In this privacy policy, we inform you about the processing of your personal data in connection with the access and use of our website.

To help you find the information relevant to you at a glance, we have divided this privacy notice into individual chapters:

1. responsible person and data protection officer
2. general information about the processing of your personal data
3. call our website
4. use of our website and our offers
5. marketing and user experience
6. storage period
7. recipients of your personal data
8. transfer of your personal data to countries outside the EEA
9. your rights and their assertion
10. changes to this privacy notice

In this privacy policy, we inform you in accordance with the requirements of the European Data Protection Regulation (“GDPR”, Regulation (EU) 2016/679 of the European Parliament and of the Council). In addition, we observe other national data protection requirements that may apply to the processing of your personal data.

1 RESPONSIBLE PERSON AND DATA PROTECTION OFFICER

1.1 Responsibility

The data controller decides on the purposes and means of processing your personal data and ensures compliance with data protection requirements. If several data controllers jointly decide on the purposes and means of processing, these data controllers are jointly responsible for the processing, so-called joint responsibility.

Responsible for the processing of your personal data in connection with this website is the

BOSCH BASF Smart Farming GmbH

Postal address: Im Zollhafen 24, 50678 Cologne, Germany

E-mail address: contact@onesmartspray.com

Umsatzsteuer-Ident.-Nr: DE344099658

Register Court: Local Court Cologne, HRB 106458

(“we”, “us”).

Should you require further information, please do not hesitate to contact us at any time using the contact details provided.

1.2 Data Protection Officer

You can reach our data protection officer by mail at the address of the person responsible with the note “for the attention of the data protection officer” or by e-mail at privacy@onesmartspray.com.

2 GENERAL INFORMATION ON THE PROCESSING OF YOUR PERSONAL DATA

2.1 Processing of your personal data

When we use the term personal data in this privacy notice, we mean any information that relates to you.

Personal data are, for example, your name, your e-mail address or your address. However, your personal data also includes all data that is linked to you or that relates to you. We refer to data that does not relate to you as non-personal or anonymous data. The data protection regulations and this data protection notice do not apply to this data.

By processing your personal data, we understand, for example, the collection, storage or deletion of your data.

2.2 Legal basis for the processing of your personal data (overview)

We only process your personal data if we can base the processing on a legal basis or if this is lawful according to the applicable data protection regulations, i.e. that the processing is permissible within the meaning of the law. Within the scope of application of the GDPR, we base the processing of your personal data for the most part on the legal bases listed below:

• The processing of your personal data is necessary for the performance of a contract with you or for the implementation of pre-contractual measures, which are carried out at your request (Article 6 (1) b) DSGVO).
• You have given us your consent to process your personal data for one or more specific purposes (Article 6 (1) a) DSGVO).
• The processing of your personal data is necessary for compliance with a legal obligation to which we are subject (Article 6 (1) c) DSGVO).
• The processing is necessary to protect our legitimate interests or the legitimate interests of a third party, unless your interests or fundamental rights and freedoms requiring the protection of personal data override (Article 6(1)(f) DSGVO).

Further information on which processing operations we specifically base on which legal basis or according to which data protection provisions the processing is permissible can be found below in this data protection notice.

2.3 What personal data do we collect from you

We process the personal data that you provide to us, that we (automatically) collect or that we receive from third parties.

In principle, you are not obliged to provide us with your personal data. However, the provision of certain personal data may be necessary so that we can provide and offer you the website and all its functions.

Personal data that you share with us

We process the information that you provide to us. For example, you may call or otherwise contact us and provide us with certain information in this way. We collect and process this information to enable you to use our website. If you do not provide us with certain information, this may prevent or impair the use or functionality of our website.

Personal data that is collected (automatically)

Certain information is collected and processed by us (automatically) when you use our website. This includes, for example, data such as your IP address, certain login data and data that is processed so that we can make our website technically available to you.

Personal data we receive from third parties

Sometimes we do not receive information directly from you. This may be the case, for example, when information about you is provided to us by third parties. For example, we work with companies that provide services for us and that share information about you with us.

3 Calling our website

When you visit our website, the browser used on your terminal device automatically sends information to the server of our website and stores it temporarily in a so-called log file.

If you would like to know more about the cookies we use on our website, you can find more information here.

Categories of personal data

The following information is processed when you access the website:

• Your IP address
• The date and time of access
• The name and URL of the retrieved file
• The website/application from which the access was made (referrer URL)
• The browser you use and, if applicable, the operating system of the end device you use to access our website as well as the name of your access provider

Purpose

The processing of your personal data serves the following purpose(s):

• Ensuring smooth connection establishment
• Ensuring a comfortable use of our website
• Evaluation of system security and stability

Legal basis

We base the processing of your personal data on the following legal basis:

• The processing of your personal data is necessary to enable you to access the website and to ensure the performance, long-term functionality and security of our website and systems.

We process your personal data based on Article 6(1)(f) DSGVO.

It is our legitimate interest to ensure the performance, long-term functionality and security of our website and systems.

Storage duration

In principle, we process your personal data only as long as this is necessary to achieve the stated purposes. Further information on the storage period can be found under para. 6 of this data protection notice.

4 Use of our website and our offers

4.1           Contact and communication

If you have any questions, we are always available to answer them by e-mail, by mail, by telephone, through contact forms, or by other means. If you reach out to us, we will generally respond to you by your chosen method of communication.

Categories of personal data

The following information is processed when communicating with you:

• Your contact information such as your phone number or email address
• Communications with you, including, if applicable, recordings of telephone conversations with you
• Data related to your inquiry or request, such as the subject of your inquiry or our communication with you
• Data required to clarify your request

Purpose

The processing of your personal data serves the following purpose(s):

• Communicating with you when you have approached us with questions or other concerns
• Communicating with you outside of inquiries and requests, for example, for information purposes or to fulfill legal or contractual obligations
• If we record telephone conversations with you, this is done for quality assurance and training purposes
• The improvement of our support

We refer to these purposes collectively as “Support” below.

Legal basis

We base the processing of your personal data on the following legal basis:

• The processing of your personal data within the scope of our support is necessary for the fulfillment of a contract with you or for the implementation of pre-contractual measures that take place upon your request.

We process your personal data based on Article 6(1)(b) DSGVO.

• We provide certain support services to you outside of an existing contractual relationship.

We process your personal data based on Article 6(1)(f) DSGVO.

Our legitimate interest is to assist you with questions about our offerings and services and to ensure the satisfaction of our (past and future) customers.

• For certain processing of your personal data, we obtain your consent in accordance with Article 6 (1) a) DSGVO to the extent necessary.

This applies in particular to the recording of telephone conversations.

Storage duration

In principle, we process your personal data only as long as this is necessary to achieve the stated purposes. Further information on the storage period can be found under para. 6 of this data protection notice.

5 Marketing and user experience

5.1 Cookies and similar technologies

We use technologies on our website to facilitate the use of the website and improve the user experience and to provide various functionalities. Such technologies include, for example, cookies and scripts. In this chapter, we inform you about your personal data in this context.

In our cookie information we explain which cookies and similar technologies we use for which purposes on our website and what options you have with regard to the management of these cookies.

5.2 Provision, development and improvement of our website

(a) Google Recaptcha

On our website we use reCaptcha v2. reCaptcha v2 is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, (“Google Ltd.”, together with other Google companies of Alphabet Inc. referred to as “Google”).

Categories of personal data

The following information is processed in connection with the use of Google Analytics:

• Your IP address
• Browser plugins used
• The cookies set by Google in the last 6 months
• Number of mouse clicks and touches you have made on this screen
• CSS information for the called page
• Javascript objects
• the date
• The browser language

Purpose

We use reCaptcha v2 to prevent abusive automated entries into web forms and thus protect the technical systems of the hoster.

Legal basis

We base the processing of your personal data on the following legal basis:

• The processing of your personal data is based on your consent, which you give us in the cookie banner.

We process your personal data based on Article 6(1)(a) DSGVO.

• The use of reCaptcha v2 requires the setting of a cookie. For this, we obtain your consent in accordance with Art. 6(1)(a) DSGVO in the cookie banner. Further information about our cookies can be found in our Cookie Information.

Storage duration

In principle, we process your personal data only as long as this is necessary to achieve the stated purposes. Further information on the storage period can be found under para. 6 of this data protection notice.

Transfer of your data to countries outside the EEA

In connection with the use of reCaptcha v2, personal data is transferred to countries outside the EEA. You can find more information about this under para. 7 of this privacy policy.

Privacy policy

The privacy notice for reCaptcha of Google Ldt. can be found here:

https://policies.google.com/privacy?hl=de

(b) Youtube

On our website we embed video content using Youtube. Youtube is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google Ltd.”, together with other Google companies of Alphabet Inc. referred to as “Google”).

Categories of personal data

• The following information is processed in connection with the use of Youtube:

• Your IP address
• Information about your terminal device
• Browser
• Operating system

Purpose

We include video content using Youtube to inform you about our products and offers.

Legal basis

We base the processing of your personal data on the following legal basis:

• The video content is displayed with a preview image. Only after you have agreed to the processing of your data, your data will be processed by Google (“two-click solution”).

We process your personal data based on Article 6(1)(a) DSGVO.

• The use of Youtube requires the setting of a cookie. For this, we obtain your consent in accordance with Art. 6 (1) a) DSGVO in the cookie banner. Further information about our cookies can be found in our cookie information.

Storage duration

In principle, we process your personal data only as long as this is necessary to achieve the stated purposes. Further information on the storage period can be found under para. 6 of this data protection notice.

Transfer of your data to countries outside the EEA

In connection with the use of Youtube, personal data is transferred to countries outside the EEA. You can find more information on this under para. 7 of this privacy policy.

Privacy policy

Google’s privacy policy on the processing of personal data in connection with Youtube can be found here:

https://policies.google.com/privacy?hl=de

6 STORAGE DURATION

We only store your data for as long as is necessary for the provision of our offers, in particular our website, or as long as we have a legitimate interest in the continued storage of your data. The storage period of your personal data depends in particular on the category of personal data processed and the purpose of the processing. Storage of your data may also be considered on the basis of your consent to storage.

Finally, we take into account legal storage periods that may oblige us to retain your data for a certain period of time. Your data is therefore stored if this is provided for by the European or national legislator in EU regulations, laws or other provisions to which we are subject. Corresponding requirements can be found in particular in commercial and tax law requirements or arise from the regular statutory limitation periods.

In the event of a legal dispute, we will retain the personal data we need for legal defense until the final conclusion of the proceedings.

For further information on the storage period, please contact us using the contact details provided in section 1 of this privacy policy.

7 RECIPIENTS OF YOUR PERSONAL DATA

7.1 Recipients within the BASF Group and BOSCH Group

We share your personal data in certain cases with other BASF Group and BOSCH Group companies (hereinafter “BASF and BOSCH Companies”). The processing by these BASF and BOSCH companies is regularly carried out on our behalf. The processing of your personal data may also be carried out under the responsibility of the BASF and BOSCH company receiving your data or under the joint responsibility of this company with us.

If we share your personal data with other responsible parties, this will only be done if it is necessary for the fulfillment of a contract with you, we or the third party have a legitimate interest in this or you have consented to this.

The processing of your personal data by another BASF and BOSCH company on our behalf is based on a contract for the processing of data on behalf within the meaning of the GDPR.

In the case of joint responsibility, we conclude a joint responsibility processing agreement. This agreement sets out, among other things, the obligations of the joint controllers with regard to compliance with the requirements of the GDPR. We will be happy to provide you with the essence of this agreement upon request. Please feel free to contact us using the contact details provided in section 1 of this privacy notice.

7.2 Recipients outside the BASF Group and BOSCH Group (third parties)

In addition to recipients of the BASF Group and BOSCH Group, we share your personal data with third parties in relation to individual processing operations and in compliance with data protection requirements. These third parties include service providers who process your personal data on our behalf and service providers who perform services for us that involve the processing of your personal data. The processing of your personal data may also be carried out under the responsibility of the third parties receiving your data or under their joint responsibility with us.

If we share your personal data with other responsible parties, this will only be done if it is necessary for the fulfillment of a contract with you, we or the third party have a legitimate interest in this or you have consented to this.

In connection with the processing of your personal data, we use the following categories of service providers:

• IT service provider (data hosting provider);
• Support (Customer Support);
• Lawyers, auditors and tax consultants;

Insofar as we are obliged to do so under the GDPR or the law of the EU member states, we will also disclose your data to authorities and courts.

The processing of your personal data by third parties on our behalf is based on a contract for the processing of data on behalf within the meaning of the GDPR.

In case of joint responsibility, we conclude a joint responsibility processing agreement. We will be happy to provide you with the essentials of this agreement upon request. Please feel free to contact us at the contact details provided in this Privacy Notice under section 1.

8 TRANSFER OF YOUR PERSONAL DATA TO COUNTRIES OUTSIDE THE EUROPEAN ECONOMIC AREA

Regardless of where your personal data is processed, our highest priority is to ensure that the level of protection provided by the GDPR is always guaranteed.

If we transfer personal data to recipients outside the European Economic Area, we comply with the provisions of Chapter V of the GDPR. If we cooperate with third parties or use service providers who may transfer your personal data to countries outside the European Economic Area, we oblige these third parties or service providers to comply with the provisions of Chapter V of the GDPR.

We would like to point out that not all countries outside the European Economic Area have a level of data protection recognized as adequate by the European Commission (so-called adequacy decision). A list of countries for which an adequacy decision has been issued can be found at the following link: Adequacy decisions (europa.eu).

Unless an adequacy decision has been issued, we conclude the standard contractual clauses adopted by the EU Commission with the recipients of your personal data ((EU) 2021/914 of April 4, 2021 – Ref. C (2021) 3972, OJ EU No. L 199/31 of June 7, 2021). For transfers to other controllers, we use Module One of these standard contractual clauses, and for transfers to our processors, Module Two. Where necessary, in addition to concluding the standard contractual clauses, we take supplementary measures to protect your personal data.

You can request an overview of the recipients in countries outside the European Economic Area and information about the measures we have taken to ensure the level of protection of the GDPR from us at any time using the contact details provided in this Privacy Notice under section. 2 contact data mentioned in this privacy policy

9 YOUR RIGHTS AND THEIR ASSERTION

If you wish to exercise your rights as set out below, you can contact us at any time and informally via the communication channels specified in this privacy policy. You can reach us and our data protection officer by e-mail and other communication channels at the addresses given in this data protection notice under section 2. 2 listed in this data protection notice.

9.1 Right to information

You have a right to request confirmation as to whether personal data about you is being processed. If we process personal data from you, you have a right to information about this personal data and certain legally required information. You can find more information about your right to information in Art. 15 DSGVO.

9.2 Right to rectification

You have the right to request that inaccurate personal data concerning you be corrected without undue delay. Taking into account the purposes of the processing, you have the right to request the completion of incomplete personal data. For more information on your right to rectification, please refer to Article 16 of the GDPR.

We always strive to ensure the accuracy of your personal data. We therefore ask you to inform us immediately of any changes to your data (such as changes of address), so that we can ensure that your personal data is up to date.

9.3 Right to deletion

You may, if the legal requirements are met, demand that we delete your personal data without delay. This is particularly the case if

• Your personal data is no longer needed for the purposes for which it was collected or otherwise processed;
• The processing of your personal data is based on your consent, you revoke this consent and we cannot base the processing on another legal basis;
• you have objected to the processing of your personal data on grounds relating to your particular situation and there are no overriding reasons for processing your personal data.
• If your personal data has been disclosed to third parties and we are obliged to delete your personal data, we will inform these third parties of the deletion to the extent required by law.

We would like to point out that your right to deletion is subject to restrictions. For example, we may not delete personal data that we are required by law to retain. Data that we need to assert, exercise or defend legal claims are also excluded from your right to erasure. For more information on your right to erasure, please refer to Art. 17 DSGVO.

9.4 Right to restriction of processing

You may, if the legal requirements are met, request restriction of the processing of your personal data. This is particularly the case if:

• The accuracy of your personal data is disputed by you. The processing of your data will be restricted for a period of time that allows us to verify the accuracy of your personal data;
• The processing of your personal data is not lawful and you request a restriction of the use of your personal data instead of the deletion of your personal data;
• We no longer need your personal data for the purposes of processing, but you need this data to assert, exercise or defend legal claims;
• you have objected to the processing of your personal data on grounds relating to your particular situation, as long as it has not been determined whether our legitimate grounds for processing override your grounds.

For more information on your right to restrict processing, see Art. 18 GDPR.

9.5 Right to data portability

You have the right to receive personal data that you have provided to us and that we process for the performance of the contract, on the basis of your consent or with the help of automated processes, in a structured, common and machine-readable format. In addition, if the aforementioned conditions are met, you have the right to have us transfer this data directly to a third party, insofar as this is technically feasible. Further information on your right to data portability can be found in Art. 20 DSGVO.

9.6 Revocation of consent

If you have given your consent to the processing of your personal data, you may revoke this consent at any time with effect for the future. The lawfulness of the processing of your data until the revocation remains unaffected.

9.7 Right to lodge complaints with the data protection supervisory authorities

If you believe that the processing of your personal data violates applicable data protection law, you may lodge a complaint with a data protection supervisory authority, in particular the data protection supervisory authority in your place of residence, place of work or place of the alleged infringement.

9.8 Right to object to processing

10 CHANGES TO THIS PRIVACY NOTICE

In this data protection notice, we always provide you with up-to-date, complete and basically conclusive information about the processing of your personal data in connection with our website. This requires that we regularly update this data protection notice. We therefore recommend that you call up this data protection notice regularly.