Privacy Notice

Table of Contents

Privacy notice for prospective customers, business partners and customers

The following information is intended to provide you with an overview of how Proxima Fusion GmbH (hereinafter referred to as “we” or “Proxima Fusion”) processes your personal data and your rights under the General Data Protection Regulation (Regulation (EU) 2016/679 – “GDPR”) and the German Federal Data Protection Act (“BDSG”).

This privacy notice applies to the personal data of individuals with whom we enter into contractual or business relationships, as well as to the bodies, managing directors, key account managers or other employees of our contractual or business partners, which we process in the context of existing or prospective contractual and business relationships. These include, among others, existing or potential suppliers, service providers, customers or consultants, as well as existing or potential cooperation partners or other partner companies.

1. Name and contact details of the controller

The entity responsible for the data processing described in this privacy notice within the meaning of Article 4(7) of the GDPR is:

Proxima Fusion GmbH
Flößergasse 2
81369 Munich
Germany

2. Data Protection Officer

You can contact our Data Protection Officer at:

MAMS Consulting GmbH
z. Hd. Datenschutzbeauftragter / Attn. Data Protection Officer
Landsberger Str. 155, 80687 München
Mail: datenschutz@pri-com.de
www.pri-com.de

3. Sources and types of personal data

Personal data is any information relating to an identified or identifiable natural person (hereinafter referred to as the ‘data subject’). We primarily process personal data that data subjects themselves provide to us within the framework of contractual and business relationships, or that we receive from the respective contractual and business partners (e.g. from your colleagues with whom we are already in contact), for example when processing an enquiry or an order. We also process personal data that we collect from publicly available sources (such as commercial registers, the press and the internet) or receive from third parties (e.g. business partners). Personal data that we have not collected directly from you originates in particular from the following sources:

Business partners
References
Research institutions/universities
Suppliers

Relevant personal data includes, in particular, personal details (such as surname, first name, address, business bank details, billing address, tax number/VAT ID) and other contact details (such as business telephone number, mobile number, or email address). In addition, this may also include contract or order data arising from the fulfilment of our contractual obligations, and further data relating to you (e.g. business interests, profession, industry, or positions). The scope of the data processed in relation to a person varies depending on the capacity in which the person deals with us, such as the position they hold with the relevant business partner.

4. Lawful bases, purposes of processing and legitimate interests

We process personal data for the following purposes or to pursue the following legitimate interests, in each case on the basis of the following legal grounds:

| Purpose | Processing/legitimate interest | Lawful basis | | :-- | :-- | :-- | | Advertising | We process your personal data if you have granted your consent to select and contact you directly with advertising via email (including newsletters) and/or telephone. Furthermore, we process your personal data for the purposes of direct marketing and for marketing our own goods and services if we have received your email address in connection with the sale of a goods or services and you have not objected to its use. You may object to the use of your personal data for direct marketing purposes at any time, without incurring any costs other than the transmission costs in accordance with standard rates | Art. 6(1)(a) GDPR; Art. 6(1)(f) GDPR in conjunction with Section 7(3) of the German Unfair Competition Act | | Preparation, performance and fulfilment of contracts with you or the company you work for | We process your personal data for the following purposes: Preparation and implementation of pre-contractual measures, e.g. to conclude a contract, to fulfil or terminate a contract already concluded, for the preparation and dispatch of an individual quotation or individual agreement, and the transmission of contractual terms with the aim of concluding a contract. This also includes, for example, data processing carried out in connection with our customer service; Purchase and supply contracts (e.g. processing of purchase and sale enquiries, authentication of contractual partners, preparation and signing of contractual documents, execution of purchases and sales, invoicing and settlement of purchase price payments; Service and work contracts as well as other contractual relationships (e.g. processing and reviewing relevant offers and enquiries; authentication of contractual partners, preparation and signing of contractual documents, processing of payments; sending of information letters) | Art. 6(1)(b) and (f) GDPR | | Customer support | For customer support services we process your personal data for: inclusion of contact details in our customer database; customer contact and relationship management, including in relation to our business partners’ employees | Art. 6(1)(f) GDPR | | Our own business purposes, including the optimization of our business processes | For our own business purposes, we process your personal data for: optimizing our business processes, for example by maintaining a database of suppliers or prospective customers, including as part of a ‘customer relationship management’ system; centralization or outsourcing of business functions; safeguarding legal claims and defending against legal disputes in connection with the assertion, exercise or defense of legal claims | Art. 6(1)(f) GDPR | | Compliance with legal obligations | We are subject to various commercial, corporate, competition and tax, data protection and other legal obligations (e.g. obligations to provide evidence) or official orders. Where required by law, we will in such cases share your personal data (e.g. to public authorities such as the tax office) | Art. 6(1)(c) GDPR | | Our legitimate interests | We process your personal data where this is necessary to safeguard our interests or the interests of third parties, and your interests do not override these interests. This might be possible, particularly in the following circumstances: prevention and investigation of criminal offences and misuse; prevention of damage to our IT systems; video surveillance; collection, sale or re-purchase of outstanding debts (e.g. debt collection procedures); preparation and conduct of customer satisfaction surveys and contact for sales promotion (e.g. analysis of certain inventory data to determine individual needs, messages for marketing purposes); further development of our services and products (e.g. through analysis or by incorporating the results of customer satisfaction surveys); management, quality assurance and improvement of our business processes and IT systems | Art. 6(1)(f) GDPR |

5. Recipients or categories of recipients of personal data

While processing your personal data, we may share your personal data with the following recipients. We will only share your personal data to recipients if you have granted your consent or if this is permitted by law.

Recipients of your personal data include, in particular:

affiliated companies of Proxima Fusion
external employees / freelancers
Processors (IT service providers, software providers, cloud providers)
Suppliers
Cooperation partners
Billing partners, debt collection agencies, financial institutions, credit institutions
Logistics companies, parcel delivery services, the Post Office
Public authorities, e.g. tax offices, courts, trade inspectorates
Tax advisers, solicitors, auditors

Under certain circumstances (beyond the cases already mentioned above), your personal data may be disclosed for the purposes set out above; specifically:

Where necessary to investigate or prosecute unlawful or abusive incidents, personal data will be passed on to our legal advisers, law enforcement agencies and, where applicable, to third parties who have suffered harm. However, this will only occur where there are concrete indications of unlawful or abusive conduct.
Data may also be disclosed where this serves to enforce contractual arrangements between us and our contractual and business partners.

We are also legally obliged to provide information to certain public authorities upon request. These are primarily law enforcement agencies, authorities that prosecute administrative offences punishable by fines, and the tax authorities.

Occasionally, in order to fulfil the purposes described in this privacy notice or to provide our services, we may rely on contractually affiliated third-party companies or other cooperation partners, as well as external service providers, some of whom may be based outside the EU or the EEA, such as logistics companies, IT service providers, business and financial consultants, and financial institutions. In such cases, information is passed on to these recipients to enable them to process it further. Where these recipients are located outside the EU or the EEA, we ensure an adequate level of data protection, for example by entering into appropriate contracts and implementing technical measures with the data recipient.

As part of the further development of our business, the structure of our company may change through a change in legal form, or the establishment, purchase or sale of subsidiaries, business units or parts of the business. In such transactions, customer information is transferred together with the part of the business being transferred. Whenever personal data is disclosed to third parties to the extent described above, we ensure that this is done in accordance with this privacy policy and the relevant data protection laws.

6. Retention period

We delete personal data when it is no longer required (see the purposes set out above). We take appropriate measures to ensure that your data is processed and retained in accordance with the following principles:

As long as the data is used to provide you with a service
As required by applicable law, contract, or in light of our legal obligations
Only for as long as necessary to achieve the purposes described above, or longer if required by contract, law, or for statistical or evidentiary purposes, subject to appropriate safeguards

The retention period is also linked to the duration of your employment with one of our business partners, but not beyond the final termination of the relevant business relationship between us and your employer. We delete transaction-related information (such as that relating to a specific contractual or commission-based relationship) upon completion of the relevant transaction, e.g. fulfilment of a supply contract, with a retention period of three years following the end of the relevant calendar year, unless these are subject to longer statutory retention obligations (such as the six- or ten-year retention period pursuant to Section 257 German Commercial Code); in such cases, data concerned will be blocked for further processing. Furthermore, we store your data on the basis of legal requirements (e.g. commercial or tax law requirements); in these cases, we delete the data upon expiry of the statutory time limits.

7. Transfer of personal data outside the EEA

In principle, your personal data collected and generated during the provision of relevant products and services is stored on our servers within the European Union. As the providers of certain software solutions or cloud services offer their products and/or services on the basis of available resources and servers worldwide, your personal data may be transferred to or accessed from jurisdictions outside the European Union and the European Economic Area.

Hence, your personal data might be transferred or accessed to/from the US. With regard to the transfer of personal data to the US, there is an adequacy decision by the European Commission on the EU-US Data Privacy Framework within the meaning of Article 45 of the GDPR (hereinafter: DPF – https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en).

Our operators of products and/or services are certified under the DPF, meaning that the standard level of protection under the GDPR applies to such transfers. You can view provider’s certifications under the EU-US Data Privacy Framework at https://www.dataprivacyframework.gov/list.

To ensure appropriate safeguards for the protection of the transfer and processing of personal data outside the EU, the transfer of data to and processing by our service providers is also carried out on the basis of appropriate safeguards in accordance with Article 46 et seq. GDPR, in particular through the conclusion of so-called standard data protection clauses in accordance with Article 46(2)(c) GDPR.

8. Contact

If you contact us by telephone, the telephone number from which you call us, the time and the duration of the call will be processed.

If you send us an email, the user’s personal data transmitted with the email will be stored. The data will be used exclusively for the purpose of processing the correspondence. Your personal data is stored for the purpose of dealing with the matter raised in your communication and, if necessary, contacting you. The legal basis for processing the data transmitted when sending an email is Article 6(1)(f) of the GDPR. Our legitimate interest lies in responding appropriately to contact enquiries. If the email contact is aimed at concluding a contract, the additional legal basis for processing is Article 6(1)(b) of the GDPR. The data will be deleted as soon as it is no longer required to fulfil the purpose for which it was collected. For personal data sent by email, this is the case once the relevant conversation with the user has ended. The conversation is deemed to have ended when it can be inferred from the circumstances that the matter in question has been conclusively resolved.

9. Data subject rights

You have the right to obtain information about the data stored about you at any time. Provided the relevant conditions are met, you are also entitled to the following rights:

Right to rectification: You have the right to have any inaccurate personal data concerning you rectified.
Right to erasure: You may also request the erasure of your personal data, for example if your data is no longer necessary for the purposes for which it was collected or otherwise processed.
Right to restriction of processing: You also have the right to request the restriction of the processing of your personal data; in such a case, the data will be blocked from any further processing. This right applies in particular where the accuracy of the personal data is disputed between you and us.
Right to data portability: Where we process your personal data to fulfil a contract with you or on the basis of your consent, you also have the right to receive your personal data in a structured, commonly used and machine-readable format, provided that and to the extent that you have made the data available to us.
Right to withdraw consent: If you have given us your consent to process your personal data, you may withdraw this consent at any time. Withdrawing your consent does not affect the lawfulness of the processing carried out on the basis of your consent prior to its withdrawal.
Right to object: Furthermore, you may object to data processing on grounds relating to your particular situation. However, this applies only in cases where we process data to fulfil a legitimate interest. If you can provide such grounds and we cannot demonstrate a compelling, legitimate interest in further processing, we will not process this data for the relevant purpose.

If you wish to obtain information about the data stored about you, wish to exercise your other rights, or have any questions regarding data protection, you may contact us using the contact details provided above.

You also have the right to lodge a complaint with a supervisory authority at any time, in particular with a supervisory authority in the Member State of your residence, your place of work or the place of the alleged infringement, if you consider that the processing of personal data relating to you infringes data protection regulations. The supervisory authority responsible for us is the following authority:

Bavarian State Office for Data Protection Supervision

Postal address:

Promenade 18
91522 Ansbach
Germany
www.lda.bayern.de

10. Amendments to this privacy notice

The ongoing development of our company may also affect how we handle personal data. We therefore reserve the right to amend this privacy notice in future in accordance with applicable data protection laws and, where necessary, to adapt it to changes in data processing practices. Previous versions of this privacy notice can be requested through the contact channels mentioned above.

Version: March 2026