Data Privacy

1. Responsible Parties

The party responsible for the operation of this B2B online shop and for the processing of personal data in connection with the use of the website, the registration of user accounts and the technical processing of orders is:

1Q Health GmbH
Gewerbestraße 8
82064 Straßlach
Germany

Tel.: +49 (0)9270 / 9916820
1Q-Contact@1Qhealth.com

1Q Health GmbH operates the online shop technically and organizationally and processes, in particular, data in connection with the use of the website, the registration of user accounts and order processing.

The party responsible for the processing of personal data in connection with the fulfilment of orders, in particular production, shipping and invoicing, is:

HKS health solutions GmbH Austria
Gewerbestraße 32
5211 Lengau
Austria

Email: info@hks-hs.at

As part of contract processing, personal data is exchanged between the platform operator and the respective seller company to the extent necessary for the fulfilment of the order.

2. General Information on Data Processing

We process personal data exclusively in accordance with the applicable data protection regulations, in particular the General Data Protection Regulation (GDPR).

Personal data means any information relating to an identified or identifiable natural person.

3. Data Processing When Visiting the Website

When our website is accessed, information is automatically transmitted by the user’s browser to our server. In particular, the following data is processed:

• IP address

• date and time of the request

• page / URL accessed

• referrer URL

• browser and operating system used

• access status / HTTP status code

This data is processed in order to:

• technically provide the website,

• ensure system security, and

• analyze technical errors.

The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in the secure and functional operation of the website.

4. Hosting

Our website is hosted by:

Microsoft Corporation / Microsoft Ireland Operations Limited
One Microsoft Place
South County Business Park
Leopardstown
Dublin 18
Ireland

The website is operated using the Microsoft Azure cloud infrastructure.

Personal data may be processed on Microsoft servers in this context.

Further information on data protection at Microsoft:
https://privacy.microsoft.com

The legal basis for the processing is Art. 6(1)(f) GDPR.

5. Registration and Customer Account

Registration is required in order to place orders in the B2B shop.

In particular, the following data is processed:

• company name

• legal form

• business address

• contact person

• email address

• telephone number

• VAT identification number, if available

The processing is carried out for the purpose of setting up and managing a customer account and processing orders.

The legal basis is Art. 6(1)(b) GDPR, performance of a contract.

6. Orders and Contract Processing

As part of orders, personal data required for the performance of the contract is processed.

This includes, in particular:

• company contact details

• delivery address

• invoice data

• order data

• payment information

This data is processed by the platform operator, 1Q Health GmbH, and, to the extent necessary for processing the order, transmitted to the respective responsible seller company.

In addition, personal data may be transmitted within the corporate group to affiliated companies to the extent necessary for the performance of the contract, the production or delivery of goods, or compliance with legal obligations.

The legal basis for the processing is Art. 6(1)(b) GDPR.

7. Payment Service Providers

We use external payment service providers to process payments.

Stripe

Credit card payments are processed via Stripe.

Stripe Payments Europe Ltd.
1 Grand Canal Street Lower
Dublin 2
Ireland

When this service is used, payment data is transmitted to Stripe.

Further information:
https://stripe.com/privacy

PayPal

Payments may also be made via PayPal.

PayPal (Europe) S.à r.l. et Cie, S.C.A.
22–24 Boulevard Royal
L-2449 Luxembourg

Further information:
https://www.paypal.com/privacy

8. Shipping Service Providers

For the delivery of goods, we pass on necessary data to shipping service providers.

The shipping service providers currently used are:

DPD Deutschland GmbH
Wailandtstraße 1
63741 Aschaffenburg

DACHSER SE
Thomas-Dachser-Straße 2
87439 Kempten

In particular, the following data is transmitted:

• company name

• contact person

• delivery address

The processing is carried out for the performance of the contract pursuant to Art. 6(1)(b) GDPR.

9. Storage of Label Uploads

As part of the ordering process, customers may upload their own labels or designs.

These files are stored on Microsoft Azure Blob Storage servers.

The storage is carried out for the purpose of performing the regulatory check and producing the ordered products.

As a rule, the files do not contain personal data. In individual cases, however, they may contain a company name or address.

The legal basis is Art. 6(1)(b) GDPR.

10. Analytics and Tracking Tools

Google Analytics (GA4)

We use Google Analytics to analyze the use of our website.

Provider:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

Google Analytics uses cookies that enable an analysis of website usage.

Processing takes place only with the user’s consent.

Legal basis: Art. 6(1)(a) GDPR.

Hotjar

We use Hotjar to analyze user behavior.

Hotjar Ltd.
Dragonara Business Centre
5th Floor
Dragonara Road
Paceville St Julian’s
Malta

Hotjar enables us to understand how users use our website.

Legal basis: Art. 6(1)(a) GDPR.

Typeform

We use Typeform for certain forms.

TYPEFORM S.L.
Carrer Bac de Roda 163
08018 Barcelona
Spain

Further information:
https://admin.typeform.com/to/dwk6gt

Legal basis: Art. 6(1)(a) GDPR.

11. Cookies and Consent Management

Our website uses cookies.

Cookies that are not technically necessary are only set after consent has been given.

Consent is obtained via a consent management tool.

Consent tool used: [insert name, e.g. Usercentrics / Cookiebot]

12. Data Transfer to Third Countries

When certain services are used, personal data may be transferred to countries outside the European Union or the European Economic Area.

Where such a transfer takes place, it is carried out exclusively on the basis of an adequacy decision by the European Commission or appropriate safeguards within the meaning of Art. 44 et seq. GDPR, in particular by concluding EU Standard Contractual Clauses.

13. Newsletter and Marketing Communication

We may use personal data to inform business partners about products, offers or relevant information.

This is done exclusively on the basis of consent pursuant to Art. 6(1)(a) GDPR or, in the B2B sector, on the basis of our legitimate interest pursuant to Art. 6(1)(f) GDPR.

Recipients may object to the use of their data for marketing purposes at any time.

14. Storage Period

Personal data is stored only for as long as necessary for the respective processing purposes.

In addition, statutory retention obligations may apply, in particular under:

• the German Commercial Code (HGB)

• the German Fiscal Code (AO)

In such cases, the retention period is generally up to 10 years.

15. Rights of Data Subjects

Data subjects have the following rights:

• right of access, Art. 15 GDPR

• right to rectification, Art. 16 GDPR

• right to erasure, Art. 17 GDPR

• right to restriction of processing, Art. 18 GDPR

• right to data portability, Art. 20 GDPR

• right to object, Art. 21 GDPR

To exercise these rights, data subjects may contact us at any time.

16. Right to Lodge a Complaint

Data subjects have the right to lodge a complaint with a data protection supervisory authority.

In particular, the competent authority is the data protection authority of the federal state in which our company has its registered office.

17. Data Security

We use technical and organizational security measures to protect personal data against manipulation, loss or unauthorized access.

Version: March 2026