With this data privacy policy, Peak Product AG (hereinafter we or us) provides detailed information on the scope and extent to which your personal data (hereinafter also referred to as “data”) is handled when visiting https://peakproduct.io, https://productmanagementfestival.com or https://pmep.education.

1 Responsible for processing data

Peak Product AG, Fraumünsterstrasse 16, 8001 Zürich.

events@peakproduct.io

2 Data processing within the scope of your visit to our website

When you visit our website, there are certain pieces of personal information we are required to process. This is solely done for the purposes and to the extent described below. We shall only pass on your data to third parties in the manner subsequently described.

3 Provision of our website and services

In order to provide you with our website and services, we automatically collect and process the following data from you:

– Date and time of your access

– The referral website, from which you visited our site

– The pages you visit on our website

– Information about your Internet browser (browser type and version)

– the operating system of the device with which you access our website and service

– Your Internet Service Provider

For security reasons, this information is stored in log files, which do not contain your IP address, and are then deleted after 30 days. The data in the log files is stored separately from your other data.

A longer storage is only necessary in individual cases (e. g. in case of concrete suspicion of abuse or fraud). In these cases, the respective log files are stored until the facts of the case have been clarified and subsequent necessary measures have been completed.

To provide our website and its services, we use service providers who process your data exclusively on our behalf. They do so in accordance with our instructions and have taken suitable technical and organizational measures to protect your rights, as stated in this data protection declaration (so-called contract processors according to Article 28 of the GDPR.

These include:

for website hosting, including the necessary services therein:

Google Ireland Limited

Gordon House

Barrow Street

Dublin 4

Ireland

The legal basis for processing your data to provide our website and services is Article 6 paragraph 1 sentence 1 letter f, of the GDPR. We have a legitimate interest in processing your data so that we can provide our website and its services in a technically flawless manner, securely and optimized for your needs. The data in the server log files is stored separately from other data.

4 The Use of Cookies and Other Similar Technologies

When you visit our website, we also collect and use your information, so that you can more conveniently use our website and services, as well as to measure and improve the effectiveness of our marketing activities. To this end, we also employ so-called cookies and other technologies similar to cookies, such as pixel tags (i.e. small, transparent graphics, also called web beacons). Cookies are small text files that are stored on your device via your internet browser. You can find out more about the term, how cookies work and other data protection and technical terms below under “Help with data protection terms”.

You have the option of deactivating the use of cookies from Google Analytics by clicking on a tool provided by Google here: http://tools.google.com/dlpage/gaoptout?hl=en.

Furthermore, you may deactivate the use of all non-essential cookies in your browser settings. Without the use of cookies, however, some functions of this website may not function in the manner intended or may not provide the usual convenience.

5 Contact

You have the possibility to contact us in different ways. This includes contacting us using the forms on our website and by email. Depending on the content of your message, the data processing that takes place within the scope of contacting us may serve different purposes. In general, we store and process the data provided to deal with the issue you submitted. Your data may also be stored and processed in a customer management system.

Only should your contact serve to directly establish a contractual relationship between us shall another matter apply. In these cases, we base the processing of your data on Article 6(1), first sentence, point (b) of the GDPR.

After contacting us, your stored data will be deleted as soon as it is no longer required and it is not subject to any legal storage obligations.

6 The Use of Our Newsletter

On our website you can subscribe to a free newsletter including advertisements if you have expressly consented to its receipt. To prevent fraudulent use, you will first receive an email with a confirmation link which you must activate to receive the actual newsletter (so-called double opt-in procedure).

When you register for the newsletter, your email address, your IP address and the date and time of your registration will be transmitted to us and stored and processed by us. Your data will only be used to prove your consent to receive and dispatching of the newsletter. Your data is not transferred to third parties.

The legal basis for processing your data is Article 6 paragraph 1 sentence 1 letter f, of the GDPR. We have a legitimate interest in processing your data so that we can inform you about interesting offers and information and prove your agreement to receive the newsletter.

If we send you the newsletter regularly your data will be stored. If we no longer send you a newsletter, we will delete your data no later than 12 months after the last newsletter was sent to you.

Please note that you can unsubscribe at any time by clicking on the unsubscribe link included in each newsletter.

To send out our newsletter we use the services HubSpot, Inc., 25 First Street, 2nd Floor Cambridge, MA 02141 USA, who processes your data exclusively on our behalf and in accordance with our instructions (so-called contract processor according to Article 28 of the GDPR) and has taken the appropriate technical and organizational measures to protect your rights. You may find the services privacy policy here: https://legal.hubspot.com/privacy-policy.

Your data will be processed in and transferred to the USA, which means a third country outside the European Union (EU) or the European Economic Area (EEA). There is no adequate decision of the EU Commission for this country guaranteeing a level of data protection compliant with the European standard. To effectively protect your data, the transmission and processing is carried out based on the so-called EU-US Privacy Shield, under which the provider is registered. Further information can be found here: https://www.privacyshield.gov/welcome.

This service provider helps us to determine on a pseudonymized basis how many recipients have opened our newsletters and the links they contain by integrating pixel tags into the newsletters. Within the scope of this retrieval, technical information, such as information about the browser and your system, as well as your IP address and time of retrieval are initially collected. This information is used for the technical improvement of services based on the technical data or the target groups and their reading behavior based on their retrieval locations (which can be determined using the IP address) or access times. The legal basis for this is article 6, paragraph 1, sentence 1, letter f, of the GDPR. We have a legitimate interest in analyzing the opening behavior of our newsletters in order to optimize our services and operate them economically. If you do not agree, do not open our newsletter and do not click on the links contained therein. According to its own information, the shipping service provider can use this data in pseudonymized form, i.e. without assignment to a user, to optimize or improve its own services, e.g. for technical optimization of shipping and presentation or for statistical purposes to determine the recipients’ countries of origin.

7 Integration of external content

We have included third party content in some places on our website. These include videos, map services, images and fonts. In connection with the integration of this content, it is technically necessary that the providing third parties are informed of your IP address so that the content can be displayed to you. We do not store your IP address for the integration of external content. Third-party providers may use your IP address, the use of cookies and other technologies (e.g. pixel tags, i.e. invisible graphics) to track your surfing behavior and, in addition to your IP address, process other technical information (including browser type/version, operating system used, the page you have previously visited, the host name of the accessing device and the time and other information about the use of our online offering).

The legal basis for processing your data to provide our website and services is article 6, paragraph 1, sentence 1, letter f, of the GDPR. We have a legitimate interest in optimizing our website and improving our services by embedding content from third-party providers.

A more detailed description of whose content is embedded and how your data is processed is given below in the respective description of the embedded content:

– YouTube (Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). Privacy policy: https://policies.google.com/privacy

Opt-Out: https://adssettings.google.com/authenticated

– Google Maps (Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). Privacy policy: https://policies.google.com/privacy

Opt-Out: https://adssettings.google.com/authenticated

– Google Fonts (Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). Privacy policy: https://policies.google.com/privacy

Opt-Out: https://adssettings.google.com/authenticated

8 Purchase of Tickets and Data Processing at Events

For our events, you have the option of purchasing tickets. We receive the following information:

Address, first name, last name, company, job title, email, telephone number.

When you apply to attend an activity or workshop, we may provide speakers, presenters and hosts, as detailed in the General Terms and Conditions, with the information you provided regarding first and last name, company and position for the purpose of selecting attendees to the event in question. For the purposes of exchange and contact after the activity or workshop, the presenting company or host shall receive the first and last name, email address, company and position for every participant of the respective activity or workshop.

When you decide to purchase one of our services, we will also process your name, your address, contact information, as well as contract and payment information (e.g. bank account) you provide in order to complete the payment process. The legal basis for processing your data to provide our website and services is article 6, paragraph 1, sentence 1, letter b, of the GDPR. This information shall be transferred to third-party financial service providers, as well as to authorities and consultants within the legally permissible scope for the purpose of executing the payment process.

A more detailed description of how your data is processed in the payment process is given below in the respective description of the embedded third-party providers:

– Stripe (185 Berry St #550, San Francisco, CA 94107, USA). Privacy policy: https://stripe.com/privacy

– Eventtia (10 rue de Penthièvre, 75008 Paris, France). Privacy policy: https://www.eventtia.com/en/privacy-policy

The legal basis for processing your data to provide our website and services is article 6, paragraph 1, sentence 1, letter f, of the GDPR.

At the Product Management Festival, you have the option of having your badge scanned by exhibitors at their booth to provide them with your personal data so that the respective exhibitor or represented sub-exhibitor may contact you. In this case, the following data will be passed on to the exhibitor (or sub-exhibitor): first name, last name, email address, company, country and position. Data shall be transferred with the express purpose of facilitating contact and exchange at the Product Management Festival (article. 6 paragraph. 1 sentence. 1 letter. f GDPR). Should you not consent to this, please inform the respective contact person at the booth.

At our events, images and videos shall be created, which may be published in print, digital or online, as well as on our social media channels. This data processed is necessary for the purposes of the legitimate interests of public relations work pursued by the event organizer (Art. 6 paragraph. 1 sentence. 1 letter. f GDPR). Should you not consent to this, please inform the respective photographer in concrete situations.

9 Use of Web Analytics Services

When you visit our website, we automatically collect and process data to track the behavior of visitors, so that we can optimize our website and adapt it accordingly to user interests.

The legal basis for the processing of your data is article 6, paragraph 1, sentence 1, letter f, of the GDPR. We have a legitimate interest in conducting web analysis on an anonymized basis to better understand our users, to optimize our website accordingly and to determine whether the Internet advertising we place achieves the results we desire. You can object to the use of these services by opting-out. However, please note that you may not be able to use all functions of our website.

10 Right to information

You have the right to obtain information from us as to whether and which data we process about you. This also includes information on how long and for what purpose we process the data, where they come from and to which recipients or categories of recipients we pass them on to. In addition, we can provide you with a copy of this data.

11 The right to correction

You have the right that we immediately correct any information about you that is incorrect or no longer applicable. You may also request that your incomplete personal data be completed. If this is required by law, we will also inform third parties about this correction if we have passed on your data to them.

12 Right to cancellation (“right to be forgotten”)

You have the right to ask us for deletion of your personal data immediately if one of the following reasons applies:

– Your data is no longer necessary for the purposes it was collected or otherwise processed, or the purpose has been achieved;

– You revoke your consent and there is no other legal basis for processing;

– You object to the processing and there are no overriding legitimate reasons for processing; in the case of the use of personal data for direct marketing, a sole objection on your part to the processing is sufficient;

– Your personal data has been processed unlawfully;

Please note that your right to cancellation may be restricted by law. These include the restrictions listed in Article 17 of the GDPR.

13 Right to limitation of processing (blocking)

You have the right to request a restriction of the processes of your personal data if one of the following conditions is met:

– You deny the accuracy of your personal data for a period that enables us to verify the accuracy of the personal data;

– The processing is unlawful, and you refuse to delete the personal data and instead request that the use of your personal data be restricted;

– We no longer need your personal data for the purposes of processing, but you do need it to assert, exercise or defend legal claims;

– You have filed an objection against the processing if it is not yet clear whether our justified reasons outweigh yours.

If you have obtained a restriction on processing as set out above, we will notify you before the restriction is lifted.

14 Right of Revocation for Consent

You can revoke your consent given to us at any time with effect for the future. This revocation can take place in the form of an informal message to the above-mentioned contact addresses. This also applies to consents that you have given us before the validity of the GDPR (i.e. before 25 May 2018). If you revoke your consent, the legality of the data processing carried out up to then will not be affected. As a rule, the consequence of a revocation is that you can no longer use our service, in the context of which we have asked you for your consent or can no longer use it in full.

15 Right to Data Transferability

You have the right to receive personal data that concerns you and that you have provided to us in a structured, common and machine-readable format and to transmit this data to others. For details and restrictions, see Article 20 of the GDPR. Exercising this right does not affect your right to cancellation.

16 The Right to Appeal to the Supervisory Authority

If you believe that the processing of your data by us violates applicable data protection law, you have the right of complaint to one of the competent supervisory authorities.

17 Right to Objection under Article 21 of the GDPR

Article 21 of the GDPR gives you the right to object to the processing of your data at any time for reasons arising from your situation, if we base this processing on legitimate interests in accordance with article 6, paragraph 1, sentence 1, letter f, of the GDPR. If you object, we will no longer process your personal data, except in two cases:

– We can prove compelling grounds for processing that outweigh your interests, rights and freedoms;

– Processing serves to assert, exercise or defend legal claims.

Even if we process your personal data for direct advertising (e.g. in the context of our

newsletter), you have the right to object at any time to the processing of your data for such advertising. If you object to the processing of your data for direct marketing purposes, we will no longer use your personal data for this purpose.