We run our Facebook page in accordance with the principles set out below: We undertake to comply with the statutory provisions on data protection and endeavour to always take into account the principles of data avoidance and data minimisation. 1. name and address of the person responsible and of the data protection officer The responsible person within the meaning of the General Data Protection Regulation and other national data protection laws of the member states of the European Union as well as other data protection regulations for this Facebook page are: a) Facebook Ireland Ltd. 4 Grand Canal Square Grand Canal Harbour Dublin 2 Ireland You can contact Facebook using the following form: https://www.facebook.com/help/contact/2061665240770586 You can reach the Facebook data protection officer via the following form: https://www.facebook.com/help/contact/540977946302970 You can access Facebook's complete privacy policy via the following link: https://www.facebook.com/privacy/explanation Facebook is the platform operator in accordance with this privacy policy. and b) BOTfriends GmbH Eichhornstraße 28 97070 Würzburg, Germany Germany Tel.: +49 931 80474739 E-mail: [email protected] Website: www.botfriends.ai The data protection officer of this controller is: SiDIT GmbH Unterdürrbacher Straße 8 D-97080 Würzburg E-mail: [email protected] Website: www.sidit.de Facebook and us have an agreement as jointly responsible persons according to art. 26 DSGVO. You can view this agreement at following link [https://www.facebook.com/legal/terms/page_controller_addendum]. This agreement stipulates that Facebook assumes all data protection obligations in connection with the Page Insights itself. Page Insights is aggregate information that enables us, as a Facebook page operator, to understand how users interact with our site. This includes in particular the obligations under Art. 12, 13, 15 - 22 and 32 - 34 DSGVO. In this context, we would like to ask you to contact Facebook directly if you have any questions regarding data processing by the Page Insights. You can this form [https://www.facebook.com/help/contact/2061665240770586]. Alternatively, you can of course also contact us and we will forward your request to them in these cases - in accordance with our agreement with Facebook. 2. definitions of terms We have designed our Privacy Statement in accordance with the principles of clarity and transparency. However, should there be any ambiguity regarding the use of various terms, the corresponding definitions can be found here: here can be viewed. 3. legal basis for the processing of personal data We only process your personal data such as your surname and first name, your e-mail address and IP address etc. if there is a legal basis for this. In particular, the following rules can be considered under the basic data protection regulation:

• Art. 6(1)(a) GDPR: The data subject has given consent to the processing of his or her personal data for one or more specific purposes.
• Art. 6(1) (b) GDPR: Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
• Art. 6(1) (c) GDPR: Processing is necessary for compliance with a legal obligation to which the controller is subject
• Art. 6 (1)(d) GDPR: Processing is necessary in order to protect the vital interests of the data subject or of another natural person
• Art. 6(1)(e) GDPR: Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
• Art. 6(1)(f) GDPR: Processing is necessary for the purpose of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

However, at the respective points of this data protection declaration, we will always point out to you the legal basis on which the processing of your personal data takes place. You can find out more about the processing by Facebook in the Facebook privacy statement: https://www.facebook.com/privacy/explanation 4. disclosure of personal data The transfer of personal data is also processing within the meaning of the previous point 3. However, we would like to inform you again separately here about the subject of transfer to third parties. The protection of your personal data is very important to us. For this reason, we are particularly careful when it comes to passing on your data to third parties. Therefore, data is only passed on to third parties if there is a legal basis for the processing. For example, we disclose personal data to persons or companies that act for us as processors in accordance with Art. 28 DSGVO. A processor is anyone who processes personal data on our behalf - i.e. in particular in an instruction and control relationship with us. In accordance with the requirements of the GDPR, we conclude a contract with each of our order processors to oblige them to comply with data protection regulations and thus provide your data with comprehensive protection. We would like to point out that Facebook may also pass on your data to third parties. However, we have no influence on this. You can find more details on this in Facebook's privacy policy: https://www.facebook.com/privacy/explanation 5. storage period and deletion We store all personal data that you transmit to us only for as long as it is needed to fulfil the purposes for which this data was transmitted or as long as this is required by law. Upon fulfilment of the purpose and/or expiry of the statutory storage periods, the data will be deleted or blocked by us. Information on data storage by Facebook can be found in their privacy policy: https://www.facebook.com/privacy/explanation 6. SSL encryption This website uses SSL encryption for security reasons and to protect the transmission of confidential content, such as enquiries that you send to us as the website operator. You can recognise an encrypted connection by the fact that the address line of the browser changes from "http://" to "https://" and by the lock symbol in your browser line. If SSL encryption is activated, the data you transmit to us cannot be read by third parties. 7. collection and storage of personal data as well as their type and purpose of use In the following, we explain the data processing operations by us. With regard to data processing by Facebook, please refer to their privacy policy [https://de-de.facebook.com/policy.php]. a) When visiting the platform When you access our Facebook page, information is automatically sent to the server of the platform operator by the browser or app used on your end device. This information is temporarily stored by the platform operator in a so-called log file. The following information is collected without your intervention and stored until automatic deletion:

• IP address of the requesting device
• the date and time of access,
• Type of device you are using
• the name and URL of the requested file,
• the website from which the site is accessed (referrer URL),
• the browser used, and if applicable, your computer’s operating system and the name of your access provider.

However, this data is only available to the platform operator. It is not possible for us to access this data. Further information can be found in the platform operator's privacy policy, see above. We do not collect any personal data about you. However, it is possible to obtain pseudonymised data in the form of statistics about the users of our site over a certain period of time. The software for analysing user statistics is usually provided by the platform operator itself, but in some cases it is also possible to integrate third-party software (e.g. Google Analytics). Here, data about the users of the site can be collected, such as age, gender, country of origin, browser used and interests. However, this data is always pseudonymised and it is not possible for us to make statements about individual users based on this data alone. We use this data exclusively to optimise the content we offer and its marketing and to adapt it to the respective user interests. This is a legitimate interest according to Art. 6 para. 1 p. 1 lit. f DSGVO. b) For interactions with our account It is also possible for you to interact with our account. You can do this, for example, by marking a post with "Like", sharing or commenting on it, or by writing to us directly. When you interact with us, data processing by us is usually inevitable, as we can see your account and thus have access to your personal data, such as your user name, your profile picture or the date or time of the interaction. We use this data exclusively to optimise the content we offer and its marketing and to adapt it to the respective user interests. This is a legitimate interest pursuant to Art. 6 para. 1 p. 1 lit. f DSGVO. Our legitimate interest follows from the above-mentioned reason of optimising the content provided by us on our profile. Furthermore, the data collected is information that is only made available to us through your interaction with our profile. This establishes a relevant and appropriate relationship between you and our profile. Where deletion is possible by us, personal data will be deleted by us after 28 days at the latest, unless there is a legal basis for further processing beyond this period. Further information on data processing by the platform operator can be found in the platform operator's privacy policy, see above. 8. cookies Cookies are used by Facebook on our Facebook page. Cookies are small data packages that are automatically created by your browser and stored on your end device when you visit our website. These cookies serve to store information in connection with the respective end device used. However, a personal identification of your person is not possible through the cookies. The data processed by cookies is necessary for the aforementioned purposes to protect our legitimate interests as well as those of third parties in accordance with Art. 6 para. p. 1 lit. f DSGVO. Most browsers automatically accept cookies due to the browser default setting. However, you can configure your browser so that either no cookies are stored on your end device at all or at least a notice is displayed before a new cookie is stored. If you completely deactivate the cookie function in your browser, you may not be able to use all the functions of our website. Below we explain the different types of cookies we use. a) Session cookies In order to make the use of our offer more pleasant for you, Facebook uses so-called session cookies to recognise that you have already visited individual pages of our Facebook site. These session cookies are automatically deleted after you leave Facebook. b) Temporary cookies Facebook also uses cookies that allow us to recognise you when you visit our Facebook page again and use our services. This means that you do not have to make the entries and settings you made last time again. These temporary cookies are stored on your terminal device for a certain period of time specified by Facebook. c) Cookies for optimisation purposes Finally, Facebook also uses cookies for optimisation purposes. These statistically record the use of Facebook and our Facebook page and are evaluated for the purpose of optimising the offer for you. The cookies enable the recognition of your internet browser when you visit Facebook and/or our Facebook page again. These cookies are automatically deleted after a period of time defined by Facebook. For more information on Facebook's use of cookies, please refer to Facebook's privacy policy: https://www.facebook.com/privacy/explanation 9. rights of the data subject You have the following rights: a) Right of access Pursuant to Art. 15 GDPR, you shall have the right to request information about your personal data being processed by us. This right of access includes the following information:

• the processing purposes
• the categories of personal data
• the recipients or categories of recipients to whom your information has been or will be disclosed
• the planned storage period or at least the criteria for determining the storage period
• the existence of a right to rectification, erasure, limitation of processing or opposition
• the existence of a right of appeal to a supervisory authority
• the origin of your personal data, if not collected by us
• the existence of automated decision making, including profiling and, where appropriate, meaningful information on its details

If it is a matter of processing by Facebook, you can also contact Facebook directly. This is in particular the case if it concerns a processing in the context of the side Insights. You can contact Facebook via the following form: https://www.facebook.com/help/contact/2061665240770586 Alternatively, you can of course also contact us and we will forward your request to them in these cases - in accordance with our agreement with Facebook pursuant to Art. 26 DSGVO. b) Correction In accordance with Art. 16 DSGVO, you have the right to have incorrect or incomplete stored personal data corrected by us without delay. If the processing is carried out by Facebook, you can also contact Facebook directly. This is particularly the case if the processing is within the scope of Page Insights. You can contact Facebook using the following form: https://www.facebook.com/help/contact/2061665240770586 Alternatively, you can of course also contact us and we will forward your request to them in these cases - in accordance with our agreement with Facebook pursuant to Art. 26 DSGVO. c) Deletion In accordance with Art. 17 GDPR, you shall have the right to obtain from us without undue delay the erasure of your personal data stored by us, unless further processing is required for one of the following reasons:

• the personal data are still necessary for the purposes for which they were collected or otherwise processed;
• to exercise the right of freedom of expression and information;
• for compliance with a legal obligation which requires processing under Union or Member State law to which the controller is subject, or for the performance of a task carried out in the public interest, or in the exercise of official authority vested in the controller;
• for reasons of public interest in the area of public health pursuant to Art. 9(2)(h) and (i) and Art. 9(3) GDPR;
• for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes pursuant to Art. 89(1) GDPR, to the extent that the right referenced in a) is likely to render impossible or seriously impair the achievement of the objectives of that data processing, or
• for the establishment, exercise or defence of legal claims.

If the processing is carried out by Facebook, you can also contact Facebook directly. This is particularly the case if the processing is within the scope of Page Insights. You can contact Facebook using the following form: https://www.facebook.com/help/contact/2061665240770586 Alternatively, you can of course also contact us and we will forward your request to them in these cases - in accordance with our agreement with Facebook pursuant to Art. 26 DSGVO. (d) restriction of processing Pursuant to Art. 18 GDPR, you may request the restriction of processing of your personal data, for one of the following reasons:

• You contest the accuracy of your personal data.
• The processing is unlawful, and you oppose the erasure of your personal data.
• We no longer require the personal data for the purposes of the processing, but you require them for the establishment, exercise or defence of legal claims.
• They lodge an objection against the processing pursuant to Art. 21 (1) DSGVO.

If it is a matter of processing by Facebook, you can also contact Facebook directly. This is in particular the case if it concerns a processing in the context of the side Insights. You can contact Facebook via the following form: https://www.facebook.com/help/contact/2061665240770586. Alternatively, you can of course also contact us and we will forward your request to them in these cases - in accordance with our agreement with Facebook pursuant to Art. 26 DSGVO. e) Information  If you have requested rectification or erasure of your personal data or restriction of processing in accordance with  Art. 16, Art. 17 Par. 1 and Art. 18 DSGVO, we will notify all recipients to whom your personal data has been disclosed, unless this proves impossible or involves disproportionate effort. You can ask us to inform you of these recipients. If it is a matter of processing by Facebook, you can also contact Facebook directly. This is in particular the case if it concerns a processing in the context of the side Insights. You can contact Facebook via the following form: https://www.facebook.com/help/contact/2061665240770586 Alternatively, you can of course also contact us and we will forward your request to them in these cases - in accordance with our agreement with Facebook pursuant to Art. 26 DSGVO. f) Transmission In accordance with Art. 20 DSGVO, you have the right to receive your personal data that you have provided to us in a structured, common and machine-readable format. You also have the right to request the transfer of this data to a third party, provided that the processing has been carried out with the aid of automated procedures and is based on consent in accordance with Art. 6 Par. 1 S. 1 lit. a or Art. 9 Para. 2 lit. a or on a contract according to Art. 6 Paragraph 1 sentence 1 lit. b DSGVO. If it is a matter of processing by Facebook, you can also contact Facebook directly. This is in particular the case if it concerns a processing in the context of the side Insights. You can contact Facebook via the following form: https://www.facebook.com/help/contact/2061665240770586 Alternatively, you can of course also contact us and we will forward your request to them in these cases - in accordance with our agreement with Facebook pursuant to Art. 26 DSGVO. g) Complaint Pursuant to Article 77 of the GDPR, you have the right to complain to a supervisory authority if you believe that the processing of your personal data violates the GDPR. You have this right of complaint both against us and against Facebook. h) Opposition If your personal data is processed on the basis of legitimate interests pursuant to Art. 6 (1) sentence 1 lit. f DSGVO, you have the right to object to the processing of your personal data pursuant to Art. 21 DSGVO, insofar as there are grounds for doing so that arise from your particular situation or the objection is directed against direct advertising. In the latter case, you have a general right of objection, which will be implemented by us without specifying the particular situation. If you would like to make use of your right of revocation or objection, it is sufficient to send an e-mail to [email protected]. If it is a matter of processing by Facebook, you can also contact Facebook directly. This is in particular the case if it concerns a processing in the context of the side Insights. You can contact Facebook via the following form: https://www.facebook.com/help/contact/2061665240770586 Alternatively, you can of course also contact us and we will forward your request to them in these cases - in accordance with our agreement with Facebook pursuant to Art. 26 DSGVO. Furthermore, you can send your request by post to the following address: Facebook Ireland Ltd. 4 Grand Canal Square Grand Canal Harbour Dublin 2 Ireland 10. amendment of the privacy policy If we change the privacy policy, this will be indicated on the website. Regarding changes to the data protection statements by Facebook, please refer to their data protection statement: https://www.facebook.com/privacy/explanation Release 24.09.2018