fraud, including credit or debit card numbers, any security codes and other billing information;
• Data that is legally required for compliance purposes, such as information on legal disputes that may be relevant for antitrust purposes, for example;
• Usage data when a partner’s/supplier employee/contact-person visits ABOUT YOU Group websites, such as the browser used, the device and operating system used, the time spend on the website, the date and time of the visit, the location of access, the language, the use of website functions, the search terms that may have been entered, the frequency with which a partner’s/supplier employee/contact-person visit the ABOUT YOU Group websites, the most recent visits, the website from which one arrived at the ABOUT YOU Group websites, for example by clicking on Google Ads banners, and the website one visits from the ABOUT YOU Group websites, whether by clicking on links on the websites or by entering a domain directly in the input field of the same tab (or window) of the browser in which the ABOUT YOU Group websites were opened.

The provision of contact information, payment details and data for compliance purposes is necessary for the conclusion and performance of a contract. If ABOUT YOU Group does not receive the personal data from a partner’s/supplier employee/contact-person, ABOUT YOU Group may not be able to conclude a contract or fulfill its contractual obligations in full or in part. The usage data is not required for the conclusion of a contract. However, if this data is not provided to ABOUT YOU Group, ABOUT YOU Group may not be able to provide all the functions of its website (which might be relevant for the conclusion of a contract).

5. Purposes of processing and legal bases

ABOUT YOU Group uses the above mentioned (section 4) personal data for the following purposes:

• the planning, execution, control and management of the contractual relationship with ABOUT YOU Group, for example by executing transactions and orders for products or services, processing payment transactions, carrying out accounting, auditing, billing and debt collection activities, arranging shipments and deliveries, enabling repairs/rectifications and providing support services or providing other services at request (Art. 6 (1) (b) GDPR);
• ensuring compliance with legal obligations (such as accounting obligations), compliance checks or record-keeping obligations (for example under competition laws, export laws, trade sanctions and embargo laws or the prevention of white-collar crime or money laundering); this may involve ABOUT YOU Group matching contact details or other information provided by partners/suppliers against applicable lists of sanctioned parties and contacting you to confirm the identity if there is a potential match in this matching process, or recording an interaction with partners/suppliers that may be relevant for antitrust purposes (Art. 6 (1) (b) or (c) GDPR);
• contacting a partner’s/supplier employee/contact within an existing business relationship, insofar as this is legally permissible, in order to inform partners/suppliers about products or services from ABOUT YOU Group that are similar or related to the products and services that have already purchased/acquired or used within the scope of this business relationship (generally on the basis of Art. 6 (1) (f) GDPR; if ABOUT YOU Group has obtained consent to do so, on the basis of Art. 6 (1) (a) GDPR);
• the settlement of disputes, the enforcement of our contractual agreements and the establishment, exercise or defense of legal claims (Art. 6 (1) (b) GDPR)
• ensuring compliance with legal obligations, for example the storage of sales documents for tax purposes or the sending of legally required notifications and other announcements (Art. 6 (1) (c) GDPR); or
• the usage data to optimize ABOUT YOU Group’s websites and online offers, as well as the (direct) marketing of own products and services on the basis of ABOUT YOU Group’s legitimate interest in being able to offer a functioning website that meets the needs of users (Art. 6 (1) (f) GDPR).

ABOUT YOU Group will not use a partner’s/supplier’s employee/contact personal data to make automated decisions or for profiling purposes.

With regard to direct advertising (for example by email), ABOUT YOU Group will only transfer personal data if it has obtained consent to such processing, insofar as this is required by law.

6. Recipients of the personal data

ABOUT YOU Group shares partner’s/supplier’s employee/contact-person personal data with the following recipients:

• ABOUT YOU Group uses processors to process personal data for the aforementioned purposes, who process the personal data on ABOUT YOU Group’s behalf. ABOUT YOU Group always retains control over the respective personal data and remains responsible for the data processing.
• To analyze usage data, ABOUT YOU Group might use analysis tools that processes the usage data on ABOUT YOU Group’s behalf. ABOUT YOU Group retains control over the respective personal data and remains responsible for data processing. The processor does not use the data for any other purpose, merge it with other data or pass it on to third parties.
• In individual cases, ABOUT YOU Group transmits payment details to banks in order to process payments.
• In individual cases, one ABOUT YOU Group company may share personal data with other ABOUT YOU Group companies, including international representative offices at your request. Insofar as there is no adequacy decision by the European Commission for the respective third country outside the European Economic Area, this is done on the basis of Art. 49 (1) (b) GDPR.
• ABOUT YOU Group transmit personal data in individual cases to courts, law enforcement authorities, supervisory authorities, tax consultants and lawyers, insofar as this is legally permissible or required.

7. Storage duration

ABOUT YOU Group only stores partner’s/supplier’s employee/contact-person personal data for as long as is necessary for the provision of services, the sale of its products/services or the transmission of information that have been requested from ABOUT YOU Group, as well as the administration of the business relationship with partners/suppliers.

In addition, ABOUT YOU Group is required by applicable law to retain certain personal data for statutory periods (such as in connection with business transactions).

Partner’s/Supplier’s employee/contact-person personal data will be deleted immediately if it is no longer required for the purposes stated.

8. Data subject rights

According to the statutory provisions, partners/suppliers as well as partner’s/supplier’s employees/contact-persons have the following rights, in case the respective requirements are met:

• The right to access their personal data: this enables one to obtain a copy of the personal data ABOUT YOU Group processes about the data subject and to check that ABOUT YOU Group is lawfully processing it;
• The right to rectification of the personal data that ABOUT YOU Group processes about the respective data subject: this enables data subjects to have incomplete or inaccurate data corrected;
• The right to erasure of a data subject’s personal data: this enables a data subject to ask ABOUT YOU Group to delete or remove personal data where there is no good reason for ABOUT YOU Group continuing to process it. A data subject also has the right to request that ABOUT YOU Group erases or removes personal data after a data subject has exercised its right to object;
• The right to object to the processing of a data subject’s personal data if the processing is based on ABOUT YOU Group’s legitimate interests (or those of a third party) and there are grounds relating to a particular situation on the basis of which the data subject wishes to object to the processing on the aforementioned basis. In particular, a data subject has the right to object if ABOUT YOU Group process a data subject’s personal data for direct marketing purposes;
• The right to restrict the processing of a data subject’s personal data: this enables a data subject to request the suspension of the processing of a data subject’s personal data, for example, if a data subject wants ABOUT YOU Group to establish its accuracy or the basis for processing;
• In certain circumstances, the right to transfer a data subject’s personal data to another controller.

If a data subject has given ABOUT YOU Group consent to process its personal data, the data subject has the right to withdraw its consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

A data subject has the right to lodge a complaint with a competent supervisory authority at any time.

Dated: 17 June 2025