Duty to provide information pursuant to Art. 12 ff EU GDPR

In order to fulfill our information obligations in accordance with Art. 12 ff. of the General Data Protection Regulation (GDPR), we present our information on data protection below: Who is responsible for data processing? The controller within the meaning of data protection law is my-eLiquid @ Markus Steiner & Stephan Steiner GbR - Adam-Geisler-Straße 3 - 82140 Olching Additional information about our company can be found in the website's legal notice: https://www.my-eliquid.de/impressum/ Purposes of processing and legal basis Your data transmitted to us will only be processed by us for the purposes for which it was transmitted or collected. Data processing for other purposes will only be considered if there are necessary legal requirements in accordance with Art. 6 para. 4 GDPR. In these cases, we will comply with any information obligations pursuant to Art. 13 para. 3 GDPR and Art. 14 para. 4 GDPR accordingly. The legal basis for the processing of your personal data results from Art. 6 GDPR. The following options are possible:

• Consent (Art. 6 para. 1 lit. a) GDPR)
• Data processing for the performance of contracts (Art. 6 (1) (b) GDPR)
• Data processing on the basis of a balancing of interests (Art. 6 para. 1 lit. f) GDPR)
• Data processing to fulfill a legal obligation (Art. 6 para. 1 lit. c) GDPR)

If personal data is processed on the basis of your consent, you have the right to withdraw your consent from us at any time. If data is processed on the basis of a balancing of interests, you as the data subject have the right to object to the processing of personal data, taking into account the provisions of Art. 21 GDPR. Duration of data storage Your data will be processed by us for as long as this is necessary for the respective purpose. Insofar as statutory retention obligations exist, the relevant personal data will be stored for the duration of the retention obligation. After the retention obligation has expired, we will check whether there is any further need for processing. If there is no further need, the data will be deleted. You have the right to obtain information about the personal data we have stored about you and to request its erasure or restriction of processing. Disclosure of your data to third parties Your personal data will only be passed on to third parties if this is necessary for the execution of the contract with you, if the transfer is permissible on the basis of a balancing of interests within the meaning of Art. 6 para. 1 lit. f) GDPR, if there is a legal obligation to pass on the data or if you have given your consent to do so. Transfer to third countries We process your personal data exclusively in the Federal Republic of Germany. Information about your rights as a data subject You have the right to information about the personal data we process about you. Depending on the form of the request, we may require additional proof of your identity. You have the right to rectification or erasure or to restriction of processing of your personal data, insofar as you are legally entitled to do so. You also have the right to object to processing within the scope of the statutory provisions. The same applies to the right to data portability. You have a right to object in accordance with Art. 21 (1) and (2) GDPR and can revoke related consents at any time. Our data protection officer A data protection officer has not been appointed/designated at the provider, as the necessary obligation to do so in accordance with Art. 37 para. 1 GDPR or § 38 BDSG (new) does not exist. Right of appeal You have the right to lodge a complaint about the processing of personal data with the competent supervisory authority for data protection. The address of the body responsible for us is: The Bavarian State Commissioner for Data Protection and Freedom of Information

email poststelle@datenschutz-bayern.de, Web https://www.datenschutz-bayern.de/ Status: 06.06.2018