Privacy Policy

Data protection — general information

TMRW Reality S.à r.l. for the TMRW Foundation Group (“we”, “us” or “our”) is committed to protecting and respecting your privacy. Accordingly, we handle your personal data as confidential information and in compliance with the statutory data protection regulations and this Privacy Policy.

This Privacy Policy applies to our website and to our external online presences (e.g. our social media profiles) (collectively “Website” or “Site”).

When you visit our Site a variety of personal information will be collected. Personal data means any information relating to an identified or identifiable natural person and comprises data that can be used to personally identify you, such as your name, e-mail address, IP address, etc. We aim to be transparent about the personal data we collect, why we collect it and how we use it.

We herewith advise you that the transmission of data via the Internet (i.e., through e-mail communications) may be prone to security gaps. It is not possible to completely protect data against third-party access.

Overview of the processing

Who is responsible for processing your personal data?

The data processing controller (referred to as the “controller” in the GDPR) is TMRW Reality S.à r.l. for the TMRW Foundation Group, 14-16, Avenue Pasteur, L-2310 Luxembourg.

Email: dataprotection@tmrw.com

The controller is the natural person or legal entity that single-handedly or jointly with others makes decisions as to the purposes of and resources for the processing of personal data.

How do we record your data?

• We collect your data as a result of your sharing of your data with us. This may, for instance, be when you enter into our contact form.
• Other data is recorded by our IT systems automatically or after you consent to its recording during your Website visit. This data comprises primarily technical information (e.g., web browser, operating system, or time the site was accessed).
• Analysis tools and tools provided by third parties: there is a possibility that your browsing patterns will be statistically analyzed when you visit our Websites. Such analyses are performed primarily with what we refer to as analysis programs.

What personal data do we collect when you visit the Website and use the service?

The information we collect, and how that information is used, depends on how you use the Website and how you manage your privacy controls and the requirements of applicable law.

We collect information to provide better services to all our users. We do not sell personal information to third parties but only use it to deliver the Website, to identify and troubleshoot problems and improve it. Types of data collected include data you provide to us directly, data we collect automatically from your use of the Site, and data we receive from third parties.

How do we process (or use) your information?

We use personal data to provide, maintain and improve our Website and your user experience; for security and safety; to help improve the safety and reliability of our Website (including detecting, preventing, and responding to fraud, abuse or security risks); and to comply with applicable law.

Legal basis: your collected personal data is processed on the basis of Art. 6 para. 1 p. 1 lit. b GDPR if your inquiry is related to the fulfilment of a contract or is required for the performance of pre-contractual measures. In all other cases, the data is processed on the basis of our legitimate interest pursuant to Art. 6 para. 1 p. 1 lit. f GDPR or on your consent pursuant to Art. 6 para. 1 p. 1 lit. a GDPR.

Who do we share your personal data with?

We only pass on your personal data to third parties:

• insofar as you have given your express consent in accordance with Art. 6 para. 1 p. 1 lit. a GDPR;
• if the disclosure is necessary for the purposes of the legitimate interests pursuant to Art. 6 para. 1 p. 1 lit. f GDPR and there is no reason to assume that you have an overriding interest worthy of protection in the non-disclosure of your data;
• in the event that there is a legal obligation to disclose your data pursuant to Art. 6 para. 1 p. 1 lit. c GDPR; or
• where this is legally permissible and necessary according to Art. 6 para. 1 p. 1 lit. b GDPR for the execution of contractual relationships with you.

Data processing and transfer to the USA or non-EU or third countries: we may use tools of companies domiciled in the United States or other non-EU countries. If these tools are active, your personal data may be transferred to these countries and processed there. Such third countries do not always have a level of data protection comparable to the EU. Where appropriate consent has been obtained, the legal basis for such transfers is Art. 49 para. 1 lit. a GDPR.

How do we store and safeguard your data?

Storage duration. Unless explicitly stated in this Privacy Policy, your personal data stored by us will be deleted as soon as the purpose for which it was collected no longer applies and the deletion does not conflict with any statutory storage requirements.

Security measures. We take appropriate technical and organisational measures in accordance with the law, taking into account the state of the technic, the costs of implementation and the nature, scope, circumstances and purposes of the processing.

Your rights

As far as your information is concerned, you have the following rights:

• Revocation of your consent. A wide range of data processing transactions are possible only subject to your express consent. You can revoke at any time any consent you have given (Art. 7 para 3 GDPR). This shall affect all future data processing but be without prejudice to data processed prior to revocation.
• Right of objection (Art. 21 GDPR). If your personal data is processed on the basis of public interest (Art. 6 para. 1 p. 1 lit. e GDPR) and/or legitimate interests (Art. 6 para. 1 p. 1 lit. f GDPR), you have the right to object to the processing of your personal data.
• Right to complain (Art. 77 GDPR). You have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, place of work, or place of the alleged infringement.
• Right to information (Art. 15 GDPR), rectification (Art. 16 GDPR) and eradication (Art. 17 GDPR). Within the scope of the applicable statutory provisions, you have the right to demand information about your archived personal data, rectification of inaccurate data, and erasure of data.
• Right to data portability (Art. 20 GDPR). You have the right to demand that we hand over any data we automatically process on the basis of your consent or in order to fulfil a contract.
• Right to demand processing restrictions (Art. 18 GDPR). You have the right to demand the imposition of restrictions as far as the processing of your personal data is concerned.

To exercise your rights or if you have any privacy-related questions or comments related to this statement, please contact us at any time at dataprotection@tmrw.com.

Contact form

If you submit inquiries to us via our contact form, the information provided in the contact form as well as any contact information provided therein will be stored by us in order to handle your inquiry and in the event that we have further questions.

In all other cases the processing is based on our legitimate interest in the effective processing of the requests addressed to us (Art. 6 para. 1 p. 1 lit. f GDPR) or on your consent (Art. 6 para. 1 p. 1 lit. a GDPR) if this has been requested.

The information you have entered into the contact form shall remain with us until you ask us to eradicate the data, revoke your consent to the archiving of data, or until the purpose for which the information is being archived no longer exists. This shall be without prejudice to any mandatory legal provisions, in particular retention periods.

Request by e-mail or telephone

If you contact us by email or phone, your request, including all resulting personal data (name, request) will be stored and processed by us for the purpose of processing your request. We do not pass these data on without your consent.

The data sent by you to us via contact requests remain with us until you request us to delete, revoke your consent to the storage, or the purpose for the data storage lapses (e.g. after completion of your request). Mandatory statutory provisions — in particular legal retention periods — remain unaffected.

Hosting with Cloudflare

The provider is Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. For details, please view the data privacy policy of Cloudflare: https://www.cloudflare.com/privacypolicy/.

We use Cloudflare on the basis of Art. 6 para. 1 p. 1 lit. f GDPR. We have a legitimate interest in ensuring the most reliable presentation of our website possible. If appropriate consent has been obtained, the processing is carried out exclusively on the basis of Art. 6 para. 1 p. 1 lit. a GDPR.

We have concluded a data processing agreement (DPA) for the use of the above-mentioned service. This is a contract mandated by data privacy laws that guarantees that they process personal data of our website visitors only based on our instructions and in compliance with the GDPR.

Cookies

Our website uses cookies. Cookies are small text files that do not cause any damage to your device. They are either stored temporarily for the duration of a session (session cookies) or they are permanently archived on your device (permanent cookies).

Cookies have a variety of functions. Many cookies are technically essential since certain website functions would not work in the absence of the cookies. The purpose of other cookies is to analyse user patterns or display promotional messages.

You have the option to set up your browser in such a manner that you will be notified any time cookies are placed and to permit the acceptance of cookies only in specific cases. You may also exclude the acceptance of cookies in certain cases or generally and activate the deletion of cookies upon closing the browser. Please be aware that if you deactivate cookies, the functions of this website may be limited.

Consent management with Ketch

Our website uses the consent management platform Ketch to obtain and document your consent to the storage of certain cookies on your device and to the use of certain technologies, and to manage your privacy preferences. The provider is Ketch Kloud, Inc., 548 Market St PMB 62319, San Francisco, CA 94104, USA. For details, please view the data privacy policy of Ketch: https://www.ketch.com/privacy-policy.

When you visit our website, Ketch processes the information necessary to record and prove your consent decisions (such as your consent status, the time of consent and technical identifiers). This data is processed on the basis of Art. 6 para. 1 p. 1 lit. c GDPR — the use of a consent management platform serves to fulfil our legal obligation to document consent — and Art. 6 para. 1 p. 1 lit. f GDPR, based on our legitimate interest in the legally compliant operation of our website.

We have concluded a data processing agreement (DPA) for the use of the above-mentioned service. This is a contract mandated by data privacy laws that guarantees that they process personal data of our website visitors only based on our instructions and in compliance with the GDPR.

Server log files

The provider of this Website automatically collects and stores information in so-called server log files, which your browser communicates to us automatically. The information comprises:

• the type and version of browser used,
• the used operating system,
• referrer URL,
• the hostname of the accessing computer,
• the time of the server inquiry,
• the IP address.

This data is not merged with other data sources. This data is recorded on the basis of Art. 6 para. 1 p. 1 lit. f GDPR. We have a legitimate interest in the technically error-free depiction and the optimisation of the Website.

Links to third-party websites

Certain links within the Website or the Site may lead to other independent companies. We will never share your personal information with these third-party companies. Links to third-party websites are provided as a service to you. We have no control over these sites or over their privacy practices, which may differ from ours.

Analysis tools

Where analysis tools are used to understand site usage and improve our Website, they are configured to anonymise IP addresses where possible. Data is processed on the basis of legitimate interest pursuant to Art. 6 para. 1 p. 1 lit. f GDPR or, where consent is required, on the basis of Art. 6 para. 1 p. 1 lit. a GDPR.

Plug-ins and tools

This Website embeds videos from YouTube. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We use YouTube in the expanded data protection mode. According to YouTube, this mode ensures that YouTube does not store any information about visitors to this Website before they watch the video. For more information on how YouTube handles user data, please consult: https://policies.google.com/privacy.

Web fonts used on this Website are locally embedded so that a connection to external font servers is not established in conjunction with their use.

Our social media appearances

We maintain publicly available profiles in social networks (LinkedIn, X / Twitter, YouTube). On the Website we link to the online presence of the different social media. Our icon in this regard acts as an external link.

Social networks can generally analyse your user behaviour comprehensively if you visit their website or a website with integrated social media content (e.g. like buttons or banner ads). Our social media appearances should ensure the widest possible presence on the Internet. This is a legitimate interest within the meaning of Art. 6 para. 1 p. 1 lit. f GDPR.

Modification and update of the privacy policy

We ask you to regularly inform yourself about the content of our Privacy Policy. We adapt the Privacy Policy as soon as the changes in the data processing carried out by us make this necessary and we reserve the right to adapt this Privacy Policy.

Last update: February 7, 2022.