Personal data will be processed on the basis of Art. 6 (1) lit. f) GDPR in the following cases:

Collection of personal data when visiting our website

When you use the website for informational purposes only, we collect only the personal data that your browser transmits to our server. If you wish to view our website, we collect the following data, which is technically necessary for us to display our website to you and to ensure stability and security:

• Browser type and browser version
• Operating system used
• Referrer URL
• Host name of the accessing computer
• Time of the server request
• IP address

The legitimate interest consists in the proper presentation of our website and in ensuring the stability and security of our website.

Use of cookies

The legal basis for the possible processing of personal data using cookies and their storage duration may vary. If you have given us your consent, the legal basis is Art. 6 (1) lit. a) GDPR. If data processing is based on our overriding legitimate interests, the legal basis is Art. 6 (1) lit. f) GDPR. The stated purpose then corresponds to our legitimate interest.

We use cookies to ensure the proper functioning of the website, to provide basic functionality, to measure reach and, with your consent, to customize our services to your preferred areas of interest. For this purpose, we use both transient cookies and persistent cookies

You can delete cookies already stored on your device at any time. If you wish to prevent cookies from being stored, you can do so via the settings in your internet browser. Please note that individual functions of our website may not work if you have disabled the use of cookies.

Collection of personal data when visiting our website

The website is created and hosted using Foleon, which may process technical data such as IP addresses and usage logs for the purposes of delivering, maintaining, and securing the service.

Cookiebot

Cookiebot is a consent management platform that enables websites to protect user privacy and comply with the GDPR when it comes to cookies and tracking. “Cookiebot” is a service provided by Cybot A/S, Havnegade 39, 1058 Copenhagen, Denmark.

Through the “Cookiebot” function, we inform our website visitors about the use of cookies and other technologies on our website and enable them to make a decision about their use.

If the visitor consents to the use of cookies, the following data is automatically logged:

• IP address
• Date and time of consent,
• user agent of the end user's browser,
• URL of the provider,
• The user's permitted cookies (cookie status), which are required as proof of consent,
• An anonymous, random, and encrypted key.

The encrypted key and the cookie status are stored on the user's device using a cookie in order to establish the corresponding cookie status when the page is accessed in the future. This cookie is automatically deleted after 12 months.

The legal basis for this is Art. 6 (1) lit. f) GDPR. Our legitimate interest lies in the user-friendliness of the website and in complying with the legal requirements of the GDPR. Local cookie laws may apply depending on your location.

The user can prevent or terminate the installation of the cookie and its storage, and thus their consent to cookies, at any time by adjusting their browser settings. You can open the Cookiebot settings by selecting “Cookies settings” in the footer. Further information on Cookiebot can be found at: https://www.cookiebot.com/en/privacy-policy/

jsDelivr

In order to distribute traffic on the website across multiple servers and optimize response times, we use jsDelivr, a CDN for open source projects provided by Prospect One sp.z o.o., Królewska 65A/1, 30-081 Kraków, Poland.

The following data is collected

• IP address
• Browser type
• Browser version
• Pages visited
• Date and time of visit
• Time spent on a page
• Usage data
• Device ID
• Diagnostic data

The data is deleted as soon as it is no longer required for processing purposes. The information collected is processed in the European Union.

More information on the handling of user data can be found below: https://www.jsdelivr.com/terms/privacy-policy

The legal basis for this is Art. 6 (1) lit. f) GDPR. Local cookie laws may apply depending on your location. Our legitimate interest consists in the functionality and user-friendliness of the website.

We use various services described below for the purpose of analyzing and optimizing our websites. This enables us, for example, to analyze how many users visit our site, which information is most popular, or how users find our site. Among other things, we collect data about the website from which a person has come to a website (known as the referrer), which subpages of the website have been accessed, or how often and for how long a subpage has been viewed. This helps us to design our offerings in a user-friendly manner and to improve them. The data collected in this process is not used to identify individual users personally.

Google Tag Manager

For transparency reasons, we would like to point out that we use the Google Tag Manager provided by Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA. For users in the EU, the EEA and Switzerland the service is provided by Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland.

The Google Tag Manager makes it easier for us to integrate, centrally manage and schedule our tags. Tags are script codes or code sections that can trigger different functionalities, such as measuring the success of our advertisements (Google Ads). The Google Tag Manager itself does not collect any personal data, but may transmit the IP address to Google. You can find more information in our privacy policy.

If Google stores personal data, this data is stored on the Google servers. The storage period for the data processed by the individual tracking tools can be found in our individual data protection notices for the individual tools.

For more information on Google Tag Manager, see: https://marketingplatform.google.com/about/analytics/tag-manager/use-policy/.

The legal basis and withdrawal option for this data processing is your consent, Art. 6 para. 1 lit. a) GDPR. You can withdraw your consent at any time with effect for the future by opening the data protection (“Cookies settings”) in the footer and making the appropriate changes there.

Google YouTube

If you have given your consent, Hydro uses services from YouTube, a video content provider owned by Google LLC. The responsible service provider in the EU is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

The ability to view videos serves to improve our online offering.

When you visit a website that contains YouTube, your browser establishes a direct connection to Google's servers and processes the following data:

• Device information
• Videos viewed
• IP address
• Referrer URL

The information collected about your use of this website is usually processed within the European Union.

This service may transfer visitor data to the US, which does not offer an adequate level of data protection. There is a risk that your data may be processed by US authorities for control and monitoring purposes, without you having any legal recourse.

The data will be deleted as soon as it is no longer required for processing purposes.

More information on the handling of user data can be found below: https://business.safety.google/privacy/?hl=en https://policies.google.com/technologies/cookies?hl=en https://safety.google/privacy/privacy-controls/

Legal basis and withdrawal option for this data processing is your consent, Art. 6 para. 1 lit. a) GDPR. You can withdraw your consent at any time with effect for the future by opening the data protection (“Cookies settings”) in the footer and making the appropriate changes there.

Google-Re/Marketing-Services

We use the marketing and remarketing services ("Google Marketing Services" for short) provided by Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA, to optimize and economically operate our online offer. The responsible body for users in the EU/EEA and Switzerland is Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland. The Google Marketing Services allow us to display advertisements for our website in a more targeted manner in order to present you only with advertisements that potentially correspond to your interests. If, for example, you are shown advertisements for our services on other websites, this is referred to as "remarketing". For these purposes, when our and other websites on which Google marketing services are active are accessed, a code is executed directly by Google and so-called (re)marketing tags (invisible graphics or code, also known as "web beacons") are integrated into the website. With their help, an individual cookie, i.e. a small file, is stored on your device (comparable technologies can also be used instead of cookies).

The cookies can be set by different domains, including google.com, doubleclick.net, invitemedia.com, admeld.com, googlesyndication.com or googleadservices.com. This file records which websites you visited, what content you were interested in and what offers you clicked on, as well as technical information about the browser and operating system, referring websites, visiting time and other information about the use of the online offer. Your IP address is also recorded, whereby we inform you within the framework of Google Analytics that the IP address is shortened within member states of the European Union or in other contracting states of the Agreement on the European Economic Area and only in exceptional cases is it transmitted in full to a Google server in the USA and shortened there.

The IP address will not be merged with your data within other Google offers. The above information may also be linked by Google to such information from other sources. If you subsequently visit other websites, you may be shown the advertisements tailored to you according to your interests. We process your data pseudonymously as part of the Google marketing services. This means that Google does not store and process, for example, your name or e-mail address, but processes the relevant data cookie-related within pseudonymous user profiles. The information collected about users by Google Marketing Services is transmitted to Google and stored on Google's servers in the United States. One of the Google marketing services we use is the online advertising program "Google Ads" (formerly: "Google AdWords"). In the case of Google Ads, each Ads customer receives a different "conversion cookie". This means that cookies cannot be tracked via the websites of Ads customers. The information obtained with the help of the cookie is used to create conversion statistics for Ads customers who have opted for conversion tracking. Ads customers learn the total number of users who clicked on their ad and were redirected to a page with a conversion tracking tag. However, they do not receive any information that can be used to personally identify users. Insofar as data is processed outside the EEA, where there is no level of data protection corresponding to the European standard, we have concluded EU standard contractual clauses with the service provider to establish a secure level of data protection. Further information on the use of data for marketing purposes by Google can be found on the overview page:

https://www.google.com/policies/technologies/ads Google's privacy policy is available at https://www.google.com/policies/privacy

The legal basis and right to withdrawal for this data processing is your consent, Art. 6 para. 1 lit. a) GDPR. You can withdraw your consent at any time with effect for the future by opening the data protection (“Cookies settings”) in the footer and making the appropriate changes there.