In this Privacy Notice, we provide you with information about the processing of your personal data in connection with visiting and using our website.

To help you get the information that is relevant to you at a glance, we have broken down this Privacy Notice into individual sections:

1. Controller and Data Protection Officer
2. General information on the processing of your personal data
3. Visiting our website
4. Use of our website and our services
5. Marketing and user experience
6. Storage period
7. Recipients of your personal data
8. Transfer of your personal data to countries outside the EEA
9. Your rights and exercising your rights
10. Changes to this Privacy Notice

In this Privacy Notice, we provide you with information in accordance with the requirements of the European General Data Protection Regulation (“the GDPR”, Regulation (EU) 2016/679 of the European Parliament and of the Council). We also observe the requirements of other national data protection legislation that may apply to the processing of your personal data.

1 CONTROLLER AND DATA PROTECTION OFFICER

1.1 Controller

The controller under data protection law shall determine the purposes and means of the processing of your personal data and ensure compliance with the requirements of data protection legislation. Where two or more controllers jointly determine the purposes and means of the processing, those controllers shall be jointly responsible for the processing, so-called joint controllers. The controller responsible for the processing of your personal data in connection with this website is:

BOSCH BASF Smart Farming GmbH

Postal address: Im Zollhafen 24, 50678 Cologne, Germany

Email: contact@onesmartspray.com

VAT ID number: DE344099658

Registration court: District Court of Cologne, Commercial Register Number 106458

(“BBSF”, “we”, “us”). If you would like further information, please contact us at any time using the contact details specified above.

1.2 Data Protection Officer

Our Data Protection Officer can be contacted by sending a letter to the controller’s address marked “for the attention of the Data Protection Officer” or by sending an email to privacy@onesmartspray.com.

2 GENERAL INFORMATION ON THE PROCESSING OF YOUR PERSONAL DATA

2.1 Processing of your personal data

Where we use the term “personal data” in this Privacy Notice we mean any information relating to you. Examples of personal data are your name, email address and postal address. However, your personal data include any data that are linked to you or that relate to you. We refer to data that do not relate to you as “non-personal data” or “anonymous data”. Data protection rules and this Privacy Notice do not apply to these data. We understand processing of your personal data to include, for example, the collection, storage, or erasure of your data.

2.2 Overview of the legal basis for processing your personal data

We process your personal data only if we can base the processing on a legal basis or if this is lawful under the applicable data protection law, i.e. the processing is legally permissible. Within the scope of the GDPR most of the processing of your personal data is based on the following legal basis:

• The processing of your personal data is necessary for the performance of a contract with you or in order to take steps at your request prior to entering into a contract (Article 6 (1) (b) of the GDPR).
• You have given us your consent to the processing of your personal data for one or more specific purposes (Article 6 (1) (a) GDPR).
• The processing of your personal data is necessary for compliance with a legal obligation to which we are subject (Article 6 (1) (c) of the GDPR).
• Processing is necessary for the purposes of the legitimate interests pursued by us or by a third party, except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data (Article 6 (1) (f) of the GDPR).

Further information on which processing operations are specifically based on which legal basis or under which data protection legislation processing is permissible is set out below in this Privacy Notice.

2.3 What personal data we collect from you

We process personal data that you provide to us, that we collect (automatically) or that we receive from third parties. In principle, you are not obliged to provide your personal data to us. However, the disclosure of certain personal data may be necessary to enable us to offer and provide the website and all the functions of the website to you. Personal data that you provide to us We process information that you provide to us. For example, you may call us or contact us in some other way and provide certain information to us by these means. We collect and process these data to enable you to use our website. If you do not provide us with certain information, this may exclude or impair the use or full functionality of our website. Personal data that are collected (automatically) Certain information is collected and processed by us (automatically) when you use our website. This includes data such as your IP address, specific login data and data that are processed to enable us to make our website technically available. Personal data that we receive from third parties Sometimes we do not receive information directly from you. This may be the case, for example, if information about you is provided to us by third parties. For example, we work with companies that provide services for us and provide us with information about you.

3 VISITING OUR WEBSITE

When you visit our website, the browser used on your device automatically sends information to the server on our website and temporarily stores it in a log file. If you would like to learn more about the cookies we use on our website, please click here. Categories of personal data The following information is processed when the website is visited:

• Your IP address
• The date and time of access
• The name and URL of the retrieved file
• The web page/application from which access was made (referrer URL)
• The browser you are using and, if applicable, the operating system of the device you are using to access our website and the name of your access provider

Purpose Your personal data are processed for the following purposes:

• To ensure that a smooth connection is established
• To ensure that our website is easy to use
• To analyse system security and stability

Legal basis We base the processing of your personal data on the following legal basis:

• Processing of your personal data is necessary to enable you to visit the website and to ensure the performance, long-term functionality and security of our website and systems.

We process your personal data based on Article 6 (1) (f) of the GDPR. We have a legitimate interest in ensuring the performance, long-term functionality and security of our website and systems. Storage period In principle, we shall process your personal data only for as long as is necessary to achieve these purposes. For more information on the storage period, see section 6 of this Privacy Notice.

4 USE OF OUR WEBSITE AND OUR SERVICES

4.1           Contact and communication

If you have any questions, you can contact us at any time by email, post, telephone, contact forms or any other means. If you contact us, we will usually reply to you via the means of communication chosen by you. Categories of personal data The following information is processed when communicating with you:

• Your contact details, such as your phone number or email address
• Communication with you, including recordings of telephone calls with you, if applicable
• Data relating to your request or your concern, such as the subject matter of your request or our communication with you
• Data necessary to clarify your concern

Purpose Your personal data are processed for the following purposes:

• To communicate with you if you have contacted us with questions or other concerns
• To communicate with you in relation to matters other than requests and concerns, for example for information purposes or to comply with legal or contractual obligations
• If we record telephone calls with you, this is done for quality assurance and training purposes
• To improve our support

These purposes are hereinafter collectively referred to as “support”. Legal basis We base the processing of your personal data on the following legal basis:

• Processing your personal data in connection with our support is necessary for the performance of a contract with you or in order to take steps at your request prior to entering into a contract.

We process your personal data based on Article 6 (1) (b) of the GDPR.

• We provide you with certain support services outside of an existing contract.

We process your personal data based on Article 6 (1) (f) of the GDPR. We have a legitimate interest in helping you in the event of questions about our offers and services and in ensuring the satisfaction of our (former and future) customers.

• For some processing of your personal data we shall obtain your consent where necessary in accordance with Article 6 (1) (a) of the GDPR.

This applies in particular to the recording of telephone calls. Storage period In principle, we shall process your personal data only for as long as is necessary to achieve these purposes. For more information on the storage period, see section 6 of this Privacy Notice.

5 MARKETING AND USER EXPERIENCE

5.1 Cookies and similar technologies

We use technologies on our website that are intended to facilitate the use of the website and make it more user-friendly and to provide various functionalities. Such technologies include, for example, cookies, pixels and scripts. This section provides information on your personal data in this context. In our cookie policy we explain what cookies and similar technologies we use on our website for what purposes and how you can manage these cookies.

5.2 Providing, developing, and improving our website

(a) Google reCAPTCHA

We use reCAPTCHA v2 on our website. reCAPTCHA v2 is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google Ltd”, together with other Google companies of Alphabet Inc. “Google”).

Categories of personal data The following information is processed in connection with the use of Google reCAPTCHA:

• Your IP address
• Used browser plug-ins
• The cookies set by Google in the last 6 months
• Number of clicks and touches you have made on this screen
• CSS information for the page visited
• JavaScript objects
• The date
• The browser language

Purpose

We use reCAPTCHA v2 to prevent abusive automated entries in web forms, thereby protecting the host’s technical systems.

Legal basis We base the processing of your personal data on the following legal basis:

• The processing of your personal data is based on your consent, which you give us in the cookie banner.

We process your personal data based on Article 6(1)(a) DSGVO.

• The use of reCaptcha v2 requires the setting of a cookie. For this, we obtain your consent in accordance with Art. 6(1)(a) DSGVO in the cookie banner. Further information about our cookies can be found in our Cookie Information.

Storage duration In principle, we shall process your personal data only for as long as is necessary to achieve these purposes. For more information on the storage period, see section 6 of this Privacy Notice. Transfer of your data to countries outside the EEA In connection with the use of reCAPTCHA v2, personal data are transferred to countries outside the EEA. For more information, see section 8 of this Privacy Notice. Privacy Notice The Privacy Notice for Google Ltd’s reCAPTCHA can be found here: https://policies.google.com/privacy?hl=de

(b) YouTube

On our website we embed video content via YouTube. YouTube is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (‘Google Ltd’, together with other Google companies of Alphabet Inc. “Google”).

Categories of personal data

The following information is processed in connection with the use of Youtube:

• Your IP address
• Information about your device
• Browser
• Operating system
• Information about the video content you have viewed

Purpose

We link video content via YouTube to inform you about our products and offers.

Legal basis We base the processing of your personal data on the following legal basis:

• Video content is displayed with a thumbnail image. Your data are processed by Google only when you have consented to the processing of your data (“two-click solution”).

• We process your personal data based on Article 6 (1) (a) of the GDPR.

• The use of YouTube requires setting a cookie. To that end, we shall obtain your consent under Article 6 (1) (a) of the GDPR in the cookie banner. For more information about our cookies, see our cookie policy.

Storage duration In principle, we shall process your personal data only for as long as is necessary to achieve these purposes. For more information on the storage period, see section 6 of this Privacy Notice. Transfer of your data to countries outside the EEA

• In connection with the use of YouTube, personal data are transferred to countries outside the EEA. For more information, see section 8of this Privacy Notice.

Privacy Notice Google’s Privacy Notice for the processing of personal data in connection with YouTube can be found here: https://policies.google.com/privacy?hl=de

6 STORAGE PERIOD

We shall store your data only for as long as is necessary to provide our offerings, in particular our website, or for as long as we have a legitimate interest in continuing to store your data. The storage period for your personal data depends in particular on the category of personal data processed and the purpose of the processing. Storage of your data is also considered based on your consent to its storage. Finally, we take into account statutory storage periods, which may require us to keep your data for a certain period of time. Your data will therefore be stored if this is provided for by the European or national legislator in European Union regulations, laws or other provisions to which we are subject. Corresponding requirements are also found in particular in commercial and tax legislation or derive from the regular statutory limitation periods. In the event of a legal dispute, we will keep the personal data that we need for our legal defence until the final conclusion of the proceedings. For further information on the storage period, please contact us using the contact details that can be found in section 1 of this Privacy Notice.

7 RECIPIENTS OF YOUR PERSONAL DATA

7.1 Recipients within the BASF Group and BOSCH Group

In certain cases, we share your personal data with other companies in the BASF Group and BOSCH Group (hereinafter „BASF and BOSCH companies“). Processing by these BASF and BOSCH companies is done regularly on our behalf. The processing of your personal data may also be carried out under the sole controllership of the BASF and BOSCH company receiving your data or under the joint controllership of that company with us. If we share your personal data with other controllers, this will in principle be done only if this is necessary for the performance of a contract with you, if we or the third party have a legitimate interest in this or if you have agreed to this. Processing of your personal data by another BASF and BOSCH company on our behalf is carried out on the basis of a contract for processing data on behalf of a controller within the meaning of the GDPR. In the case of joint controllership, we shall conclude an agreement on processing under joint controllership. This agreement shall lay down, inter alia, the obligations of the joint controllers in relation to compliance with the requirements of the GDPR. We shall be happy to provide you with the essential elements of this agreement on request. To this end, please contact us using the contact details that can be found in section 1 of this Privacy Notice.

7.2 Recipients outside the BASF Group and BOSCH Group (third parties)

In addition to recipients in the BASF and BOSCH companies, we also share your personal data with third parties, in respect of individual processing operations and taking into account the data protection requirements. These third parties include service providers that process your personal data on our behalf and service providers that provide services for us that are associated with the processing of your personal data. The processing of your personal data may also be carried out under the sole controllership of the third parties receiving your data or under the joint controllership of those third parties with us. If we share your personal data with other controllers, this will in principle be done only if this is necessary for the performance of a contract with you, if we or the third party have a legitimate interest in this or if you have consented to this. In connection with the processing of your personal data we use the following categories of service providers:

• IT service providers (data hosting providers)
• Support (customer support)
• Lawyers, accountants and tax advisers

Where we are obliged to do so under the GDPR or the law of EU Member States, we will also pass on your data to authorities and courts. Processing of your personal data by third parties on our behalf is carried out on the basis of a contract for processing data on behalf of a controller within the meaning of the GDPR. In the case of joint controllership, we shall conclude an agreement on processing under joint controllership. We shall be happy to provide you with the essential elements of this agreement on request. To this end, please contact us using the contact details that can be found in section 1 of this Privacy Notice.

8 TRANSFER OF YOUR PERSONAL DATA TO COUNTRIES OUTSIDE THE EUROPEAN ECONOMIC AREA

Regardless of where your personal data are processed, our highest priority is to always ensure the level of protection guaranteed by the GDPR. If we transfer personal data to recipients outside the European Economic Area, we comply with the requirements of Chapter V of the GDPR. If we work with third parties or use service providers that may transfer your personal data to countries outside the European Economic Area, we shall oblige those third parties or service providers to comply with the requirements of Chapter V of the GDPR. We point out that not all countries outside the European Economic Area have a level of data protection that is recognised as adequate by the European Commission (so-called “adequacy decision”). A list of the countries for which an adequacy decision has been adopted can be found at the following link: Adequacy decisions (europa.eu). Where an adequacy decision has not been adopted, we conclude the standard contractual clauses adopted by the EU Commission with the recipients of your personal data ((EU) 2021/914 of 4 April 2021 – C (2021) 3972, OJ EU No L 199/31 of 7 June 2021). For transfer to other controllers, we use Module One of these standard contractual clauses and for transfer to our processors we use Module Two. If necessary, in addition to concluding the standard contractual clauses we shall also take additional measures to protect your personal data. You can ask us for an overview of recipients in countries outside the European Economic Area and for information on the measures we have taken to ensure the level of protection of the GDPR at any time using the contact details specified in section 1 of this Privacy Notice.

9 YOUR RIGHTS AND EXERCISING YOUR RIGHTS

If you wish to exercise your rights set out below, you can contact us informally at any time using the means of communication specified in this Privacy Notice. You can contact us and our Data Protection Officer by email and the other means of communication using the contact details set out in section 1 of this Privacy Notice.

9.1 Right of access

You have the right to obtain confirmation as to whether or not personal data concerning you are being processed. If we are processing personal data concerning you, you have the right of access to the personal data and certain information prescribed by law. For more information on your right of access, see Article 15 of the GDPR.

9.2 Right to rectification

You have the right to obtain without undue delay the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed. For more information on your right to rectification, see Article 16 of the GDPR.

We always strive to ensure the accuracy of your personal data. Therefore, please notify us of any changes to your data (such as address changes) without undue delay, so that we can ensure your personal data are up-to-date.

9.3 Right to erasure

If the legal requirements are met, you may obtain the erasure of your personal data without undue delay. In particular, this is the case where:

• your personal data are no longer needed for the purposes for which they were collected or otherwise processed;

• the processing of your personal data is based on your consent, you withdraw that consent and we cannot base the processing on another legal basis;

• you have objected to the processing of your personal data on grounds relating to your particular situation and there are no overriding grounds for the processing of your personal data;

• if your personal data have been passed on to third parties and we are obliged to erase your personal data, we shall inform those third parties of the erasure obligation, where required by law.

Please note that your right to erasure is subject to restrictions. For example, we are not allowed to erase personal data that we are legally required to continue to keep. Data that we need for the establishment, exercise or defence of legal claims are also excluded from your right to erasure. For more information on your right to erasure, see Article 17 of the GDPR.

9.4 Right to restriction of processing

If the legal requirements are met, you may obtain restriction of processing of your personal data. In particular, this is the case where:

• you contest the accuracy of your personal data. The processing of your data will be restricted for a period enabling us to verify the accuracy of your personal data;

• the processing of your personal data is unlawful and you request the restriction of the use of your personal data instead of the erasure of your personal data;

• we no longer need your personal data for the purposes of processing, but they are required by you for the establishment, exercise or defence of legal claims;

• you have objected to the processing of your personal data on grounds relating to your particular situation pending the verification whether our legitimate grounds for the processing override your grounds.

For more information on your right to restriction of processing, see Article 18 of the GDPR.

9.5 Right to data portability

You have the right to receive the personal data that you have provided to us and that we process for the performance of the contract, based on your consent or by automated means, in a structured, commonly used and machine-readable format. You also have the right, if the above-mentioned conditions are met, to have us transmit these data directly to a third party, where technically feasible. For more information on your right to data portability, see Article 20 of the GDPR.

9.6 Withdrawal of consent

If you have given your consent to the processing of your personal data, you may withdraw it at any time with future effect. This shall be without prejudice to the lawfulness of the processing of your data until it has been withdrawn.

9.7 Right to lodge complaints with the data protection supervisory authorities

If you consider that the processing of your personal data infringes applicable data protection legislation, you may lodge a complaint with a data protection supervisory authority, in particular the data protection supervisory authority in the place of your habitual residence, place of work or place of the alleged infringement.

9.8 Right to object to processing

Right to object to the processing of your personal data in the case of processing based on our legitimate interests   Where we process data based on a legitimate interest, you may object to the processing, on grounds relating to your particular situation, at any time. We shall then no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or the processing is for the establishment, exercise or defence of legal claims. We assume that, when processing is carried out based on a legitimate interest, we shall generally be able to demonstrate such compelling legitimate grounds, but we shall examine and assess each objection individually. For more information on your right to object, see Article 21 of the GDPR.

10 CHANGES TO THIS PRIVACY NOTICE

In this Privacy Notice, we always provide you with up-to-date, complete and, in principle, final information about the processing of your personal data in connection with our website. This requires us to regularly update this Privacy Notice. We therefore advise you to consult this Privacy Notice on a regular basis.