Privacy Notice for the website available at https://blackroll.com/eu/en/marco-reus

(hereinafter referred to as “Privacy Notice”)

Information about the Controller
We would like to inform you about the data protection matters relevant when using the website available at https://blackroll.com/eu/en/marco-reus and we,

BLACKROLL AG
Hauptstrasse 17
CH-8598 Bottighofen
Switzerland
(Legal Notice)
(hereinafter also referred to as “we” or “BLACKROLL”)

as the controller within the meaning of data protection law, would like to inform you below, as a user of our services and/or offerings.
For general enquiries regarding data protection, you can contact us at datenschutz@blackroll.com

Contact details of our representative in the European Union
Our representative pursuant to Art. 27 GDPR in the European Union is

V-Formation GmbH
Stephanienstr. 18
76133 Karlsruhe
www.v-formation.de
Tel.: +49 (0)721 17029034
Email: eu-rep.blackroll@v-formation.de

Contact details of BLACKROLL’s Data Protection Officer
We have appointed an external Data Protection Officer.
For direct and confidential communication, you can contact the Data Protection Officer using the following contact details:

David Heieck,
c/o V-Formation GmbH,
Stephanienstr. 18,
76133 Karlsruhe,
www.v-formation.de
Tel.: +49 721 181292-15
Email: dsb.blackroll@v-formation.de

For ease of readability, the generic masculine form is used below. Female and other gender identities are expressly included where relevant to the statement.

Your personal data is processed exclusively in accordance with the applicable statutory provisions of data protection law, in particular the EU General Data Protection Regulation (hereinafter “GDPR”), the Swiss Federal Act on Data Protection (“FADP”) and other statutory data protection provisions (collectively hereinafter referred to as “Data Protection Laws”).

If you would like to take a look at the GDPR yourself, you can find it online at: https://eur-lex.europa.eu/legal-content/DE/TXT/HTML/?uri=CELEX:32016R0679. The FADP can also be found online at the following link: https://www.fedlex.admin.ch/eli/cc/2022/491/de.

This Privacy Notice applies only to the use of the website available at https://blackroll.com/eu/en/marco-reus (hereinafter also referred to as “our website”). The following information does not otherwise apply to other websites linked from our website. Information on data processing when using the website available at https://blackroll.com can be found at https://blackroll.com/de/de/service/datenschutz.

Our website is hosted by Vercel Inc., 440 N Barranca Ave. #4133, Covina, CA 91723, USA (hereinafter “Vercel”). In this context, use of our website may result in personal data (in particular server log data; see Section 2.1 below) being transferred to Vercel servers outside the European Economic Area (EEA), in particular in the USA. Vercel is certified under the EU-U.S. Data Privacy Framework (see https://www.dataprivacyframework.gov/list). Transfers of data to Vercel servers outside the EEA are subject to the Standard Contractual Clauses concluded with Vercel or to the adequacy decision of the European Commission based on the EU-U.S. Data Privacy Framework.

Where data is processed by us in Switzerland, an adequate level of data protection is ensured for users from the European Union (EU) or the European Economic Area (EEA) in accordance with the EU adequacy decision for Switzerland pursuant to Art. 45(1) GDPR.

1. Subject Matter of Data Protection and Legal Bases

The subject matter of data protection is the protection of personal data (also referred to as “personal information”) within the meaning of the FADP and the GDPR. Personal data means any information relating to an identified or identifiable natural person (a “data subject”). Your personal data therefore includes all data that makes it possible to identify you, such as your name, address, telephone number or email address. Personal data also includes information necessarily generated through the use of our platform, such as the start, end and scope of use or your IP address.

Personal data is also collected to the extent that you provide us with information and content as part of customer communications.

We process your data only where permitted by an applicable legal provision. In particular, we will rely on the following legal bases when processing your data:

• Consent: We will process certain data only on the basis of your prior explicit and voluntary consent. You have the right to withdraw your consent at any time with effect for the future.
• Performance of a contract or taking steps prior to entering into a contract: In particular, we require certain data from you in order to initiate or perform your contractual relationship with us.
• Compliance with a legal obligation: We also process your personal data in order to comply with legal obligations, such as regulatory requirements or retention obligations under commercial and tax law.
• Protection of legitimate interests: We will process certain data in order to protect our legitimate interests or those of third parties. However, this applies only where your interests do not override those interests in the individual case.

Please note that this is not a complete or exhaustive list of the possible legal bases, but merely examples intended to make the legal bases under data protection law more transparent. For more detailed information on the legal bases for the individual processing activities on our website, please refer to the explanations in the sections below.

2. Data Processing When Using Our Website

2.1. Server Log Data

When you access our website, the following information about the access may be stored:

• IP address of the requesting end device,
• pages and files accessed,
• the HTTP response code,
• the size of the pages and files accessed in bytes,
• the previous website from which you visit the platform (referrer URL),
• date, time and time zone of the server request,
• type and version of the browser used,
• operating system used by the requesting end device.

We process this data on the basis of our legitimate interests in providing our website, ensuring its technical operation and ensuring the security of our information technology systems. Our legitimate interest is to enable and continuously maintain the use of our website and its technical functionality. When you access our website, this data is processed automatically. Without providing this data, you cannot use our website. We do not use this data for the purpose of drawing conclusions about your identity.

When you access our website, corresponding information may be stored on your end device and/or information already stored on your end device may be accessed. The storage of or access to this information is strictly necessary in order to ensure the operation of our website and IT security and to provide you with our services as requested.

Data collected automatically is generally deleted once the purpose no longer applies, unless another legal basis applies. If the latter is the case, we delete the data once that other legal basis ceases to apply.

We cannot comply with an objection to the collection and storage of your server log data, as this data is strictly necessary for the smooth operation of our website.

2.2. Contact by Telephone and Email

You can contact us by telephone or email. If you contact us using the communication channels mentioned above, we may process the data you voluntarily provide, for example contact details such as your name, telephone number or email address, as well as your individual message where applicable.

The data you provide to us via our contact form, by telephone or by email is transmitted to us via a secure connection (for details, see Section 9). We transfer this data to our customer relationship management system (see Section 3). Your data is collected, processed and used solely for the purpose of receiving and, where applicable, responding to your enquiry. Your data is processed for the initiation or performance of a contractual relationship with you or for the protection of our legitimate interests. In the latter case, we have a legitimate interest in processing contact enquiries voluntarily addressed to us.

We delete the data you provide as soon as the purpose for which it was collected no longer applies, subject to compliance with any continuing statutory retention obligations.

Where your data is processed on the basis of legitimate interests, you may object to the storage of your personal data at any time. In this case, we will no longer process your data unless we can demonstrate a legitimate interest in doing so or are otherwise legally obliged to retain it. To exercise your right to object to the processing, please contact us by email.

Please note, however, that we cannot guarantee complete data security when communicating via a contact form and, in particular, by email. In the case of confidential information in particular, we therefore recommend sending it via a secure transmission method, such as by post.

2.3. Cookies

We use cookies and similar technologies on our website (collectively referred to below as “Cookies”) in order to optimise the design of the website. Among other things, this facilitates navigation and ensures a high degree of user-friendliness.

Cookies are generally small identifiers that our web server sends to your browser and that your end device stores if the corresponding default settings are enabled. On our website, we use Cookies that are necessary for the functioning of our website and in whose storage we have a legitimate interest, as we would otherwise be unable to provide our website with certain basic functionalities (for example, you would otherwise have to reset website settings each time you change pages). These Cookies may be used to determine whether communication with us has already taken place from your end device. The storage and use of technically strictly necessary Cookies and the associated data processing are carried out on the basis of our legitimate interests. Personal data may be stored in Cookies where this is strictly necessary to provide the requested service or where you have given your consent. We expressly reserve the right to rely on other statutory legal bases.

Our website currently does not use any Cookies.

3. Customer Relationship Management System

The data you provide to us when contacting us is transferred by us to our customer relationship management system (“CRM system”). There, your data is managed, maintained and processed for lead and customer management purposes and for initiating and performing contracts. Your master data, contact data and contract data and, where applicable, data collected through other channels, such as at trade fairs or via our social media presences, are combined in a customer profile.

For this purpose, we use the service provided by Klaviyo Inc., 125 Summer Street, Floor 6, Boston, MA 02110, USA (hereinafter “Klaviyo”).

Klaviyo acts on our behalf on the basis of a data processing agreement that we have entered into with Klaviyo. Under this agreement, Klaviyo undertakes to process the relevant personal data on our behalf only in accordance with our instructions.

The processing is carried out, where necessary, for the initiation or performance of the contract between you and us. Where the processing is carried out for direct marketing purposes, your prior consent serves as the legal basis. In certain cases, your data may be processed in order to protect our legitimate interests in optimising our business processes and effectively organising our lead and customer management.

In this context, your data may be transferred to and stored on Klaviyo servers outside Switzerland and the EU or EEA, in particular in the USA. Klavyio is certified under the EU-U.S. Data Privacy Framework and the Swiss-U.S. Data Privacy Framework (see https://www.dataprivacyframework.gov/list). Any transfers of personal data of persons resident in the EU to the USA are subject to the adequacy decision of the European Commission based on the EU-U.S. Data Privacy Framework. Any transfers of personal data of persons resident in Switzerland to the USA are subject to the Standard Contractual Clauses concluded with Klaviyo, which can be accessed here: https://www.klaviyo.com/legal/data-processing-agreement.

You may withdraw any consent you have given at any time with effect for the future. Where your data is processed on the basis of legitimate interests, you may object to the storage of your personal data at any time. In this case, we will no longer process your data unless we can demonstrate a legitimate interest in doing so or are otherwise legally obliged to retain it. To exercise your right to withdraw consent or object to the processing, please contact us in writing, by fax or by email.

4. Recipients of Personal Data

Within our company, only those persons who require your personal data for the purposes specified have access to it. We disclose your personal data to external recipients only where this is necessary to handle or process your request, where we have your consent to do so or where another legal permission applies. External recipients may include in particular:

• Affiliated companies: These are affiliated companies with which we may exchange personal data where this is necessary for internal administrative, marketing or customer service purposes. Where applicable, this is carried out on the basis of your explicit consent or to protect our legitimate interests.
• Processors: These are service providers that we use to provide services, for example in the areas of technical infrastructure and maintenance of our website. We select such processors carefully and review them regularly to ensure that your privacy is protected. These service providers may use the data only for the purposes specified by us and in accordance with our instructions. We are entitled to use such processors subject to the applicable statutory requirements.
• Public bodies: These are authorities, government institutions and other public-law bodies, for example supervisory authorities, courts, public prosecutors’ offices or tax authorities. Personal data is transferred to such public bodies only where required by law.
• Non-public bodies: Service providers and auxiliary persons to whom data is transferred on the basis of a legal obligation or to protect legitimate interests, for example tax advisers or auditors.

5. Data Processing in Third Countries

Where we transfer your data to countries outside Switzerland, the EU or the EEA, we ensure before the transfer that, except in cases of legally permitted exceptions, the recipient either provides an adequate level of data protection or you consent to the data transfer. An adequate level of data protection is ensured, for example, by certification of the recipient under the EU-U.S. Data Privacy Framework or the Swiss-U.S. Data Privacy Framework, the conclusion of EU Standard Contractual Clauses or the existence of so-called Binding Corporate Rules (BCR). Please contact us using the communication channels stated above to obtain a copy of the specific safeguards for the transfer of your data to third countries.

6. Retention Period and Deletion

We store your personal data only for as long as necessary to fulfil the relevant purposes or, in the case of consent, until you withdraw that consent. In the event of an objection, we will no longer process your personal data unless its further processing is permitted or even required under the applicable statutory provisions (for example, in connection with retention obligations under commercial and tax law). We also delete your personal data where we are legally required to do so.

For further details regarding the retention period of your personal data, please refer to the relevant explanations in the sections above.

7. Your Rights

As a person affected by data processing, you have a number of rights. These include the following:

• Right of access: You have the right to obtain information about the data we store about you.
• Right to rectification and erasure: You may request that we correct inaccurate data and, where the statutory requirements are met, erase your data.
• Right to restriction of processing: Where the statutory requirements are met, you may request that we restrict the processing of your data.
• Right to data portability: If you have provided us with data on the basis of a contract or consent, you may, where the statutory requirements are met, request that you receive the data you provided in a structured and commonly used format or that we transmit it to another controller.
• Right to object to data processing based on legitimate interests: You have the right, on grounds relating to your particular situation, to object at any time to our processing of your data where such processing is based on legitimate interests. If you exercise your right to object, we will stop processing your data unless we can demonstrate compelling legitimate grounds for further processing that override your rights.
• Withdrawal of consent: Where you have given us consent to process your data, you may withdraw it at any time with effect for the future. The lawfulness of the processing of your data carried out up to the time of withdrawal remains unaffected.
• Right to lodge a complaint with a supervisory authority: You may also lodge a complaint with the competent supervisory authority if you believe that the processing of your data infringes applicable law. You may contact either the data protection authority responsible for your place of residence, your place of work or the place of the alleged infringement, or the data protection authority responsible for us.

If you have any questions about the processing of your personal data, your rights as a data subject or any consent you may have given, please contact us using the contact details provided at the beginning of this Privacy Notice.

8. EU Representative

BLACKROLL AG has appointed a representative in an EU Member State. You can contact the representative as follows:

V-Formation GmbH

Stephanienstr. 18

76133 Karlsruhe

Germany

www.v-formation.de

Tel.: +49 721 170 290 34

Email: eu-rep.blackroll@v-formation.de

9. Security

We implement technical and organisational security measures to protect your personal data against accidental or intentional manipulation, loss, destruction or access by unauthorised persons. These security measures are adapted in accordance with the current state of the art.

The data transmitted to us when you use our website and services is securely transmitted using encryption. We use the Transport Layer Security (TLS) encryption protocol, more commonly known by its former name, Secure Sockets Layer (SSL).

Our employees are required to maintain data confidentiality.

10. Amendments

From time to time, it may be necessary to amend the content of this Privacy Notice. We therefore reserve the right to amend it at any time. Where your consent is required for an amendment, we will obtain it from you. We will also publish the amended version of the Privacy Notice here. When you visit our website again, you should therefore review the Privacy Notice again.

Last updated: October 2026