Privacy Notice

Disclaimer:

The English version of these Privacy Notices is provided for the convenience of the reader and is for informational purposes only. The legally binding version is the German version of these Privacy Notices.

Preface

We, IIS Asset Management GmbH, operating under the brand MDnomics (hereinafter collectively referred to as „the Company“, „we“, or „us“), take the protection of your personal data seriously and wish to inform you about data protection in our company at this juncture.

In the context of our data protection obligations with the enactment of the EU General Data Protection Regulation (Regulation (EU) 2016/679; hereinafter: „GDPR“), additional duties have been imposed on us to ensure the protection of personal data of individuals affected by processing (hereinafter also referred to as „customer“, „user“, „you“, or „data subject“).

Where we alone or jointly with others decide on the purposes and means of data processing, this primarily includes the obligation to inform you transparently about the nature, scope, purpose, duration, and legal basis of the processing (see Art. 13 and 14 GDPR). With this declaration (hereinafter: „Privacy Notice“), we inform you about how your personal data are processed by us.

Our Privacy Notice is structured modularly. It consists of a general part for any processing of personal data and processing situations, and a specific part whose content only pertains to the processing situation described therein.

To find the parts relevant to you, please refer to the following overview of the breakdown of the Privacy Notice:

Section	Topic	This section is for you…	Link
A	General	…always relevant	Click here
B	Website	…relevant if you visit our website	Click here
C	Direct Marketing	…relevant if we have contacted you as part of our direct marketing	Click here

A. General

(1) Definitions

Following the example of Art. 4 GDPR, these Privacy Notices are based on the following definitions:

„Personal Data“ (Art. 4 No. 1 GDPR) refers to any information relating to an identified or identifiable natural person („data subject“). An identifiable person is one who can be identified, directly or indirectly, particularly by reference to an identifier such as a name, an identification number, an online identifier, location data, or through information concerning physical, physiological, genetic, psychological, economic, cultural, or social identity. Identifiability can also be established through linking such information or other additional knowledge. The form, embodiment, or how the information came about is irrelevant (even photographs, video, or audio recordings can contain personal data).
„Processing“ (Art. 4 No. 2 GDPR) refers to any operation or set of operations performed on personal data, whether or not by automated means. This includes, but is not limited to, collecting, recording, organizing, structuring, storing, adapting or altering, retrieving, consulting, using, disclosing by transmission, disseminating or otherwise making available, aligning or combining, restricting, erasing, or destroying data.
„Controller“ (Art. 4 No. 7 GDPR) refers to the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of processing of personal data.
„Third Party“ (Art. 4 No. 10 GDPR) refers to any natural or legal person, public authority, agency or any other body other than the data subject, controller, processor, and persons who, under the direct authority of the controller or processor, are authorized to process personal data; this also includes other legal entities within the same corporate group.
„Processor“ (Art. 4 No. 8 GDPR) is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller, particularly in accordance with the controller’s instructions (e.g., IT service providers). For the purposes of data protection law, a processor is specifically not considered a third party.
„Consent“ (Art. 4 No. 11 GDPR) of the data subject means any freely given, specific, informed, and unambiguous indication of the data subject’s wishes by which he or she, through a statement or a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

(2) Name and Address of the Controller

The entity responsible for processing your personal data in terms of Art. 4 No. 7 GDPR is:

IIS Asset Management GmbH, operating under the brand MDnomics
Platz der Einheit 2
60327 Frankfurt am Main

Tel.: +49 (0)69 – 87 00 68 450
Email: info@md-nomics.com

For further information about our company, please refer to the legal notice section on our website

(3) Contact Details of the Data Protection Officer

IIS Asset Management GmbH
Attention: Data Protection Officer
René Gröber
Platz der Einheit 2
60327 Frankfurt am Main

Tel.: +49 (0)69 – 87 00 68 452
Email: rg@md-nomics.com

(4) Legal Bases for Data Processing

By law, the processing of personal data is generally prohibited unless it is permitted under one of the following justifications:

6(1)(a) GDPR („Consent“): If the data subject has voluntarily, in an informed manner, and unambiguously given consent through a declaration or some other clear affirmative action, indicating agreement to the processing of their personal data for one or more specific purposes;
6(1)(b) GDPR: If processing is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract;
6(1)(c) GDPR: If processing is necessary for compliance with a legal obligation to which the controller is subject (e.g., legal retention requirements);
6(1)(d) GDPR: If processing is necessary in order to protect the vital interests of the data subject or another natural person;
6(1)(e) GDPR: If processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller or
6(1)(f) GDPR („Legitimate Interests“): If processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party, unless the interests or fundamental rights and freedoms of the data subject which require protection of personal data, particularly where the data subject is a child, override those interests.

For the processing activities we undertake, we will specify the applicable legal basis below. Processing may also be based on multiple legal grounds.

(5) Data Deletion and Retention Duration

For the processing activities we undertake, we specify below how long data is stored and when it is deleted or blocked. Unless a specific retention duration is stated, your personal data will be deleted or blocked as soon as the purpose or legal basis for storage no longer applies. Generally, your data is stored only on servers located within the European Union, subject to any transfers in accordance with the provisions in A.(7) and A.(8).

However, storage may extend beyond the specified period in case of (impending) legal disputes with you or other legal proceedings, or if storage is prescribed by legal regulations to which we as the controller are subject (e.g., § 257 HGB, § 147 AO). When the storage period prescribed by law expires, personal data will be blocked or deleted unless further storage is necessary for us and there is a legal basis for this.

(6) Data Security

We employ appropriate technical and organizational security measures to protect your data against accidental or deliberate manipulation, partial or complete loss, destruction, or unauthorized access by third parties (e.g., SSL/TLS encryption for our website), considering the state of the art, the costs of implementation, and the nature, scope, context, and purpose of processing as well as the existing risks of a data breach (including the likelihood and severity of its consequences) for the data subject. Our security measures are continuously improved in line with technological developments.

(7) Collaboration with Processors

We occasionally rely on external domestic and foreign service providers (e.g., in the areas of IT, logistics, telecommunications, sales, and marketing) to handle our business transactions. These service providers act only according to our instructions and have been contractually obligated under Art. 28 GDPR to comply with data protection regulations.

(8) Conditions for the Transfer of Personal Data to Third Countries

In the context of our business relationships, your personal data may be disclosed or transferred to third-party companies, which may be located outside the European Economic Area (EEA), i.e., in third countries. Such processing is carried out exclusively to fulfill contractual and business obligations and to maintain your business relationship with us. We will provide you with details of the transfers at the relevant places.

The European Commission has certified some third countries with adequacy decisions, affirming that they have data protection standards comparable to those of the EEA (a list of these countries and a copy of the adequacy decisions can be found here: https://ec.europa.eu/info/law/law-topic/data-protection_en). In other third countries, where personal data may be transferred, there might be a lack of consistent high-level data protection due to the absence of statutory provisions. In such cases, we ensure that adequate data protection is maintained through binding corporate rules, standard contractual clauses of the European Commission for the protection of personal data, certificates, recognized codes of conduct, or self-certification under the EU-US Privacy Shield (information about this can be found here: https://www.privacyshield.gov/welcome).

(9) No Automated Decision-Making (including Profiling)

We do not intend to use the personal data collected from you for any process of automated decision-making (including profiling).

(10) No Obligation to Provide Personal Data

We can only enter into contracts with you if you provide us with the necessary personal data, such as the name of the contracting party. As a customer, however, you are generally not legally or contractually obliged to provide us with your personal data; however, it may be that we cannot provide certain services or may only provide them to a limited extent if you do not provide the required data.

(11) Legal Obligation to Transmit Certain Data

We may be subject to a specific legal or statutory obligation to make lawfully processed personal data available to third parties, particularly public authorities (Art. 6(1)(c) GDPR).

(12) Your Rights

As a data subject, you can exercise your rights regarding your processed personal data at any time using the contact details provided initially under A.(3). You have the right to:

Request access to your data processed by us according to Art. 15 GDPR. Specifically, you can request information about the processing purposes, the category of data, the categories of recipients to whom your data have been or will be disclosed, the planned storage duration, the existence of a right to rectification, deletion, restriction of processing, or objection, the right to lodge a complaint, the source of your data if they were not collected by us, as well as about the existence of automated decision-making including profiling and, if applicable, meaningful information about the details thereof;
Immediately request the rectification of incorrect or complete data stored by us according to Art. 16 GDPR;
Request the deletion of your data stored by us according to Art. 17 GDPR, unless the processing is necessary for exercising the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise, or defense of legal claims;
Request the restriction of processing of your data according to Art. 18 GDPR, as far as the accuracy of the data is contested by you, or the processing is unlawful;
Receive your data provided to us in a structured, commonly used, and machine-readable format or request the transfer to another controller according to Art. 20 GDPR („data portability“);
Object to the processing according to Art. 21 GDPR, if the processing is based on Art. 6(1)(e) or (f) GDPR. This is particularly the case if the processing is not necessary for the fulfillment of a contract with you. If it is not an objection to direct marketing, we ask you to explain the reasons why we should not process your data as performed by us. In the case of your justified objection, we will review the situation and either discontinue or adjust the data processing, or we will demonstrate our compelling legitimate grounds, which require us to continue the processing;
Revoke your consent at any time according to Art. 7(3) GDPR if you have given it before the GDPR came into effect (i.e., before May 25, 2018) – which means your voluntarily expressed consent in an informed and unambiguous manner through a declaration or other clear affirmative action that you agree with the processing of the relevant personal data for one or more specific purposes – which will result in us no longer being permitted to continue the data processing based on this consent for the future;
Lodge a complaint with a data protection supervisory authority about the processing of your personal data in our company according to Art. 77 GDPR, for example at the supervisory authority responsible for us:

The Hessian Commissioner for Data Protection and Information Freedom
P.O. Box 3163
65021 Wiesbaden
Phone: +49 611 1408 – 0
Fax: +49 611 1408 – 900 / 901

(13) Changes to the Privacy Notice

In the course of the development of data protection law as well as technological or organizational changes, our Privacy Notices are regularly reviewed for adjustment or supplementation needs. Changes will be particularly communicated on our website at https://www.md-nomics.com. These Privacy Notices are up to date as of April 30, 2024.

B. Website

(1) Explanation of Function

Information about our company and the services we offer can be found at https://www.md-nomics.com and its associated subpages (hereafter collectively referred to as „Websites“). When you visit our Websites, your personal data may be processed.

(2) Processed Personal Data

During the informational use of the Websites, the following categories of personal data are collected, stored, and further processed by us:

„Log Data“: When you visit our Websites, a so-called log record (server log files) is temporarily and anonymously stored on our web server. This includes:

The page from which the requested page was referred (referrer URL)
The name and URL of the requested page (domain and request line)
The date and time of the visit
The description of the type, language, and version of the web browser used
The IP address of the requesting computer, which is shortened in such a way that personal identification is no longer possible
The amount of data transferred
The operating system
The message whether the call was successful (status code)

„Contact Form Data“: When using the contact form, the transmitted data are processed (e.g., name, first name, email address, telephone number, the time of transmission, consent to our privacy notices, and your entered message).

(3) Purpose and Legal Basis for Data Processing

We process the aforementioned personal data in accordance with the provisions of the GDPR and other relevant data protection regulations, and only to the extent necessary. Where the processing of personal data is based on Art. 6(1)(f) GDPR, the specified purposes also represent our legitimate interests.

The processing of log data is technically necessary to display our website to you. Furthermore, processing also serves statistical purposes and the improvement of the quality of our website, particularly the stability and security of the connection (legal basis is Art. 6(1)(f) GDPR).

The processing of contact form data is carried out to handle customer inquiries and contact (legal basis is Art. 6(1)(a) as well as Art. 6(1)(b) or Art. 6(1)(f) GDPR).

(4) Duration of Data Processing

Your data will be processed only as long as necessary to achieve the specified processing purposes; the legal bases outlined within the scope of these processing purposes apply accordingly. Please refer to section B.(6)c regarding the use and retention duration of cookies.

Third parties we employ will store your data on their systems for as long as necessary in connection with the provision of services to us, as required by the respective contract.

(5) Transmission of Personal Data to Third Parties; Legal Basis

The following categories of recipients, who are typically processors (see section A.(7)), may have access to your personal data:

Service providers for operating our website and processing data stored or transmitted through the systems (e.g., for data center services, IT security). The legal basis for the transfer is Art. 6(1)(b) or Art. 6(1)(f) GDPR, unless they are acting as processors;
Governmental authorities/agencies, as far as necessary to fulfill a legal obligation. The legal basis for the transfer is then Art. 6(1)(c) GDPR;
Persons engaged in conducting our business operations (e.g., auditors, insurers, legal advisors, regulatory authorities). The legal basis for the transfer is then Art. 6(1)(b) or Art. 6(1)(f) GDPR.

For assurances of an adequate level of data protection in the transfer of data to third countries, see section A.(8).

Furthermore, we only transfer your personal data to third parties if you have provided your express consent according to Art. 6(1)(a) GDPR.

(6) Use of Cookies, Plugins, and Other Services on Our Website

a. OpenStreetMap

For route descriptions, we use OpenStreetMap, a service provided by the OpenStreetMap Foundation, located at St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom, hereinafter referred to as „OpenStreetMap.“ These data are offered based on the Open Data Commons Open Database License (ODbL) by the OpenStreetMap Foundation (OSMF).

When you access our website into which the OpenStreetMap service is integrated, a request is sent to the OpenStreetMap server. This process involves the processing of your user settings and data for the purpose of displaying the page or ensuring the functionality of the OpenStreetMap service. This processing allows OpenStreetMap to identify, among other things, from which website your request has been sent and to which IP address the display should be transmitted.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the optimization and economical operation of our online presence.

For more information on the collection and use of data as well as your rights and options for protecting your privacy, OpenStreetMap provides further details at:

https://wiki.osmfoundation.org/wiki/Privacy_Policy

b. Google Fonts

In our online presence, we utilize Google Fonts to display external fonts. This service is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, hereafter referred to as „Google.“

Through certification under the EU-US Privacy Shield („EU-US Privacy Shield“)

https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active

Google guarantees that it complies with the EU’s data protection regulations even when processing data in the USA. To enable the display of certain fonts on our website, a connection to the Google server in the USA is established whenever our website is accessed. The legal basis for this is Art. 6(1)(f) GDPR. Our legitimate interest lies in the optimization and economical operation of our web presence. The connection made to Google when our website is accessed allows Google to determine from which website your request has been sent and to which IP address the display of the font should be transmitted.

Google provides further information under:

https://adssettings.google.com/authenticated

https://policies.google.com/privacy

especially regarding the options to restrict data usage.

c. Cookies

On our websites, we use cookies. Cookies are small text files that are stored on your hard drive, assigned to the browser you are using, and provide certain information to the entity that sets the cookie. Cookies cannot run programs or transmit viruses to your computer, and therefore do not cause any damage. They are intended to make the internet offering more user-friendly and effective, making it more pleasant for you. Cookies can contain data that makes it possible to recognize the device being used. However, some cookies only contain information about certain settings which are not personally identifiable. Cookies do not directly identify a user.

Cookies are differentiated into:

Session Cookies: These are deleted as soon as you close your browser.
Permanent Cookies: These are stored beyond the individual session.

In terms of their function, cookies are further categorized into:

Technical Cookies: These are strictly necessary for navigating the website, using basic functions, and ensuring the website’s security; they do not collect information about you for marketing purposes nor store which websites you have visited;
Performance Cookies: These collect information about how you use our website, which pages you visit, and, for example, whether there are errors in the use of the website; they do not collect information that could identify you – all collected information is anonymous and is only used to improve our website and find out what interests our users;
Advertising Cookies, Targeting Cookies: These are used to provide website users with advertising tailored to their needs on the website or to offer third-party deals, and to measure the effectiveness of these offers; advertising and targeting cookies are stored for a maximum of 13 months;
Sharing Cookies: These are used to enhance the interactivity of our website with other services (e.g., social networks); sharing cookies are stored for a maximum of 13 months.

The use of cookies that are not strictly necessary for technical reasons constitutes data processing that is only permitted with your express and active consent in accordance with Art. 6(1)(a) GDPR. This particularly applies to the use of advertising, targeting, or sharing cookies.

We use only technically necessary cookies that are essential for the function of our website. (The legal basis is Art. 6(1)(f) GDPR; Our legitimate interest lies in the optimization and economic operation of our web presence.) We do not use any other cookies. There is no transfer to third parties.

C. Direct Marketing

(1) Explanation of Function

We engage in direct marketing to inform potential customers about our services. In this process, we handle personal data.

(2) Processed Personal Data

In the context of direct marketing, we process the following personal data:

Surname and, if applicable, first name
Contact details such as telephone number and email address
Employer’s name
Employer’s address
Position you hold at your employer

(3) Purpose and Legal Basis for Data Processing

We process the aforementioned personal data in accordance with the provisions of the GDPR and other relevant data protection regulations, and only to the extent necessary. Where the processing of personal data is based on Art. 6(1)(f) GDPR, the stated purposes also represent our legitimate interests.

a. Direct Collection

If you have provided us with your personal data so that we can inform you about our services, for example, by handing over a business card, sending an email, or other means of contact, we process your personal data to get in touch with you and inform you about our services or to conduct contract negotiations (legal basis is Art. 6(1)(a), Art. 6(1)(b), or Art. 6(1)(f) GDPR).

b. Acquisition of Personal Data from Third Sources

If we process your personal data and contact you to make you aware of our services without you having provided us with your personal data, we have obtained your personal data from third-party sources. For this purpose, we use the internet presence of your employer as a generally publicly accessible source. Should we have obtained your data through a recommendation from a third party, we will specifically inform you of this at the first point of contact (legal basis is Art. 6(1)(f) GDPR).

(4) Duration of Data Processing

Your data will be processed only as long as necessary for the achievement of the aforementioned processing purposes; the legal bases specified within the scope of these processing purposes apply accordingly.

Third parties employed by us will store your data on their systems for as long as necessary in connection with the provision of services to us, according to the respective contract.

(5) Transmission of Personal Data to Third Parties; Legal Basis

The following categories of recipients, who are typically processors (see section A.(7)), may have access to your personal data:

Service providers for the operation of IT and communication systems (e.g., for data center services, IT security, telecommunications). The legal basis for the transfer is then Art. 6(1)(b) or Art. 6(1)(f) GDPR, unless they are acting as processors;
Governmental authorities/agencies, as far as necessary to fulfill a legal obligation. The legal basis for the transfer is then Art. 6(1)(c) GDPR;
Persons engaged in conducting our business operations (e.g., auditors, insurers, legal advisors, regulatory authorities). The legal basis for the transfer is then Art. 6(1)(b) or Art. 6(1)(f) GDPR.

For assurances of an adequate level of data protection in the transfer of data to third countries, see section A.(8).

Furthermore, we only transfer your personal data to third parties if you have provided your express consent according to Art. 6(1)(a) GDPR.