Privacy Notice for Our Social Media Channels

Hermann Paus Maschinenfabrik GmbH (hereinafter also "Hermann Paus Maschinenfabrik GmbH", "Paus" or "we") provides you with the following information about the processing of your personal data in connection with the use of our social media presences, in accordance with Art. 13, 14 and 21 of the General Data Protection Regulation (GDPR). We maintain presences on Instagram, Facebook, LinkedIn, Xing and YouTube.

The controller within the meaning of Art. 4 No. 7 GDPR for the data processing carried out by us is:

Hermann Paus Maschinenfabrik GmbH
Siemensstraße 1–9
D-48488 Emsbüren
E-mail: datenschutz[at]paus.de
Imprint: https://www.paus.de/impressum.html

If you have any questions about this privacy notice or about the protection of your data by Hermann Paus Maschinenfabrik GmbH, you may also contact our Data Protection Officer at any time:

Carla Holterhus
E-mail: datenschutz@paus.de

Note on joint controllership (Art. 26 GDPR)

For certain processing operations — in particular the provision of aggregated page statistics (so-called Insights or Page Analytics) — we are joint controllers together with the respective platform operator within the meaning of Art. 26 GDPR. This applies to the Facebook, Instagram and LinkedIn platforms. Details and the respective provider are explained in the platform-specific sections (Section 5). You may exercise your data subject rights both against us and directly against the respective platform provider.

We operate our social media presences to provide information about our company, our products and services, and career opportunities, to raise awareness of Hermann Paus Maschinenfabrik GmbH, and to engage and communicate with customers, prospective customers, applicants and other visitors to our profiles (hereinafter "users").

Specifically, we pursue the following purposes in operating our social media presences:

• Public relations, external communications and marketing
• Information about products, services and company news
• Recruitment marketing and outreach to potential applicants
• Communication and interaction with users (e.g. responding to comments and messages)
• Evaluation of aggregated, anonymous reach and usage statistics to improve our content

Which personal data is processed when visiting and using the platforms, and who bears responsibility for this, depends primarily on the respective platform and on whether you are registered and logged in with the provider.

The legal basis for operating our social media presences and for communicating and interacting with users is our legitimate interest in public relations, external communications and outreach pursuant to Art. 6 para. 1 lit. f GDPR.

Where you have given us your consent, the legal basis is Art. 6 para. 1 lit. a GDPR. Consent given may be withdrawn at any time with effect for the future (Art. 7 para. 3 GDPR).

Where a business relationship exists between you and us, or where you submit a specific enquiry (e.g. regarding the initiation of a contract), processing may additionally be based on Art. 6 para. 1 lit. b GDPR.

Where platform operators store information on users' devices or access information already stored (e.g. cookies), the permissibility is governed by Section 25 TDDDG; any consent required for this is obtained by the respective platform operator.

In connection with the use of our social media presences, the following categories of personal data may be processed in particular:

• Interaction data (e.g. likes, shared posts, clicks, views, subscriptions)
• Profile information that you make publicly accessible on the respective platform (e.g. username, profile picture)
• Content of messages and comments that you address to us or publish on our presences
• Insights and statistical data provided to us by platform operators in aggregated, anonymised form that do not allow conclusions to be drawn about individual persons
• Usage and metadata collected by the platform operator (e.g. IP address, device and browser information, cookies and similar technologies)

The collection and processing of usage and metadata is carried out predominantly under the sole responsibility of the respective platform operator; we ourselves generally do not store personal data outside the respective platform.

Platform operators process personal data when users visit and use their platforms under their own responsibility, for example for market research and advertising purposes and to tailor their services to user needs. We have no influence over the nature, scope and purposes of this independent processing and no access to the data processed in this context. For further information and details on how to exercise your rights, please refer to the privacy policies of the respective providers, which are linked in the platform-specific sections below.

Provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland ("Meta").

Purpose: Operation of our Facebook company page for public relations, external communications, and communication and interaction with users.

Joint controllership: For the processing of so-called Page Insights (aggregated statistics on the use of our page), Meta and we are joint controllers pursuant to Art. 26 GDPR. The agreement concluded for this purpose ("Page Controller Addendum") sets out which party fulfils which data protection obligations; primary responsibility for fulfilling data subject rights and information obligations towards users lies with Meta. The Insights provided to us are aggregated and do not allow conclusions to be drawn about individual users.

Third-country transfer: Meta may transfer personal data to the USA (see Section 6).

Meta/Facebook privacy policy: https://www.facebook.com/privacy/policy

The Page Insights Controller Addendum governing the joint controllership for data collected via Page Insights is available at: https://www.facebook.com/legal/terms/page_controller_addendum.

Provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland ("Meta").

Purpose: Operation of our Instagram profile for public relations, external communications, and communication and interaction with users.

Joint controllership: For the processing of Insights and statistical data, Meta and we are joint controllers pursuant to Art. 26 GDPR (Meta Page Insights Controller Addendum). Primary responsibility for fulfilling data subject rights lies with Meta. The statistics provided to us are aggregated and do not allow conclusions to be drawn about individual users.

Third-country transfer: Meta may transfer personal data to the USA (see Section 6).

Instagram privacy policy: https://privacycenter.instagram.com/policy

The Page Insights Controller Addendum governing the joint controllership is available at: https://www.facebook.com/legal/terms/page_controller_addendum.

Provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland ("LinkedIn").

Purpose: Operation of our LinkedIn company page for public relations, recruitment marketing, and communication and interaction with users.

Joint controllership: For Page Analytics, LinkedIn and we are joint controllers pursuant to Art. 26 GDPR (LinkedIn Page Insights Joint Controller Addendum). The statistics provided to us are aggregated and do not allow conclusions to be drawn about individual users. You may also exercise your rights directly against LinkedIn.

Third-country transfer: LinkedIn may transfer personal data to the USA (see Section 6).

LinkedIn privacy policy: https://www.linkedin.com/legal/privacy-policy

The Page Insights Joint Controller Addendum governing the joint controllership is available at: https://legal.linkedin.com/pages-joint-controller-addendum.

Provider: New Work SE, Am Strandkai 1, 20457 Hamburg, Germany ("Xing").

Purpose: Operation of our Xing profile for public relations, recruitment marketing, and communication and interaction with users.

Responsibility/third-country transfers: Xing is operated by a provider based in Germany; data processing takes place within the European Union. A transfer to a third country is therefore not required. Xing is responsible for the independent processing of usage data.

Xing privacy policy: https://privacy.xing.com/de/datenschutzerklaerung

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google").

Purpose: Operation of our YouTube channel for public relations and external communications, and for communication and interaction with users (e.g. via comments).

Responsibility: Google is solely responsible for the independent processing of usage data (e.g. when videos are accessed, during interactions, and via analytics tools). We have no influence over this and no access to the data processed in this context.

Third-country transfer: Google may transfer personal data to the USA (see Section 6).

Google/YouTube privacy policy: https://policies.google.com/privacy

The primary recipients of data processed via our social media presences are the respective platform operators. Content that you publish publicly on our presences (e.g. comments) is also visible to the general public. Otherwise, we only share personal data with third parties where you have consented, where a legal basis exists, or where this is necessary for the assertion, exercise or defence of legal claims.

The providers Meta (Facebook, Instagram), LinkedIn and Google (YouTube) may transfer personal data to the USA and, where applicable, to other third countries. These transfers are based on the EU-US Data Privacy Framework (DPF), supplemented by the standard contractual clauses of the EU Commission (Art. 46 GDPR). The DPF remains valid; following the judgment of the General Court of the European Union (GC) in the Latombe case of 3 September 2025, the adequacy decision remains in force, with an appeal pending before the Court of Justice of the EU.

For Xing (New Work SE), processing takes place in Germany or within the European Union; a transfer to a third country is therefore not required.

We generally do not store any personal data relating to your use of our social media presences outside the respective platform. Content that you publish on our presences (e.g. comments) or send to us via direct messages is stored by the respective platform operator within the framework of your user relationship and can generally be deleted by you there directly.

Where we process data in the context of communication with you, we delete it as soon as the relevant purpose no longer applies and no statutory retention obligations prevent deletion. The retention period for data processed independently by the platform operators is governed by their respective privacy policies.

In accordance with the applicable legal provisions, you have the following rights:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing (Art. 21 GDPR)
• Right to withdraw consent given with effect for the future (Art. 7 para. 3 GDPR)

Right to object pursuant to Art. 21 GDPR

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Art. 6 para. 1 lit. f GDPR; this also applies to profiling based on that provision. If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves the assertion, exercise or defence of legal claims.

You may exercise your rights against us using the contact details provided in Section 1. As platform operators have comprehensive access to the usage data stored by them, we recommend directing requests relating to such data directly to the respective platform provider. In particular in the context of joint controllership (Facebook, Instagram, LinkedIn), you may also exercise your data subject rights directly against the respective provider.

Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The supervisory authority responsible for us is:

The State Commissioner for Data Protection of Lower Saxony
Prinzenstraße 5
30159 Hanover

We revise this privacy notice when changes to data processing occur or when other circumstances require it. The current version can always be found on our social media presences and on our website.

Last Update: 15th June 2026