This Personal Data Exchange Policy has been prepared by Klikonline in consideration of the fact that Klikonline exchanges personal data with its Business Units (BUs). Both Klikonline and each BU qualify as a data controller within the meaning of Article 4(7) of the AVG. As part of the careful handling of personal data, Klikonline has laid down in this policy a number of agreements regarding the exchange of personal data with its BUs.

1. The personal data exchanged will be treated in accordance with the applicable laws and regulations regarding the handling of personal data protection. The BUs are each independently responsible for compliance with applicable laws and regulations.

2. Personal data exchanged will be used only for the purpose for which it was exchanged.

3. The personal data exchanged will be made available internally only to those employees who need this personal data for the performance of their duties.

4. Personal data exchanged will be kept confidential.

5. Klikonline and the BUs are each independently responsible for the security of the personal data under their responsibility.

6. Klikonline and the BUs independently inform data subjects about the purposes for which personal data are processed in their own privacy statements and do not process personal data other than for which they themselves have a legal basis.

7. Klikonline and the BUs are and will remain independently responsible for reporting a personal data breach (data leak) within the meaning of Article 4 paragraph 12 AVG to the Personal Data Authority and/or data subjects. If the data breach relates to a situation, in which Klikonline can be regarded as co-responsible, consultation will take place as soon as possible to determine how the data breach can be handled as carefully and adequately as possible.

8. In the event that a data subject addresses a request for the exercise of his/her rights, such as the right to inspection, deletion, rectification, objection or any of the other rights mentioned in the AVG, to a BU, the BU will handle the request independently, if the request is related to a processing for which the BU in question is an independent controller.

9. If the request (as described under point 8) relates to a processing for which BU and Klikonline are joint controllers, consultation will take place as soon as possible to determine who will handle the request. The data subject who made the request may be informed of this.

10. If necessary, BU will provide the necessary information and cooperation to enable Klikonline to handle the request (as described in point 9). Klikonline has the same obligation towards BU.

11. If the data subject addresses his or her request to a BU and the request relates to another BU, or to Klikonline, the BU shall ensure that the request reaches the appropriate BU, or to Klikonline. Klikonline has the same obligation towards BUs.