Protecting your privacy and personal data is very important to us. We therefore only use your personal data within the scope of legal regulations, in particular the General Data Protection Regulation ("GDPR") and the German Federal Data Protection Act ("BDSG"). With this privacy policy, we would like to inform you - regardless of whether you set up a Patalyze account, use our Service or visit our website - about the nature, scope and purposes of the collection, use and processing of your personal data by Patalyze GmbH.

1. Data controller / Contact / Data Protection Officer

The data controller responsible for data processing pursuant to the GDPR, BDSG, other data protection laws applicable in the member states of the European Union, and other regulations relating to data protection is:

Patalyze GmbH, Stadionstr. 6, 85716 Unterschleißheim, Germany

If you have any questions or concerns about privacy, please contact info@patalyze.com. For the conclusion of a data processing agreement pursuant to Art. 28 GDPR and for general questions about our products, please contact infor@patalyze.com. Further information on the data processing when contacting Patalyze can be found in section 9

2. Scope of Data Protection

Data protection applies to personal data as defined by the GDPR, i.e. all information relating to an identified or identifiable natural person. An identifiable natural person is deemed to be a natural person who can be identified directly or indirectly, in particular by means of assignment to an identifier such as a name, an identification number, location data, an online identifier or to one or more specific attributes.

3. Match

When using Match to map patents to product information, the texts or files you submit (Input) will not be permanently stored and will only be kept temporarily to the extent necessary for the production and transmission of the Output. After complete performance of the contractually agreed services all submitted texts or documents and their improvements will be deleted, unless requested by Users with MatchPro subscription. Customer Content will not be used to improve the quality of Patalyze’s services. For further information on the processing of customer’s data in Match, please refer to section 7 of this privacy policy and Patalyze’s Terms and Conditions.

Please note that according to its Terms and Conditions, you may not use Patalyze’s Service for processing personal data of any kind.

4. MatchPro

When using MatchPro to store, organize and analyse Customer Content, the texts or files customer submits (Input) and receives (Output) will be permanently stored and will be kept as requested by the User. The Customer Content will not be used to improve the quality of Patalyze’s services. For further information on the processing of customer’s data in Patalyze, please refer to section 7 of this privacy policy and Patalyze’s Terms and Conditions.

Please note that according to its Terms and Conditions, you may not use Patalyze’s Service for processing personal data of any kind.

5. Creating a Patalyze Account

Customer needs to create a Patalyze account for using Patalyze Services. To create the account, the following personal data will be stored:

• E-mail address
• Password
• IP address
• First name, surname, and company name/organization name
• Address
• Payment details
• Tax numbers (where applicable)
• Patalyze purchases (where applicable)
• Possibly other, additional data you provided during the registration process.

Patalyze processes the email address, password, first name, surname, company name, address, payment details, tax numbers, Patalyze purchases, and possibly other, additional data Customer provided during the registration process on the basis of Art. 6 para. 1 sentence 1 lit. b) GDPR in order to perform the contract of use. Customer’s IP address is processed in accordance with Art. 6 para. 1 sentence 1 lit. f) GDPR, as it is in our legitimate interests to match customer’s IP address with IP addresses that have misused our service in the past for fraud prevention purposes.

Please note that the creation of a Patalyze account is a prerequisite for using Patalyze Services, but creating a Patalyze account does not oblige customer to purchase a subscription or Paid Tokens. Customer can delete the Patalyze account at any time by sending an e-mail with such request to info@patalyze.com. If Customer uses Single Sign-On (SSO) to log in to Patalyze, there is no need for a separate registration with Patalyze. When Users log in via Single Sign-On, the Customer transmits User’s email address as well as User’s first and last name directly to Patalyze. Patalyze processes this data on the basis of Art. 6 para. 1 sentence 1 lit. b) GDPR.

In order to process payments, Patalyze forwards the necessary payment data to Patalyze’s authorized payment service provider Stripe Payments Europe Ltd., Block 4, Harcourt Centre, Harcourt Road, Dublin 2, Ireland. Where necessary, Stripe will transfer the data to Stripe, Inc., located in the USA. Further information on data protection at Stripe and compliance with the requirements of Art. 44 GDPR can be found here and here. Patalyze has concluded a data processing agreement with Stripe, which allows Stripe to process the data solely in accordance with Patalyze’s instructions and not for its own purposes.

In addition to the aforementioned data, Patalyze processes further (usage-)data relevant for the provision and billing of Services, such as Customer ID, date and time of purchases of Credits, billing period, successful payment processing, logins, Number of Documents. The processing and storage of the aforementioned data is necessary for the conclusion of the contract as well as its performance and is therefore justified according to Art. 6 para. 1 sentence 1 lit. b) GDPR. If User himself/herself is not a party to the contract, but Patalyze is provided to User, e.g. by employer or an organization to which he/she belongs, Patalyze justifies the processing of the data mentioned in section 7.1 and the aforementioned usage data via Art. 6 para. 1 sentence 1 lit. f) GDPR, as this is necessary for the performance of the business relationship with Patalyze’s customers, i.e. User’s employer or User’s organization.

Patalyze stores the data for the duration of the contract term and subsequently, if applicable, for the duration of statutory retention periods, insofar as these prescribe the retention for the respective types of data. Patalyze will delete Customer’s account if requested to do so. Otherwise, Patalyze will maintain Customer’s account so that it is available to Users in the event of a renewed use without the User having to register again. This is in User’s as well as in our legitimate interests pursuant to Art. 6 para. 1 sentence 1 lit. f) GDPR. In the account in the section “usage”, Users can also view data about usage behavior e.g. the Number of Documents, number of Credits consumed and the number of Credits purchased. Patalyze justifies this data processing via Art. 6 para. 1 sentence 1 lit. b) GDPR, insofar as it is necessary for the performance of the contract, in particular for billing purposes or for managing the number of Credits still available. Insofar as the processing goes beyond what is necessary for the performance of the contract, Patalyze bases the processing on Patalyze’s legitimate interests pursuant to Art. 6 para. 1 sentence 1 lit. f) GDPR, as Patalyze seeks to meet customers' wish to visualize information on usage behavior in a transparent manner. The graphical representation of the development of consumption over the contract period is considered to be also in the interest of customers.

If User’s access to Patalyze products is provided by the User’s employer or an organization to which User belongs, it is possible that Patalyze shares data about User’s usage (e.g. Number of Credits consumed, Number of Documents, last login date) with User’s employer or organization on request. Providing this data corresponds to Patalyze’s legitimate interests as well as the legitimate interests of our customers in receiving information about the use of the Services Customers have paid for.

6. Processing of Customer Content

Patalyze processes the Input Users submit to Patalyze only temporarily, insofar as this is necessary for the creation and transmission of the Output. The processing is therefore justified by Art. 6 para. 1 sentence 1 lit. b) GDPR. Your Customer Content will - within the framework of the contractual agreements - not be stored permanently and will be deleted after the performance of the contractually owed service. The only exception is if User chooses storing Customer Content, e.g. by subscription to MatchPro. In this case, Customer Content can be saved on Patalyze servers and thus kept accessible at all times.

7. Storage of Data when Mapping Products to Patents

When using Match, section 3 of this privacy policy applies. Without MatchPro subscription, if Users map patent documents, the Input and Output will only be processed temporarily and will be deleted 14 days after the completion of the mapping process. The following data is stored for each mapping process:

• Status/progress of the mapping process
• Product data
• Patent data
• Estimates of time needed for the mapping
• Number of Documents
• Errors that occurred during the mapping process

This information is processed in accordance with Art. 6 para. 1 sentence 1 lit. f) GDPR based on our legitimate interest in improving the functionality of our products, as this makes it easier to identify any sources of error related to the translation process. The data is stored in a database that can only be accessed by selected employees and is automatically deleted after 14 days.

8. Automatic Collection of Data via Website Access

Regardless of whether visitors have an account registered with Patalyze, devices automatically transmit certain data for technical reasons when accessing Patalyze’s website www.patalyze.com. The following data that visitors may send will be stored:

• Date and time of access

• Browser type and version

• Operating system

• URL of the website previously visited

• Volume of data transmitted

• Requested domain

• Notification of successful data retrieval

• Search term when using a web browser

• Abbreviated/anonymized IP

• Full IP address

• Diagnostic information in the event of errors

Processing is carried out in accordance with Art. 6 para. 1 sentence 1 lit. f) GDPR based on our legitimate interest in improving the stability and functionality of Patalyze’s website. The data is stored for purely technical reasons. Website access data is used for error analysis, ensuring system security, logging access to Patalyze and for improving Patalyze’s Services. Based on visitor’s IP address, Patalyze uses geolocation to determine the region from which visitors are visiting Patalyze’s website. Patalyze uses this information to check whether Patalyze can offer Service in visitor’s region, which corresponds to Patalyze’s legitimate interests pursuant to Art. 6 para. 1 sentence 1 lit. f) GDPR.. The storage of IP addresses of Users for the duration of the contract is justified by Art. 6 para. 1 sentence 1 lit. b) GDPR.

Patalyze’s website also uses services of Cloudflare, Inc, 101 Townsend St, San Francisco, CA 94107, USA ("Cloudflare"), which operates a so-called Content Delivery Network (CDN). To protect Patalyze’s website, the data transfer between visitor’s oder User’s browser and Patalyze servers is routed through Cloudflare's infrastructure in order to analyze whether it is an abusive attack. As part of this analysis, visitor’s data is transmitted to Cloudflare in encrypted form, if necessary also to Cloudflare servers in the USA. However, since visitor/User requests and other customer data are encrypted between visitor’s/User’s end device and the Patalyze servers, Cloudflare does not have any access to this data, but only to meta-data (such as visitor’s/User’s IP address). Only static resources (such as graphics) are loaded directly from Cloudflare- servers. In addition, Cloudflare determines a so-called bot score immediately before the login to Patalyze, which is based on the analysis of the metadata of the client (browser) used. The use of Cloudflare is in Ptalyze’s legitimate interest to secure the use of our website and to prevent and defend harmful attacks from outside, Art. 6 para. 1 sentence 1 lit. f) GDPR. Patalyze has concluded a data processing agreement with Cloudflare and Cloudflare may therefore only process the data according to our instructions and not for its own purposes. You can find more information about Cloudflare's handling of personal data here.

9. Use of Cookies and other Technologies on patalyze.com and Analysis of User Behavior

9.1 Use of Cookies, Web Storage and other Technologies on patalyze.com

We use cookies, web storage objects and other technologies to provide you with a variety of features and improve your user experience. If you do not want us to use such technologies, you can change your browser settings accordingly. Please note that if you completely disable the use of cookies, web storage objects and other technologies, the functionality and scope of the website may be impaired. We specifically use cookies or web storage objects in the following categories:

• Necessary: These cookies or web storage objects are necessary for our website to work properly, to enable smooth navigation and access our most important functions. This includes essential security and accessibility features and preferences such as interface language as well as the handling of the checkout process for Patalyze. The collecting of data via the necessary cookies or web storage objects is justified according to § 25 para. 2 no. 2 TTDSG (“Telekommunikation-Telemedien- Datenschutz-Gesetz”: German Telecommunications and Telemedia Data Protection Act). The further processing of this data is either necessary in accordance with Art. 6 para. 1 sentence 1 lit. b) GDPR for performing the contract or justified due to our legitimate interest in presenting our products and our company in accordance with Art. 6 para. 1 sentence 1 lit. f) GDPR.

• Performance: These cookies or web storage objects measure how our site is used. We use this information to improve our website and services. With these cookies we measure, for example, how often users return and which functions they use. We and our external service providers use these cookies or web storage objects with your explicit consent in accordance with § 25 para. 1 TTDSG. The further processing of this data is also based on your consent, Art. 6 para. 1 sentence 1 lit. a) GDPR.

• Functional: These cookies or web storage objects enable us to provide you with enhanced functionality and personalization on our website. For example, we can personalize your experience based on which pages you visited. In accordance with § 25 para. 1 TTDSG and Art. 6 para. 1 sentence 1 lit. a) GDPR, we only use these cookies or web storage objects and process the data collected from

them with your explicit consent.

• Marketing: These cookies and other technologies are used to deliver advertising more relevant to you and your interests. By selecting this category, you also consent to Patalyze sending your data to third parties outside the EU (e.g., Google), including the sharing of hashed email addresses. In accordance with § 25 para. 1 TTDSG and Art. 6 para. 1 sentence 1 lit. a) GDPR, we only use these cookies, web storage objects and other technologies and process the data collected from them with your explicit consent.

The table below lists the different types of technologies that may be used on our website. Cookies or web storage objects are stored until the specified expiration time or until you delete them in your browser or, if it is a session cookie, until the session has expired. You can withdraw the consent you have given for the use of cookies, web storage objects and other technologies in the categories “Performance”, “Functional” and “Marketing” in your application settings at any time.