Data Privacy Statements of PortasGC, Lda. Ba (Portugal), last updated June 2020

The details and pieces of information that appear on our websites have been carefully checked and researched by GEZE. We strive to keep expanding and updating this pool of information. However, GEZE is unable to assume any liability, guarantee or responsibility for correctness, completeness and topicality. This also applies to internet sites to which this website makes direct or indirect references. Our privacy policy does not apply to websites of other providers, even if our website links to these. Therefore, please note the specific privacy policies of the corresponding website providers when you leave our website. GEZE reserves the right to make changes or additions to the provided information without making any prior announcements regarding the same.

The provider is not responsible for the information and content stored, by way of example but not limitation, in forums, chats, blog generators, comments, social networks or any other means that allows third parties to publish content independently from the website of the lender. However, and in compliance with the provisions of art. 11 and 16 of the LSSICE, the provider makes himself available to all users, authorities and security forces, and actively collaborates in the withdrawal or, when necessary, the blocking of all content that may affect or contravene the national or international legislation, third party rights or morals and public order. In the event that the user considers that there may be any content that could be susceptible to this classification, please notify the website administrator immediately.

The contents and layouts of these websites are protected by copyright. The websites or their contents may be reproduced only with prior written consent from GEZE GmbH. This condition does not apply to press releases that appear in the ‘Company’ and ‘Press’ sections, and which serve to facilitate general and customary press work. Links directing towards the sites of www.geze.de/.com/.pt as well as GEZE GmbH websites, may be set. The following section contains information regarding the specific personal data that we collect when you use our websites or their services and functions, how we process said data, and for what purposes. GEZE GmbH, Reinhold-Vöster-Str. 21-29 in 71229 Leonberg, Germany (hereinafter referred to as ‘we’) is responsible for the operations in which these websites are used to collect and utilize data.

You can use our websites to sign up for and subscribe to our monthly newsletter or other communications that are sent via e-mail. We collect your name and e-mail address and use the said data to e-mail you the newsletter or, as the case may be, the other communications that you have subscribed to. We use the so-called ‘double opt-in procedure’ to verify your willingness to receive our newsletter or other communications via e-mail. This means that we first send an e-mail to the e-mail address that you specified during the subscription procedure in order to request you to actively confirm your willingness to receive the newsletter or other communication; this is done before we start sending the respective items. The information regarding this confirmation is used to document and (if necessary) verify your consent. Your willingness to receive the newsletter or other communications and your consent for the associated utilization of your personal data can be revoked for the future at any time.

You can use our websites to log your interest in invitations to GEZE events. If we have received your consent for this (see double-opt-in procedure in previous point), we will send you invitations to events by post or electronic mail, such as trade fair dates or architectural events, etc. Your consent to receive the newsletter or other notifications and for the associated use of your personal data may be revoked at any time with future effect.

Discount campaigns, customer campaigns and/or contests are offered through our websites from time to time. The details pertaining to the specific campaigns shall be disclosed on the company’s websites in a timely manner, communicated through our social media channels and/or sent via e-mail through the monthly newsletter. If you wish to participate in such schemes, we shall request you to provide your name and contact details (e.g. name, address, e-mail address etc.), along with any other information that might be necessary for you to be able to participate in the contest (e.g. answers to prize questions, photos of you or other people, proofs of purchase etc.). We shall only use such information to execute the specific campaign in question; your data shall then be rendered unusable. More detailed information can also be found in the participation conditions for the specific campaign. If you have given your consent within the framework of your participation, we shall also have the option of using the information for the purposes specified in the declaration of consent (e.g. if you wish to sign up for the monthly newsletter within the framework of the contest). If a prize is acquired as the result of a violation of the conditions of use or other manipulative actions on the part of a user, GEZE GmbH shall be entitled to revoke the prize; this can also be done at a subsequent stage. If the prize has already been handed over, the winner shall be obligated to return it in the same condition. As a matter of principle, winners are notified via an e-mail from GEZE GmbH and PortasGC.

GEZE reserves the right, over the course of its communications, to compile additional textual, visual and auditory information regarding the prizes and winners; it also reserves the right to publish the said information, provided that the specific winners have given their consent for such publication. As a matter of principle, prizes cannot be handed over in the form of cash. The judges’ decision is final. GEZE also reserves the right to modify announced or ongoing campaigns, prizes and contents; this can also be done on short notice. In such cases, the users shall be informed accordingly. The availabilities of the prizes shall be explicitly specified within the framework of the specific campaign (e.g. while stocks last).

Regarding the treatment of data through websites for commercial communications by electronic means, the application of the LSSICE is imposed (Law 34/2002, of July 11, on Services of the Information Society and Electronic Commerce) contained in articles 19 to 22. This regulation is of great importance since it regulates the sending of electronic commercial communications, with the AEPD (Spanish Agency for Data Protection) being the competent entity to sanction non-compliance. The LSSICE generally prohibits the sending of advertising or promotional communications by email or other equivalent electronic means of communication without having been previously requested or expressly authorized by the recipients.

Our website offers different forms that you can use to contact us, in order to, for example, ask questions about the product promoted on the websites or request (product) information. We shall only use the data provided by you (e.g. name, address, telephone number, e-mail address etc.) in order to be able to process and answer your question.

GEZE GmbH and its different subsidiaries have a presence on various social media channels, and they also occasionally use these channels to offer various campaigns such as competitions. The participation conditions of the specific campaign shall apply. If a user wins a prize, he or she shall, within the framework of the specific social media channels in question, be approached through his user name and notified about his or her win. This communication shall be accompanied by a request to transfer his or her personal data to GEZE GmbH for the sole purpose of facilitating the handover of the prize. The data that has been received through the social media channels is only used within the framework of the said channels, and is not handed over to third parties.

GEZE Group currently has a presence on Facebook (“@GEZE.Group”), Twitter (“GEZE_GmbH” and “GEZE_Int”’), LinkedIn (“GEZE GmbH”, “GEZE Benelux”, “GEZE South Africa”, “GEZE France”, “GEZE Italia”, “GEZE Scandinavia”, “GEZE India Pvt Ltd”, “GEZE Iberia”) and Xing (“GEZE GmbH”). You are solely responsible for the protection of your privacy, data and settings. The data privacy statements of Facebook, Twitter, LinkedIn and Xing apply. Apart from this, GEZE GmbH also operates its own channel (‘GEZE GmbH’, hereinafter referred to as ‘channel’) on the YouTube video platform. GEZE GmbH is responsible only for its own video content which it has produced and uploaded to GEZE GmbH channel. GEZE GmbH assumes no liability for GEZE products that are shown and/or used in other videos that have not been produced by us. YouTube users have sole responsibility for videos that they upload to a/their channel. The respective users are also solely responsible for any and all comments, images and opinions that appear in the comments field. Where content is inappropriate (for example glorification of violence, SPAM etc.), GEZE GmbH reserves the right to delete the respective comments and/or images. Here too, you have sole responsibility for the protection of your privacy, data and settings In such a case, the conditions of use and data privacy statements of YouTube or Google shall apply.

GEZE GmbH is able to evaluate personal data using personalized Facebook Insights data. These Insights are analyzed regularly to improve the efficiency of and optimize our Facebook page. We (the “controller”) are responsible alongside Facebook for processing Facebook Insights data. GEZE GmbH does not transmit these Insights to third parties, except for to service providers with which we collaborate in the social media area. With respect to Facebook Ireland Limited (“Facebook Ireland”), Facebook Ireland is solely responsible for processing the Insights data; we accept no liability for such processing. You can read the Facebook Page Insights supplementary agreement here: https://www.facebook.com/legal/terms/page_controller_addendum

The website, including but not limited to programming, editing, compilation and other elements necessary for its operation, the designs, logos, texts, photographs and / or graphics are the property of the provider or, if necessary, has the express license or authorization from the authors. All the contents of the website are duly protected by intellectual and industrial property regulations. Regardless of the purpose for which they were intended, total or partial reproduction, use, distribution and public communication require prior written authorization from the provider. Any use not previously authorized by the provider will be considered a serious breach of the author's intellectual or industrial property rights.

The designs, logos, texts and / or graphics foreign to the provider and that may appear on the website, belong to their respective owners, being themselves responsible for any possible controversy that may occur regarding them. In any case, the provider has express and prior authorization from them. The provider recognizes in favor of their owners the corresponding industrial and intellectual property rights, not implying the mention or appearance on the website, of the existence of rights or any responsibility of the provider on them, nor endorsement, sponsorship or recommendation by part of it. To make any type of observation regarding possible breaches of intellectual or industrial property rights, as well as any of the contents of the website, you can do so through the email above.

GEZE uses personal data in a variety of ways. For example, the formulation of the contact form can vary and/or be presented for a specific purpose depending on the campaign. You alone shall decide upon the purpose for which you give us your consent. You can opt out of any and all services at any time.

You can send applications for open positions to us through our Careers page, either by e-mail or using our online application portal. We process the data you send to us along with your application to evaluate your suitability for the advertised positions (or any other open positions at GEZE) and carry out the application process. After your application is received, your applicant data is inspected in house by the HR department and our department managers. Within the company, only individuals who require access to your data to carry out the application process receive such access.

The legal basis for processing your personal data in an application process is Sec. 26 BDSG, in particular. According to this Section, data may be processed if necessary in conjunction with a decision regarding the initiation of an employment relationship. Any additional information provided voluntarily by you is saved on the basis of Art. 6 para. 1 lit. f) GDPR, since we have a legitimate interest in processing additional information provided voluntarily by you for the purpose of carrying out the application process.

1. The following are processed and saved to fill positions within the application process:

*First name

*Last name

*E-mail address

*The personal details that you have provided in the application documents and the subsequent process

2. So-called session cookies are saved to facilitate usage of the website (if the application is submitted online):

GEZE only uses “first party” cookies, which are required to ensure the function and security of the application and make user guidance easier for you. Personal data is neither recorded nor saved for this purpose. The cookies are deleted as soon as you log out or close the browser. You will not be able to use the application generator if you do not accept any cookies. In this event, you must submit you application via e-mail or post.

3. So-called *log files are created to avoid

duplicate applications:

GEZE stores internet protocol addresses (IP addresses) in the log files for a limited period where necessary for tracking purposes (to prevent double applications).

We compare personal data (name, date of birth, birthplace, nationality and voluntarily provided data) of those applicants we specifically intend to hire during the application process with names on sanctions lists, in particular the EU terror list according to the EU anti-terror ordinances. We do so first to prepare to conclude an employment agreement with those applicants, and secondly to fulfil a legal obligation (Art. 6 para. 1 lit. c) GDPR), since legal regulations prohibit providing financial benefits, including paying wages, to persons listed on such sanctions lists. Finally, this comparison with sanctions lists is also carried out on the basis of our legitimate interest in the sense of Art. 6 para. 1 lit. f) GDPR, namely to maintain our AEO certification.

If you agree that your personal data remain saved in our applicant pool after – unsuccessfully – completing the application process, the legal basis for the associated further processing is your consent in accordance with Art. 6 para. 1 lit. a) GDPR. You can revoke your consent any time with future effect in written form, without providing grounds. Please send such revocations to GEZE GmbH HR department; Reinhold-Vöster-Strasse 21-29 in D-71229 Leonberg, or via e-mail to data-protection@geze.com.

We regularly delete the personal data of applicants if they are rejected after four months, or after six months at the latest. If you have agreed to the further processing of your personal data in our applicant pool, data will be deleted once it is no longer required for the purposes for which it was collected and processed, typically after 2 years from the time you were included in the applicant pool. If you are selected for a position during the application process, your data is included in our personnel management system and processed there insofar as it is necessary to initiate and carry out the employment relationship.

Further details regarding the selection procedure or the reimbursement of travel cost can be found on our Careers page. The data used therein shall be used only in the context of the application procedure and/or the reimbursement of travel costs (at your request).

As a matter of principle, your personal data shall only be processed and used in a further-reaching manner if a legal regulation permits such a course of action, or if you have given your consent for the said processing or usage of the data. Unless explicitly mentioned in the previous section, we shall not forward your personal data to third parties. However, we reserve the right to forward the data to instruction-bound service providers/data processors. In general, we delete or anonymize your personal data as soon as we reach a situation in which the said data is no longer necessary for the purposes for which we have used it (as described in the previous section). This has no effect on statutory provisions related to the retention and deletion of personal data for a longer period of time (as described above).

As a data subject whose data we process, you have the following rights:

• The right to information according to Art. 15 GDPR
• The right to rectification according to Art. 16 GDPR
• The right to deletion (“right to be forgotten”) according to Art. 17 GDPR
• The right to restrict processing according to Art. 18 GDPR
• The right to transmit your data in a structured, commonly used and machine-readable format according to Art. 20 GDPR
• The right to submit complaints to a supervisory authority according to Art. 77 GDPR
• Law 34/2002, on Information Society Services and Electronic Commerce (LSSICE or LSSI).
• (UE) 2016/679 of 27th April 2016 (RGPD)
• Law. 3/2018 of 5 December (LOPDGDD)

Please address your claims or declarations to the following address:

PortasGC, Lda. Ba (Portugal)

Zona Ind.Quinta Nova Lote A-1

3105-295 Pelariga –POMBAL –PORTUGAL

or via e-mail to: data-protection@geze.com

If you believe the processing of your personal data by GEZE GmbH or PortasGC violates statutory provisions, we would greatly appreciate notification of this via e-mail to data-protection@geze.com. In addition, you have the right to submit complaints to a responsible data privacy supervisory authority (Art. 77 GDPR).

If we process your personal data on the basis of our legitimate interest, you have the right to object to this processing. Furthermore, you have a right to object to any processing of data for the purpose of direct advertising. If you would like to exercise your right to object, a notification in text form is sufficient. You are also welcome to write to us, send a fax, or contact us by e-mail. Our contact information is provided under point 14.2 in these data privacy statements.

If we carry out processing of your personal data for certain purposes based on your consent, you have the right to revoke that consent at any time according to Art. 7 para. 3 GDPR. After receiving your revocation, we will cease data processing for the purposes for which you granted us the consent. The legality of processing carried out before your consent was received shall remain unaffected.