Privacy Policy

We are pleased about your visit to our website. The protection of your personal data is an important concern for us and we want you to feel safe when you visit our website. We protect your privacy and your personal data. We process your personal data in accordance with the content of this data protection declaration, the country-specific data protection regulations that apply to us and the General Data Protection Regulation ("GDPR").

1. Name and address of the controller
SYNLAB AG, Moosacher Straße 88, 80809 Munich, ("We", "Us", "Our") as operator of this website ("Website"), is the controller in terms of the GDPR and other, country-specific data protection regulations for processing your personal data on this Website.
 

2. Data Protection Officer
You can contact Our data protection officer, at any time with all data protection issues at the contact details of the controller and at dpo(at)synlab.com.
 

3. Personal data
When visiting Our Website, We process information which you have actively provided about yourself, or which has been generated by Us in connection with your use of the Website. In this context We process personal data from you as follows:

• information about your visits to Our Website, such as the extent of data transfer, the location from which you access data from Our Website and other connection data and files and other content you access. This is usually done through the use of log files and cookies. For more information about log files and cookies, see below.
• your residential country, city and postal code that you have to provide each time when you seek access to Our IPO website section and, depending on your residential country, your e-mail address, name and QIB number. For more information about the IPO website section, see below.
• your e-mail address, salutation, name, company, preferred language (English/German), and further personal data that you voluntarily provide by filling in the contact form or by registering for Our Investor Relations mailing list (e.g. your affiliation as private investor, institutional investor, analyst, journalist or other). For more information about the contact from and the Investor Relations mailing list, see below.

4. Purpose and personal data concerned
The extent and nature of the collection, processing and use of your data differs according to whether you visit Our Website merely to call up generally available information or to make use of additional services:
 

4.1. Informational use
When you call up Our Website for a purely informational use, We record the data that your internet browser automatically transmits to Us, such as

• the IP address of your computer
• date and time of page view 
• your browser type, the browser version and your browser settings
• the operating system used (Windows, iOS, Linux etc.)
• the transferred data volume and status of transfers
• from which website the access to Our Website was made
• other similar data and information which serve to avert danger in the event of attacks on Our information technology systems.

The IP address of your computer is only stored in so-called log files for the time of your use of the Website and is then immediately deleted or made anonymous by a shortening. The remaining data is stored for a limited period of time. We use this data for the operation of Our Website, in particular to detect and correct website errors, to determine the Website load and to make adjustments or improvements.
 

4.2 Access to Our IPO website section

Access to the information on the IPO website section is restricted for regulatory reasons. Each time you seek to access the restricted information on the IPO website section you are requested to provide your residential country, city and postal code and, depending on your residential country, your e-mail address, name and QIB number. The legal basis of the processing of this data is our legitimate interest pursuant to Art. 6 (1)(f) GDPR to establish the required standard of a reasonable belief that the IPO website section including the investor-related information therein is only accessed in line with applicable securities laws, e.g. by residents of Germany or by persons in member states of the European Economic Area, other than Germany, who are "qualified investors" within the meaning of the Prospectus Regulation (Regulation (EU) 2017/1129). This data will not be stored and is deleted immediately upon your access to the IPO website section.
 

4.3 Use in case of use of further services
If you make use of further services via Our Website, it may be necessary for you to provide personal data.

Which personal data is required for the provision of services is determined by the respective input mask. You can provide further information voluntarily. You can tell which information is required and which is voluntary by the fact that the required information is marked with a symbol (*) to indicate that it is required.
The collection, processing and use of your data is exclusively for the purpose of providing the service you requested.

a) Contact form
On Our Website We offer you the possibility to get in contact with Us and submit questions by means of a contact form.

In doing so, the information marked with a symbol (*) in the respective contact form (i.e. e-mail address, salutation, name, company, preferred language) must be provided. In addition, further data and information (e.g. your affiliation as private investor, institutional investor, analyst, journalist or other) can be provided voluntarily. This includes all data that you voluntarily provide in the free text field of your message to Us.

We will process these data only to the extent necessary on basis of Our legitimate interest pursuant to Art. 6 (1)(f) GDPR to adequately answer your enquiry.

Only a limited number of authorized recipients within Our company will have access to your enquiry. If necessary for responding to your request, your enquiry may be forwarded to other departments within Our company. The personal data that you provide in the context of this enquiry will only be used to process your enquiry and will be deleted from the web server immediately. We would like to point out that the recipients of the messages may retain your message until you request its deletion or the purpose for its storage no longer pertains (e.g. after fulfilling your enquiry). Any mandatory statutory provisions, especially within the scope of legally existing retention obligations, remain unaffected by this provision. No information will be passed on to third parties.

The transmission of data entered in the contact forms is encrypted, whereby We have chosen end-to-end encryption in addition to TLS 1.2 transport encryption. 

b) Investor Relations mailing list
On Our Website We offer you the possibility to register for Our Investor Relations mailing list ("IR Mailing List").

If you want to register for Our IR Mailing List, We need the following information marked with a symbol (*):

• your e-mail address
• salutation and name
• company
• preferred language

In addition, further data (e.g. your affiliation as private investor, institutional investor, analyst, journalist or other) can be provided voluntarily.

The following data is collected during registration:

• IP address of the calling computer
• date and time of registration

In addition, the following data is collected via Our mailings tool:

• type of entry
• IP address of the calling computer
• date and time
• user agent
• operating system (Windows, iOS, Linux, etc.)
• from which website the access was made

If you register to the IR mailing list, you will receive a confirmation e-mail to your e-mail address that you provided. Your registration is completed by clicking on the corresponding link in the confirmation e-mail (so-called "double-opt-in" procedure).

Your data is only processed for the purpose of sending you information in the context of investor relations and financial communications (e.g. early press release, news and other investor-related and financial information) by Synlab AG and to document Our authorization in this regard.

In some of the mailing We may monitor recipient actions such as e-mail open rates through embedded links within the messages. We collect this information to gauge user interest and to enhance future user experiences. Upon your registration you may also consent to such storage and monitoring.

The IR Mailing List and the corresponding mailings is operated and sent by Our service provider EQS Group AG, Karlstraße 47, 80333 Munich, Germany ("EQS") on Our behalf. We have a data processing agreement in place with EQS. In this respect, EQS carries out data processing on Our behalf in accordance with Art. 28 GDPR.

We will process these data only with your consent pursuant to Art. 6 (1)(a) GDPR. You may revoke your consent and cancel your registration for the IR Mailing List at any time with effect for the future. An informal e-mail to dpo(at)synlab.com making this request is sufficient. We will delete your data upon withdrawal of your consent. Please note that if you withdraw your consent, that does not make the data processing carried out by Us prior to receiving your request unlawful.

The data will not be passed on to third parties (with the exception of Our service provider EQS as set out above).
 

4.4 Google Analytics, Google Maps and Google reCAPTCHA

a) Use of Google Analytics
We use Google Analytics, a web analytics service provided by Google Inc, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google").

Why do We use Google Analytics?
On Our behalf, Google will use this information to evaluate your use of the Website, to compile reports on website activity and to provide Us with further services related to website and internet use.

How do We use Google Analytics?
Google Analytics uses "cookies", which are text files placed on your computer, to help the Website analyze how users use the Website. The information generated by the cookie about your use of this Website is transferred to a Google server in the USA and stored there. As IP anonymisation is activated on this Website, your IP address will be shortened by Google within member states of the European Union or in other member states of the European Economic Area. Only in exceptional cases will the full IP address be transferred to a Google server in the USA and shortened there. The IP address transmitted by your browser within the framework of Google Analytics is not combined with other data from Google.

The legal basis of this data processing is your consent per Art. 6 (1)(a) GDPR. When you visit Our Website, a cookie notice advises you on the use of Google Analytics and asks for your consent to the use of such service. The analysis starts automatically as soon as you consent to the use of Google Analytics. In addition, please note that you may revoke your consent at any time, e.g. by selecting the appropriate settings on your browser.

Please note that if you withdraw your consent, that does not make the data processing carried out by Us prior to receiving your request unlawful.

As an alternative to the browser plug-in, you can prevent the collection by Google Analytics and withdraw consent by clicking on the following link. An opt-out cookie is set to prevent future collection of your information when you visit this Website:

Disable Google Analytics data collection for this Website. You can find more information on this at https://tools.google.com/dlpage/gaoptout?hl=de and https://www.google.com/intl/de/analytics/privacyoverview.html (general information on Google Analytics and data protection).

How long do We retain such data?
We delete the data collected via Google Analytics after two years.

Who has access to your data?
Please note that the data collected during the analysis will be forwarded to Google. The transfer of your data to the U.S. is based on Standard Contractual Clauses adopted by the European Commission. You may request a copy of the Clauses by contacting Us via dpo(at)synlab.com.

For more information on how and for how long Google will process your data, please review Google's privacy policy https://www.google.com/intl/de/policies/privacy/.

b) Use of Google Maps
We use Google Maps, a mapping service of Google Inc, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google").

Why do We use Google Maps?
We use Google Maps to display an interactive map and directions and to make it easier for you to reach Us.

How do We use Google Maps?
By using Google Maps, information about your use of this Website (including your IP address) can be transmitted to a Google server in the USA and stored there. Google may transfer the information obtained to third parties if this is required by law or if third parties process this data on behalf of Google. Technically, it is possible for Google to identify at least individual users on the basis of the data obtained. It is thus possible for Google to process personal data and profiles of users of Our Website for other purposes over which We have no control.

Only when you actively click on the interactive map yourself will your internet browser establish a connection to the Google servers. You have the option of disabling the service provided by Google Maps and thereby prevent the transmission of data to Google. You can do this by disabling JavaScript in your browser. We would like to point out, however, that, by doing so, you will not be able to view maps or directions on Our web pages.

The processing of your IP address takes place for the purpose of enabling you to comfortably use the maps function. The legal basis for the collection of this data is Art. 6 (1)(f) GDPR (legitimate interest). Our legitimate interest is the provision of a user-friendly website. 

Who has access to your data?
Please note that the data collected by using Google Maps will be forwarded to Google. The transfer of your data to the U.S. is based on Standard Contractual Clauses adopted by the European Commission. You may request a copy of the Clauses by contacting us via dpo(at)synlab.com.

You can find more information about data processing by Google here: https://www.google.com/policies/privacy/.

c) Use of Google reCAPTCHA
We use "Google reCAPTCHA" (hereinafter "reCAPTCHA") on Our Website. This service is provided by Google Inc., 1600 Amphitheater Parkway, Mountain View, CA 94043, USA ("Google").

Why do We use reCAPTCHA?
reCAPTCHA is used to check whether the data entered on Our Website (such as on the contact form) has been entered by a human or by an automated program. We use reCAPTCHA to protect Our Website from abusive automated crawling and spam.

How do We use reCAPTCHA?
Google may place cookies on your device to carry out the analysis. To perform the analysis, reCAPTCHA analyses the behaviour of the website visitor based on various characteristics. For the analysis, reCAPTCHA evaluates various information (e.g. IP address, how long the visitor has been on the Website, or mouse movements made by the user). The reCAPTCHA analyses take place completely in the background.

The legal basis of this data processing is your consent per Art. 6 (1)(a) GDPR. When you visit Our site, a cookie notice advises you on the use of reCAPTCHA and asks for your consent to the use of such service. The analysis starts automatically as soon as you consent to the use of reCAPTCHA. Please note that although you are not required to provide consent, however, if you refuse to provide your consent, you might not be able to submit questions through Our Website. In this event, you may consider contacting Us in alternative ways. In addition, please note that you may revoke your consent at any time. An informal email to dpo(at)synlab.com making this request is sufficient. Please note that if you withdraw your consent, that does not make the data processing carried out by Us prior to receiving your request unlawful.

How long do We retain such data?
We delete the data collected via reCAPTCHA after two years.

Who has access to your data?
Please note that the data collected during the analysis will be forwarded to Google. The transfer of your data to the U.S. is based on Standard Contractual Clauses adopted by the European Commission. You may request a copy of the Clauses by contacting us via dpo(at)synlab.com.

For more information on how and for how long Google will process your data, please review Google's privacy policy and the product page of reCAPTCHA: https://www.google.com/intl/de/policies/privacy/ and https://www.google.com/recaptcha/intro/android.html.
 

4.5 Plugins and Tools: Vimeo
Our Website uses plugins from the video portal Vimeo. The provider is Vimeo Inc, 555 West 18th Street, New York, New York 10011, USA.

How do the Vimeo plugins work?
If you visit one of Our pages featuring a Vimeo plugin, a connection to the Vimeo servers is established. Here the Vimeo server is informed about which of Our pages you have visited. If you are logged in to your Vimeo account, Vimeo allows you to associate your browsing behaviour directly with your personal profile. You can prevent this by logging out of your Vimeo account.

Why do We use Vimeo plugins?
Vimeo is used to help make Our Website appealing. The legal basis of this data processing is your consent per Art. 6 (1)(a) GDPR. When you visit Our Website, a cookie notice advises you on the use of Vimeo plugins and asks for your consent to the use of such service. Please note that although you are not required to provide consent, however, if you refuse to provide your consent, you might not be able to access the Vimeo content from Our Website. In this event, you would need to access the relevant Vimeo content directly on the Vimeo website.

Information on the processing of your dataPlease note that We have no influence over the scope of the data that Vimeo collects using these plugins. Further information about handling user data can be found in the data protection declaration of Vimeo under https://vimeo.com/privacy.

5. Disclosure of your personal data
We may transfer your personal data to

• other entities of the Synlab group for the purpose of Our internal business processes or in the event this is necessary for the purpose of the data processing (for example, if this is necessary to respond to your queries).
• EQS Group AG, Karlstraße 47, 80333 Munich, Germany ("EQS") as Our service provider if you register for the IR Mailing List. We have a data processing agreement in place with EQS. For further information, please see section 4.3 b) above.
• Google Inc, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA as Our service provider for the use of Google Analytics, Google Maps and reCAPTCHA. For further information, please see section 4.4 above.
• Vimeo Inc, 555 West 18th Street, New York, New York 10011, USA for the use of plugins. For further information, please see section 4.5 above.

Please note that where it is necessary to transfer your data to a recipient outside of the European Union (EU) and the European Economic Area (EEA), We will comply with all transfer requirements applicable under data protection laws. You may request a copy of the arrangements We implemented with recipients located outside the EU and the EEA by contacting Us at the contact details of the controller and at dpo(at)synlab.com.

We do not pass on your personal data to other third parties, unless you have consented to the passing on of data or We are entitled or obliged to pass on data due to legal regulations and/or official or court orders. This may, in particular, involve the provision of information for the purposes of criminal prosecution, averting danger or enforcing intellectual property rights.
 

6. Data protection and third-party Websites
The Website may contain hyperlinks to and from third-party websites. If you follow a hyperlink to one of these websites, please note that We cannot accept any responsibility (unless We are responsible under applicable law) or guarantee for third-party content or compliance with data protection conditions. Please make sure you are aware of the applicable data protection terms and conditions before you submit personal data to these websites.
 

7. Data security

All the information you send Us is stored on servers within the European Union. We secure Our Website and other systems by technical and organizational measures against loss, destruction, access, modification or distribution of your data by unauthorized persons. In particular, your personal data will be transmitted encrypted.
 

8. Your rights
You have the following rights:

• to receive information free of charge about the personal data stored by Us about your person (right to information)
• to obtain confirmation as to whether We are processing personal data relating to you (right to confirmation)
• to demand from Us that the personal data relating to you be deleted by Us without delay, insofar as processing of the data is no longer necessary and the other requirements of the GDPR for deletion are also fulfilled (right to deletion)
• to request the immediate rectification and integration of incorrect personal data concerning you (right to rectification)
• to demand the restriction of the processing of your personal data (right to restrict processing)
• to receive personal data concerning you in a structured, common and machine-readable format (right to data transferability)

• to object to the processing of your personal data as follows:
  
  You have the right at any time to object to the processing of your data based on Art. 6 (1)(f) GDPR (data processing based on legitimate interests) or Art. 6 (1)(e) GDPR (data processing in the public interest) on grounds relating to your particular situation. This also applies to profiling. If you object, We will no longer process your personal data unless We can prove compelling legitimate reasons for the processing that outweigh your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.
  
  In case We process your personal data for direct marketing purposes, and you do not wish to receive advertising, you have the right to object to this at any time. This also applies to profiling insofar as it is associated with such direct marketing. If We receive such objection from you, We will stop processing your data for direct marketing purposes.

• not to be subject to a decision based solely on automated processing, including profiling, which has legal effect vis-à-vis you or affects you in a similar way (right of decision on a case-by-case basis)
• to revoke your consent to the processing of your personal data at any time with effect for the future.

To exercise your rights or for further information on your rights, please contact Our data protection officer via dpo(at)synlab.com.
 

9. Deletion and blocking of personal data after fulfilment of purpose
We process and store personal data only as long as it is necessary for the fulfilment of the purpose, at the latest, however, until the expiry of the statutory retention and storage periods. Upon fulfilment of the purpose and expiry of the statutory retention and storage periods, the personal data will be deleted or blocked in accordance with the data protection regulations.
 

10. Right of appeal
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State in which you are resident, your place of work or the place of the alleged infringement, if you consider that the processing of personal data concerning you is in breach of the GDPR.

The competent lead supervisory authority for data protection under Art. 56 GDPR in the event of complaints:

Bavarian State Office for Data Protection Supervision
Promenade 27 (castle)
91522 Ansbach
Phone: +49 981 53 1300
Fax: +49 981 53 98 1300
E-mail: poststelle(at)lda.bayern.de

Last Update: 23 April 2021

SYNLAB AG
Moosacher Straße 88
80809 Munich
Germany