Data Privacy Policy

Privacy policy

BASF is pleased about your visit to our website and your interest in our company.

The topic of data protection has the highest priority at BASF. Therefore, we would like to inform you in detail about it in the following:

A. Who is responsible for data processing and who is our data protection officer?

B. What data do we process, for what purposes, for how long and on what legal basis?

C. Are you obliged to provide us with this data?

D. To whom do we pass on your personal data?

E. How do we safeguard your personal data?

F. What rights do you have?

G. Where can you complain?

H. Data protection for minors

A. Who is responsible for data processing and who is our data protection officer?

You can find the person responsible for data processing at here.

Our data protection officer is:

Alexandra Haug
EU Data Protection Officer
67056 Ludwigshafen
+49 (0) 621 60-0

e-mail: data-protection.eu@BASF.com

B. What data do we process, for what purposes, for how long and on what legal basis?

In the following, we inform you about the data processing on our site (a), its purposes and legal basis (b) as well as the respective storage period and, if applicable, specific objection and removal options (c).

1. log files

a. Data processing

If you visit our website for information purposes only, i.e. if you do not register or transmit data in any other way (e.g. via a contact form), the following information is automatically transmitted from your browser to our server:

- IP address of your device

- Information about your browser

- Name of the website from which you visit us

- Name of the visited page (URL)

- Date and time of your visit

- Status information such as error messages

- Transferred data volume and the access status (file transferred, file not found, etc.)

- Operating system and version of your computer's operating system

b. Purposes and legal basis

When you visit the BASF web site, we use the IP address and other information automatically transmitted to our server by your browser under B. 1. a. to

(i) provide you with the requested content

(ii) ensure the security and stability of our website and to trace unauthorized use

(iii) enable a comfortable use of our website.

The legal basis for the data processing is Art. 6 para. 1 sentence 1 lit. f GDPR. Our legitimate interest follows from the above listed purposes for data processing. Under no circumstances do we use the collected data for the purpose of drawing conclusions about your person.

c. Storage period

The data will be deleted as soon as they are no longer necessary for the purpose for which they were collected. In the case of the collection of data for the provision of the website, this is the case when the respective session is ended.

2. Cookies

a. Data processing and respective legal basis

We use cookies on our website. These are text information that can be stored in the browser on the device of the viewer to a visited website (web server, server). The cookie is either sent from the web server to the browser or generated in the browser by a script (JavaScript). The web server can read this cookie information directly from the server when the user visits this page again or transfer the cookie information to the server via a script of the website. Cookies do not cause any damage to your device, do not contain viruses, trojans or other malware.

Information is stored in the cookie that is related to the specific device used. This does not mean, however, that we obtain direct knowledge of your identity.

We generally use only strictly necessary cookies.

These cookies are necessary for the functioning of the website. In general, these cookies are only set in response to actions you take in response to a service request, such as setting your privacy preferences, logging in, or filling out forms. You can set your browser to block these cookies or to notify you about these cookies. However, some areas of the website may not function properly.

The legal basis for the processing of these cookies is Art. 6 para. 1 sentence 1 lit. f GDPR. Our legitimate interest follows from the data processing purposes listed under B.1.b.

b. Specific use of cookies, purposes and storage period

Specifically, we use the following cookies. Only the strictly necessary cookies are activated by default. If you do not want this either, you have the option of generally rejecting cookies in your browser. In this case, the functionality of the visited website may be impaired.

• UltrasimWeb cookies

We generate and store refresh and access tokens in your browser. These tokens are necessary to be able to login users.

3. Contact via e-mail and support requests

a. Data processing

Our web pages contain links to send us an e-mail directly and support request forms to request support on a project level. If you send us an e-mail or request support via form, we will process the associated metadata, including relevant information about your project in support requests and the content of the message.

In support cases, we also access your project and use the documented information to support you as necessary.

b. Purpose and legal basis

Your data will be processed to enable us to contact you, to process your request and to provide you with our respective services and to ensure the security of our information technology systems.

The legal basis for the processing of data classified as being mandatory is Art. 6 para. 1 sentence 1 lit. f GDPR. The aforementioned purposes also include a legitimate interest in the processing of the data. If the purpose of the contact is the conclusion of a contract, the additional legal basis for the processing is Art. 6 para. 1 sentence 1 lit. b GDPR. The legal basis for the processing of the data that you have voluntarily provided us with is your consent in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR.

c. Storage period

The personal data of the person concerned will be deleted or made unavailable as soon as the purpose of the storage does no longer apply. Furthermore, data may be stored if this has been provided for by the European or national legislator in EU regulations, laws or other regulations to which the person responsible is subject. Data will also be deleted or made unavailable when a storage period prescribed by the above-mentioned provisions expires, unless there is a need to continue storing the data for the purpose of concluding or fulfilling a contract.

In case of a consent, you have the right to revoke such consent at any time, without affecting the lawfulness of the processing carried out on the basis of the consent until revocation. To do so, please write an e-mail to ultrasimweb@basf.com.

4. User account

If you register to our platform, we process your full name, e-mail, job role and company name for administration purposes of your user account. The legal basis for this processing is Art. 6 Sec. 1 lit. f) GDPR.

5. Statistical analysis

We analyze anonymous and statistical interactions of our users on our platform for the purpose of improving it and steer further software development activities. We do not collect those information on an individual user level, but only on an aggregated level. At no point in time can we trace this information back to a single user. In addition, we process anonymous calculation activities on a company level. By this information we receive insights about the frequency of our platform’s usage. This anonymous information is used for internal reporting. At no point in time can we trace this information back to a single user.

The analysis takes place on an anonymous level, as we collect aggregated meta information about the following interactions on our platform:

• Number of projects by time
• Number of versions by time
• Number of successful/unsuccessful simulation versions by time
• Type of support requests by time
• Support requests closed by type by time
• Materials selected by time
• Number of users sharing by time
• Number of users shared with by time

The legal basis for this processing is Art. 6 Sec. 1 lit. f) GDPR.

6. Share functionality

Our platform enables users to share content with other users within the platform. If and to the extent a user shares content, we process his project and contact information for the purpose of sharing the requested content. The legal basis for this processing is Art. 6 Sec. 1 lit. f) GDPR.

C. Are you obliged to provide us with this data?

When you visit our website, the information specified in section B. 1. a. as well as the information from the cookies classified as strictly necessary is processed automatically. The transfer of this information is voluntary. Without the provision of this personal data, we cannot display the requested page.

If you

- allow us to use cookies that are not classified as strictly necessary,

- want to contact us and send us an e-mail,

the transfer of the information is voluntary.

If you contact us, we cannot answer your inquiry in the chosen way without the provision of the personal data required in the individual case. As far as cookies are concerned, the lack of consent can lead to a restriction of the functionality of the website or parts of it. Embedded videos cannot be played without your consent.

D. To whom do we pass on your personal data?

Within our company, only persons and departments are granted access to your personal data as far as they need it to fulfil the abovementioned purposes.

Otherwise, we will only pass on your data to third parties if:

- you have given your express consent in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR,

- the disclosure pursuant to Art. 6 para. 1 sentence 1 lit. f GDPR is necessary for the assertion, exercise or defense of legal claims and there is no reason to assume that you have an overriding interest worthy of protection in not disclosing your data,

- there is a legal obligation for us to pass on the data in accordance with Art. 6 para. 1 sentence 1 lit. c GDPR, or

- this is legally permissible and, in accordance with Art. 6 para. 1 sentence 1 lit. b GDPR, is necessary for the fulfilment of contractual relationships with you.

A transfer of your personal data to service providers in a third country will only take place if the special requirements of Art. 44 ff. GDPR are fulfilled.

E. How do we secure your personal data?

BASF uses technical and organizational security measures to protect your personal data from accidental or intentional manipulation, loss, destruction or access by unauthorized persons. Our security measures are continuously revised in line with technological developments.

F. What rights do you have?

You have certain rights under the General Data Protection Regulation including the right to request a copy of the personal information we hold about you, if you request it from us in writing:

Right to access: the right to obtain access to your information (if we’re processing it), and certain other information (like that provided in this Privacy Policy);

Right to correct: if your personal information is inaccurate or incomplete you have the right to have your personal information rectified;

Right to erasure: this is also known as ‘the right to be forgotten’ and, in simple terms, enables you to request the deletion or removal of your information where there’s no compelling reason for us to keep using it. This is not a general right to erasure; there are exceptions. For example, we have the right to continue using your personal data if such use is necessary for compliance with our legal obligations or for the establishment, exercise or defense of legal claims;

Right to restriction of processing: the right to suspend the usage of your personal information or limit the way in which we can process it. Please note that this right is limited in certain situations: When we are processing your personal information that we collected from you with your consent you can only request restriction on the basis of: (a) inaccuracy of data; (b) where our processing is unlawful and you don’t want your personal information erased; (c) you need it for a legal claim; or (d) if we no longer need to use the data for the purposes for which we hold it. When processing is restricted, we can still store your information, but may not use it further. We keep lists of people who have asked for restriction of the use of their personal information to make sure the restriction is respected in future;

Right to data portability: the right to request that we move, copy or transfer (where technically feasible) your personal information in a structured, commonly used and machine-readable format, for your own purposes across different services;

Right to object: the right to object to our processing of your personal information including where we process it for our legitimate interests, direct marketing;

Right to withdraw consent: if you have given your consent to anything we do with your personal information, you have the right to withdraw your consent at any time (although if you do so, it does not mean that anything we have done with your personal information with your consent up to that point is unlawful).

Exercising these rights is free of charge. However, you are required to prove your identity by means of a two-factor-authentication. We will engage reasonable efforts consistent with our legal duty to supply, correct or delete personal information about you.

To exercise your rights, please contact us, for example by e-mail or by post. You will find the contact details in section A.

G. Where can you complain?

You have the right to lodge a complaint with our data protection officer (for contact details see Section A) or with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement.

In either case, you can contact our Lead Data Protection Authority:

State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz)

Hintere Bleiche 34

55116 Mainz

https://www.datenschutz.rlp.de/de/general-storage/footer/ueber-den-lfdi/kontakt/

E-Mail: poststelle@datenschutz.rlp.de

H. Data protection for minors

This website is intended for persons who are at least 18 years old. If a minor submits personal data via this website, we will delete this data and not process it further as soon as we become aware of this fact.