General Data Protection Notice of Olympus Europa SE & Co. KG (OEKG) („Olympus“)

As the world's leading manufacturer of precision optical and digital technology, Olympus develops and markets innovative medical technology. Protecting your privacy and personal data is important to Olympus. We hereby inform you which personal data is collected from you, how we use it and what rights you have. This General Privacy Notice provides an overview of the general processing of your data by Olympus.

Specific information on data protection on our websites can be found in the respective web-based offer. Further information on data protection on this website can be found at https://www.olympus-europa.com/company/en/privacy-notice/.

Olympus Europa SE & Co. KG
Wendenstraße 20
20097 Hamburg, Deutschland
Tel/Fax: +4940 - 23773 - 0
E-Mail: info@olympus-europa.com

For written inquiries to the Olympus Data Protection Officer, the above address with the addition of "c/o Data Protection EMEA" and the following e-mail address shall apply: privacy@olympus.com

In this section you will find information about the purposes and legal bases of the processing operations on this website and about the respective data recipients.

When you contact Olympus by letter, email or telephone, we process your personal data in order to respond to your enquiry, to contact you, to fulfil or initiate a contractual relationship or, where applicable, to fulfil legal obligations or in the exercise of our legitimate interests in communicating efficiently with our customers and contractual partners. For this purpose, we process the following categories of data:

• Name
• Contact details (email address, telephone number, address)
• Content of the communication
• If applicable, files sent as attachments to e-mails
• If applicable, metadata (date of e-mails as well as technical information on delivery).

The legal basis of the processing is Article 6 (1) (b), (c) or (f) GDPR, depending on the circumstances of the processing.

You may receive an email from us inviting you to a meeting that is conducted as a video conference. For this purpose, we use software provided by a third-party provider. Your personal data may be transferred to this third-party provider when you participate in such a meeting. Your data may also be transferred to third countries outside the EEA. For this purpose, we process the following categories of data:

• Name
• Contact details (email)
• Video, audio and chat messages from the meeting
• Files shared as attachments in the meeting, if applicable.

The legal basis for processing your personal data for this purpose is art. 6 (1) (b) GDPR (if the meeting takes place in the context of a contractual relationship between you and Olympus) or art. 6 (1) (f) GDPR. Our legitimate interest in processing is to be able to conduct timely and technically secure video conferences.

Insofar as we use another provider, you will find further information on the purpose and scope of the data collection and the further processing and use of the data by the provider, as well as your rights in this regard and setting options for protecting your privacy, in the data protection information of the respective provider.

In the event of a credit risk, we transmit your data (name, address, e-mail address, company details and, if applicable, contract and receivables data) to cooperating credit agencies for the purpose of credit assessment and debt collection processing, as well as for checking the deliverability of the specified address. The legal basis for this transfer is Article 6 (1) (b) and (f) GDPR. Transfers for the purpose of safeguarding legitimate interests may only be made to the extent that this is necessary for Olympus and interests or fundamental rights and freedoms of the data subject which require the protection of the personal data do not outweigh Olympus’ legitimate interests.

If we receive data from credit agencies or debt collection companies, we shall additionally use scoring as a mathematically-statistically recognised and proven method in accordance with art. 6 (1) f and art. 22 GDPR to calculate the probability that a customer will fulfil his or her payment obligations in accordance with the contract.

You can subscribe to various marketing messages, including text messages and marketing emails (together "newsletter"), with which we inform you about our current interesting offers.

When you register with us or make an enquiry, we generally use the so-called "double opt-in" procedure. This means that after your registration, we will send you an email to the email address you provided in which we ask you to confirm that you would like to receive the newsletter. In addition, we save your registration and confirmation date. The purpose of this procedure is to provide evidence of your registration and, if necessary, to prevent and clarify any possible misuse of your personal data.

The legal basis for this processing is your consent, art. 6 (1) (a) GDPR. You can revoke your consent to receive the newsletter at any time and unsubscribe. You can declare your revocation by clicking on the link contained in every newsletter email or by sending a message to the contact details provided in the imprint.

We will also send you marketing emails if we have received your email in connection with the sale of products or the provision of a service. In this case, you can also object to receiving marketing messages at any time, for example, by telling us when you receive your contact details, or by clicking on the relevant link in a marketing email. The legal basis in this case is art. 6 (1) (f) GDPR and Sec. 7 (3) of the German Act against Unfair Competition (UWG), as we have a legitimate interest in sending you direct advertising for our products and services that is not outweighed by your interests.

In order to send you a newsletter that is as relevant to you as possible, we personalise the content of the newsletter based on your interests, insofar as this results from your use of our (digital) offers or from other interactions. To determine your interests, the emails sent contain so-called web beacons or tracking pixels, which are single-pixel image files stored on our website. For the personalisation of the newsletter, we link the data we process and the web beacons with your email address and an individual ID. Links in the newsletter also contain this ID. With the information obtained, we create a user profile to tailor the newsletter to your individual interests. We record whether and when you have read our newsletters, and which links you have clicked on and derive your personal interests from this. We may also link this data to transactions you have made on our website and information that you yourself have provided to us. Your data may also be transferred to third party providers in third countries outside the EEA.

The information is stored for as long as you subscribe to the newsletter. After a cancellation, we only store the data if there is another purpose and otherwise in anonymous form for purely statistical purposes.

Olympus undertakes to only use employees and cooperation partners for the provision of services who have been familiarised with the data protection regulations through appropriate measures. Your data will be passed on to third parties very restrictively, e.g. if this is necessary to fulfil the (pre-) contractual relationship or to pursue our claims or if there is a legal obligation to do so, as well as in certain cases at the request of a government agency.

Within the scope of processing, it is possible that your personal data will be passed on to order processors (service providers, vicarious agents). These have been carefully selected by us and are obligated to us in accordance with the legal provisions of art. 28 GDPR to handle your data confidentially and to comply with our own data protection standards. In particular, our order processors are not permitted to use the data for their own, commercial purposes. Your data may be passed on to the following categories of recipients:

• Agencies & cooperation partners
• Credit agencies & collection service providers (for credit assessment, dunning procedures)
• Credit institutions
• Print service providers
• External legal representatives, auditors, company and tax consultants
• Internal offices & group companies
• IT service providers
• Hosting service providers
• Suppliers
• Market & opinion research companies
• Newsletter & mail service providers
• Postal & logistics service providers
• Telecommunications providers
• Travel agency & tourism service providers
• Repair & service providers
• Insurance companies
• Administrative authorities & other government agencies
• Other companies in the Olympus Group

Your personal data will generally be processed within the EU or the European Economic Area (EEA). If a transfer of data from Olympus to other Olympus companies or to third parties becomes necessary for the fulfilment of the data processing purposes, Olympus will ensure that personal data of the data subject remain within the EU or EEA.

If this is not possible and a transfer of personal data to a third country becomes necessary, e.g. to other Olympus companies or cooperation partners in third countries such as Japan or the USA, Olympus will ensure that a legal basis exists for this. These are usually:

• Consent pursuant to art. 6 (1) (a) and art. 49 (a) GDPR
• The existence of an adequacy decision by the European Commission (art. 45 GDPR). A published and constantly updated list of these countries is available for you to view here: https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/adequacy-protection-personal-data-non-eu-countries;
• Use of safeguards in the form of data protection standard contractual clauses (art. 46 (2) (b) GDPR) of the European Commission when transferring data to a third country. A published and constantly updated list of the clauses is available for you to view here: https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/model-contracts-transfer-personal-data-third-countries

Personal data will generally only be used as long as it is necessary for the respective purpose, unless you have given Olympus consent or Olympus has a legitimate interest in further processing.

In these cases, Olympus will process this data until you revoke your consent or until you object to Olympus' legitimate interests based on your particular situation. We delete your personal data as soon as the purpose of the processing has been fulfilled or the storage is otherwise no longer legally permissible.

Due to the volume of data, this review for erasure is carried out with regard to specific types of data or purposes of a processing operation. However, it is possible that your personal data will be stored until legal claims against Olympus can no longer be asserted (statutory limitation period between 3 and 30 years). In addition, we store your personal data insofar as we are legally obliged to do so. Corresponding documentation and storage obligations are regulated in the respective national laws. (e.g. in the German Commercial Code ("HGB"), as well as the German Fiscal Code ("AO"), the retention periods are up to ten years).

As a Data Subject, you have the following rights vis-à-vis Olympus:

• Information on the personal data stored about you (data categories, processing purposes, recipients of the data, if applicable, planned storage period), art. 15 GDPR
• Rectification of incorrect or incomplete data, art. 16 GDPR
• Erasure (in certain cases), art. 17 GDPR
• Restriction of Processing (in certain cases), art. 18 GDPR
• Data Portability (in certain cases), art. 20 GDPR
• Right to object, art. 21 GDPR
• Withdrawal of consent (effective for future processing), art. 7 (3) GDPR.

These rights are subject to any other legal requirements to the contrary, as prescribed in the GDPR.

If you exercise your right to erasure, objection or withdrawal of consent, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

In the case of a request for information or correction that is not made in writing, we ask for your understanding that Olympus will then require proof of your identity. This serves in particular to protect your data from unauthorised access by third parties.

To exercise these rights, you can contact us at any time - e.g. via one of the contact channels indicated at the beginning of this data protection information, e.g. using the e-mail address dataprotection@olympus-europa.com.

In addition, you are entitled under Article 77 of the GDPR to lodge a complaint with a competent data protection supervisory authority.

We do not use your data for automated decision making or profiling (art. 22 (1) GDPR).

We regularly update this Privacy Notice when legal, technical or economic conditions change. You will always find the current version of this Privacy Notice on this website.

Last Changed: 20.09.2023