3. Which data do we process when you visit our website?

3.1 Usage data

When you visit our website, our web server temporarily evaluates so-called usage data for statistical purposes as a protocol in order to improve the quality of our website. This data record consists of

• the name and address of the requested content,

• the date and time of the query,

• the transferred data volume,

• the access status (content transferred, content not found),

• the description of the used web browser and operating system,

• the referral link, which indicates from which page you reached ours,

• the IP address of the requesting computer, which is shortened in such a way that a personal reference can no longer be established.

The mentioned log data will only be evaluated anonymously.

In addition, we store the IP address transmitted by your web browser solely for the purposes of fraud detection and prevention as well as to protect you against such fraudulent activities based on Article 6 para. 1 letter f) GDPR. We may also transfer the IP address to third parties solely for the fulfillment of these purposes.

3.2 Cookies and similar technologies

Grover's websites use cookies and similar technologies to offer you a secure and personalized user experience on our sites and to improve our communications and products. For further information on cookies please refer to our Cookie Policy.

The types of cookies used on our website serve various purposes and can be categorized as follows:

Strictly Necessary Cookies.

These cookies are necessary for the website to function and cannot be switched off in our systems. Based on Article 6 para. 1 lit. f GDPR, we use these strictly necessary cookies:

• to identify you as being logged in to the website and to authenticate you;

• to make sure you connect to the right service on the website when we make any changes to the way it works;

• for the effective functioning of our services, such as tracking fraudulent activity and behaviour.

We do not use these required cookies for range analysis, tracking or advertising purposes. You can set your browser to inform you about the placement of cookies. This makes the use of cookies transparent for you. You can also delete cookies at any time using the appropriate browser setting and prevent the setting of new cookies. Please note that our web pages may not be able to be displayed and some functions may no longer be available for technical reasons.

Functional Cookies.

These cookies enable the website to provide enhanced functionality and personalisation. They may be set by us or by third party providers whose services we have added to our pages.

These cookies support additional functionality that enhances our website. They are used to remember user location, chosen language or other settings to provide a personalised user experience on our website. Other examples of functional cookies include chat services and user preferences.

The data processing is based on your consent in accordance with Article 6 para. 1 p. 1 lit. a GDPR or Section 25 para. 1 Telecommunications Telemedia Data Protection Act (Telekommunikation-Telemedien-Datenschutz-Gesetz, TTDSG), if you have given your consent via our banners. If you do not allow these cookies then some or all of these services may not function properly.

Performance and Analytics Cookies.

These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. All information these cookies collect is aggregated and then anonymous.

In addition, we use the following functions in the context of visitor measurement:

• We enrich the aggregated data with additional data provided by third parties. In this way, we are able to record demographic characteristics of our visitors, e.g. statements on age, gender and place of residence.

• We use a recognition method that allows us to capture and subsequently evaluate the mouse pointer movement of our visitors.

The data processing is based on your consent in accordance with Article 6 para. 1 p. 1 lit. a GDPR or Section 25 para. 1 TTDSG, if you have given your consent via our banners. If you do not allow these cookies we will not know when you have visited our site, and will not be able to monitor its performance.

In the following, we will name the third-party providers with whom we work in connection with visitor measurement. If the data is processed outside the EU or EEA in this context, please note that there is a risk that authorities may access the data for security and monitoring purposes without you being informed or having the right to appeal. If we use providers in insecure third countries and you give your consent, the transfer to a third country is based on Art. 49 para. 1 lit. a GDPR.

i) Provider = Google LLC (USA)

Maximum storage period: 2 years

Adequate level of data protection: No adequate level of data protection. The data is transmitted on the basis of Art. 49 para. 1 lit. a GDPR.

ii) Provider = Amplitude, Inc. (USA)

Maximum storage period: As long as necessary

Adequate level of data protection: No adequate level of data protection. The data is transmitted on the basis of Art. 49 para. 1 lit. a GDPR.

Revocation of consent: If you wish to revoke your consent, please scroll to the bottom of our website, click on "Cookie settings" and make the appropriate setting via our banner.

Profiling and Targeting Cookies.

We use cross-device tracking technologies to help us display targeted advertising on other websites based on your visit to our websites and to help us determine how effective our advertising efforts have been.

These cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.

We also engage in affiliate marketing, which is done by embedding tracking links into the website. If you click on a link for an affiliate partnership, a cookie will be placed on your browser to track any sales for commission payments. The purpose of storing this data is to process commission payments between the advertiser and us as an affiliate, which are processed via the affiliate network.

We participate in the partner program of Tradedoubler International AB, Mainzer Str. 13 80804 München, Germany. Further information about Tradedoubler's use of data can be found here (https://www.tradedoubler.com/de/privacy-policy/).

We are a member of the partner network of CJ Affiliate (Epsilon International UK Ltd), 1st Floor 2 Television Centre, 101 Wood Lane, London, England, W12 7FR. Further information on the use of data by CJ Affiliate can be found here (www.cj.com/legal/privacy-policy-services).

We, among others, partnered with Klarna MAS AB, Sveavägen 46, 111 34 Stockholm, Sweden, which enables us to manage, measure and optimize our performance marketing and influencer marketing campaigns. Further information about Klarna‘s use of data can be found here (https://creator.klarna.com/about/privacy-policy-consumer).

We use targeted advertising services of Criteo SA, 32 Rue Blanche, 75009 Paris, France. In order to be able to show you interest-based advertising, we or other Criteo partners need to be able to recognize you. For this purpose, a cookie is stored on your device or a comparable identifier is used, which links your user behavior with a pseudonymous user profile.

Criteo collects the following data: Criteo cookie, technical information related to the device you use, data regarding your internet connection, browsing events, IP addresses and hashed mail addresses. The email addresses are subject to pseudonymization methods to irreversibly transform them into a series of characters. For details, please refer to Criteo's privacy policy at: https://www.criteo.com/de/privacy/.

Criteo and we are joint controllers within the meaning of Art. 26 GDPR. A joint processing agreement has been concluded between Criteo and us, the essence of the arrangement can be found here; https://www.criteo.com/de/privacy/how-we-use-your-data/.

Both controllers are independently responsible for ensuring your data subject rights.

Your personal data and the Criteo cookies stored in your browser will be stored for a maximum of 13 months from the date of collection. The use of the above-mentioned service is carried out based on your consent in accordance with Art. 6 para. 1 lit. a GDPR. You can disable these Criteo services via the following link: https://www.criteo.com/privacy/#user-choices.

The data processing is based on your consent in accordance with Art. 6 para. 1 p. 1 lit. a GDPR or Section 25 para. 1 TTDSG, if you have given your consent via our banner. Your consent is voluntary and can be revoked at any time.

3.3 Access Protected Area

If you wish to use our access-protected area, prior registration is necessary.

We only collect the data required for registration. The processing is based on Art. 6 para. 1 sentence 1 letter b GDPR or on Art. 6 para. 1 letter f GDPR in the interest of providing you with the services and information of the access-protected area.

If we collect additional data, these are marked as voluntary and are based on your consent in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR.

7. How long will my data be stored?

Your data will be processed according to the legal regulations and deleted in accordance with the intended deletion periods.

As far as necessary, we process and store your personal data for the duration of our contractual relationship, which also includes, for example, the initiation and execution of a contract. Please note that our contractual relationship is usually a continuing obligation.

In the case of contractual relationships, but also in the case of other civil law claims, the storage period is also governed by the statutory limitation periods, which, for example, according to §§ 195 ff. of the German Civil Code (BGB), are usually three years, but in certain cases can be up to thirty years.

In addition, we are subject to various storage and documentation regulations, which result from the German Commercial Code (HGB) and the German Fiscal Code (AO), among others. The periods of retention or documentation specified there are six years for correspondence in connection with the conclusion of a contract and 10 years for accounting records and business letters (§§ 238, 257 para. 1 and 4 HGB, § 147 para. 1 and 3 AO).

Logfiles are deleted in principle after the end of the respective browser session, at the latest after seven days, unless their further storage is exceptionally necessary and lawful. The storage period of cookies depends on the individual case and is usually between twelve and 24 months.

Customer data and your customer account will be deleted five years after the end of your last rental contract or after your last login, whichever comes later.

We usually delete the following customer data within the following shorter periods:

• Data on telephone conversations with customers (for example telephone number) will be deleted one year after the last telephone conversation with the customer. If we record a telephone conversation in individual cases, which is only done with the customer's voluntary consent, the recording is automatically deleted after 30 days.

• Credit scoring data (see above under 2.) of customers whose order was rejected for reasons of creditworthiness, we delete or anonymize after six months. Otherwise, we delete or anonymize creditworthiness data five years after the end of your last rental agreement or after your last login, whichever comes later.

• Bank account data including account balances, turnover and transaction data for the purpose of deciding on the establishment of a contractual relationship, for identity verification and for fraud prevention (see above under 2.), we will delete or anonymize your data after six months from the receipt of your data.

• Data from our own analyses for abuse and fraud detection (see above under 2.) we will delete or anonymize your data five years after the end of your last rental agreement or after your last login, whichever comes later.

• Data required to complete ID verification checks including a scan of a photo ID (e.g. a passport or a driver's license or an identity card), an image, a video including audio data and the biometric facial identifiers extracted by Onfido Limited from the image/video (see above under 2.), we will delete these types of data after 6 months following the completion of identity verification process.

8. What are my privacy rights?

In order to assert all these rights as well as for further questions regarding personal data, you can fill out our Privacy Webform or contact our data protection officer.

You have the right of access (Art. 15 GDPR), the right of rectification (Art. 16 GDPR), the right to erasure (Art. 17 GDPR), the right to limit processing (Art. 18 GDPR) and the right of data transferability (Art. 20 GDPR).

You also have the right to object to data processing by us (Art. 21 GDPR).

Your rights in detail:

• You can request confirmation as to whether and how we process your personal data. In particular, you have a right of access to your personal data and the information about the purposes of processing, the categories of personal data, the recipients or categories of recipients to whom the personal data have been or will be disclosed, if possible the envisaged storage period, or, if this is not possible, the criteria for determining this period; the existence of a right to rectification or erasure of your personal data, to restriction of the processing or to object to such processing; the existence of a right to lodge a complaint with a supervisory authority; the source of the data if the personal data has not been collected from you, the existence of automated decision-making, including profiling, and, if applicable, meaningful information about the logic involved and the significance and envisaged consequences of such processing. If we transfer personal data to a third country or an international organisation, you may also request information about the safeguards we have in place to protect your data. Your right to information may be limited in individual cases by national law (Sections 29 (1) sentence 2, 34 BDSG) and the rights and freedoms of others.

• You may request the rectification of inaccurate personal data with undue delay or, taking into account the purposes of the processing, the completion of incomplete personal data - also by means of providing a supplementary declaration.

• You have a right to immediate erasure of your personal data under certain circumstances, e.g. if your personal data is no longer necessary for the purposes for which it was collected or otherwise processed, if you withdraw your consent and there is no other legal basis for the processing, or if you have objected to the processing of your data for direct marketing purposes. The right does not exist to the extent the processing is necessary for exercising the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the exercise of a public power vested in us, or for the establishment, exercise or defence of legal claims. Your right to erasure may be limited in individual cases by national law (Section 35 BDSG).

• You may request the restriction of processing if you contest the accuracy of the personal data for the duration of the verification of the accuracy by us, if the processing is unlawful but you object to the erasure of your personal data, if we no longer need your personal data but you need the data to establish, exercise or defend legal claims, or if you have objected to the processing.

• You have the right to data portability, i.e. the right to receive and transmit the personal data you have provided to us in a structured, commonly used and machine-readable format, if we process your personal data on the basis of your consent or a contract and the processing is carried out by automated means.

• Insofar as our processing of your personal data is based on consent (Art. 6 para. 1 sentence 1 lit. a GDPR), you may revoke this consent at any time; the legality of the data processing carried out on the basis of the consent until revocation remains unaffected.

Right to object (Art. 21. GDPR)

Insofar as we process your personal data on the basis of a legitimate interest, you further have the right to object on grounds relating to your particular situation; this also applies to profiling based on a legitimate interest. Insofar as we process your personal data for direct marketing purposes, you may object at any time to the processing of personal data concerning you for such marketing; this also applies to profiling to the extent that it is related to such direct marketing.

Notwithstanding the above, you have the right to lodge a complaint with a supervisory authority - in particular in the EU member state of your residence, place of work or place of the alleged violation - if you believe that the processing of the personal data you provided violates the GDPR or other applicable data protection laws (Art. 77 GDPR, § 19 BDSG).