Privacy Notice of Bhakti Event GmbH

and its affiliated companies

Bhakti Marga Yoga gGmbH, Bhakti Marga Stiftung as revised on 20 February 2024

Summary

We are very delighted that you have shown interest in our enterprise. With this summary, we intend to provide you with a brief overview on what we do with your personal data for an easily understanding. For more detailed information on each of the sections below, we recommend reading the full version of this privacy notice.

I. Scope: This privacy notice applies to the use of your personal data in the context of using our websites and order products and services.

II. Responsibility: Bhakti Event GmbH is generally responsible for the collection and processing of your personal data. However, in some cases, we may jointly process your personal data with third parties, in particular other Bhakti Marga entities. You can find contact detail in section 2.

III. Data Collected and Purposes of Use: The types of data that we process personal data such as your names, contact details, contract- and registration-related data, communication data, user and usage data and IP address, but also more sensitive data that reveal information on your religious or philosophical beliefs, such as your spiritual name or initiation status. We use your personal data to fulfil contracts with you (by fulfilling your orders and support you in your spiritual path etc.) or to pursue our legitimate interest that are not overridden by your fundamental rights and freedoms, such as promoting our cause by providing news on what may be of interest to you (such as events and courses), improving our services and ensuring the confidentiality and integrity our services, or simply to communicate with you. Where we process data on your religious or philosophical belief, we will ask for your consent. For detailed information on the types of date and the purposes of use as well as the legal basis we rely on when processing your personal data, please see section 3.

IV. Where we obtain data: We process personal data about you that you mostly directly provide to us, for example when you register for a Bhakti ID account, order products and services or communicate with us. We may also automatically collect personal data when you use our services, for example by using cookies. In addition, we may receive information from third-parties, such as family members or friends who may mention you in connection with an event (for example a prayer) or a donation.

V. How we share data: We may share certain personal data with other Bhakti Marga entities, service providers who support us in providing our services to you, who are either processors acting on our behalf (such as, for example, to support our marketing activities and maintain our website) or controllers themselves (such as , for example, payment service providers and donation and accounting service providers and shipping and distribution companies) or the public if you comment on our blog. You can learn more about how we share your personal data in section 5.

VI. International transfer: We may transfer your personal data to other countries that are located outside the European Economic Area, which means that in these countries, less protective privacy laws and regulations apply. However, we will ensure that to put appropriate legal safeguards in place for such transfers.

VII. Storage of Data: We process and store your personal data only as long as necessary for our processing purposes. However, sometimes the law requires us to keep such data for longer. To learn more about storage periods, please see section 7.

VIII. Your Rights: You have certain rights under the General Data Protection Regulation concerning your personal data. The types rights you have and further information in this regard can be found in section 8.

IX. Obligation to provide data? You do not have to provide personal data to us, but we may not be able to provide our services if we do not have your personal data.

X. No automate decision making: Bhakti does not use automated decision-making procedures.

XI. Tracking technology: We use cookies and other tracking technology, for example to improve our services, offer news and content that may be of interest to you and remember your preferred settings. Information on how tracking technologiy works, what types of cookies we use, and how log they are valid can be found in section 11, detailed information on the used cookies can be found in our Cookie Policy.

XII. Third Party Online Services: We use third-party plug-ins and other online services to provide you a convenient and interesting website and enable to easily access content from social media platforms. These third parties are (joint) controllers and they may decide on what types of personal data they collect. However, to honor your privacy, we selected an implementation of the various plug-ins that ensures that personal data will not be shared with these third-party services providers, if you activate or interact with these services. To learn more about these services, please see section 14.

XIII. Security. We take the security of your data very seriously. We have implemented various technical and organisational measures to protect your personal data. Details can be found in section 18.

XIV. Updates: We may update this Privacy Notice from time to time, the date of the last update is indicated at the beginning of this privacy notice.

1. Scope of application

We are very delighted that you have shown interest in our enterprise. Data protection is of a particularly high priority for the management of the Bhakti Event GmbH (herewith "Bhakti Event" or "we") and we are committed to protecting your privacy and personal data. With this Privacy Notice we would like to inform you in detail about how we use your personal data and what rights you have.

This Privacy Notice applies to the use of your personal data when you visit our websites available at:

http://www.bhaktimarga.org/ www.shreepeethanilaya.org https://justlovefestival.org/ https://paramahamsavishwananda.com/ https://bhaktishop.com/ https:/events.bhaktimarga.org

by e-mail or telephone, when you order products or services, or when you create a personal account on the website.

2. Who is responsible and to whom can I reach out?

Bhakti Event GmbH, Am Geisberg 4, 65321 Heidenrod, is responsible for the processing of personal data described in this Privacy Notice.

You can contact the following office for all inquiries related to data protection:

Bhakti Event GmbH

Am Geisberg 4

65321 Heidenrod

Germany

Tel. 06124/609 1125

E-mail dataprotection@bhaktimarga.org

You can contact our data protection officer, lawyer Mrs Anna Aman via following emails:

dataprotection@bhaktimarga.org or

anna.aman@bhaktimarga.org

Any data subject may, at any time, contact our data protection officer directly with all questions and suggestions concerning data protection.

Affiliated companies

Bhakti Event GmbH operates together with the following companies, which also declare this Privacy Notice as theirs:

Bhakti Marga Stiftung

Am Geisberg 1-8

65321 Heidenrod

Germany

Tel. 06124/609 1125

Bhakti Marga Yoga gGmbH

Am Geisberg 1-8

65321 Heidenrod

Germany

Tel. 06124/609 1125

You can contact our data protection officer, lawyer Mrs Anna Aman via following emails:

dataprotection@bhaktimarga.org or

anna.aman@bhaktimarga.org

Please note that we act as joint controllers with our umbrella Organisation subsidiary Bhakti Marga Stiftung (with regard to the Bhakti Marga Academy App provided by the 360Learning collaboration platform and to donations and endowments, with the exception of the "Serve a deity" donation programme, free temple events and applications for short voluntary activities organised by Bhakti Marga Yoga gGmbH). For further details in this respect, please see section 5.3. We have a contractual agreement with the tour operator Inner Journey GmbH regarding the video accompaniment of Inner Journey GmbH trips with Swami Vishwananda and other BM Swamis for the purpose of offering our virtual pilgrimage and a video production as a video-on-demand service on the media platform "Guru Connect".

3. Which data do we process from you, for what purposes and on what legal basis do we process your data?

We collect and process various personal data from you depending on the specific processing situation. Below you will find a list of the data related to the respective processing situations.

We process your personal data exclusively in accordance with the provisions of the General Data Protection Regulation ("GDPR") and the Federal Data Protection Act (Bundesdatenschutzgesetz) ("BDSG"). In certain situations, we also process your personal data to fulfill other legal obligations or based on your explicit consent.

In general, we process your personal data:

· For the performance of a contract

We process your personal data to fulfill contractual or quasi-contractual obligations, to enter into an agreement, e.g. to provide services in our role as an investor, to support current customers, or to answer questions in relation to our services.

· To be in compliance with legal obligations

To the extent that we are subject to legal obligations, for the compliance of which the processing of your personal data is necessary, we process your personal data on the basis of these legal obligations.

· Based on our legitimate interests

We also process your personal data to protect our legitimate interests, except where your interests or fundamental rights and freedoms, which require the protection of your personal data prevail.

Subject to a decision to be made in individual cases, we usually assume that our legitimate interests prevail within the context of, in particular, the following processing situations:

§ Improving our offers and services;

§ Analysis of the usage of our websites;

§ Ensuring the confidentiality and integrity of our IT systems;

§ General communication with you;

§ Cooperation with public authorities;

§ Activities to make us and our services known;

§ Eventually, we may also pursue or defend ourselves against legal claims

· Based on your consent

If you have given us separate consent to process your personal data, we will process your personal data within and on the basis of this consent. Consents may, for example, relate to the transfer of data to associated companies or third persons, the evaluation of your data for targeted advertising activities or sending of newsletters.

Consent is always freely given. Refusing or revoking your consent will not have any negative consequences for you.

3.1 Visiting our websites

3.1.1 What data do we process when you visit our websites?

If you use the services provided by Bhakti Event on the websites without registering, we will process, inter alia, the following personal data from you:

· Data about the usage of the provided websites (e.g., used browser, used operating system, internet service provider of the accessing system, referrer URL, sub-websites, date and time of server request, requested contents, duration of usage);

· IP address.

3.1.2 For what purposes and on what legal basis do we process this data?

When using these data, Bhakti Event does not draw any conclusions about the data subject. Rather, this information is needed to (1) deliver the content of our website correctly, (2) optimize the content of our website, (3) ensure the long-term viability of our information technology systems and website technology, and (4) provide law enforcement authorities with the information necessary, e.g., for criminal prosecution in case of a cyber-attack.

Bhakti Event analyses anonymously collected data and information statistically, with the aim of increasing the data protection and data security of our enterprise, and to ensure an optimal level of protection for the personal data we process. The anonymous data of the server log files are stored separately from all personal data provided by you.

The processing is necessary for the purposes of protecting our legitimate interests, except where your interests or fundamental rights and freedoms, which require the protection of your personal data prevail (Art. 6 (1) lit. f GDPR).

3.1.3 Further information on processing operations, procedures and services:

- Provision of online offer on rented storage space: For the provision of our online offer, we use storage space, computing capacity and software that we rent or otherwise obtain from a corresponding server provider (also called "web host"); legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

- Collection of access data and log files: Access to our online offering is logged in the form of so-called "server log files". The server log files may include the address and name of the websites and files accessed, the date and time of access, the amount of data transferred, notification of successful access, browser type and version, the user's operating system, referrer URL (the previously visited page) and, as a rule, IP addresses and the requesting provider. The server log files may be used for security purposes, e.g. to avoid overloading the servers (especially in the event of abusive attacks, so-called DDoS attacks) and to ensure the utilisation of the servers and their stability; legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR). Deletion of data: Log file information is stored for a maximum of 30 days and then deleted or anonymised. Data whose further retention is required for evidentiary purposes is excluded from deletion until the respective incident has been finally clarified.

3.1.4 Website Hosting

· Mediactive: Mediactive SAS, situé 3-4-10, 3 Cité Paradis - 75010 Paris (RCS PARIS B 487 724 536 00015), responsible Alexandre Lafond, https://www.groupe-mediactive.fr/.

· WordPress.com: Hosting and software for the creation, provision and operation of websites, blogs and other online offerings; service provider: Aut O'Mattic A8C Ireland Ltd, Grand Canal Dock, 25 Herbert Pl, Dublin, D02 AY86, Ireland; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://wordpress.com; Privacy Policy; Data Processing Agreement. Basis for transfer to third countries: EU-US Data Privacy Framework (DPF).

3.2 Registration on the website, Bhakti ID and personal profile

3.2.1 Which data do we process when you register on our website?

If you take the possibility to register on our website, we will process, inter alia, the following data:

· IP address,

· Date and time of the registration,

· Username and password,

· E-mail address.

In addition, you can provide us with further personal data, inter alia, your first and last name as well as your shipping and billing address. You can insert such further information as part of the registration process on a voluntary basis. You can decide yourself whether you want to provide such data which is marked as "optional".

After creating your account, you will have your own personal profile on our website (Bhakti-ID). In the further process, you can enter into your profile further information about you (such as your country, phone number, date of birth, a photo of you, language preference) on a voluntary basis.

In addition, you can provide information about your Devotee or Brahmachari status (inter alia, date of initiation, your initiating person, related Swamis or Rishis, Ishtadev), information on your experience with Atam Kriya Yoga (such as your level and your teacher and/or initiating person) and courses already taken with us (for example, attended in Atma Kriya Yoga) and whether you are a Bhakti Marga Teacher (all together referred to as “My Data”).

The information you provide may contain personal data relating to your religious or philosophical beliefs (i.e., special categories of personal data pursuant to Art. 9 (1) GDPR), such as your spiritual name, your Devotee or Brahmachari status and related initiation information, information about your initiations and Ishtadev.

3.2.2 For what purposes and on what legal basis do we process this data?

The data is collected, processed and stored for internal use by us, and for the purpose to provide you with a personal user profile (Bhakti ID). In addition, Bhakti Event will provide you with a personalized dashboard where you can, for example, make donations and see your donation history.

The registration data is intended to enable Bhakti Event to offer you content or services that may only be offered to registered users due to the nature of the matter in question. In addition, we use your registration and profile data to provide you with special offers based on your specific and individual interests. Finally, we use your profile data to support your Journey at Bhakti Event and to help you achieving your goals, for example the Devotee status. In this regard we use your data, inter alia, to contact you directly via email.

To be in a position to offer you events or courses that are only open with a certain status (such as Devotee or Brahmachari) we need to send your personal status information (such as your Devotee or Brahmachari status) to your initiating Swami/Rishi. The Swami/Rishi uses the information about your status, in particular, to verify your current initiation status. Without your consent to share such data for such verification, we cannot provide certain offers to you. In addition, with your consent, we may send “My Data” to your initiating Swami/Rishi/ or the Bhakti Marga Country Coordinator responsible for you (“BMCC”). The Swami/Rishi/BMCC may use this data to contact you directly in order to help you on your spiritual path, to

support you and provide information with news and updates on Bhakti, our events, courses, offers and fundraising.

Registered persons are free to change the personal data specified during the registration process and profile update at any time, or to have them completely deleted from our database.

The processing is necessary to fulfil contractual or quasi-contractual obligations (Art. 6 (1) lit. b GDPR) or for the purposes of protecting our legitimate interests, except where your interests or fundamental rights and freedoms, which require the protection of your personal data prevail (Art. 6 (1) lit. f GDPR).

If required by applicable law, we will seek your explicit consent (Art. 6 (1) lit. a GDPR) (such as where we share your data with the Swami/Rishi//BMCC) to process and transfer personal data collected on our websites or volunteered by you. Consent will be entirely voluntary. However, if the requested consent to process your personal data has not been granted by you, the use of this website may not be entirely possible.

We only collect and process data relating to your religious or philosophical beliefs (special categories of personal data according to Art. 9 (1) GDPR), such as your spiritual name or, with your explicit consent.

3.3. Subscription to the Bhakti Membership (Guru Connect)

3.3.1 Which data do we process when you subscribe to our membership?

On our website, users are given the opportunity to subscribe to our exclusive membership. In order to subscribe to our membership, you need to buy a subscription in Bhakti Event´s online shop. If you subscribe to our membership, we will process, inter alia, the following data:

· IP address,

· Date and time of the registration,

· Title (optional),

· Your first and last name,

· E-mail address,

· Phone number,

· Company name,

· Country,

· Address,

· Payment information such as credit card number or other bank information.

3.3.2 For what purposes and on what legal basis do we process this data?

With the exclusive membership you can access the members dashboard, exclusive member content on the website and you can book special events and courses and get special offers and access to special video-on- demand services.

Registered members are free to change the personal data specified during the subscription process and profile update at any time, or to have them completely deleted from the database of Bhakti Event.

The processing is necessary to fulfil contractual or quasi-contractual obligations (Art. 6 (1) lit. b GDPR) or for the purposes of protecting our legitimate interests, except where your interests or fundamental rights and freedoms, which require the protection of your personal data prevail (Art. 6 (1) lit. f GDPR).

If required by applicable law, we will seek your explicit consent to process personal data collected on our websites or volunteered by you. Consent will be entirely voluntary. However, if the requested consent to process your personal data has not been granted by you, the use of this website may not be entirely possible.

We only collect and process data relating to your religious or philosophical beliefs (special categories of personal data according to Art. 9 (1) GDPR), such as your spiritual name or, with your explicit consent.

3.4 Subscription to our newsletter

3.4.1 Which data do we process when you subscribe to our newsletter?

On our website, users are given the opportunity to subscribe to our newsletter. If you subscribe to our newsletter, in addition to your first and last name, your e-mail address and your country (optional), we may, depending on the newsletter you are subscribing for, also process “My Data” which you have voluntarily provided to us during the process to create an Bhakti ID account. In particular, we process all information that is necessary to prove that you have registered for the newsletter. In this regard, we use the so-called double opt-in procedure to confirm your subscription and e-mail address. In this process, an e-mail is sent to the provided e-mail address with a message asking you to confirm your consent. In connection with the double opt-in process, we document the IP address, date and time of submission of the web form as well as the IP address, date and time of confirmation of the double opt-in e-mail.

3.4.2 Newsletter-Tracking

We would like to point out that our newsletter contains so-called tracking pixels. A tracking pixel is a miniature graphic embedded in such e-mails, which are sent in HTML format to enable log file recording and analysis. The newsletters contain a so-called "web beacon", i.e. a pixel-sized file that is retrieved from our server when the newsletter is opened or, if we use a dispatch service provider, from their server. As part of this retrieval, technical information, such as information about the browser and your system, as well as your IP address and the time of retrieval, is initially collected. This allows a statistical analysis of the success or failure of online marketing campaigns. Based on the embedded tracking pixel, we may see if and when an e-mail was opened by you, and which links in the e-mail were called up by you.

Such personal data collected in the tracking pixels contained in the newsletters are stored and analysed by us in order to optimise the sending of the newsletter, as well as to adapt the content of future newsletters even better to the interests of the data subject. These personal data will not be passed on to third parties.

The tracking of opening statistics and click rates as well as the storage of the tracking results in the user profiles and their further processing are based on the user's consent.

In this context, we collect your personal data such as IP address, browser type and device as well as the time. This data can be used to create user profiles under a pseudonym. The data collected will not be used to identify you personally. The data collected is only used for statistical analysis to improve newsletter campaigns.

The measurement of opening rates and click rates and the storage of the measurement results in the user profiles and their further processing are carried out on the basis of the user's consent.

Unfortunately, it is not possible to revoke the performance measurement separately; in this case, the entire newsletter subscription must be cancelled or objected to. In this case, the stored profile information will be deleted.

3.4.3 For what purposes and on what legal basis do we process this data?

The personal data collected as part of the registration for the newsletter will only be used to send our newsletter. Our newsletters keep you posted about what is new and upcoming. While the content varies from one to the next, they all include a message from Paramahamsa Vishwananda along with any important information you need to know. If English is a challenge for you, no problem: the newsletter is always translated into more than a dozen languages. In addition, subscribers to the newsletter may be informed by e-mail, as long as this is necessary for the operation of the newsletter service or a registration in question, as this could be the case in the event of modifications to the newsletter offer, or in the event of a change in technical circumstances. There will be no transfer of personal data collected by the newsletter service to third parties.

We will process your personal data in connection with the newsletter sending and tracking within and on the basis of your consent (Art. 6 (1) lit. a GDPR respectively Art. 9 (2) lit. a GDPR). Consent is always freely given. Refusing and revoking your consent will not have any negative consequences for you.

Your personal data is also processed on the basis of Art. 6 para. 1 lit. f GDPR due to our overriding legitimate interest in a targeted, effective advertising and user-friendly newsletter system. You have the right to object to this processing of your personal data at any time on grounds relating to your particular situation.

Your data may be transmitted to HubSpot servers in the USA and stored there. The EU Commission has issued an adequacy decision for the USA, the Trans-Atlantic Data Privacy Framework (TADPF). HubSpot has certified itself in accordance with the TADPF and is therefore committed to complying with European data protection principles.

You can withdraw your consent from Bhakti Event GmbH and unsubscribe from our newsletter at any time. For the purpose of withdrawal of consent, a corresponding link is included in each newsletter. It is also possible to unsubscribe from the newsletter at any time by contacting us at unsubscribe@bhaktimarga.org.

3.4.4 Processor Hubspot

We use the service of HubSpot Ireland Ltd (Ground Floor, Two Dockland Central Guild Street, Dublin 1, Ireland; "HubSpot") for the newsletter dispatch within the framework of order processing. HubSpot is a company affiliated with HubSpot, Inc. (25 First Street, Cambridge, MA 02141 USA). We pass on the information you provide when registering for the newsletter (e-mail address, first and last name if applicable) to HubSpot. The data processing serves the purpose of sending the newsletter and its statistical analysis.

Further information can be found in HubSpot's privacy policy. Order processing contract: https://legal.hubspot.com/de/dpa; Basis for third country transfer: EU-US Data Privacy Framework (DPF), standard contractual clauses (provided by the service provider). Further information: special security measures.

3.5 Contact possibility via the website

3.5.1 Which data do we process when you contact us?

Our website contains information that enables a quick electronic contact to us. Depending on your request, you can contact us via our website (including via our live-chat channel), via e-mail or outside the Internet, either by telephone or in writing. We process the data you send with your request, inter alia, your first name, last name, organization (if applicable), department (if applicable), e-mail address, telephone number, and

other information that you have provided to us. In the case of the use of the live-chat channel, we also need to process you IP address.

3.5.2 For what purposes and on what legal basis do we process this data?

The personal data collected as part of the contacting will only be used to answer your inquiry. Therefore, the processing is necessary to fulfil contractual or quasi-contractual obligations (Art 6 (1) lit. b GDPR) or for the purposes of protecting our legitimate interests (Art. 6 (1) lit. f GDPR).

3.5.3 Collection and processing when using the contact form

When you use the contact form, we only collect your personal data (name, e-mail address, message text) to the extent that you provide it. The data processing serves the purpose of establishing contact.

If the purpose of the contact is to carry out pre-contractual measures (e.g. advice on an interest in purchasing, preparation of an offer) or concerns a contract already concluded between you and us, this data processing is carried out on the basis of Art. 6 para. 1 lit. b GDPR.

If contact is made for other reasons, this data processing is carried out on the basis of Art. 6 para. 1 lit. f GDPR due to our overriding legitimate interest in processing and responding to your enquiry. In this case, you have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data concerning you based on Article 6(1)(f) GDPR.

We will only use your email address to process your enquiry. Your data will then be deleted in compliance with statutory retention periods, unless you have consented to further processing and use.

3.5.4 Collection and processing when using the application form

When you use the application form, we only collect your personal data to the extent that you provide it. This includes your contact details (e.g. name, e-mail address, telephone number), details of your professional qualifications and training, details of further professional training and performance-related evidence.

The data processing serves the purpose of establishing contact and deciding on the establishment of an employment relationship with you. The provision of the data is necessary in order to carry out the application process. Your personal data is processed on the basis of Art. 6 para. 1 lit. b GDPR in conjunction with Art. 26 para. 1 BDSG. § 26 para. 1 BDSG for the implementation of pre-contractual measures (going through the application procedure as an employment contract initiation).

If you have given us your consent to the processing of personal data for inclusion in our applicant pool, e.g. by ticking a checkbox, the processing is carried out on the basis of Art. 6 para. 1 lit. a GDPR. You can withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

If special categories of personal data within the meaning of Art. 9 para. 1 GDPR are requested from applicants as part of the application process, such as information on the degree of severe disability, this is done on the basis of Art. 9 para. 2 lit. b. GDPR.

GDPR, so that we can exercise the rights arising from labour law and social security and social protection law and fulfil our obligations in this regard.

We store your personal data for as long as this is necessary for the decision on your application. Your data will then be deleted after six months at the latest, unless you have consented to further processing and use. If an employment relationship is established following the application process, the data provided will be further processed on the basis of Art. 6 para. 1 lit. b GDPR in conjunction with Section 26 para. 1 BDSG for the purposes of implementing the employment relationship and then transferred to the personnel file.

3.6 Customer account orders

3.6.1 Customer account

When you open a customer account, we collect your personal data to the extent specified there. The purpose of data processing is to improve your shopping experience and simplify order processing. The processing is carried out on the basis of Art. 6 para. 1 lit. a GDPR with your consent. You can revoke your consent at any time by notifying us without affecting the legality of the processing carried out on the basis of the consent until revocation. Your customer account will then be deleted.

3.6.2 Collection, processing and forwarding of personal data for orders

When you place an order, we collect and process your personal data only to the extent necessary to fulfil and process your order and to process your enquiries. The provision of the data is necessary for the conclusion of the contract. Failure to provide the data means that no contract can be concluded. The processing is carried out on the basis of Art. 6 para. 1 lit. b GDPR and is necessary for the fulfilment of a contract with you.

Your data will be passed on, for example, to the shipping companies and dropshipping providers you have selected, payment service providers, service providers for order processing and IT service providers. In all cases, we strictly observe the legal requirements. The scope of data transfer is limited to a minimum.

Your data may be transferred to third countries outside the European Union for which an adequacy decision has been issued

3.7 Virtual pilgrimages

3.7.1 Affiliated company for pilgrimages

· Tour operator is Inner Journey GmbH, Glärnischstrasse 15, 8712 Stäfa, Switzerland,

phone +41 79 918 80 88, e-mail: info@innerjourney.ch, www.innerjourney.ch, https://innerjourney.ch/about/#privacy-policy, commercial register Switzerland (Zefix); registration number: UID: CHE-413.724.090.

Bhakti Bharat Bhakti Bharat, a registered partnership firm,, GST: 09AAVFB5794R1Z2, PAN: AAVFB5794R, IEC: AAVFB5794R, Address:Ground floor, 383 Sheetal Chaya,Raman Reti road,Vrindavan 281121 E-mail: PVindiaadventures@bhaktib.in, privacy policy.

3.7.2 What data do we process when you register for a pilgrimage

We only process data in the case of a subsequent virtual pilgrimage: name, surname, e-mail address, language of interpretation, spiritual name (optional), information about the pilgrimage, photo and video recordings of the pilgrimage for which you have registered in the case of a parallel virtual pilgrimage.

3.7.3 Purpose

If you sign a video production contract with us, we will use your photo and video footage of the pilgrimage you took part in to offer the digital product of a live virtual pilgrimage and to offer the digital product of a video-on-demand as a subscription within the media platform "Guru Connect". We use Hexaglobe platform for video production and editing. There is an order processing agreement with Hexaglobe in accordance with Art. 28 GDPR.

We have concluded a contractual agreement with the tour operator Inner Journey GmbH, regarding the video accompaniment of Inner Journey GmbH trips with Swami Vishwananda and other BM Swamis, for the purpose of offering our virtual pilgrimage and a video production as a video-on-demand service on the media platform "Guru Connect".

In addition, we may use your photos and videos taken during the pilgrimage for commercial purposes. This means that your photos and videos may be used on our websites, in (print) publications and on our Facebook, Instagram page and YouTube channel. The same applies to Bhakti Bharat.

3.7.1.3 On what legal basis do we process the data?

The processing takes place on the legal basis of Art. 6 para. 1 lit. b GDPR (fulfilment of contract / video production contract) and on your consent in accordance with Art. 6 para. 1 lit. a GDPR. Furthermore, the processing of the data available to us in connection with business transactions, contracts, booked travel services in connection with usage data as well as the e-mail address and address of the travel applicant for the purpose of direct advertising is carried out on the legal basis of legitimate interest (Art. 6 para. 1 lit. f GDPR in conjunction with § 7 para. 3 UWG) or consent, Art. 6 para. 1 lit. a GDPR). We may also process your spiritual name as part of the pilgrimage if you request such use (Art. 9 para. 2 lit. a GDPR). After the contract has been fully processed, we will continue to store the aforementioned data for verification purposes and for the purpose of defence against legal claims on the basis of legitimate interest (Art. 6 para. 1 lit. f GDPR) and for the fulfilment of statutory retention periods (Art. 6 para. 1 lit. c GDPR). If you consent, we may also process your personal data for commercial purposes as described above and for participation in the shared experience during the pilgrimage (Art. 9 para. 2 lit. a GDPR).

Processor: Hexagobe, 171 - 173 rue Saint-Martin 75003, Paris, France, +33 1 42 86 67 68 contact@hexaglobe.com

Further information can be found in Hexaglobe's privacy policy. We have concluded an order processing contract with Hexaglobe in accordance with Art. 28 GDPR.

3.7.2 Booking a virtual pilgrimage

3.7.2.1 Which data do we process when you book a virtual pilgrimage?

If you book a virtual pilgrimage via our website, we process from you, inter alia, first and last name, e-mail address, language of interpretation, spiritual name (optional), information about the pilgrimage you have registered for, your IP address and payment information such as credit card number or other bank information.

We may also process videos recordings of you while you participate in the virtual pilgrimage to share the common experience with the whole participating (online and offline) community during a livestream and a certain period then after. In this process, the username by which you participate in the virtual pilgrimage will also be displayed.

Moreover, we may use your photos and videos taken during the pilgrimage for the purpose of commercial use. This means your photos and videos may be used on our websites, in (print) publications and our Facebook, Flickr, Instagram page as well as our You Tube channel.

3.7.2.2 For what purposes and on what legal basis do we process this data?

The personal data will be collected as part of the virtual pilgrimage booking and to fulfil the services, for contract communication and the IP address for verification and documentation purposes.

We may also analyse the data we have on business transactions, contracts, booked travel services in conjunction with usage data to increase the user-friendliness of our services, optimise our portfolio and to provide you with offers tailored to your interests. The analyses serve us alone and are not disclosed externally unless they are anonymous analyses with aggregated values.

The processing is based on the legal basis of Art. 6 (1) lit. b GDPR (performance of contract. Furthermore, the processing of the data available to us relating to business transactions, contracts, booked travel services in conjunction with usage data as well as the e-mail address and address of the travel applicant for the purpose of direct advertising is based on the legal basis of legitimate interest (Art. 6 (1) lit. f GDPR in conjunction with § 7 (3) UWG) or consent, Art. 6 (1) lit. a GDPR). We may also process your spiritual name in the context of the pilgrimage to the extent you agree to such use (Art. 9 (2) lit. a GDPR). After complete processing of the contract, we continue to store the aforementioned data for verification purposes as well as for the purpose of defending legal claims on the basis of legitimate interest (Art. 6 (1) lit. f GDPR) as well as for the fulfilment of legal retention periods (Art. 6 (1) lit. c GDPR).

To the extent you consent, we may also process your personal data for commercial use as set out above as well as to participate in the common experience during the pilgrimage (Art. 9 (2) lit. a GDPR).

To provide a virtual pilgrimage, for video production and editing, we use Hexaglobe.

Processor: Hexagobe, 171 - 173 rue Saint-Martin 75003, Paris, France, +33 1 42 86 67 68 contact@hexaglobe.com

Further information can be found in Hexaglobe's privacy policy. We have concluded an order processing contract with Hexaglobe in accordance with Art. 28 GDPR.

3.8 Registration for events

3.8.1 Which data do we process in the context of booking and managing events?

If you register for our paid events in the event calendar on our website (you do not need a Bhakti ID account for an event booking), we process from you, inter alia, title, first and last name, country, address, e-mail address, telephone number, spiritual name (optional), information about the event you have registered for, payment information such as credit card number or other bank information.

If you register for our free events in the event calendar on our website, we process from you, inter alia, username, e-mail address, spiritual name (optional), information about the event you have registered for.

3.8.2 For what purposes and on what legal basis do we process this data?

The personal data collected as part of the event booking and managing will particularly be used to fulfil your inquiry. In addition, we may use the collected data to contact you directly and offer you similar offers and events based on your booking history and personal interests.

The processing is necessary to fulfil contractual or quasi-contractual obligations (Art. 6 (1) lit. b GDPR). The processing of your data for the free events is based on the legitimate interest Art. 6 lit f GDPR to be able to offer you the booked service. We may also seek your explicit consent to process personal data collected in connection with the event booking and managing (Art. 6 (1) lit. a GDPR). Consent will be entirely voluntary.

We only collect and process data relating to your religious or philosophical beliefs (special categories of personal data according to Art. 9 (1) GDPR), such as your spiritual name or, with your explicit consent.

3.8.3 Photo, filming, livestream in the temple and our events

During our events in the temple and in the event tent, photo and/or film recordings (including sound) and a live broadcast are made and broadcast live in real time.

Your religious beliefs may become recognisable in this process.

In addition, we may use your photos and videos recorded during the event for commercial purposes. This means that your photos and videos may be used on our websites, in (print) publications and on our Facebook, Flickr, Instagram page and YouTube channel. At the beginning and end of the darshan, when Paramahamsa Vishwananda enters and leaves the venue, video and audio recordings for a livestream take place, especially of Paramahamsa Vishwananda, so it may happen that participants are also captured by the livestream recordings. It is mainly the rituals, the priests, swamis and swaminis and Paramahamsa Vishwananda that are filmed. Recordings of guests will be avoided as far as possible, but cannot be ruled out.

If you do not want to be photographed or filmed, you can go to the photo/video/livestream -free area.

3.8.4 For what purposes and on what legal basis do we process this data?

· Purpose: The recordings may be published or broadcast live on the Internet, the online portal of social media channels, or on the Bhakti Marga YouTube channel or on other Internet-based networks, platforms or mobile apps, live streaming (real-time streaming) on the Bhakti Marga website or on the Bhakti Marga Facebook page, the responsible entity as well as in TV and print media (including books). To share the common experience with the entire participating (online and offline) community during a livestream and a certain period of time afterwards. Possible further recipients can be found in this privacy policy.

· Duration of processing: The recordings are stored for 3 years and then deleted.

· Legal basis and legitimate interest: The processing is carried out on the basis of the legitimate interest of the controller to document the event organised visually, and to report positively to a larger public (Art. 6 para. 1 lit. f GDPR) as well as on your voluntary consent in accordance with Art. 6 para.

1 lit. a GDPR. We only collect and process data relating to your religious or philosophical beliefs (special categories of personal data pursuant to Art. 9 (1) GDPR), e.g. only with your express consent.

Order processors:

- Hexagobe, 171 - 173 rue Saint-Martin 75003, Paris, France, +33 1 42 86 67 68 contact@hexaglobe.com Further information can be found in Hexaglobe's privacy policy. We have concluded an order processing contract with Hexaglobe in accordance with Art. 28 GDPR.

- Flickr, operated by Flickr, Inc, Flickr c/o Yahoo! Inc, 701 First Avenue, Sunnyvale, CA 94089, USA. Further information can be found in Flickr's privacy policy. Basis for the transfer to third countries: Standard contractual clauses. Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.flickr.com, Privacy Policy: https://www.flickr.com/help/privacy. Data processing agreement: https://www.flickr.com/help/dpa.

- YouTube: Social network and video platform; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Privacy Policy: https://policies.google.com/privacy; Basis for third country transfer: EU-US Data Privacy Framework (DPF). Option to object (opt-out): https://adssettings.google.com/authenticated. DPA: https://www.youtube.com/t/terms_dataprocessing.

3.9 Fundraising and endowments

3.9.1 Which data do we process in the context of the fundraising function?

You can use a fundraising function on our website. If you fundraise, we process from you, inter alia, name, surname, email, and payment information such as credit card number or other payment information.

The processing of donations is handled by the third-party providers Raisenext of Buildnext GmbH, located at Bremer Heerstr. 117, 26135 Oldenburg, Germany.

For more information in relation to the data processing by Raisenext see the imprint information: https://www.raisenext.de/impressum and Raisenext's Privacy Policy: https://www.raisenext.de/datenschutz. We have concluded an order processing contract with Buildnext in accordance with Art. 28 GDPR.

3.9.2 Donations are processed via the Shopify software

We use the e-commerce software Shopify for the online donation management on our website https://donate.bhaktimarga.org and on the website https://donate.shreepeethanilaya.org. Shopify International Limited, address: Victoria Buildings, 2nd floor

1-2 Haddington Road, Dublin 4, D04 XN32, Ireland, e-mail: hilfe@shopify.de, Privacy Policy of Shopify https://www.shopify.com/legal/privacy.

Shopify processes this data primarily on European servers. Shopify sends some data to its Canadian servers. Data transfers to Canada are legitimised by an adequacy decision. Occasionally, Shopify sends data to sub-

processors in the USA. However, Shopify obliges them to comply with strict data protection obligations. We have concluded an order processing contract with Shopify in accordance with Art. 28 GDPR.

Shopify Data Processing Addendum. For more information, please visit the page of our online shop Privacy Policy.

We use the payment service provider "Shopify Payments", 3rd Floor, Europa House, Harcourt Building, Harcourt Street, Dublin 2. If you choose a payment method offered by the payment service provider Shopify Payments, the payment will be processed by the technical service provider Stripe Payments Europe Ltd, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland, to whom we pass on your information provided during the ordering process together with the information about your order (name, address, account number, bank sort code, credit card number if applicable, invoice amount, currency and transaction number) in accordance with Art. 6 para. 1 lit. b GDPR. Your data will only be passed on for the purpose of payment processing with Stripe Payments Europe Ltd. and only to the extent that it is necessary for this purpose. You can find more information on Shopify Payments' data protection at the following Internet address: https://www.shopify.com/legal/privacy.

Data protection information on Stripe Payments Europe Ltd. can be found here: https://stripe.com/de/privacy.

Bhakti Marga Stiftung (Foundation) accepts endowments and is therefore responsible for endowments under data protection law. Bhakti Marga Yoga gGmbH accepts donations and sponsorship of spiritual events and processes this data accordingly. With regard to data processing, there is a joint responsibility with Bhakti Event GmbH in accordance with Art. 26 b GDPR.

3.9.2 For what purposes and on what legal basis do we process this data?

The personal data collected as part of the fundraising will only be used to fulfil your donation and to ensure that your donation is used in accordance with your fundraising intention. Therefore, the processing is necessary to fulfil contractual or quasi-contractual obligations (Art. 6 (1) lit. b GDPR).

3.10 Booking and managing accommodations on the http://www.shreepeethanilaya.org/ website

3.10.1 Which data do we process in the context of booking and managing accommodations?

You can book and manage accommodations on our shreepeethanilaya.org - website. If you book an accommodation, we process from you, inter alia, salutation, title, first and last name, spiritual name (optional), address, date of birth, country, phone, email address, username, date of arrival and expected departure, number of persons and estimated time of arrival and departure.

In the course of our accommodation offer we are subject to the reporting obligation pursuant to § 29 ff. BMG and collect the necessary data in this regard. These include the date of arrival and expected departure, surnames, first names, date of birth, nationality, address, number of passengers and their nationality.

3.10.2 For what purposes and on what legal basis do we process this data?

The personal data collected as part of booking and managing accommodations will only be used to fulfil your booking. Therefore, the processing is necessary to fulfil contractual obligations (Art. 6 (1) lit. b GDPR), or consent (Art. 6 (1) lit. a GDPR respectively Art. 9 (2) lit. a GDPR), where the provision of your data is optional. To the extent we comply with § 29 et.sec. BMG, the legal basis for the processing is Art. 6 (1) lit. c GDPR.

Processor: Wubook, ITALY (HEAD OFFICE), via Mura Malatestiane 1/A, 61032 - Fano (PU) italy@wubook.net, https://en.wubook.net/page/privacy-policy-17.html, We have concluded an order processing contract with Wubook in accordance with Art. 28 GDPR.

3.11 Online shop

3.11.1 Which data do we process in the context of the online shop?

In the course of an order in our Online Shop on the website www.bhaktishop.com, we process, inter alia, title, first and last name, company name, country, billing and shipping address, e-mail address, telephone number, spiritual name (optional), notes about the order (optional), information about the products or services you have ordered, including the order status, and payment information such as credit card number or other bank information.

3.11.2 For what purposes and on what legal basis do we process this data?

The personal data collected as part of the online shop will only be used to fulfil your order. Therefore, the processing is necessary to fulfil contractual or quasi-contractual obligations (Art. 6 (1) lit. b GDPR), respectively consent (Art. 6 (1) lit. a GDPR respectively Art. 9 (2) lit. a GDPR), where the provision of your data is optional.

For our online shop on the website https://bhaktishop.com we use the e-commerce software Shopify. Privacy policy of Shopify: Shopify International Limited, address: Victoria Buildings, 2nd floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland, e-mail: hilfe@shopify.de , Privacy Policy of Shopify https://www.shopify.com/legal/privacy.

Shopify processes this data primarily on European servers. Shopify sends some data to its Canadian servers. Data transfers to Canada are legitimised by an adequacy decision. Occasionally, Shopify sends data to sub- processors in the USA. However, Shopify obliges them to comply with strict data protection obligations. We have concluded an order processing contract with Shopify in accordance with Art. 28 GDPR.

DPA from Shopify: https://www.shopify.com/legal/dpa#3-european-union-and-united-kingdom.

For more information, please visit the page of our online shop: https://bhaktishop.com/policies/privacy- policy.html?locale=en-DE.

3.12 Zoom

We use the tool Zoom to conduct online events, online courses, video conferences and/or webinars (hereinafter: "online meetings"). Zoom is a service of Zoom Video Communications, Inc. which is based in the USA.

3.12.1 Which data do we process in the context of Zoom online meetings?

When using Zoom, various types of personal is processed. The amount of data also depends on the information you provide before or during participation in an online meeting. Inter alia, the following data is processed:

· User details: first name, last name, telephone (optional), e-mail address, password (if "single sign- on" is not used), profile picture (optional), department (optional);

· Meeting metadata: Topic, description (optional), participant IP addresses, device/hardware information;

· For recordings: MP4 file of all video, audio and presentation recordings, M4A file of all audio

recordings, text file of the online meeting chat; any video recording that may take place using the video conference function will be indicated by a recording mark and a respective notification before you enter a recorded session / before the recording function is turned on so that you can decide whether you would like to participate in the recorded session or not or would like to limit the data sharing with other participants to the username you have used to enter the session by turning off the video function;

· For dial-in via phone: information on the incoming and outgoing phone number, country, start and end time. If necessary, further connection data such as the IP address of the device can be stored.

· Text, audio and video data: You may have the opportunity to use the chat, question or survey functions in an online meeting. In this respect, the text entries you make are processed in order to display them in the online meeting and, if necessary, to record them. To enable the display of video and the playback of audio, the data from the microphone of your terminal device and from any video camera of the terminal device are processed accordingly during the online meeting. You can switch off or mute the camera or microphone yourself at any time via the Zoom applications.

To participate in an online meeting or to enter the meeting room, you must at least enter a name.

You can use Zoom by entering the respective meeting ID and, if necessary, further access data for the meeting directly in the Zoom app. If you do not want to or cannot use the Zoom app, the basic functions can also be used via a browser version, which you can also find on the Zoom website. Please note that if you access the Zoom website, Zoom is the controller for the data processing in relation to the website. For further information, please see Zoom's Privacy Notice.

3.12.2 For what purposes and on what legal basis do we process this data

We use Zoom to conduct Bhakti Event´s online meetings. If we intend to record the online meetings, we will inform you transparently in advance and - if necessary - ask for your consent. The fact of the recording will be displayed to you in the Zoom app.

If it is necessary for the purposes of recording the results of an online meeting, we will record the chat content. However, this will not usually be the case.

In the case of webinars, we may also process questions asked by webinar participants for the purposes of recording and following up webinars.

If you are a registered user of Zoom, reports of online meetings (meeting metadata, telephone dial-in data, questions and answers in webinars, survey function in webinars) may be stored on Zoom for up to one month.

The personal data processes as part of the online meetings via Zoom will only be used to enable you participating in an event or online course offered by Bhakti Event. Thus, the processing is necessary to fulfil contractual or quasi-contractual obligations (Art. 6 (1) lit. b GDPR). If no contractual relationship exists, the processing is based on our legitimate interests to enable online meetings for users (Art. 6 (1) lit. f GDPR.

Zoom is a service of Zoom Video Communications, Inc. based in the USA.

3.12.3 Processor Zoom

Website: https://zoom.us; Privacy Policy: https://zoom.us/docs/de-de/privacy-and-legal.html; Data Processing Agreement: https://zoom.us/docs/de-de/privacy-and-legal.html (referred to as Global DPA). Basis for third country transfers: EU-US Data Privacy Framework (DPF), Standard Contractual Clauses (https://zoom.us/docs/de-de/privacy-and-legal.html (referred to as Global DPA)).

3.13 Proactive contact by the customer by e-mail

If you contact us by e-mail on your own initiative, we will only collect your personal data (name, e-mail address, message text) to the extent provided by you. The data processing serves to process and respond to your contact enquiry.

If the purpose of the contact is to carry out pre-contractual measures (e.g. advice on an interest in purchasing, preparation of an offer) or concerns a contract already concluded between you and us, this data processing is carried out on the basis of Art. 6 para. 1 lit. b GDPR.

If contact is made for other reasons, this data processing is carried out on the basis of Art. 6 para. 1 lit. f GDPR due to our overriding legitimate interest in processing and responding to your enquiry. In this case, you have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data based on Article 6(1)(f) GDPR.

We will only use your email address to process your enquiry. Your data will then be deleted in compliance with statutory retention periods, unless you have consented to further processing and use.

3.14 Data processing as part of the whistleblower protection system

If you submit information to the internal reporting centre as part of the whistleblower protection system that has been set up, we will only collect your personal data (name, electronic contact details, address, message text, information on violations within the meaning of Section 3 (3) HinSchG, information on the identity of persons protected under the HinSchG) to the extent provided by you. The data processing serves the purpose of fulfilling the tasks, obligations and rights of the internal reporting office, which are assigned to the internal reporting office by the HinSchG.

The data processing is carried out to fulfil a legal obligation on the basis of Art. 6 para. 1 lit. c GDPR in conjunction with § 10 HinSchG. Your data will then be deleted in compliance with statutory retention periods (3 years after completion of the procedure within the meaning of Section 18 HinSchG).

4. Processing of special categories of personal data

The information you provide in context of using the services of our website may contain personal data relating to your religious or philosophical beliefs (special categories of personal data pursuant to Art. 9 (1) GDPR), such as your spiritual name, your Devotee or Brahmachari status and related initiation information, information about Swamis/Rishis and Ishtadev.

We only collect and process such sensitive data relating to your religious or philosophical beliefs with your explicit consent.

Please note that also the information which will be transferred to third parties may contain personal data relating to your religious or philosophical beliefs (i.e., special categories of personal data pursuant to Art. 9

(1) GDPR). The mere fact that you are registered with us or book or purchase something may be enough to disclose your religious or philosophical beliefs or faith.

However, we only transfer data relating to your religious or philosophical beliefs (special categories of personal data according to Art. 9 (1) GDPR) with your explicit consent.

5. From whom do we collect your personal data?

Personal data is collected directly from you, e.g., by visiting our websites or using the services offered.

In addition, family members or friends may mention you in connection with an event (for example a prayer) or a donation, in this case we may receive your personal data from your family or friends.

6. To whom do we transfer your data?

Bhakti Event only shares your personal data if this is permitted pursuant to European data protection law, for example, because the data transfer is necessary for the performance of a contract or because you have given us your consent to share the data. We work with some service providers, such as technical service providers (e.g., hosting services, maintaining the website, support our marketing activities, provide communication tools) or logistics companies (e.g. postal companies such as DHL). If you book an offer or event on our website, we pass on certain data from you to Bhakti Event partners (e.g. your name and address) so that the partner can offer you the service or deliver the ordered goods.

In addition, we transfer your personal data to the extent necessary to provide our services or because you have given us your consent to third persons (e.g., Swamis and Rishis) or companies affiliated with us.

Please note that the information which will be transferred to third parties may contain personal data relating to your religious or philosophical beliefs (i.e., special categories of personal data pursuant to Art. 9 (1) GDPR). However, we only transfer data relating to your religious or philosophical beliefs (special categories of personal data according to Art. 9 (1) GDPR) with your explicit consent.

6.1 Transfer to processors

For the processing of your data we use external service providers to whom we transfer your personal data, with who we enter into an appropriate data processing agreements and who may only process the data on our behalf and only in a contractually agreed framework and in accordance with our instructions (“Processors”), unless such service providers act as their own controllers (such as payment service providers, tour operators when you book pilgrimages, legal and tax consultants and shipping and distribution services to deliver goods you ordered). Processors are also contractually obliged, for example, to either delete or return the personal data upon termination of the engagement. Our main processor are Hubspot (for marketing), WordPress (for the operation of our Website, Shopify platform for our online shops www.bhaktishop.org for physical products, www.events.bhaktimarga.org (for in-house events and courses) www.onlineevents.bhaktimarga.org (for online events ) and Mediactive LLC for hosting services (with servers in France), as well as 1&1 IONOS SE and Zoom Video Communications Inc for communication.

6.2 Transfer to shipping service providers

Forwarding the e-mail address to shipping companies for information on the shipping status

We will pass on your e-mail address to the shipping company as part of the contract processing if you have expressly agreed to this during the ordering process. The purpose of this disclosure is to inform you of the dispatch status by e-mail. The processing is carried out on the basis of Art. 6 para. 1 lit. a GDPR with your consent. You can withdraw your consent at any time by notifying us or the transport company without affecting the lawfulness of processing based on consent before its withdrawal.

6.3 Transfer based on legal obligations or for the protection of legitimate interests

To the extent we are obliged to do so by law, court order, or by an enforceable official order, we will transfer your personal data to bodies entitled to receive information.

6.3.1 Affiliated companies

Bhakti Event GmbH operates together with the following companies, which also declare this Privacy Notice as theirs:

Bhakti Marga Stiftung

Am Geisberg 1-8

65321 Heidenrod Germany

Tel. 06124/609 1125

Bhakti Marga Yoga gGmbH

Am Geisberg 1-8

65321 Heidenrod Germany

Tel. 06124/609 1125

There is a joint responsibility in accordance with Art. 26 GDPR, with Bhakti Marga Stiftung (Foundation) in relation to the Bhakti Marga Academy App provided by the 360Learning collaboration platform and donations and endowments, with the exception of the "Serve a deity" donation program and free temple events, applications for short volunteer activities offered by Bhakti Marga Yoga gGmbH, here too there is a joint responsibility with Bhakti Marga Yoga gGmbH.

You can contact our data protection officer, lawyer Mrs Anna Aman via following emails:

dataprotection@bhaktimarga.org or

anna.aman@bhaktimarga.org

In addition, where you have consented to this, we may share certain personal data (including information about devotee or brahmachari status) with the swami/rishi who initiated you and with the BMCC in order to verify your current initiation status or to offer you further insights, events and courses that may be of particular interest to you and which may only be open to persons with a particular initiation status.

6.4 Payment service providers, credit information and accounting service providers

Bhakti Event offers various payment options. For this purpose, payment data may be transferred to payment service providers with whom we cooperate. For more information on the processing of personal data by payment service providers, please see their privacy notices:

6.4.1 Payment methods

Why do we use payment methods on our website?

Efficient and secure payment transactions are very important to us on our website. Payment procedures are used in the following situations:

· Fulfilment of contractual and other legal relationships,

· Fulfilment of legal obligations.

6.4.2 Who receives payment data about you?

In addition to banks and credit institutions, we use other service providers ("payment service providers") for payment procedures, who receive data about payment transactions. Credit agencies may also receive data from the payment service providers. This procedure serves to verify your identity and creditworthiness.

6.4.3 What data is usually collected for payment transactions?

The following data is processed by the payment service providers:

· Name

· Address

· Bank details (account number, credit card number, credit card verification code, credit card expiry date)

· Passwords

· TANs

· Contract details (subject matter of the contract, term, customer category)

· Interest in content and website visited

· Payment amount

· Recipient-related data

· IP address

· Time data

· identification number

· Consent status

· Any cookies

The data is necessary to carry out the transactions and is only processed or stored by the payment service providers. We do not receive any information about your account or your credit card, but only a confirmation or negative information about the payment made. Further details can be found in the respective terms and conditions and data protection notices of our payment service providers.

6.4.4 What is the basis for data processing in the context of payment transactions?

Consent (Article 6 paragraph 1 sentence 1 lit. a GDPR, Section 25 TTDSG): You have given your consent to the processing of your personal data for the purpose of a payment transaction. This consent can be revoked at any time.

Contract fulfilment or pre-contractual enquiries (Article 6 paragraph 1 sentence 1 lit. b GDPR): Processing is necessary for the fulfilment of a contract or for pre-contractual enquiries from the data subject or pre- contractual measures with you.

Legal obligation (Article 6 paragraph 1 sentence 1 lit. c GDPR): Processing is necessary for compliance with a legal obligation.

6.4.5 What rules apply in addition to our GTC?

Payment transactions are governed by the GTC and the privacy policies of the payment service providers we use, which you can access on the respective websites and transaction applications.

6.4.6 How long is the storage period?

The storage period depends on the respective provider.

6.4.7 What rights do you have in relation to your data with regard to payment transactions?

You are entitled to the rights under Articles 15 to 21 GDPR, such as information, erasure, rectification, cancellation and complaint. With regard to your rights vis-à-vis the payment service providers, please take note of their respective terms and conditions and contact the respective payment service provider.

6.4.8 Which payment service providers do we use?

We would like to offer you a professional payment process. For this reason, we offer you several payment providers so that you can choose your preferred payment provider. You can choose from the following:

Visa, Mastercard, Amex, Maestro, Union Pay, Eps, Ideal, Sofort, Shoppay, ApplePay, GooglePay, Paypal, Klarna

6.4.8.1 Use of Visa

What are the contact details of our provider?

Visa Inc (hereinafter: Visa) Global Privacy Office:

Visa Europe Limited 1 Sheldon Square London, W2 6TT United Kingdom https://www.visa.de

For what purposes do we use Visa?

We use VISA for professional payment processing and technical connection of online payment methods. What data does Visa collect?

Visa processes the following data:

· First name/last name,

· e-mail address,

· Visa card number,

· Transactions within the participation period (purchase date, time and amount).

In addition, Visa carries out data analyses and profiling to prevent fraud or other offences, among other things. Further details can be found in Visa's privacy policy: https://www.visa.de/nutzungsbedingungen/visa- privacy-center.html and https://www.visa.co.uk/legal/global-privacy-notice/jurisdictional-notice-eea.html, https://www.visa.de/promotions/geldzurueck/datenschutz.html (as at 13/05/2023).

On what legal basis does Visa collect your data?

· Consent (Article 6 (1) sentence 1 lit. a GDPR, Section 25 TTDSG): You have given your consent to the processing of your personal data for the purpose of a payment transaction with Visa. This consent can be revoked at any time.

· Contract fulfilment or pre-contractual enquiries (Article 6 paragraph 1 sentence 1 lit. b GDPR): Processing is necessary for the fulfilment of a contract or for pre-contractual enquiries or pre- contractual measures with you.

· Legal obligation (Article 6 paragraph 1 sentence 1 lit. c GDPR): Processing is necessary for compliance with a legal obligation.

How long does Visa store your data?

Visa states that it stores your data until the purpose has been fulfilled. After that, the data will be deleted. Does Visa transfer your data to third countries?

Yes.

What data protection measures have we taken with Visa?

We have concluded a legally binding contract with Visa on order processing for the use of the above- mentioned service. This contract is intended to ensure that the personal data on our website is only processed in third countries in accordance with instructions and in compliance with the GDPR.

What rights do you have vis-à-vis Visa?

You have all rights vis-à-vis Visa under Articles 15 to 21 GDPR. Please contact Visa directly for this.

6.4.8.2 Use of Mastercard, AMEX, Union Pay, EPS

· Mastercard: Payment services (technical connection of online payment methods); service provider: Mastercard Europe SA, Chaussée de Tervuren 198A, B-1410 Waterloo, Belgium; Legal basis: Contract fulfilment and pre-contractual enquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR); Website: https://www.mastercard.de/de-de.html. Privacy Policy

· AMEX, American Express payment services (technical connection of online payment methods); service provider: American Express Theodor-Heuss-Allee 112 60486 Frankfurt am Main Germany; Legal basis: Contract fulfilment and pre-contractual enquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR); Website: https://www.americanexpress.com Privacy Policy

· Union Pay International Co, Ltd, German Branch, An der Welle 4, 60322 Frankfurt, for the payment brands "CUP" and "Union Legal basis: Contract fulfilment and pre-contractual enquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR); Website:Pay" http://www.unionpayintl.com/en/aboutUs/com, Privacy Policy

· EPS: PSA Payment Services Austria GmbH Address: Handelskai 92, Gate 2, 1200 Vienna, Website: https://eps-ueberweisung.at/de/ Privacy Policy

6.4.8.3 Use of PayPal Express

We use the PayPal Express payment service of PayPal (Europe) S.à.r.l. et Cie, S.C.A. (22-24 Boulevard Royal L- 2449, Luxembourg; "PayPal") on our website. The purpose of data processing is to be able to offer you payment via the PayPal Express payment service.

To integrate this payment service, it is necessary for PayPal to collect, store and analyse data (e.g. IP address, device type, operating system, browser type, location of your device) when you access the website. Cookies can also be used for this purpose. Cookies make it possible to recognise your browser.

The use of cookies or comparable technologies takes place with your consent on the basis of § 25 para. 1 sentence 1 TTDSG i.V.m. Art. 6 para. 1 lit. a GDPR. Your personal data is processed with your consent on the basis of Art. 6 para. 1 lit. a GDPR. You can withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

By selecting and using PayPal Express, the data required for payment processing will be transmitted to PayPal in order to fulfil the contract with you using the selected payment method. This processing is carried out on the basis of Art. 6 para. 1 lit. b GDPR. Further information on data processing when using the PayPal Express payment service can be found in the associated privacy policy.

Use of PayPal Check-Out

We use the PayPal Check-Out payment service from PayPal (Europe) S.à.r.l. et Cie, S.C.A. (22-24 Boulevard Royal L-2449, Luxembourg; "PayPal") on our website. The purpose of data processing is to be able to offer you payment via the payment service. By selecting and using payment via PayPal, credit card via PayPal, direct debit via PayPal or "Pay later" via PayPal, the data required for payment processing will be transmitted to PayPal in order to fulfil the contract with you using the selected payment method. This processing is carried out on the basis of Art. 6 para. 1 lit. b GDPR.

Cookies may be stored that enable your browser to be recognised. The resulting data processing takes place on the basis of Art. 6 para. 1 lit. f GDPR from our overriding legitimate interest in a customer-oriented offer of different payment methods. You have the right to object to this processing of your personal data at any time on grounds relating to your particular situation.

Credit card via PayPal, direct debit via PayPal & "Pay later" via PayPal

For individual payment methods such as credit card via PayPal, direct debit via PayPal or "Pay later" via PayPal, PayPal reserves the right to obtain credit information on the basis of mathematical-statistical procedures using credit agencies. For this purpose, PayPal transmits the personal data required for a credit check to a credit agency and uses the information received on the statistical probability of a payment default for a balanced decision on the establishment, execution or termination of the contractual relationship. The credit report may contain probability values (score values) that are calculated on the basis of scientifically recognised mathematical-statistical procedures and whose calculation includes address data, among other things. Your legitimate interests are taken into account in accordance with the statutory provisions. The data processing serves the purpose of credit assessment for the initiation of a contract. The processing is carried

out on the basis of Art. 6 para. 1 lit. f GDPR out of our overriding legitimate interest in protection against payment default if PayPal makes advance payments.

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Article 6(1)(f) GDPR by notifying PayPal. The provision of the data is necessary for the conclusion of the contract with the payment method you have requested. Failure to provide the data means that the contract cannot be concluded with the payment method you have selected.

PayPal third party providers

When paying via the payment method of a third-party provider, the data required for payment processing is transmitted to PayPal. This processing takes place on the basis of Art. 6 para. 1 lit. b GDPR. PayPal may then forward the data to the respective provider in order to process this payment method. This processing is carried out on the basis of Art. 6 para. 1 lit. b GDPR. Local third-party providers can be, for example:

· Sofort (SOFORT GmbH, Theresienhöhe 12, 80339 Munich, Germany)

· Giropay (Paydirekt GmbH, Stephanstr. 14-16, 60313 Frankfurt am Main, Germany)

Purchase on account via PayPal

When paying via the payment method purchase on account, the data required for payment processing is first transmitted to PayPal. In order to process this payment method, the data is then transmitted by PayPal to Ratepay GmbH (Franklinstraße 28-29, 10587 Berlin; "Ratepay") in order to fulfil the contract with you using the selected payment method. This processing is carried out on the basis of Art. 6 para. 1 lit. b GDPR. Ratepay may carry out a credit check on the basis of mathematical-statistical procedures (probability or score values) using credit agencies in accordance with the procedure described above. The data processing serves the purpose of credit assessment for the initiation of a contract. The processing is carried out on the basis of Art. 6 para. 1 lit. f GDPR out of our overriding legitimate interest in protection against payment default if Ratepay makes advance payments. Further information on data protection and which credit agencies Ratpay uses can be found at https://www.ratepay.com/legal-payment-dataprivacy/ and https://www.ratepay.com/legal- payment-creditagencies/.

Further information on data processing when using PayPal can be found in the associated privacy policy at https://www.paypal.com/de/webapps/mpp/ua/privacy-full.

6.4.8.4 Use of Klarna payment options

We use the payment service of Klarna Bank AB (publ) (Sveavägen 46, 111 34 Stockholm, Sweden; "Klarna") on our website. By selecting and using payment via Klarna, the data required for payment processing is transmitted to Klarna in order to fulfil the contract with you using the selected payment method. This processing is carried out on the basis of Art. 6 para. 1 lit. b GDPR.

Cookies may be stored that enable your browser to be recognised. The resulting data processing takes place on the basis of Art. 6 para. 1 lit. f GDPR from our overriding legitimate interest in a customer-oriented offer of different payment methods. You have the right to object to this processing of your personal data at any time on grounds relating to your particular situation.

"Pay Later" (invoice), "Pay Now" (payment by direct debit), "Financing" (instalment purchase)

For individual payment methods such as "Pay Later" (invoice), "Pay Now" (payment by direct debit), "Financing" (instalment purchase), Klarna reserves the right to obtain credit information on the basis of mathematical-statistical procedures using credit agencies.

For this purpose, Klarna transmits the personal data required for a credit check, such as first and last name, address, gender, e-mail address, IP address and data related to the order, to a credit agency for the purpose of identity and credit checks and uses the information received on the statistical probability of non-payment for a balanced decision on the establishment, execution or termination of the contractual relationship. The credit report may contain probability values (score values) that are calculated on the basis of scientifically recognised mathematical and statistical procedures and whose calculation includes address data. Your legitimate interests are taken into account in accordance with the statutory provisions. The data processing serves the purpose of credit assessment for the initiation of a contract. The processing is carried out on the basis of Art. 6 para. 1 lit. f GDPR out of our overriding legitimate interest in protection against payment default if Klarna makes advance payment. You have the right, for reasons arising from your particular situation, to object at any time to this processing of personal data concerning you based on Art. 6 para. 1 lit.f GDPR by notifying Klarna. The provision of the data is necessary for the conclusion of the contract with the payment method you have chosen. Failure to provide the data means that the contract cannot be concluded with the payment method you have selected.

Further information, in particular to which credit agencies Klarna will pass on your personal data, can be found here.

General information about Klarna can be found at: https://www.klarna.com/de/. Your personal data will be treated by Klarna in accordance with the applicable data protection regulations and in accordance with the information in Klarna's privacy policy.

6.4.8.5 iDEAL

When paying via "iDEAL", payment is processed via the payment service provider Currence iDEAL BV, Postbus 83073, 1080 AB Amsterdam, Netherlands (hereinafter referred to as "iDEAL").

We pass on the information you provide during the ordering process, together with the information about your order, to iDEAL in accordance with Art. 6 para. 1 lit. b GDPR exclusively for the purpose of payment processing and only to the extent necessary.

Details of iDEAL's privacy policy can be found here.

6.4.8.6 Shopify Payments

We use the payment service provider "Shopify Payments", 3rd Floor, Europa House, Harcourt Building, Harcourt Street, Dublin 2. If you choose a payment method offered by the payment service provider Shopify Payments, the payment will be processed by the technical service provider Stripe Payments Europe Ltd, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland, to whom we pass on your information provided during the ordering process together with the information about your order (name, address, account number, bank sort code, credit card number if applicable, invoice amount, currency and transaction number) in accordance with Art. 6 para. 1 lit. b GDPR. Your data will only be passed on for the purpose of payment processing with Stripe Payments Europe Ltd. and only to the extent that it is necessary for this purpose. You can find more information on Shopify Payments' data protection at the following Internet address: https://www.shopify.com/legal/privacy. Data protection information on Stripe Payments Europe Ltd. can be found here.

6.4.8.7 Google Pay

If you select the "Google Pay" payment method (a service provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google")), the payment transaction will be processed via the "Google Pay" application on your Android (at least 4.4 "KitKat") mobile device with an NFC function. Payment is made via one of your payment cards stored with Google Pay or a payment system verified there (e.g. PayPal). To authorise a payment via Google Pay of more than EUR 25, you must first unlock your mobile device. The information you provide when placing the order will be passed on to Google for the purpose of payment processing. Google generates a unique transaction number that is transmitted to the order website to verify the payment. This transaction number is merely a numerical token that does not contain any information about your data. The actual transaction is carried out between the user and the ordering website by debiting the payment method stored with Google Pay. Personal data may be processed during the processes described. In this case, the processing is carried out for the purpose of payment processing in accordance with Art. 6 para. 1 lit. b GDPR.

Further information, in particular information on how Google handles your data, can be found here: Google Pay terms of use and Google Data protection.

6.4.8.8 Apple Pay

If you select the "Apple Pay" payment method (a service provided by Apple Distribution International (Apple), Hollyhill Industrial Estate, Hollyhill, Cork, Ireland), payment will be processed via the "Apple Pay" function of your device running iOS, watchOS or macOS by debiting a payment card you have stored with "Apple Pay".

Your transaction is protected by the security functions of your device's hardware and software. If a payment is to be authorised, it must be approved by entering a code and verification using the "Face ID" or "Touch ID" function on your device.

The information you provide during the ordering process, together with information about your order, will be forwarded to Apple in encrypted form for the purpose of payment processing. This data is then encrypted again by Apple and then transmitted to the payment service provider of the payment card stored in Apple Pay to process the payment. Encryption ensures that only the website on which the order was placed can access the payment data.

After payment, Apple sends the device account number and a transaction-specific, dynamic security code to the shop website to confirm the payment.

Personal data may be processed during the aforementioned processes. In this case, this is done for the purpose of payment processing in accordance with Art. 6 para. 1 lit. b GDPR.

When using Apple Pay on the iPhone or Apple Watch to complete a purchase made via Safari on the Mac, the Mac and the authorisation device communicate via an encrypted channel on the Apple servers. Apple can process or save data in the process. However, this is done in a format that does not allow your person to be identified.

Information on Apple Pay data protection can be found here.

6.4.8.9 Use of SOFORT

We use the payment service provider SOFORT GmbH, (Theresienhöhe 12, 80339 Munich, Germany; "SOFORT") for payment processing on our website. Sofort GmbH is a company of the Klarna Group (Klarna Bank AB (publ), Sveavägen 46, 11134 Stockholm, Sweden). The purpose of data processing is to be able to offer you various payment methods by processing payments via the payment service provider SOFORT. If you have decided in favour of the payment option, the data required for payment processing will be transmitted to SOFORT. This data processing is carried out on the basis of Art. 6 para. 1 lit. b GDPR. You can find more information on data processing when using the payment service provider SOFORT here and at: https://www.klarna.com/sofort/.

6.4.8.10 Use of the payment service provider Stripe

We use the Stripe payment service of Stripe Payments Europe Ltd, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland) on our website. The purpose of data processing is to be able to offer you payment via the payment service. By selecting and using Stripe, the data required for payment processing is transmitted to Stripe in order to fulfil the contract with you using the selected payment method. This processing is carried out on the basis of Art. 6 para. 1 lit. b GDPR.

Stripe reserves the right to obtain credit information on the basis of mathematical-statistical procedures using credit agencies. For this purpose, Stripe transmits the personal data required for a credit check to a credit agency and uses the information received on the statistical probability of a payment default for a balanced decision on the establishment, execution or termination of the contractual relationship. The credit report may contain probability values (score values) that are calculated on the basis of scientifically recognised mathematical-statistical procedures and whose calculation includes address data. Your interests worthy of protection are taken into account in accordance with the statutory provisions. The data processing serves the purpose of credit assessment for the initiation of a contract. The processing is carried out on the basis of Art. 6 para. 1 lit. f GDPR out of our overriding legitimate interest in protection against payment default if Stripe makes advance payments.

You have the right, for reasons arising from your particular situation, to object at any time to this processing of personal data concerning you based on Art. 6 para. 1 lit. f GDPR by notifying Stripe. The provision of the data is necessary for the conclusion of the contract with the payment method you have requested. Failure to provide the data means that the contract cannot be concluded with the payment method you have selected. All Stripe transactions are subject to the Stripe privacy policy.

6.4.5 Accounting services

· AccountOne GmbH, Fördepromenade 4d, 24944 Flensburg, Germany. For more information please see the Privacy Notice of AccountOne.

· DATEV, Paumgartnerstr. 6 - 14, 90429 Nuremberg, technical information services provider for tax, accountant and attorneys. For more information, please see DATEV Imprint and Privacy Policy.

· Moss Services, Nufin GmbH Ziegelstraße 16 10117 Berlin, virtual cards and spend management software. For more information, please see Nufin GmbH Privacy Policy.

6.5 Forwarding and distribution companies, shipping service providers

6.5.1 Forwarding the e-mail address to shipping companies for information about the shipping status

We pass on your e-mail address to the transport company as part of the contract processing, provided you have expressly agreed to this during the ordering process. The purpose of this disclosure is to inform you of the dispatch status by e-mail. The processing is carried out on the basis of Art. 6 para. 1 lit. a GDPR with

your consent. You can withdraw your consent at any time by notifying us or the transport company without affecting the lawfulness of processing based on consent before its withdrawal.

For the delivery of our products and other orders we cooperate with the following shipping companies:

· DHL Paket International, DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany.

· Books on Demand GmbH, In de Tarpen 42, 22848 Norderstedt, Germany.

6.6 Social Media plug-ins and other embedded content

We also use social media channels and tools, for which the service providers of these channels remain the controller of the data. Please see section 12 for further information.

6.7 Public

If you post comments of our blog, your comments, and the name under which you post your comment can be viewed by the public.

6.8 Transfer to the Swamis/Rishis, Bhakti Marga Country Coordinators

Additionally, to the extent you have consented according Art. 6 para. 1 lit. a GDPR thereto, we may share certain personal data (including information on Devotee or Brahmachari status) with the Swami/Rishi who initiated you as well as the BMCC to verify your current initiation status respectively to offer you further insights, events and courses which may be of special interest to you and which may only be open to persons with a certain initiation status.

6.9 Other transfers

If you have given us a separate consent to use and transfer your personal data, your personal data may be passed on to the recipients named therein. As part of the provision of third-party services on our websites, personal data may be passed on to third parties. Please also refer to section 11 as 12 for more detailed information.

6.10 Do we transfer your data to third countries?

For some types of processing, we may transfer your personal data to countries outside the European Union or the European Economic Area, to so-called third countries. This may mean that your personal data may be processed in a jurisdiction that offers a level of protection that may, in certain instances, be less protective of your personal data than the jurisdiction you are typically a resident in. In the course of a transfer of personal data to a third country, we will regularly provide appropriate guarantees, for example, by concluding the Standard Contractual Clauses of the European Commission to ensure that the transfer of data takes place with the same level of data protection that corresponds to the GDPR. If you would like to obtain further information on the safeguards we have in place, please contact us using the contact details listed in section 2.

7. How long do we store your personal data?

We process and store your personal data only as long as necessary for our processing purposes. If we process and store your personal data based on your consent, we delete such data immediately after you withdraw your consent.

Upon request, we will regularly delete the data collected and stored for our websites’ usage at any time. We will do this ourselves and within a few days, unless we have a particular interest in continuing storage for individual cases, e.g., cyberattacks.

Regarding your contact requests, we only store your data for the time period necessary to answer your request.

Insofar as you have registered for our newsletter, we process your data in this context for the duration of the registration to our newsletter and delete it at any time, should you unsubscribe from our newsletter or withdraw your consent.

The same apply in relation to the registration on our website and the data in connection with your personal user profile.

In the context of product or service orders and fundraising, we retain your data only as long as necessary to fulfill your booking, order or other request. In the context of event, course, accommodation, virtual pilgrimage registrations, we store your personal data collected during the booking for two years, starting at the end of the calendar year of the customer’s last visit to ensure a better customer care. Moreover, in the case you participate in virtual pilgrimages, your name and information on the pilgrimage you attended may be stored for additional 2 years so that we can support your path. Personal data that is necessary to establish or defend against claims may be stored until limitation periods have expired.

However, insofar as a longer retention period is required by statutory retention and documentation obligations or to protect our legitimate interests, e.g., in the event of possible legal disputes, your personal data will be stored and processed even after the above-mentioned period has expired. With complete execution of a contract or quasi-contractual relationship, we will, as far as possible, immediately restrict your personal data from further processing.

A final deletion takes place after the legal retention and documentation obligation periods expire, which are between two and ten years and result, inter alia, from the Fiscal Code of Germany (Abgabenordnung) or German Commercial Code (Handelsgesetzbuch).

8. Your rights

In the following, you will find a summary of your rights regarding the processing of your personal data:

8.1 Rights to access, delete, correct, restrict processing, and portability of your data

According to Article 15 GDPR, you have the right to obtain confirmation from us as to whether or not personal data concerning you is being processed by us. Where that is the case, you have a right to access the personal data and obtain further information.

According to Article 16 GDPR, you may have the right to obtain the rectification of inaccurate personal data concerning you without undue delay.

According to Article 17 GDPR, you may have the right to obtain erasure of personal data concerning you if (i) it is no longer necessary in relation to the purpose for which it is collected, (ii) you have withdrawn your consent on which the processing is based, (iii) you have objected to the processing pursuant to Article 21 (1) GDPR and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21 (2) GDPR, (iv) your personal data has been unlawfully processed; (v) the personal data has to be erased for compliance with a legal obligation to which Bhakti is subject , or (vi) the

personal data has been collected in relation to the offer of information society services pursuant to Article 8

(1) GDPR.

According to Article 18 GDPR, you may have the right to obtain the restriction of processing. Such right shall exist if (i) you contested the accuracy of the personal data, (ii) the processing is unlawful and you oppose the erasure of the personal data and request the restriction of its use instead, (iii) the personal data is no longer needed for the purposes of the processing, but it is required by you for the establishment, exercise or defense of legal claims, or (iv) you have objected to processing pursuant to Article 21(1) GDPR pending the verification of whether our grounds legitimately override yours.

According to Article 19 GDPR, you have the right to obtain information about the recipients of data to whom the rectification, erasure, or restriction of processing has been communicated.

According to Article 20 GDPR, you have the right to obtain personal data concerning you in a structured, commonly used and machine-readable format and to transmit the data to another controller.

If the processing or transfer of your personal data is based on a consent given by you, you can withdraw your consent at any time with effect for the future.

You have the right to lodge a complaint against the processing of your data or any decision of Bhakti in relation to one of your rights you have exercised, to the Hessische Commissioner for Data Protection and Freedom of Information (Der Hessische Beauftragte für Datenschutz und Informationsfreiheit), Gustav- Stresemann-Ring 1, 65189 Wiesbaden]. However, we encourage you to first reach out to us so that you we can find a solution together.

8.2 Contact

To exercise your rights under section 8. and 8.1 you can contact us without any formality by post, fax or e- mail at the points of contact listed in section 2.

9. Is there any obligation on your side to provide personal data?

There is neither a contractual nor a legal obligation to provide us with your personal data for the use of our websites. However, if you wish to contact us or to use one of our services, certain information may be required to enable us to process your request and provide our services to you.

10. Is the processing based on automated decision-making or profiling?

You have a right not to be subject to a decision based solely on automated processing, including profiling, if the decision is not necessary for the conclusion or performance of a contract, is not required by mandatory law, or is not based on your explicit consent.

Bhakti does not use automated decision-making procedures, including profiling, unless we have explicitly informed you of them.

11. What kind of cookies and tracking technology do we use?

For the provision, maintenance, and analysis of our websites and their usage, we use various software tools from third parties and ourselves, which are regularly based on the use of cookies, Flash cookies (also called Flash Local Shared Objects), web beacons or similar technologies (collectively as "Tracking Technologies"). Tracking Technologies can help us understand how you use our services (e.g., the pages you display or the links you click and other actions you perform with the services), give us information about your browser and online usage patterns (e.g., IP address, log data, browser type, browser language, referring/exiting pages and URLs, pages viewed, whether you have opened an e-mail, clicked links, etc.) as well as information about the devices with which you access our services. Tracking Technologies allow us to link the devices you use to access our services so that we can identify and contact you on the various devices you use. It also helps us and our advertising partners to determine products and services that may be of interest to you, in order to serve you targeted advertisements.

You can limit the use of Tracking Technologies by changing the settings of your browser. You can determine what access you grant us and whether and for how long cookies can be stored on your device. You can also delete cookies that have already been stored at any time. Please note that the functionality of our websites may be affected after deactivating all cookies. Similar functions (such as Flash cookies), which are used by so-called browser add-ons, can be switched off or deleted by changing the settings of the browser add-on or via the website of the browser add-on provider.

11.1 What are cookies?

A cookie is a small file that is transferred during the use of a website from the host server of the website and stored on the user's device (desktop computer, laptop, tablet, smartphone, other Internet-enabled devices) by the browser used. Cookies are used to store information about the user and to retrieve it when the website is called up again. Our website uses cookies. Cookies are small text files that are stored in the Internet browser or by the Internet browser on the user's computer system. When a user accesses a website, a cookie may be stored on the user's operating system. This cookie contains a characteristic string of characters that enables the browser to be uniquely identified when the website is called up again.

Cookies are stored on your computer. You therefore have full control over the use of cookies. By selecting the appropriate technical settings in your Internet browser, you can be notified before cookies are set and decide whether to accept them individually and prevent the storage of cookies and transmission of the data they contain. Cookies that have already been saved can be deleted at any time. However, we would like to point out that you may then not be able to use all the functions of this website to their full extent.

You can find out how to manage (including deactivating) cookies in the most important browsers by clicking on the links: Chrome, Microsoft Edge, Mozilla Firefox, Safari.

11.2 What are cookies used for?

Cookies help us understand the use of our websites, analyze trends, administer the websites, track a user's steps on our websites, collect demographic information about our user base as a whole, allow you to navigate efficiently between the pages, remember your preferences and settings on our websites, and generally improve your browsing experience. We process the data collected using Tracking Technologies to

(i) remember information so that you do not have to re-enter them during your visit or a new visit,

(ii) recognize you across multiple devices, (iii) control the functionality and performance of our websites,

(iv) collect aggregated metrics regarding the total number of visitors, total traffic, usage and demographic patterns on our websites, (v) diagnose and resolve technical issues, (vi) determine products and services that may be of interest to you, in order to serve you targeted advertisements and (vii) otherwise plan and improve our website.

11.3 What types of cookies are used on our websites?

The cookies used on our website can usually be categorized as follows: mandatory cookies, analytical / performance cookies, function-related cookies, and marketing cookies.

11.3.1 Mandatory cookies

These cookies are essential for the functioning of our websites and enable you to move around our websites and to use their functions. Without these cookies, certain services that are required for the full functioning of our websites cannot be provided.

11.3.2 Analytical / performance cookies

With the help of these cookies, we collect information about how our users use our websites, e.g., which pages are accessed and read most frequently, or how users move from one link to the next. All information collected by this type of cookie does not relate to a single user but is aggregated and processed with the information of other users. Cookies provide us with analytical data on how our websites work and how we can improve them.

11.3.3 Function-related cookies

These cookies allow us to save a specific selection you have made and to adapt our website in such a way that it offers you extended functions and content. These cookies can be used, for example, to save your language selection or country selection.

11.3.4 Marketing cookies

These cookies record your visit to our website, the pages you have visited and the links you have followed. We will use this information to make our website and the advertising displayed on it, and the marketing messages we send to you more relevant to your interests. We may also share this information with third parties who provide a service to us for this purpose.

11.4 How long are cookies stored on your device?

The retention period depends essentially on whether the cookie is "persistent" or "session-based.” Session- based cookies are deleted after you leave the websites that set the cookie. Persistent cookies remain on your device even after you have finished browsing until they are deleted or until they have expired.

11.5 Cookie Policy

If you would like to obtain further information on the specific cookies we use, please see our Cookie Policy.

11.6 Technically necessary cookies

Unless otherwise stated below in the privacy policy, we only use these technically necessary cookies for the purpose of making our website more user-friendly, effective and secure. Furthermore, cookies enable our systems to recognise your browser even after a page change and to offer you services. Some functions of our website cannot be offered without the use of cookies. For these, it is necessary for the browser to be recognised even after a page change.

The use of cookies or comparable technologies is based on § 25 para. 2 TTDSG. Your personal data is processed on the basis of Art. 6 para. 1 lit. f GDPR due to our overriding legitimate interest in ensuring the optimal functionality of the website and a user-friendly and effective design of our offer.

You have the right to object to this processing of your personal data at any time on grounds relating to your particular situation.

11.7 Use of Cookie Hub for the website bhaktimarga.org

We use the CookieHub tool from CookieHub ehf Number 6801211090 of Hafnargata 55, 230 Reykjanesbæ, Iceland on our website. The tool enables you to give consent to data processing via the website, in particular the setting of cookies, and to make use of your right of revocation for consent already given.

The purpose of data processing is to obtain and document the necessary consent for data processing and thus to comply with legal obligations.

Cookies may be used for this purpose. The following information may be collected and transmitted to Consentmanager: Date and time of the page view, information about the browser you are using and the device you are using, anonymised IP address, opt-in and opt-out data. This data is not passed on to other third parties.

The data processing is carried out to fulfil a legal obligation on the basis of Art. 6 para. 1 lit. c GDPR. You can find more information on data protection at Consentmanager at: https://www.cookiehub.com/privacy- policy.

11.7.1 Use of the cookie consent plug-in from WebToffee

- We use the GDPR cookie consent plug-in from WebToffee of Mozilor Limited (10 Paxton Crescent, Shenley Lodge, Milton Keynes MK5 7PY, United Kingdom; "WebToffee") on our website.

- The plug-in enables you to consent to the processing of data via the website, in particular to the setting of cookies, and to exercise your right to withdraw previously given consent. Data processing must obtain the necessary consent for the purpose of data processing and thus fulfil the legal obligations. Cookies may be used for this purpose. Among other things, the following information may be collected and transmitted to WebToffee: anonymised IP address, user ID, consent status, date and time of consent or refusal. This data is not passed on to third parties.

The data is processed to fulfil a legal obligation on the basis of Art. 6 (1) (c) GDPR. Further information on data protection at WebToffee can be found in their Privacy Policy.

We use the Webtoffee tool on our website https://shreepeethanilaya.org.

11.8 Use of the GDPR cookie consent manager for Shopify shops

We use the Cookie Consent Manager from Pandectes GDPR Cookie Consent Manager for Shopify shops on our website, Shopify International Ltd, Attn: Data Protection Officer, c/o Intertrust Ireland, 2nd Floor 1-2 Victoria Buildings, Haddington Road, Dublin 4, D04 XN32, Ireland.

The tool enables you to give your consent to data processing via the website, in particular to the setting of cookies, and to exercise your right to withdraw consent you have already given. The data processing serves to obtain and document the necessary consent for data processing and thus to comply with legal obligations. Cookies may be used for this purpose. User information, including your IP address, is collected and transmitted to Shopware. This data is not passed on to other third parties.

Data processing is carried out on the basis of Article 6(1)(c) GDPR to fulfil a legal obligation. You can find more information about Shopware's in their data protection policy.

· We use the GDPR cookie consent plug-in from WebToffee of Mozilor Limited (10 Paxton Crescent, Shenley Lodge, Milton Keynes MK5 7PY, United Kingdom; "WebToffee") on our website.

· The plug-in enables you to consent to the processing of data via the website, in particular to the setting of cookies, and to exercise your right to withdraw previously given consent. Data processing must obtain the necessary consent for the purpose of data processing and thus fulfil the legal obligations. Cookies may be used for this purpose. Among other things, the following information may be collected and transmitted to WebToffee: anonymised IP address, user ID, consent status, date and time of consent or refusal. This data is not passed on to third parties.

The data is processed to fulfil a legal obligation on the basis of Art. 6 (1) (c) GDPR. Further information on data protection at WebToffee can be found in their Privacy Policy.

12. Analysis of advertising tracking communication

12. 1 Use of Google Analytics

We use the web analysis service Google Analytics from Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; "Google") on our website.

The data processing serves the purpose of analysing this website and its visitors as well as for marketing and advertising purposes. For this purpose, Google will use the information obtained on behalf of the operator of this website to analyse your use of the website, to compile reports on website activity and to provide other services relating to website activity and internet usage to the website operator.

12.2 Services to the website operator

The following information may be collected: IP address, date and time of the page view, click path, information about the browser and device you are using, pages visited, referrer URL (website from which you accessed our website), location data, purchase activities. Your data may be linked by Google with other data, such as your search history, your personal accounts, your usage data from other devices and all other data that Google has about you.

The IP address will be shortened by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area.

Your personal data is processed with your consent on the basis of Art. 6 para. 1 lit. a GDPR. You can withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

The information generated about your use of this website is usually transferred to a Google server in the USA and stored there. An adequacy decision by the EU Commission is in place for the USA, the Trans-Atlantic Data Privacy Framework (TADPF). Google has certified itself in accordance with the TADPF and has therefore undertaken to comply with European data protection principles. Both Google and US government authorities have access to your data.

You can find more information on terms of use and data protection.

12.3 Use of the Shopify statistics

We use the statistics and analysis functions of Shopify International Limited (2nd Floor Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland; "Shopify") on our website as part of order processing. Shopify is a company affiliated with Shopify Inc (151 O'Connor Street, Ground Floor, Ottawa, Ontario, K2P 2L8, Canada)

The purpose of data processing is to analyse this website and its visitors. For this purpose, data is stored for marketing and optimisation purposes and provided in reports, analyses and statistics. Among other things, the following device information is collected and processed: Web browser information, IP address, time zone and some of the cookies installed on your device. When you navigate the website, information is also collected on the web pages or products accessed, the referrer URL (website from which you accessed our website) and information on how you interact with the website. Technologies such as cookies, web beacons, tags and pixels (electronic files used to collect information about how you navigate the website) are used for this purpose.

The use of cookies or comparable technologies takes place with your consent on the basis of § 25 para. 1 sentence 1 TTDSG i.V.m. Art. 6 para. 1 lit. a GDPR. Your personal data is processed with your consent on the basis of Art. 6 para. 1 lit. a GDPR. You can withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

You can find more information on data protection at Shopify: Privacy Policy, information on the order processing contract and information on the cookies used.

12.4 Use of the software provided by HubSpot

We use the Marketing Hub software from HubSpot, Inc. (25 First Street Cambridge, MA 02141, USA; "HubSpot" with a branch in Ireland HubSpot, 2nd Floor 30 North Wall Quay, Dublin 1, Ireland) on our website as part of order processing.

The purpose of data processing is to analyse our website and its visitors, to analyse and evaluate our marketing campaigns and to better address customers by placing targeted advertisements. Cookies are used for this purpose, which enable the browser to be recognised. Among other things, your IP address may be collected and transmitted to HubSpot. The data collected in this way can be used to create user profiles using pseudonyms.

Your data may be transferred to the USA. The EU Commission has issued an adequacy decision for the USA, the Trans-Atlantic Data Privacy Framework (TADPF). HubSpot has certified itself in accordance with the TADPF and is therefore committed to complying with European data protection principles.

The use of cookies or comparable technologies takes place with your consent on the basis of § 25 para. 1 sentence 1 TTDSG i.V.m. Art. 6 para. 1 lit. a GDPR. Your personal data is processed with your consent on the basis of Art. 6 para. 1 lit. a GDPR. You can withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

The use of cookies or comparable technologies takes place with your consent on the basis of § 25 para. 1 sentence 1 TTDSG in conjunction with Art. 6 para. 1 lit. a GDPR. Art. 6 para. 1 lit. a GDPR. Your personal data is processed with your consent on the basis of Art. 6 para. 1 lit. a GDPR. You can withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

For more information on the collection and use of data by HubSpot, your rights in this regard and options for protecting your privacy, please refer to Hubspot's privacy policy and their data processing agreement.

13. Presence in social networks (social media)

We maintain online presences within social networks and process user data in this context in order to communicate with the users active there or to offer information about us.

We would like to point out that user data may be processed outside the European Union. This may result in risks for users because, for example, it could make it more difficult to enforce users' rights.

Furthermore, user data is generally processed within social networks for market research and advertising purposes. For example, user profiles can be created based on user behaviour and the resulting interests of users. The user profiles can in turn be used, for example, to place adverts within and outside the networks that presumably correspond to he interests of the users. For these purposes, cookies are usually stored on the user's computer, in which the user's usage behaviour and interests are stored. Furthermore, data can also be stored in the user profiles independently of the devices used by the users (especially if the users are members of the respective platforms and are logged in to them).

For a detailed description of the respective forms of processing and the opt-out options, please refer to the data protection declarations and information provided by the operators of the respective networks.

In the case of requests for information and the assertion of data subject rights, we would also like to point out that these can be asserted most effectively with the providers. Only the providers have access to the users' data and can take appropriate measures and provide information directly. Should you nevertheless require assistance, you can contact us.

- Processed data types: Contact data (e.g. e-mail, telephone numbers); Content data (e.g. entries in online forms); Usage data (e.g. websites visited, interest in content, access times); Meta, communication and process data (e.g. IP addresses, time data, identification numbers, consent status); Inventory data (e.g. names, addresses).

- Data subjects: Users (e.g. website visitors, users of online services).

- Purposes of Processing: Contact requests and communication; Feedback (e.g. collecting feedback via online form); Marketing. Provision of our online services and user-friendliness.

- Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR). Further information on processing operations, procedures and services:

- Instagram: Social network; Service provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.instagram.com. Privacy Policy: https://instagram.com/about/legal/privacy.

- Facebook pages: Profiles within the social network Facebook - We are jointly responsible with Meta Platforms Ireland Limited for the collection (but not the further processing) of data from visitors to our Facebook page (so-called "fan page"). This data includes information about the types of content users view or interact with, or the actions they take (see under "Things you and others do and provide" in the Facebook Data Policy: https://www.facebook.com/policy), as well as information about the devices used by users (e.g. IP addresses, operating system, browser type, language settings, cookie data; see under "Device information" in the Facebook Data Policy: https://www.facebook.com/policy). As explained in the Facebook Data Policy under "How do we use this information?", Facebook also collects and uses information to provide analytics services, so-called "Page Insights", for page operators so that they can gain insights into how people interact with their pages and the content associated with them. We have concluded a special agreement with Facebook ("Information on Page Insights", https://www.facebook.com/legal/terms/page_controller_addendum), which regulates in particular which security measures Facebook must observe and in which Facebook has agreed to fulfil the rights of data subjects (i.e. users can, for example, send information or deletion requests directly to Facebook). The rights of users (in particular to information, deletion, objection and complaint to the competent supervisory authority) are not restricted by the agreements with Facebook. Further information can be found in the "Information on Page Insights" (https://www.facebook.com/legal/terms/information_about_page_insights_data); Service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.facebook.com; Privacy Policy: https://www.facebook.com/about/privacy; Basis for transfer to third countries: EU-US Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.facebook.com/legal/EU_data_transfer_addendum). Further information: Agreement on joint controllership: https://www.facebook.com/legal/terms/information_about_page_insights_data. The joint controllership is limited to the collection by and transfer of data to Meta Platforms Ireland Limited, a company based in the EU. The further processing of the data is the sole responsibility of Meta Platforms Ireland Limited, which in particular concerns the transfer of the data to the parent company Meta Platforms,

Inc. in the USA (on the basis of the standard contractual clauses concluded between Meta Platforms Ireland Limited and Meta Platforms, Inc.).

- Telegram channels: We use the Telegram platform to send messages to subscribers of our Telegram channel; Service provider: Representative in the European Union: European Data Protection Office (EDPO), Avenue Huart Hamoir 71, 1030 Brussels, Belgium; Website: https://telegram.org/; Privacy Policy: https://telegram.org/privacy; Further information: We process the personal data of subscribers only to the extent that we can view and delete the subscribers as recipients of the channel. Beyond this, i.e. in particular for the sending of messages, the evaluation and provision of anonymous sending statistics for the channel operators and the administration of subscribers, Telegram is responsible under data protection law.

- Threema: Threema Messenger with end-to-end encryption; service provider: Threema GmbH, Churerstrasse 82, 8808 Pfäffikon SZ, Switzerland; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://threema.ch/en. Privacy Policy: https://threema.ch/de/privacy. We have concluded an order processing agreement with Threema Work in accordance with Art. 28 GDPR.

- X: Social network; Service provider: Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2 D02 AX07, Ireland; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR). Privacy Policy: https://twitter.com/privacy, (Settings: https://twitter.com/personalization).

- Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://twitter.com/de; Privacy Policy: https://twitter.com/privacy, (Settings: https://twitter.com/personalization); Data processing agreement: https://privacy.twitter.com/en/for-our-partners/global-dpa. Basis for third country transfer: Standard Contractual Clauses (https://privacy.twitter.com/en/for-our-partners/global-dpa).

- YouTube: Social network and video platform; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Privacy Policy: https://policies.google.com/privacy; Basis for third country transfer: EU-US Data Privacy Framework (DPF). Option to object (opt-out): https://adssettings.google.com/authenticated.

14. Third Party providers Online Services

To offer you a convenient website, we use, inter alia, Hubspot, and YouTube (Google Maps and YouTube are together referred to as “ content plug-ins”), and so-called social media plugins of the social networks.

14.1 HubSpot

On our websites, we use the services of the CRM platform HubSpot, which is operated by HubSpot, Inc. The European subsidiary is HubSpot Ireland Limited, 1 Sir John Rogerson's Quay, Dublin 2.

The processed data may include, personal data as necessary to provide the CRM services by HubSpot, in particular, IP addresses and email addresses, which, however, are not collected and processed without your consent (Art. 6 (1) lit. a GDPR) (usually as part of the settings of your desktop or mobile devices). The data may be processed in the USA. Further information can be found in HubSpot's privacy policy, which you can access here.

- Hubspot: email sending and email sending and automation services; service provider: HubSpot, Inc. The European subsidiary is HubSpot Ireland Limited, 1 Sir John Rogerson's Quay, Dublin 2

- Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website; Privacy Policy: https://legal.hubspot.com/privacy-policy; Data processing agreement: https://legal.hubspot.com/de/dpa; Basis for transfer to third countries: EU-US Data Privacy Framework (DPF), Standard Contractual Clauses (provided by the service provider). Further information: Special security measures: https://trust.hubspot.com. Your data may be transferred to the USA. The EU Commission has issued an adequacy decision for the USA, the Trans-Atlantic Data Privacy Framework (TADPF). HubSpot has certified itself in accordance with the TADPF and is therefore committed to complying with European data protection principles.

14.2 YouTube

On our websites, we use the services of the video portal YouTube LLC., 901 Cherry Ave., 94066 San Bruno, CA, USA, ("YouTube") to integrate videos. In connection with the provision of YouTube, we use the "Enhanced Privacy Mode", which is intended to ensure that data is only transmitted to YouTube when the videos are accessed.

Thus, only if you interact with the video, a connection to YouTube will be established to be able to call up and display the video. In this context, YouTube stores at least the IP address, the date and time as well as the website you visited. In addition, a connection to Google's advertising network "DoubleClick" is established.

If you are logged into YouTube at the time you visit our website, YouTube may establish a connection to your YouTube account. To prevent this, you must either log out of YouTube before visiting our website or make the appropriate settings in your YouTube user account.

For the purpose of ensuring improved usability and analyzing usage behavior, YouTube permanently stores cookies on your end device via your Internet browser. If you do not agree with this processing, you have the option to prevent the storage of cookies by a setting in your Internet browser. You can find more information on this above under "Cookies".

Google provides further information on the collection and use of data as well as your rights and protection options in this regard in the Privacy Notice.

14.3 Plugins and other features

We incorporate functional and content elements into our online offering that are obtained from the servers of their respective providers (hereinafter referred to as "third-party providers"). These may be, for example, graphics, videos or city maps (hereinafter uniformly referred to as "content").

The integration always requires that the third-party providers of this content process the IP address of the user, as they would not be able to send the content to their browser without the IP address. The IP address is therefore required to display this content or function. We aim to only use content whose respective providers only use the IP address to deliver the content. Third-party providers may also use so-called pixel tags (invisible graphics, also known as "web beacons") for statistical or marketing purposes. The "pixel tags" can be used to analyse information such as visitor traffic on the pages of this website. The pseudonymous information may also be stored in cookies on the user's device and may contain, among other things, technical information about the browser and operating system, referring websites, time of visit and other information about the use of our online offer, as well as being linked to such information from other sources.

- Processed data types: Usage data (e.g. websites visited, interest in content, access times); meta, communication and process data (e.g. IP addresses, time data, identification numbers, consent status); inventory data (e.g. names, addresses); contact data (e.g. email, telephone numbers); content data (e.g. entries in online forms). Location data (information on the geographical position of a device or person).

- Data subjects: Users (e.g. website visitors, users of online services).

- Purposes of processing: Provision of our online services and user-friendliness; marketing. Profiles with user-related information (creation of user profiles).

- Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR). Further information on processing operations, procedures and services:

· X plugins and content: Plugins and buttons of the platform "X" - This may include, for example,

content such as images, videos or texts and buttons with which users can share content from this online offer within X; Service provider: Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2 D02 AX07, Ireland; Legal basis: Legitimate interests (Art. 6 para. 1 sentence

1 lit. f) GDPR); Website: https://twitter.com/de; Privacy Policy: https://twitter.com/privacy, (Settings: https://twitter.com/personalization); Data processing agreement: https://privacy.twitter.com/en/for-our-partners/global-dpa. Basis for third country transfer: Standard Contractual Clauses (https://privacy.twitter.com/en/for-our-partners/global-dpa). Your data may be transferred to the USA. There is an adequacy decision by the EU Commission for the USA, the Trans-Atlantic Data Privacy Framework (TADPF). X is not certified under the TADPF.

· YouTube videos: Video content; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Legitimate interests (Art. 6 Para. 1 S. 1 lit. f) GDPR); Website: https://www.youtube.com; Privacy Policy: https://policies.google.com/privacy; Basis for third country transfer: EU-US Data Privacy Framework (DPF). Possibility of objection (opt-out): Opt-out plugin: https://tools.google.com/dlpage/gaoptout?hl=de; Settings for the display of adverts: https://adssettings.google.com/authenticated.

· Flickr, operated by Flickr, Inc, Flickr c/o Yahoo! Inc, 701 First Avenue, Sunnyvale, CA 94089, USA. Further information can be found in Flickr's privacy policy. Basis for the transfer to third countries: Standard contractual clauses. Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.flickr.com, Privacy Policy: https://www.flickr.com/help/privacy Data processing agreement. https://www.flickr.com/help/dpa.

· Instagram: Social network; Service provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; Legal basis: Legitimate interests (Art. 6 Para. 1 S.

1 lit. f) GDPR); Website: https://www.instagram.com. Privacy Policy: https://instagram.com/about/legal/privacy. Your data may be transferred to the USA. The EU Commission has issued an adequacy decision for the USA, the Trans-Atlantic Data Privacy Framework (TADPF). Meta has certified itself in accordance with the TADPF and is therefore committed to complying with European data protection principles.

· Use of the Google Tag Manager. We use the Google Tag Manager of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; "Google") on our website.

This application is used to manage JavaScript tags and HTML tags that are used to implement tracking and analysis tools in particular. The purpose of data processing is to design and optimise our website in line with requirements. The Google Tag Manager itself neither stores cookies nor does it process personal data. However, it enables the triggering of other tags that can collect and process personal data. Further information on terms of use and data protection can be found here.

· Use of Google Fonts: We use Google Fonts from Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; "Google") on our website.

The purpose of data processing is to ensure the uniform display of fonts on our website. In order to load the fonts, a connection to Google's servers is established when the page is accessed. Cookies may be used for this purpose. Among other things, your IP address and information about the browser you are using are processed and transmitted to Google. This data is not linked to your Google account. Your data may be transferred to the USA. The EU Commission has issued an adequacy decision for the USA, the Trans-Atlantic Data Privacy Framework (TADPF). Google has certified itself in accordance with the TADPF and has therefore undertaken to comply with European data protection principles. The use of cookies or comparable technologies takes place with your consent on the basis of § 25 para. 1 sentence 1 TTDSG i.V.m. Art. 6 para. 1 lit. a GDPR. Your personal data is processed with your consent on the basis of Art. 6 para. 1 lit. a GDPR. You can withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal. Further information on data processing and data protection can be found at https://www.google.de/intl/de/policies/ and at https://developers.google.com/fonts/faq.

· Use of Google Translate: We use the translation service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) on our website via an API integration. The purpose of data processing is to display the information provided on the website in another language. In order for the translation to be displayed automatically after you have selected a language, the browser you are using connects to Google's servers. Cookies may be used for this purpose. Among other things, the following information may be collected and processed: IP address, URL of the page visited, date and time. Your data may be transmitted to the USA. The EU Commission has issued an adequacy decision for the USA, the Trans-Atlantic Data Privacy Framework (TADPF). Google has certified itself in accordance with the TADPF and has therefore undertaken to comply with European data protection principles. The use of cookies or comparable technologies takes place with your consent on the basis of § 25 para. 1 sentence 1 TTDSG i.V.m. Art. 6 para. 1 lit. a GDPR. Your personal data is processed with your consent on the basis of Art. 6 para. 1 lit. a GDPR. You can withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal. You can find more information on the collection and use of your data by Google at: https://www.google.com/policies/privacy/.

· Facebook of Meta Platforms Ireland Limited (4 Grand Canal Square, Dublin 2, Ireland): https://www.facebook.com/policy.php. Your data may be transferred to the USA. The EU Commission has issued an adequacy decision for the USA, the Trans-Atlantic Data Privacy Framework (TADPF). Meta has certified itself in accordance with the TADPF and is therefore committed to complying with European data protection principles.

· Shariff Wrapper: On our website we offer you the possibility to use so-called "Social Media Buttons". To protect your data, we use a solution called "Shariff". Here, the share buttons are implemented as static images that contain a link to the corresponding social network page. If you

click on such a button, you will be redirected to the corresponding page of the social network, just as normal links would do. Only at this moment does the provider of the social network receive information about you, e.g. your IP address. If you do not click on such a share button, no data will be transmitted. Information about the collection and use of your data by the social networks can be found in the corresponding terms of use of the respective providers. Further information about the plugin and the Shariff solution can be found here: https://wordpress.org/plugins/shariff/.

· Facebook Inc., 1601 Willow Road Menlo Park, CA 94025, USA. If a person lives outside of the United States or Canada, the controller is the Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. To learn more about Facebooks data collection and use, please read their Privacy Notice. Together with Facebook Ireland, we are jointly responsible within the meaning of Art. 26 GDPR for the processing of so-called Page Insights as part of the operation of our Facebook page. Facebook Ireland uses these Page Insights to analyse the activities on our Facebook page and provides us with this information in a form that does not relate to the specific person. For this purpose, we have concluded an agreement with Facebook Ireland on joint data protection responsibility, which you can access at the following link. In this agreement, Facebook Ireland undertakes, among other things, to assume primary responsibility under the GDPR for the processing of Page Insights and to fulfil all obligations under the GDPR with regard to the processing of Page Insights.

(Hereinafter together referred to as "social networks".)

To ensure the most extensive protection of your personal data, Bhakti Event uses technical solutions that ensure that a data transfer via social media plugins to the respective operator of the social media service does not take place without prior activation of the social plug-ins by you – by way of activating the respective button (so that the button is no longer grey).

Thus, only deactivated social media plugins are integrated on our websites in the initial state, which do not establish contact with the servers of Facebook or other social network operators and social media plugins without corresponding activation. If you activate these deactivated social media plugins by clicking the "Activate social media" button, you thereby declare your consent to the transfer of your data to the social network operator. After activation, the social media plugins establish a connection to the respective social network. With a further click, you can then transmit a recommendation within the respective social network (such as your IP address and which websites you have visited is transmitted).

15. Special notes on applications (apps)

We process the data of the users of our application insofar as this is necessary in order to provide the application and its functionalities to the users, to monitor its security and to develop it further. We may also contact users in compliance with legal requirements if communication is necessary for the purposes of administering or using the application. Otherwise, we refer to the data protection information in this privacy policy with regard to the processing of user data.

Legal basis: The processing of data required to provide the functionalities of the application serves to fulfil contractual obligations. This also applies if the provision of the functions requires user authorisation (e.g. release of device functions). If the processing of data is not necessary for the provision of the functionalities of the application, but serves the security of the application or our business interests (e.g. collection of data for the purpose of optimising the application or security purposes), it is carried out on the basis of our

legitimate interests. If users are expressly asked to consent to the processing of their data, the data covered by the consent is processed on the basis of the consent.

- Processed data types: inventory data (e.g. names, addresses); meta, communication and process data (e.g. IP addresses, time data, identification numbers, consent status). Sound recordings.

- Purposes of processing: Provision of contractual services and fulfilment of contractual obligations.

- Legal bases: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR); fulfilment of contract and pre-contractual enquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR). Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Further information on processing processes, procedures and services:

- Device authorisations for access to functions and data: The use of our application or its functionalities may require user authorisations for access to certain functions of the devices used or to the data stored on the devices or accessible with the help of the devices. By default, these authorisations must be granted by the users and can be revoked at any time in the settings of the respective devices. The exact procedure for controlling app authorisations may depend on the user's device and software. Users can contact us if they require clarification. We would like to point out that the denial or revocation of the respective authorisations may affect the functionality of our application.

- Use of microphone functions: As part of the use of our application, the microphone functions and audio recordings captured with its help are processed. The use of the microphone functions requires user authorisation, which can be revoked at any time. The use of the microphone functions and audio data only serves to provide the respective functionality of our application, as described to users, or its typical and expected functionality.

- Processing of saved contacts: As part of the use of our application, the contact information of persons stored in the contact directory of the device (name, e-mail address, telephone number) is processed. The use of contact information requires user authorisation, which can be revoked at any time. The use of contact information only serves to provide the respective functionality of our application, as described to users, or its typical and expected functionality. Users are advised that permission to process contact information must be permitted and, in the case of natural persons in particular, requires their consent or legal authorisation.

- Use of contact data for contact matching purposes: The contact data stored in the device's contact directory can be used to check whether these contacts also use our application. For this purpose, the contact details of the respective contacts (which include the telephone number and email address as well as the names) are uploaded to our server and used solely for the purpose of synchronisation.

Obtaining applications via app stores

Our application is obtained via special online platforms operated by other service providers (so-called "app stores"). In this context, the data protection notices of the respective app stores apply in addition to our data protection notices. This applies in particular with regard to the procedures used on the platforms to measure reach and interest-based marketing as well as any obligation to pay costs.

- Processed data types: Inventory data (e.g. names, addresses); Payment data (e.g. bank details, invoices, payment history); Contact data (e.g. email, telephone numbers); Contract data (e.g. subject matter of the contract, duration, customer category); Usage data (e.g. websites visited, interest in the app). e.g. websites visited, interest in content, access times); meta, communication and process data (e.g. IP addresses, time data, identification numbers, consent status); content data (e.g. entries in online forms).

- Data subjects: Customers; users (e.g. website visitors, users of online services).

- Purposes of processing: Provision of contractual services and fulfilment of contractual obligations. Marketing.

- Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

15.1 Bhakti Marga Academy App

· 360 Learning Collaborative Learning platform

To provide online courses, we use 360Learning Collaborative Learning platform as an App, that relies on peer learning where anyone can elevate and respond to requests for knowledge, closing skills gaps faster. 360Learning involves learners in online courses on a day-to-day basis and helps increase engagement rates using gamification methods. Feedback and data from interactions within the course are pushed to coaches on the platform, who facilitate peer learning by ensuring that courses are easily accessible, actionable and impactful. For more information, please see 360Learning Privacy Policy. If you have a Bhakti ID account with us and have consented there to us, that we may contact you to offer you courses to support you on your spiritual path, you will receive an email from us with a link to the Bhakti Marga Academy app hosted by 360Learning Platform. Upon logging in, you will be redirected to the Bhakti ID login-in page. The processed data may include, personal data as necessary to provide the learning Collaborative platform services by 360Learning, in particular, IP addresses and email addresses, username, which, however, are not collected and processed without your consent (Art. 6 (1) lit. a GDPR) (usually as part of the settings of your desktop or mobile devices in the Bhakti ID Account). We have concluded an order processing agreement with the provider of 360Learning platform that complies with the requirements of Art. 28 GDPR.

Service provider: "Société Anonyme" 117 rue de la Tour, 75116 Paris, France, contact@360learning.com , website: https://360learning.com, DPA, Privacy Policy.

15.2 Translation system for readings and satsangs - Sennheiser app

In order to be able to offer our customers a translation during one of our events, we use the translation system from Sennnheiser.

Service provider: Sennheiser electronic GmbH & Co. KG, Am Labor 1 30900 Wedemark Germany, Website: www.sennheiser.com,

Phone: +49 (0) 5130 600 0

Fax: +49 (0) 5130 600 1300

E-Mail: contact@sennheiser.com,

Privacy Policy: https://www.sennheiser.com/en-de/privacy-policy

16. Communication via messenger

We use messengers for communication purposes and therefore ask you to observe the following information on the functionality of the messengers, encryption, the use of communication metadata and your options to object.

You can also contact us by alternative means, e.g. by telephone or email. Please use the contact options provided to you or the contact options provided within our online offering.

In the case of end-to-end encryption of content (i.e. the content of your message and attachments), we would like to point out that the communication content (i.e. the content of the message and attached images) is encrypted from end to end. This means that the content of the messages cannot be viewed, not even by the messenger providers themselves. You should always use a current version of the messenger with encryption enabled to ensure that the message content is encrypted.

However, we would also like to point out to our communication partners that although the messenger providers cannot view the content, they can find out that communication partners are communicating with us and when, as well as technical details.

Information about the communication partner's device used and, depending on the settings of their device, location information (so-called metadata) is also processed.

Notes on legal bases: If we ask communication partners for permission before communicating with them via Messenger, the legal basis for our processing of their data is their consent. Otherwise, if we do not ask for consent and you contact us, for example, on your own initiative, we use Messenger in relation to our contractual partners and in the context of contract initiation as a contractual measure and, in the case of other interested parties and communication partners, on the basis of our legitimate interests in fast and efficient communication and fulfilment of our communication partners' needs for communication via Messenger. We would also like to point out that we will not transmit the contact data provided to us to Messenger for the first time without your consent.

Revocation, objection and deletion: You can revoke your consent at any time and object to communication with us via Messenger at any time. In the case of communication via Messenger, we delete the messages in accordance with our general deletion guidelines (i.e., for example, as described above, after the end of contractual relationships, in the context of archiving requirements, etc.) and otherwise as soon as we can assume that we have answered any information from the communication partners, if no reference to a previous conversation is to be expected and the deletion does not conflict with any statutory retention obligations.

Reservation of reference to other communication channels: Finally, we would like to point out that, for reasons of your security, we reserve the right not to answer enquiries via Messenger. This is the case if, for example, internal contractual information requires special confidentiality or a reply via Messenger does not fulfil the formal requirements. In such cases, we will refer you to more appropriate communication channels.

- Processed data types: Contact data (e.g. e-mail, telephone numbers); Usage data (e.g. websites visited, interest in content, access times); Meta, communication and process data (e.g. IP addresses, time data, identification numbers, consent status); Content data (e.g. entries in online forms).

- Data subjects: Communication partners.

- Purposes of Processing: Contact requests and communication; Direct marketing (e.g. by e-mail or postal).

- Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR). Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Further information on processing operations, procedures and services:

- Telegram: Messenger with end-to-end encryption; Service provider: Representative in the European Union: European Data Protection Office (EDPO), Avenue Huart Hamoir 71, 1030 Brussels, Belgium; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://telegram.org/. Privacy Policy: https://telegram.org/privacy.

- Threema: Threema Messenger with end-to-end encryption; Service provider: Threema GmbH, Churerstrasse 82, 8808 Pfäffikon SZ, Switzerland; Legal basis: Legitimate interests (Art. 6 Para. 1 S. 1 lit. f) GDPR); Website: https://threema.ch/en. Privacy Policy: https://threema.ch/de/privacy. We have concluded an order processing agreement with ThreemaWork in accordance with Art. 28 GDPR.

17. Video conferences, online meetings, webinars and screen sharing

We use platforms and applications of other providers (hereinafter referred to as "conference platforms") for the purpose of conducting video and audio conferences, webinars and other types of video and audio meetings (hereinafter collectively referred to as "conference"). When selecting the conference platforms and their services, we observe the legal requirements.

Data processed by conference platforms: In the context of participation in a conference, the conference platforms process the personal data of the participants listed below. The scope of the processing depends on which data is required in the context of a specific conference (e.g. specification of access data or clear names) and which optional information is provided by the participants. In addition to processing for the purpose of holding the conference, the conference platforms may also process participants' data for security purposes or service optimisation.

The processed data includes personal data (first name, surname), contact information (e-mail address, telephone number), access data (access codes or passwords), profile pictures, information on professional position/function, the IP address of the Internet access, information on the participants' end devices, their operating system, the browser and its technical and language settings, information on the content of the communication processes, i.e. entries in chats and audio and video data, as well as the use of other available functions (e.g. surveys). The content of communications is encrypted to the extent technically provided by the conference providers. If the participants are registered as users with the conference platforms, further data may be processed in accordance with the agreement with the respective conference provider.

Logging and recordings: If text entries, participation results (e.g. from surveys) and video or audio recordings are logged, this will be transparently communicated to the participants in advance and they will be asked for consent where necessary. Data protection measures for participants: Please note the details of the processing of your data by the conference platforms in their data protection notices and select the optimum security and data protection settings for you in the conference platform settings. Please also ensure data and privacy protection in the background of your recording for the duration of a video conference (e.g. by informing roommates, locking doors and using the function to make the background unrecognisable if technically possible). Links to the conference rooms and access data may not be passed on to unauthorised third parties.

Notes on legal bases: If, in addition to the conference platforms, we also process users' data and ask users for their consent to use the conference platforms or certain functions (e.g. consent to the recording of conferences), the legal basis for processing is this consent.

Furthermore, our processing may be necessary to fulfil our contractual obligations (e.g. in participant lists, in the case of processing the results of discussions, etc.). Otherwise, user data is processed on the basis of our legitimate interests in efficient and secure communication with our communication partners.

- Processed data types: inventory data (e.g. names, addresses); contact data (e.g. email, telephone numbers); content data (e.g. entries in online forms); usage data (e.g. websites visited, interest in content, access times); meta, communication and process data (e.g. IP addresses, time data, identification numbers, consent status).

- Data subjects: Communication partners; users (e.g. website visitors, users of online services). Persons depicted.

- Purposes of processing: Provision of contractual services and fulfilment of contractual obligations; contact requests and communication. Office and organisational procedures.

- Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR). Further information on processing processes, procedures and services:

- Microsoft Teams: Conferencing and communication software; Service provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR);

Website: https://www.microsoft.com/de-de/microsoft-365;

Privacy Policy: https://privacy.microsoft.com/de-de/privacystatement, Security information: https://www.microsoft.com/de-de/trustcenter.

Basis for third country transfers: EU-US Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection- Addendum-DPA).

- Zoom: Conference and communication software; Service provider: Zoom Video Communications, Inc, 55 Almaden Blvd, Suite 600, San Jose, CA 95113, USA; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://zoom.us; Privacy Policy: https://zoom.us/docs/de-de/privacy-and- legal.html; Data Processing Agreement: https://zoom.us/docs/de-de/privacy-and-legal.html (referred to as Global DPA). Basis for third country transfers: EU-US Data Privacy Framework (DPF), Standard Contractual Clauses (https://zoom.us/docs/de-de/privacy-and-legal.html (referred to as Global DPA)).

18. Technical security measures

We take appropriate technical and organisational measures in accordance with the legal requirements, taking into account the state of the art, the implementation costs and the nature, scope, circumstances and purposes of the processing as well as the different probabilities of occurrence and the extent of the threat to the rights and freedoms of natural persons, in order to ensure a level of protection appropriate to the risk.

The measures include, in particular, safeguarding the confidentiality, integrity and availability of data by controlling physical and electronic access to the data as well as access, input, disclosure, safeguarding availability and separation of the data. Furthermore, we have established procedures that ensure the exercise of data subject rights, the deletion of data and responses to data threats. Furthermore, we already take the protection of personal data into account during the development and selection of hardware, software and processes in accordance with the principle of data protection, through technology design and data protection- friendly default settings.

We implement a variety of security measures designed to maintain the safety of your personal data we store and process. For example, to protect the transmission of confidential information that you send to us as the website provider, we use SSL encryption. You can recognize an encrypted connection by the fact that the address line of the browser changes from "http://" to "https://" and by the lock symbol in your browser line.

If SSL encryption is activated, the data you transmit to us cannot be read by third parties.

However, no security system is impenetrable, and we cannot guarantee the security of our systems 100%. In the event that any personal data under our control is compromised as a result of a security breach, we will take reasonable steps to investigate the situation and, where appropriate, notify those individuals whose personal data may have been compromised and or the competent data protection authority.

19. Rights of the data subject

You have the right to access, rectification, erasure, restriction, objection and data portability. You also have the right to lodge a complaint with the Hessian supervisory authority Postfach 3163, Hessian Commissioner for Data Protection and Freedom of Information

65021 Wiesbaden, Tel.: +49 611 14080, Fax: +49 611 1408900, E-Mail:poststelle@datenschutz.hessen.de.

With regard to the processing of the records and any objection, please contact us directly via the following e-mail address: dataprotection@bhaktimarga.org.

20. Right to object

If the personal data processing listed here is based on our legitimate interest in accordance with Art. 6 para. 1 lit. f GDPR, you have the right to object to this processing at any time with effect for the future for reasons arising from your particular situation.

Once you have objected, the processing of the data concerned will be terminated unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or if the processing serves the establishment, exercise or defence of legal claims.

If personal data is processed for direct marketing purposes, you can object to this processing at any time by notifying us. Once you have objected, we will stop processing the data concerned for the purpose of direct marketing.

21. Status of the Privacy Notice and Updates

Please note, this privacy notice may be amended by us at any time to the extent necessary to provide you with adequate information about the processing of your personal data. Therefore, please check this privacy notice at regular intervals, insofar as you regularly visit our website or regularly use our products and services. The date of the last update of this privacy notice is indicated at the beginning of this privacy notice.

Last update: 20.02.2024