Data processing in connection with Netto Online Shops

1. General

The protection of your personal data (hereinafter "Data") is an important concern of Hanshow Germany GmbH (hereinafter "Hanshow", "We" or "Us"). We treat your Data confidential and according to the legal regulations and in accordance with this privacy policy.

Personal Data is any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified directly or indirectly, in particular by means of association with an identifier (such as a customer number).

In the following, Hanshow therefore informs you in detail in accordance with Articles 13, 14 of the General Data Protection Regulation (hereinafter "GDPR") about the processing of your Data within the scope of Our cooperation with NeS GmbH (hereinafter "Netto") in connection with the Netto online shops.  The Privacy Policy explains what Data We collect and what We process it for. It also explains how and for what purpose this is done and what rights you have as a Data subject.

1.1 Name and contact of Data controller

Hanshow is responsible for the processing of your Data pursuant to Article 4 No. 7 GDPR and is always available to answer any questions you may have regarding the processing of your Data and your Data protection rights.

Hanshow Germany GmbH

Prinzenallee 7

40549 Düsseldorf

Responsible is the natural or legal person, authority, institution or other body which alone or jointly with others determines the purposes and means of the processing of Data.

1.2 Name and contact of the Data protection officer

You can reach Our Data processing officer under:

dataprotection@hanshow.com

2. Purposes of the processing

2.1 Processing of your Data for the performance of the contract

The NETTO Group operates the online shops Netto-Online.de and Marktkauf.de (hereinafter "Netto Online Shops"). If you order certain solar products from these shops and conclude a contract with Netto, We will ensure that the desired solar product is delivered to your home. For this purpose, Netto sends Us the following categories of Data from you:

• Title, first and last name,
• address,
• customer number,
• contact details: telephone number of the recipient,
• order information: order number, item number, item description, order quantity and net price of the item and delivery.

The legal basis of the processing is Article 6 para. 1 sentence 1 lit. b) GDPR, as the processing serves the performance of the contract between you and Netto, of which you are a contracting party.

If material defects or defects of title should become apparent on the goods and a granted guarantee or the limitation period for material defects and defects of title has not yet expired, We will assist Netto in remedying the defect. In this context, We receive the following Data categories from Netto in order to be able to process your warranty complaint:

• Title, first and last name,
• address,
• customer number,
• contact details: telephone number of the recipient,
• order information: order number, item number, item description, order quantity and defect description.

If you ordered a solar product from the manufacturer group Altenergy Power Systems Inc. and also use the associated monitoring app "AP EaysPower" from Altenergy Power Systems Inc., Building 2, No. 522, Asia Pacific Road, Nanhu District, Jiaxing, Zhejiang (hereinafter "APsystems"), We will receive the following Data categories from APsystems upon request in order to process your warranty complaint:

Information about the amount of electricity generated and stored,

the article number of the solar product.

In both cases, Our legal basis is Article 6 para. 1 sentence 1 lit. b) GDPR, as We only use the Data to perform your contract between you and Netto.

2.2 Processing of your Data for the purpose of anonymization

We anonymize your Data and share it with other companies in the Hanshow group of companies, namely:

• New Energy Team of Hanshow Technology Co., Ltd., Floor 4, Building 1 Jiaxing Guangfu Innovation Park, No. 1288, 314000 Jiaxing, China,
• New Energy Team of Hanshow France SAS, 88 Rue du Dôme, 92100 Boulogne-Billancourt, Frankreich,
• New Energy Team of Hanshow Netherlands B.V., 3rd floor, Transformatorweg 86 (1014AK) Amsterdam, the Netherlands .

In the context of anonymized data, it is no longer possible to identify you as a person, to link data records to you and to derive information about you. The legal basis for the anonymization of your data is Article 6 para. 1 sentence 1 lit. f) GDPR. Anonymization serves Our legitimate interest to analyze sales and operations and to improve the processes within the scope of delivery and support.

2.3 Duration of storage

Your Data will be deleted as soon as it is no longer required for the purpose of performance of the contract or if statutory or official retention periods have expired. We may be contractually or legally obliged to store Data even after termination of the contract (e.g. in order to comply with Our obligations to retain Data under tax and commercial law). In this case, this storage is based on Article 6 para. 1 semtence 1 lit. c) GDPR.

3. Passing on Data to third parties

3.1 Passing on to logistics companies

We pass on your Data to the logistics companies commissioned by Us with the delivery of the solar products you have ordered. The legal basis for this is Article 6 para. 1 sentence 1 lit. b) GDPR, as the transfer serves the delivery of your ordered solar products. The logistics companies use your Data exclusively to process the delivery. If the logistics companies offer you further services, such as tracking functions, the logistics companies are responsible for this Data processing. In this case, please observe their privacy policies.

The logistics companies We work with are:

• JD-Logistik, Ehlenbrucher Straße 60, 32791 Lage,
• GEL Express Logistik GmbH, Jakob-Kaiser-Straße 3, 47877 Willich,
• DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn.

3.2 Passing on Data to Processors

In the course of providing Our services, We use companies that process your Data on Our behalf and instructions. The Data processing is carried out exclusively in accordance with the applicable Data protection law. In particular, We have concluded agreements on Data processing on behalf with these companies that meet the requirements of Article 28 GDPR. We will provide you with further information on these companies upon request.

4. Third countries

Generally, your Data will be processed within the European Union or the European Economic Area and will not be transferred to a so-called third country. If your Data is exceptionally processed in a third country, Hanshow will ensure that your Data is adequately protected by means of contractual regulations or other re-cognized instruments.

This means for you: Either Hanshow includes so-called EU Standard Contractual Clauses in the contract (Article 46 GDPR). Or the European Commission has explicitly determined that the level of Data protection in the specific third country is adequate (Article 45 GDPR) or other protective measures or exceptions according to Article 47 or 49 GDPR exist. We will provide you with further information on the appropriate guarantees provided upon request.

5. No automatic decision in individual cases (Profiling)

We do not process your Data with the aim of automatically evaluating certain personal aspects.

6. Rights of the Data subject

Below We summarise your rights under the GDPR:

Every Data subject has the right of access pursuant to Article 15 para. 1 GDPR, the right to receive a copy of the Data pursuant to Article 15 para. 3 GDPR, the right to rectification pursuant to Article 16 GDPR, the right to erasure pursuant to Article 17 GDPR, the right to restriction of processing (blocking) pursuant to Article 18 GDPR and the right to data portability pursuant to Article 20 GDPR.

Right of revocation: Insofar as the Data processing is based on consent, you are entitled to revoke your consent to the processing of your Data at any time without stating reasons with effect for the future in accordance with Article 7 para. 3 GDPR. Please address your revocation to dataprotection@hanshow.com.

Right to object: Insofar as Data processing is carried out on the basis of Article 6 para. 1 sentence 1 lit. f) GDPR to safeguard legitimate interests, you have the right to object to the processing of this Data at any time for reasons arising from your particular situation in accordance with Article 21 GDPR. We will then no longer process this Data unless We can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims. Please address your objection to dataprotection@hanshow.com.

If you are dissatisfied with the processing of your Data by Us, please feel free to contact Us at any time.

In addition, you have the right to lodge a complaint with a data protection supervisory authority pursuant to Article 77 GDPR if you believe that the processing of your Data is not lawful. The right of appeal is without prejudice to any other administrative or judicial remedy. Please address it to: State Commissioner for Data Protection and Information Security of North Rhine-Westphalia (LfDI NRW), Kavalleriestraße 2-4, 40213 Düsseldorf, (postal address: P.O. Box 20 04 44, 40102 Düsseldorf), Germany, telephone: +49 (0) 211 / 384 24 - 0, fax: +49 (0) 211 /384 24 - 10, e-mail: poststelle@lfdi.nrw.de, website: www.ldi.nrw.de.

7. Contact Hanshow

For further questions or comments on Data protection and for the purpose of exercising your Data protection rights, you are welcome to contact Us at:

dataprotection@hanshow.com

Status: June 2023