Privacy Policy

General Information The following information provides an overview of what happens to your personal data when you visit this website. Personal data is any information that can be used to personally identify you. Detailed information can be found in the following sections of this Privacy Policy. Data Collection on This Website Who is responsible for data collection? Data processing is carried out by the operator of this website. The relevant contact details can be found in the section “Controller and Data Protection Contact” and in the Legal Notice. How do we collect your data? Some data is collected when you provide it to us, for example via a contact or application form. Other data is collected automatically or, where applicable, after you have given your consent when visiting the website through our IT systems. This includes, in particular, technical data such as browser type, operating system, time of page access and IP address. What do we use your data for? Some data is required to ensure the technically correct provision of the website. Other data may be used, with your consent, to analyse website usage or to display external content. Data submitted through enquiries is used to process your request. What rights do you have? In particular, you have the right to access, rectification, erasure, restriction of processing, data portability and objection. Consent that you have given may be withdrawn at any time with effect for the future. You also have the right to lodge a complaint with a data protection supervisory authority. 2. Controller and Data Protection Contact The controller within the meaning of the General Data Protection Regulation (GDPR) and other applicable data protection legislation is: GEBIOM GmbH Wilhelm-Schickard-Straße 12 48149 Münster Germany Phone: +49 251 98724 0 Email: info@gebiom.com Contact Details of Our Data Protection Officer GEBIOM GmbH Wilhelm-Schickard-Straße 12 48149 Münster Germany Email: datenschutz@gebiom.com 3. General Information and Legal Bases

Protection of Personal Data We treat personal data confidentially and in accordance with applicable data protection legislation. Nevertheless, data transmission over the internet, for example when communicating by email, may be subject to security vulnerabilities. Complete protection against access by third parties cannot be guaranteed. Legal Bases for Processing Depending on the processing activity, we rely in particular on the following legal bases: - Art. 6(1)(a) GDPR: Processing based on consent. - Art. 6(1)(b) GDPR: Processing necessary for the performance of a contract or in order to take steps prior to entering into a contract. - Art. 6(1)(c) GDPR: Processing necessary for compliance with a legal obligation. - Art. 6(1)(f) GDPR: Processing necessary for the purposes of legitimate interests, provided that such interests are not overridden by the interests or fundamental rights and freedoms of the data subject. - Section 25(1) TDDDG: Consent for storing information on the end device or accessing information already stored there, unless a statutory exception applies. - Section 25(2) TDDDG: Access or storage insofar as this is strictly necessary to provide a digital service expressly requested by the user.

Withdrawal of Consent and Right to Object Consent that has been given may be withdrawn at any time with effect for the future. Where processing is based on Art. 6(1)(f) GDPR, you may object to the processing on grounds relating to your particular situation. In the case of direct marketing, you have the right to object at any time without any further requirements. 4. Hosting and Technical Provision

Hosting by Onepage This website is provided and hosted via Onepage. Provider: Onepage GmbH Hanauer Landstraße 172 60314 Frankfurt am Main Germany When you visit the website, technically necessary connection and log data is processed. This may include, in particular, your IP address, date and time of access, content accessed, referrer URL, browser type, operating system and access status. The processing is carried out to ensure the secure, stable and efficient provision of the website and to prevent and investigate technical attacks. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the reliable and secure operation of the website. Where Onepage processes personal data on our behalf, this is carried out on the basis of a data processing agreement pursuant to Art. 28 GDPR. Retention period for server log data: Server log data and data submitted via forms are stored only for as long as necessary for the operation of the website, the processing of your enquiry or due to contractual requirements. Within the infrastructure provided by Onepage, data is deleted upon instruction by the controller or, at the latest, upon termination of the contractual relationship with the hosting provider.

5. Onepage Website Platform We use Onepage for the creation, administration and technical delivery of this website. Provider: Onepage GmbH Hanauer Landstraße 172 60314 Frankfurt am Main Germany Onepage is used to manage website content and – depending on the configuration – to process form submissions and so-called leads and store them in a cloud environment. Depending on the function concerned, processing is carried out for the technical provision of the website, the processing of enquiries and the management of form submissions. The legal bases are Art. 6(1)(b) GDPR where the enquiry relates to a contract or pre-contractual measures, and Art. 6(1)(f) GDPR for other business communications and the secure operation of the website. Onepage is used as a processor. The applicable data processing agreement forms part of the contractual relationship or is provided by Onepage. Specific retention period in Onepage / Onepage CRM: Until deletion upon instruction by the controller or until termination of the main contract with Onepage. No automatic deletion period is provided.

6. Cookies, Consent and Consent Management This website may use cookies and similar technologies. Cookies are small data packages that are stored on or read from your device. Technically necessary technologies are used insofar as they are required to provide the website and functions expressly requested by you. The legal bases are Section 25(2) TDDDG and Art. 6(1)(f) GDPR. All technologies that are not technically necessary – in particular those used for audience measurement, external maps or comparable services – are activated only after you have given your consent. The legal bases are Section 25(1) TDDDG and Art. 6(1)(a) GDPR. You may change or withdraw your selection at any time via the privacy settings available on the website. Consent management / banner used: ONEPAGE CONSENT 7. Contact and Forms

Contact Form If you contact us via a form, we process the information you enter in order to handle your enquiry and respond to any follow-up questions. The data processed typically includes your name, company, email address, telephone number, information about your area of interest and the content of your message. Mandatory fields are marked accordingly. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to the initiation or performance of a contract. In all other cases, processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in the appropriate handling of business and general enquiries. The data will be deleted once your enquiry has been fully processed, provided that there are no statutory retention obligations or legitimate reasons for further storage.

Internal retention period for general enquiries: 12 months after completion. Contact by Email or Telephone If you contact us by email or telephone, we process the contact details you provide and the content of the communication in order to handle your enquiry. The same legal bases and deletion principles apply as for enquiries submitted via the contact form. 8. Applications If you apply for a position with us, we process the application data you provide. This may include, in particular, contact details, CV, certificates, qualifications, interview notes and any other information you provide during the application process. Processing is carried out for the purpose of deciding whether to establish an employment relationship on the basis of Section 26(1) BDSG and Art. 6(1)(b) GDPR. Where special categories of personal data are processed, processing may additionally be based on Art. 9(2)(b) GDPR and/or Section 26(3) BDSG. Application data is generally deleted after completion of the application process unless consent has been given for longer storage or statutory or legitimate reasons require further retention.

Defined retention period after completion of the application process: 6 months Application channel / tool used: bewerbungen@gebiom.group 9. Audience Measurement and Analytics

Google Analytics 4 Where you have given your consent, we use Google Analytics 4, a web analytics service provided by Google. For users in the European Economic Area and Switzerland, the responsible entity is generally:

Google Ireland Limited Gordon House Barrow Street Dublin 4 Ireland Google Analytics helps us understand how visitors use our website and enables us to improve its content and user experience. In particular, information about page views, session duration, interactions, approximate location and device information as well as technical identifiers may be processed. Google states that IP addresses of users from the EU are discarded before logging and are not stored. Google Analytics is activated only after you have given your consent. The legal bases are Section 25(1) TDDDG and Art. 6(1)(a) GDPR. You may withdraw your consent at any time via the privacy settings. Google Analytics Property / Measurement ID: G-94QVKQ0DFE Data retention in GA4: 14 months Google Signals, advertising features or linkage with Google Ads: No 10. Google Tag Manager We use Google Tag Manager to technically manage website tags and integrated services. The Tag Manager provides configurations and ensures that other services are triggered. It does not generally create independent user profiles itself; however, technical connection data may be transmitted to Google when it is delivered. Where the Tag Manager or services integrated through it access information on the user's device that is not strictly necessary or process personal data for analytics purposes, they are activated only after you have given your consent. The legal bases are Section 25(1) TDDDG and Art. 6(1)(a) GDPR. 11. Google Maps This website may use Google Maps to display locations and provide route planning. For users in the European Economic Area and Switzerland, the responsible entity is generally: Google Ireland Limited Gordon House Barrow Street Dublin 4 Ireland When the map is loaded, your IP address, device and browser information and, where applicable, location data may be transmitted to Google. If you are logged into a Google account, Google may associate your use of the service with your account. Google Maps is loaded only after you have given your consent. The legal bases are Section 25(1) TDDDG and Art. 6(1)(a) GDPR. You may withdraw your consent at any time via the privacy settings.

12. LinkedIn and Social Media

LinkedIn Links Our website may contain links to our company profile on LinkedIn. Simply visiting our website via a standard link does not result in data being transmitted to LinkedIn. Only when you click the link do you leave our website. From that point onwards, LinkedIn processes data under its own responsibility and in accordance with its applicable privacy policy.

LinkedIn Insight Tag Where you have given your consent, this website may use the LinkedIn Insight Tag. This allows website visits, conversions and target audiences to be statistically analysed. Technical identifiers, IP address, device and browser data, page views and interactions may be processed and associated with LinkedIn accounts. The Insight Tag is activated only after you have given your consent on the basis of Section 25(1) TDDDG and Art. 6(1)(a) GDPR. You may withdraw your consent at any time. LinkedIn Insight Tag used: Yes

13. External Links and Embedded Content Our website may contain links to external websites. The respective operators are responsible for the content and data processing on those external websites. When you click an external link, the privacy policy of the respective provider applies. Embedded content from external providers – such as maps, videos, social media elements or external font and media services – is used only where technically necessary or where you have previously given your consent. Where such content is used, it is specifically identified in the privacy settings and in this Privacy Policy. Embedded Videos (YouTube) Individual pages may contain embedded videos from YouTube. For users in the European Economic Area and Switzerland, the responsible entity is generally: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland When an embedded video is loaded, your IP address, device and browser information and information about the page you have accessed may in particular be transmitted to Google. If you are logged into a Google account, Google may associate your use of the service with your account. YouTube videos are loaded only if the required consent has been given. The legal bases are Section 25(1) TDDDG and Art. 6(1)(a) GDPR. Consent may be withdrawn at any time with effect for the future via the privacy settings. Where data is transferred to the United States or other third countries, the information in the section “Data Transfers to Third Countries” also applies.

Transparency Notice Regarding AI-Generated and AI-Edited Media Texts, images, illustrations, graphics or other media on this website may have been created or edited, in whole or in part, using generative artificial intelligence. Such content is reviewed editorially before publication. Where AI-generated or AI-edited representations depict recognisable persons, situations, products or environments, they may be purely illustrative and do not necessarily represent the actual situation. Simply accessing such media does not generally result in personal data of website visitors being transmitted to an AI provider. Should an interactive AI function be used in the future in which user input or personal data is transmitted to an external AI service, this Privacy Policy will be updated accordingly before such a function is introduced. 14. Data Transfers to Third Countries When using services provided by internationally operating providers, the processing of personal data outside the European Union or the European Economic Area cannot be ruled out. Data transfers take place only where the requirements of Art. 44 et seq. GDPR are met, for example on the basis of an adequacy decision, appropriate safeguards such as Standard Contractual Clauses, or a statutory exception. For certified US companies, data may be transferred on the basis of the EU-US Data Privacy Framework and the corresponding adequacy decision. Where a provider is not certified, or is not certified for the relevant processing activity, other appropriate transfer mechanisms are used.

15. Data Retention Unless a more specific retention period is stated in this Privacy Policy, we store personal data only for as long as necessary for the respective purpose. The data is then deleted unless statutory retention obligations, ongoing legal claims or other legitimate reasons require further storage. Statutory retention periods under commercial and tax law may, in particular, be six or ten years. Records of consent may be retained for as long as necessary to demonstrate that valid consent was obtained. 16. Rights of Data Subjects Subject to the applicable legal requirements, you have in particular the following rights: - Right of access pursuant to Art. 15 GDPR. - Right to rectification pursuant to Art. 16 GDPR. - Right to erasure pursuant to Art. 17 GDPR. - Right to restriction of processing pursuant to Art. 18 GDPR. - Right to data portability pursuant to Art. 20 GDPR. - Right to object pursuant to Art. 21 GDPR. - Right to withdraw consent pursuant to Art. 7(3) GDPR. - Right to lodge a complaint with a supervisory authority pursuant to Art. 77 GDPR.

Competent Supervisory Authority The competent supervisory authority for data protection matters is: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen Kavalleriestr. 2–4 40213 Düsseldorf Germany Phone: +49 211 38424-0 Fax: +49 211 38424-10 Email: poststelle@ldi.nrw.de However, we recommend that you first address any complaint to our Data Protection Officer. 17. Data Security This website uses TLS/SSL encryption. You can identify an encrypted connection in particular by “https://” in your browser's address bar. We implement appropriate technical and organisational measures to protect personal data against loss, destruction, manipulation and unauthorised access. These measures are continuously reviewed in accordance with the state of the art and the applicable risk situation. 18. Automated Decision‒Making When using this publicly accessible corporate website, no solely automated decision-making within the meaning of Art. 22 GDPR generally takes place that produces legal effects concerning you or similarly significantly affects you. 19. Updates and Amendments We update this Privacy Policy whenever legal requirements, the services we use or the technical design of the website change. The version of this Privacy Policy currently published on the website shall apply. Last updated: August 2026