1. Data Controller

Mmaah Berlin GmbH Nostitzstraße 51 10961 Berlin Germany

Managing Directors: Andreas Lechle, Sebastian Lechle

Privacy contact: contact@mmaah.de

2. General Information on Data Processing

We process personal data of our users only to the extent necessary to provide a functional website as well as our content and services. Processing generally only takes place with consent, or in cases where obtaining consent in advance is not possible for factual reasons and processing is permitted by law.

3. Legal Bases for Processing

The legal bases for processing personal data arise from Art. 6 GDPR: Art. 6(1)(a) GDPR: consent Art. 6(1)(b) GDPR: performance of a contract and pre-contractual measures Art. 6(1)(c) GDPR: legal obligation Art. 6(1)(f) GDPR: legitimate interests

4. Data Collection When Visiting the Website

Each time you visit this website, our hosting provider automatically processes information in so-called server log files transmitted by your browser: IP address Date and time of access Name and URL of the accessed file Referrer URL Browser and, where applicable, operating system

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure and trouble-free provision of the website). Retention: maximum 14 days.

5. Hosting

This website is hosted by Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg, in the eu-central-1 region (Frankfurt am Main, Germany). All data is processed exclusively on servers within the European Union.

AWS EMEA SARL is a subsidiary of Amazon Web Services Inc., based in the USA. Amazon Web Services Inc. is certified under the EU-U.S. Data Privacy Framework (European Commission adequacy decision of 10 July 2023). An adequate level of protection therefore applies to any access to data from the USA.

5a. Content Management System (Sanity)

For managing editorial content (text, images, FAQ entries, etc.), we use Sanity Inc. (USA) as a data processor. Editorial content is stored and processed on Sanity's EU infrastructure (Google Cloud Platform, region europe-west1, Belgium).

Limited editor account and activity data (e.g. email addresses for sign-in, Studio activity logs) may be processed by Sanity Inc. in the USA. Sanity Inc. is certified under the EU-U.S. Data Privacy Framework (European Commission adequacy decision of 10 July 2023).

6. Cookies and Local Storage

On page load, this website does not set cookies and does not use local storage (localStorage, sessionStorage) in the browser. No analytics, tracking or marketing technologies are used.

One exception is the YouTube video embedded on the home page: cookies are only set if you actively start the video by clicking play. Details in section 6a.

6a. Embedded Content (YouTube)

On our home page we embed a YouTube video in privacy-enhanced mode (domain youtube-nocookie.com). When the page loads, no data is transmitted to YouTube or Google; only a preview image stored locally on our server is shown.

Only when you click the "Play video" button is the YouTube player loaded, and at that point data is transmitted to Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Cookies may be set and information such as your IP address, device and browser data, and the video being viewed may be transmitted to YouTube. If you are simultaneously signed in to a Google account, Google may associate the visit with your account.

Legal basis: Art. 6(1)(a) GDPR (consent through actively clicking the play button). You can withdraw this consent at any time by not starting playback and, where applicable, deleting any cookies already set via your browser settings.

A transmission to the USA through Google LLC cannot be ruled out. Google LLC is certified under the EU-U.S. Data Privacy Framework (European Commission adequacy decision of 10 July 2023).

For further information, please refer to YouTube's/Google's privacy policy: https://policies.google.com/privacy

7. Contact (Franchise Inquiry)

If you contact us by email (e.g. via the franchise inquiry), your information will be stored for the purpose of processing the inquiry and in case of follow-up questions.

As part of pre-contractual measures, before any contract is concluded we provide you with the information about the franchise system required by German Federal Court of Justice (BGH) case law (including profitability, risks, and system experience).

Processed data: name, email address, contents of your message Purpose: responding to the inquiry and pre-contractual measures Legal basis: Art. 6(1)(b) GDPR Retention: until your matter has been resolved, thereafter in accordance with commercial and tax retention periods (up to 6 years pursuant to § 257 HGB for business correspondence). If your inquiry leads to a contract, longer commercial and tax retention periods of up to 10 years apply to contract-relevant documents (§ 257(4) HGB, § 147 AO).

8. External Links

The footer and navigation contain links to social networks (Instagram, TikTok, YouTube, LinkedIn). These are plain hyperlinks only. No data is transmitted to the operators of these networks when loading this page. Data is only transmitted when you click one of these links. Please refer to the privacy policies of the respective providers.

9. Fonts

This website uses fonts stored locally on our servers (self-hosted). No connection is made to Google Fonts or comparable third-party CDNs.

10. Your Rights

You have the following rights vis-à-vis us as the controller regarding your personal data: Right of access (Art. 15 GDPR) Right to rectification (Art. 16 GDPR) Right to erasure (Art. 17 GDPR) Right to restriction of processing (Art. 18 GDPR) Right to data portability (Art. 20 GDPR) Right to object (Art. 21 GDPR) Right to withdraw consent (Art. 7(3) GDPR) Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

To exercise your rights, please contact contact@mmaah.de.

11. Right to Lodge a Complaint with a Supervisory Authority

The competent supervisory authority is the Berlin Commissioner for Data Protection and Freedom of Information: Alt-Moabit 59-61, 10555 Berlin, Germany mailbox@datenschutz-berlin.de +49 (0) 30 138 89-0

12. Changes to This Privacy Policy

We reserve the right to update this Privacy Policy in order to keep it current in the event of changes to the legal situation or our services. The updated Privacy Policy will apply on your next visit.