The following information serves to clarify the nature, scope and purpose of the collection and use of personal data by EDD Research GmbH in connection with surveys and also informs you about your rights regarding the collection and processing of your personal data. This information is provided in accordance with Articles 13 and 14 of the General Data Protection Regulation (GDPR).

The person responsible for data processing is

EDD Research GmbH, FN 575331 a, Hafenstr. 47-51, 4020 Linz, AUSTRIA, (hereinafter referred to as "EDD")

What data is processed and where does this data come from?

We process the data voluntarily provided by you as part of your participation in an EDD Team Due Diligence. This data is used to carry out and evaluate the team analysis. The personal data processed includes Name (if provided by the client), e-mail address, information provided by you about your personality, your assessments of personality traits of your team members.

The evaluation is carried out jointly for the entire team. Both your self-assessments and your assessments of other team members are included in the analysis. These external assessments are a central component of the EDD methodology and serve to reveal blind spots, strengths and potential areas of tension in the team.

All processed data originates exclusively from the information provided by the participating persons and is compiled in a structured manner as part of the team due diligence.

On what legal basis and for what purposes is data processing carried out?

EDD Team Due Diligence measures success-relevant characteristics in team collaboration. The aim is to make strengths and potential risk factors visible and thus provide data-based support for team development, management and selection processes.

Your data will be processed exclusively for the purpose of carrying out and evaluating the EDD analysis.

We process your personal data

1) on the basis of your express consent (Article 6(1)(a) GDPR): The processing of personal data is carried out for the purpose of fulfilling the services and offers provided by EDD; and

2) to safeguard legitimate interests (Article 6(1)(f) GDPR): We process personal data to protect our legitimate interests, provided that these are not overridden by your interests in confidentiality. These legitimate interests include, for example, the interest in the availability of data in the event of a legal dispute.

Who will your data be passed on to?

The relevant data in individual cases is transferred on the basis of statutory provisions and/or contractual agreements and - where necessary - for the processing of contracts to the following bodies, among others:

• Client of the survey (according to consent);
• Legal representatives, notaries and third parties involved in legal services;
• Courts in case of cause;
• Administrative authorities in the event of an incident;
• Participating contractual and business partners;
• Provider (IT service provider);

If the above-mentioned recipients of your personal data are located outside the EEA and the EU Commission has not determined that the country in question has an adequate level of data protection, we will ensure that the transfer takes place on the basis of standard contractual clauses (currently 2010/87/EC and/or 2004/915/EC).

In addition, processors commissioned by us will receive your data for the purpose of fulfilling the respective service. All processors are contractually obliged to treat your data confidentially and to process it only within the scope of our instructions.

How long will your data be processed and stored?

We process your personal data for as long as this is necessary. As soon as your data is no longer required, it will be anonymized or deleted.

We store the personal data necessary for the fulfillment of legal obligations in any case for the duration of the analysis of the survey results as well as beyond that in accordance with the statutory retention and documentation obligations (e.g. according to the Austrian Commercial Code or the Federal Fiscal Code). In addition, we take into account the statutory limitation periods, which can be up to 30 years in certain cases according to the Austrian General Civil Code (ABGB).

What rights are you entitled to?

- Right to information: If we process your personal data, you have the right to information about the processing purposes, the categories of personal data processed, the recipients of this personal data, the storage period, the rights to which you are entitled, the origin of the personal data and the existence of automated decision-making.

- Correction and deletion: You are entitled to request the correction of incorrect or incomplete personal data concerning you. You are entitled to request the deletion of personal data concerning you, provided that the processing of the data is not lawful and there are no legal obligations on our part against deletion.

- Restriction of processing: You are entitled to request the restriction of processing of your personal data in certain cases.

- Data portability: You are entitled to request the transfer of your personal data that you have provided to us in a structured, commonly used and machine-readable format. You have the right to have the personal data transmitted by us directly to a controller named by you, insofar as this is technically feasible.

- Objection: You are entitled to object to the processing of personal data concerning you at any time on grounds relating to your particular situation. If you object, we will no longer process personal data concerning you unless we can prove that our reasons for processing outweigh your interests.

- Complaint: You have the right to lodge a complaint with the Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna, AUSTRIA +43 1 521 520, e-mail: dsb@dsb.gv.at, if you believe that your data protection rights have been violated.

- Contact: To exercise your rights in relation to your data processed by us, please contact: EDD Research GmbH, FN 575331 a, Hafenstr. 47-51, 4020 Linz, AUSTRIA, e-mail: datenschutz@edd.team

- Definitions: Definitions of the terms used (e.g. "personal data" or "processing") can be found in Article 4 GDPR.