If your personal data are transferred to third countries that do not provide adequate data protection, we will take measures to ensure that your personal data have appropriate protection in these countries (e.g. among other things by using the standard contractual clauses of the EU Commission, if necessary with additional protective measures). We can provide information about the protection mechanism via the contact details given in the first subsection of sections 2 ff.In order to ensure the security of visitors to our websites, all traffic flows are assessed and filtered by our service provider Myra Security GmbH, Landsberger Str. 187, 80687 Munich, Germany (“Myra Security”) before our websites are accessed. Myra Security provides a secure, certified Security-as-a-Service platform for the protection of digital business processes. This enables us to guarantee the availability of our websites and to protect our infrastructure against attacks from criminals, botnets, and other malware. Myra Security analyzes every visit, and this protects the data against unauthorized access. This filtering process does not restrict the use of our websites by our users.We use Salesforce Pardot to provide the forms that you can use to contact us. Salesforce Pardot is a software program developed by salesforce.com Inc., Salesforce Tower, 415 Mission Street, 3rd Floor, San Francisco, CA 94105, USA (“Salesforce”) for automated lead management, marketing automation, and sales support in the B2B environment. Salesforce stores personal data in the USA. Salesforce has issued binding corporate rules for this purpose (available at https://www.salesforce.com/content/dam/web/en_us/www/documents/legal/misc/Salesforce-Processor-BCR.pdf), which ensure that the data are transferred securely.The following explains in detail how tasks are assigned within this joint responsibility: Companies belonging to the Dürr Group have laid out assigned responsibilities in a contract as follows: Data subjects can approach all joint controllers to exercise their rights as data subjects. Nevertheless, Dürr Aktiengesellschaft will serve as the first point of contact. Dürr Aktiengesellschaft is also responsible for information obligations as defined in Art. 13(f) GDPR. Within their scope of operations, the joint controllers are responsible for fulfilling the required reporting obligations and maintaining documentation; imposing confidentiality obligations on employees; explaining employees' obligations under data protection law to them, and ensuring the technical and organizational security of the data processing.We process the personal data of the reporting person as well as of persons affected by the report (e.g., the person who allegedly committed the violation, witnesses). The data is provided to us by the reporting person. We may collect additional data subsequently to clarify facts. The data we process depends on the type and content of the report. For example, reports may contain information about the reporting person (e.g., name, email) and their relationship to Dürr (e.g. employment relationship), as well as information about persons suspected of the violation (e.g., name) and information about the suspected violation (e.g., place, time).The legal basis for this data processing is as defined in Sections 10 and 12 HinSchG and Art. 6 (1)(f) GDPR, our legitimate interest in complying with obligations arising from the LkSG, and recommendations of the Corporate Governance Code and in investigating and stopping violations. If a report concerns an employee of the Dürr Group, data processing also serves to prevent criminal offenses or other legal violations in connection with the employment relationship (Section 26(1) German Data Protection Act (BDSG), Art. 6 (1)(b) GDPR). According to Section 10(2) HinSchG in conjunction with Art. 9(2)(g) GDPR, the processing of special categories of personal data by a reporting office is permitted notwithstanding Art. 9(1) GDPR if this is necessary to perform its tasks. Section 10(3) HinSchG provides for appropriate and specific measures to protect the fundamental rights and interests of the data subject by referring to Section 22(2) BDSG and the various protective measures available.Anonymous reporting: It is possible to submit an anonymous report through the reporting channel. Identifying features, such as name or email address, are collected only if the reporting person has answered "yes" to the question asking if they wish to provide their name. Dürr will contact the person directly only if they provide their contact details. To ensure anonymity, please note the Integrity Line information under “About anonymity”.The data submitted to Integrity Line is encrypted and stored with multi-level password protection, so that access is restricted to a very small group of employees authorized expressly for this purpose. We have a strictly role-based authorization concept that follows the need-to-know principle. Employees of Dürr Aktiengesellschaft's Compliance Department and Corporate Internal Audit responsible for processing reports are specially trained, expressly authorized, and bound to confidentiality.Information about attachment transmittal: When submitting a report or sending supplemental information, it is also possible to send attachments to Dürr AG. If you wish to submit a report anonymously, please note the following security information: The files you provide may contain hidden personal data that could jeopardize your anonymity. Remove this data before sending attachments. If you are unable to remove this data or are unsure, copy the text of your attachment into the body of your message.Exceptions: There are exceptions to the obligation to protect the confidentiality of the whistleblower's identity if the whistleblower intentionally or with gross negligence reports incorrect information about violations. According to Section 9(2) HinSchG, information about the identity of a whistleblower or other circumstances that allow conclusions to be drawn about the identity of this person may be disclosed if for example, they result from a request from law enforcement authorities, an order in administrative proceedings, or a court decision. The reporting person must always be informed of any such disclosure, unless the requesting body believes that the information would jeopardize related investigations, inquiries, or court proceedings. Furthermore, the identity of the whistleblower may be disclosed to any recipients in accordance with Section 9(3) HinSchG if disclosure is necessary to implement follow-up measures and the whistleblower has previously consented to disclosure in text form as defined in Section 126b of the German Civil Code (BGB).The identity of persons who are the subject of a report and of other persons named in the report may be disclosed under the provisions of Section 9(4) HinSchG. Data processing mentioned therein is carried out, for example, on the basis of consent by the data subject pursuant to Art. 6(1) GDPR, whereby consent must be voluntary and informed, or granted on the basis of a legal obligation pursuant to Art. 6(1)(c) GDPR to fulfill the obligation of the internal reporting office to implement follow-up measures pursuant to Section 17(1) No. 6(f) HinSchG.The personal data we collect will be stored until the purposes mentioned above cease to apply and it will then be deleted. In principle, report documentation under the HinSchG is deleted three years after the conclusion of the procedure in accordance with Section 11(5) HinSchG. This does not apply if we are obliged to store the data for a longer period of time in accordance with Article 6(1)(c) GDPR due to statutory retention and documentation obligations (e.g., as defined by the German Commercial Code (HGB), the German Penal Code (StGB), or the German Tax Code (AO)) or are entitled to do so in accordance with Art. 6(1)(f) GDPR, or if the data subject has consented to longer storage in accordance with Art. 6(1)(a) GDPR.