1. Introduction

Our Data Protection Declaration informs you about the collection and processing of our website, www.tier.app. Privacy notices for data processing in connection with the TIER app and for mobility services that can be booked via our app or via partner apps can be found at about.tier.app/privacy-notice/.

The data controller and service provider is:

Tier Mobility SE ("TIER", "we"),
c/o Mindspace,
Friedrichstraße 68,
10117 Berlin, Germany

Contact: support@tier.app

2. Data collected automatically when visiting the website

We collect the data transmitted automatically by your browser to our web server on a regular basis when you use the Internet, such as your IP address, the URLs of the websites from which you have accessed our websites, the browser used, browser language, operating system and interface used, the access device with which the services are used, the date and time of access, the accessed pages of our website and the time you spend on our website.

The data are stored for a limited period and then automatically deleted.

The legal basis for the processing of these data is our legitimate interest pursuant to Article 6 (1f) GDPR, which follows from the purposes listed below. We use this information to:

- to enable the retrieval and visit of the website;

- to continuously improve our website and offerings and to further adapt them to the needs of our users;

- to carry out internal quality controls;

- to detect, eliminate and prevent errors, malfunctions and possible misuse;

- to generate statistics on access channels and site usage.

3. Contact with us

If you contact us, e.g. via a contact form, by e-mail or telephone, we use the data you provide to communicate with you and to process your request. The legal basis is Article 6(1)b GDPR, insofar as your information is required to answer your enquiry or to initiate or execute a contract, otherwise Article 6(1)f GDPR due to our legitimate interest in your contacting us and our processing your inquiry. The data collected by us in connection with your contacting us are deleted as soon as they are no longer necessary to achieve the purpose for which they were collected.

4. Cookies

We use cookies, web beacons and similar methods when you visit our website or use our offerings. This is done particularly for the purposes outlined in the paragraphs below.

Cookies are small text files that are stored by your browser on your computer or mobile device, allowing your computer or device to be recognised, even across various websites. The cookies do not contain any personal data. Some of the cookies we use are deleted after the end of the browser session, i.e. after closing your browser (“session cookies”). Other cookies remain on your end device and enable us or our service providers to recognize your browser during your next visit (“persistent cookies”).

You can prevent the use of cookies by selecting the appropriate settings in your browser software. However, it is possible that certain areas of the website or offerings will then not function as intended.

Web beacons are small graphic files ("pixels") that may be embedded in our website and may be used to track user behaviour. Similar methods are e.g. Flash cookies, HTML5 cookies or other local (browser or device) storage methods, where - comparable to cookies - data can be stored in your browser or terminal device in order to recognise your browser or device on your next visit or during a session.

5. Google Analytics

Our website uses Google Analytics, an analytics service provided by Google Ireland Ltd, Google Building Gordon House, Barrow Street, Dublin 4, Ireland. This is done on the basis of your consent pursuant to Article 6(1)a GDPR, which you have given via the cookie banner. You can revoke your consent to the use of Google Analytics at any time at the bottom right of our website.

Google Analytics uses cookies and similar technologies to analyse and improve our website based on your user behaviour. Google will use the acquired information to evaluate your use of the website, to compile reports for the website operators on website activity and to provide other services relating to website and Internet use. The data generated in this context may be transferred by Google to a server in the United States for evaluation and stored there.

We have undertaken the following privacy settings for Google Analytics:

• IP anonymisation (shortening of the IP address before evaluation so that no conclusions can be drawn about your identity);
• automatic deletion of old logs / limitation of storage time;
• disabled advertising feature (including audience remarketing through GA Audience);
• disabled personalised ads;
• disabled measurement protocol;
• disabled cross-page tracking (Google signals);
• disabled data sharing to other Google products and services.

The following data are processed by Google Analytics:

• anonymised IP address;
• referrer URL (previously visited page);
• pages viewed (date, time, URL, title, time spent);
• downloaded files;
• clicked links to other websites;
• if applicable, achievement of specific goals (conversions);
• technical information: operating system; browser type, version and language; device type, brand, model and resolution;
• approximate location (country and city, if applicable, based on anonymised IP address);

Google Analytics places the following cookies for the specified purpose with the respective storage period:

• "_ga" for two years and "_gid" for 24 hours (both used to recognise and distinguish website visitors by a user ID);
• "_gat" for one minute (to reduce requests to Google servers);

We have concluded an order processing agreement with Google for the use of Google Analytics and standard contractual clauses in the event personal data are transferred to the United States or other third countries.

You can find more information on this in the Google Privacy Policy.

6. Google Marketing Platform and Ad Manager (DoubleClick)

Our website uses the Google Marketing Platform and the Google Ad Manager, services of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). This is done on the basis of your consent pursuant to Article 6(1)a GDPR, which you have given via the cookie banner. You can revoke your consent at any time at the bottom right on our website.

These services use cookies and similar technologies to present you with advertisements that are relevant to you. Use of the services enables Google and its partner websites to serve ads based on prior visits to our or other websites on the Internet. In this context, Google receives in particular the data about your visit to our website as described in Section 2, in particular the pages accessed or viewed in each case.

The data generated in this context may be transferred by Google to a server in the United States for evaluation and stored there. In the event personal data are transferred to the US, we have concluded standard contractual clauses with Google.

If you have not consented to the use of the Google Marketing Platform and Ad Manager, Google will only display generic advertisements that have not been selected based on the information collected about you on this website. In addition to revoking your consent, you also have the option to opt out of personalised advertising in the ad settings at Google.

The following cookies are placed by Google:

• "_gck_au" for three months.

You can find more information on this in the Google Privacy Policy.

7. Facebook

We use the "Facebook Pixel" service of Facebook Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland ("Facebook"). This is done on the basis of your consent pursuant to Article 6(1)a GDPR, which you have given via the cookie banner. You can revoke your consent at any time at the bottom right of our website.

We use Facebook Pixel to analyze the general use of our websites and to track the effectiveness of Facebook advertising ("conversion tracking"). In addition, we use Facebook Pixel to provide you individualised advertising messages based on your interest in our products ("retargeting"). This also involves target group remarketing through a "custom audience".

The "Facebook Pixel" has been integrated on our website for this purpose. This establishes a direct connection between your browser and the Facebook server. The following cookies are placed by Facebook:

• "_fbp" for three months.

When you visit our site, Facebook receives the information shown in Section 2, as well as a pixel ID and Facebook cookie data. If you are a Facebook member and have allowed Facebook to do so through your account's privacy settings, Facebook may associate the information collected about your visit to us with your member account and Facebook ID. The privacy settings of your Facebook profile can be viewed and changed at any time.

Facebook can thus select visitors to our website as a target group for the display of ads ("Facebook Ads"). Accordingly, we use Facebook Pixel to display Facebook ads placed by us only for Facebook users who have shown an interest in our online offerings or who have certain features (e.g. interests in certain topics or products that are determined on the basis of the websites visited) ("custom audiences"). With the help of Facebook Pixel, we want to ensure that our Facebook ads match the potential interest of users. Facebook Pixel allows us to further track the effectiveness of our Facebook ads by being able to trace whether users were referred to our website after clicking on a Facebook ad and downloaded the TIER app, for example (a "conversion"). The data collected are anonymous to us as the operator of this website. However, the data are stored and processed by Facebook, so that Facebook can establish a connection to the respective Facebook user profile and Facebook can also use the data for its own advertising purposes. This use of data by Facebook cannot be influenced by us as the site operator.

The data generated in this context may be transferred by Facebook to a server in the United States for evaluation and stored there. In the event personal data are transferred to the United States, we have concluded standard contractual clauses with Facebook.

You can find more information on this in the Facebook Privacy policy.

8. Google Tag Manager

We use Google Tag Manager, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). The Tag Manager is used to manage the aforementioned analytical and tracking services and other services.

Google Tag Manager places the following cookies for technical debugging purposes: "gtm"; "gtm_auth"; "gtm_debug"; "gtm_preview"; "gtm_mt".

The legal basis is Article 6(1)1f GDPR, based on our legitimate interest to integrate and manage various services on our website in a straightforward manner.

We have concluded an job processing agreement with Google. In some cases, data are processed on a Google server in the United States. In the event personal data are transferred to the US or another third country, we have concluded standard contractual clauses with Google.

You can find more information in the Google Tag Manager information.

9. Data recipients

We may use external service providers and, if necessary, also make personal data available to them in order for them to perform their activities. We use technical service providers particularly to host and operate the website. The service providers may process the personal data exclusively on our behalf and not for their own purposes and must treat the data confidentially.

If service providers process data for us outside the EU, this is done on the basis of the standard contractual clauses of the EU Commission.

10. Rights of data subject

You are entitled to the following rights as a data subject formulated in Articles 15 - 21 and 77 GDPR at any time if the legal requirements are met:

• right to revoke consent;
• right to object to the processing of your personal data (Article 21 GDPR);
• right to information about your personal data processed by us (Article 15 GDPR);
• right to rectification of your personal data stored by us incorrectly (Article 16 GDPR);
• right to erasure of your personal data (Article 17 GDPR);
• right to restrict the processing of your personal data (Article 18 GDPR);
• right to portability of your personal data (Article 20 GDPR);
• right to lodge a complaint with a supervisory authority (Article 77 GDPR).

You have the right to revoke previously issued consent to us at any time with effect for the future. The withdrawal of consent does not affect the legality of the processing carried out based on the consent until withdrawal.

Insofar as we process your data on the basis of legitimate interests, you have the right to object to the processing of your data at any time on grounds relating to your particular situation. If it is a matter of an objection to data processing for direct marketing purposes, you have a general right of objection, which we will implement even without if you do not specify any reasons.

To assert your rights, you may contact us at any time using the contact details above. In doing so, we may ask you for proof of identity, such as by submitting your request through the email address on file in your account. Consent to the use of cookies and to the use of external analytics and advertising tracking service providers can be revoked via the Consent Manager at the bottom right of our website.

Your requests for the assertion of data protection rights and our responses to them will be stored for documentation purposes for a period of up to three years and, in specific cases, even longer for the assertion, exercise or defense of legal claims. The legal basis is Article 6(1)f GDPR, based on our interest in defending against any civil claims in accordance with Article 82 GDPR, avoiding fines in accordance with Article 83 GDPR, and fulfilling our accountability obligations under Article 5(2) GDPR.

You can reach our data protection officer at dpo@tier.app or at the above postal address ("Attn: Data Protection Officer"). We expressly point out that when using the email address, the contents are not exclusively noted by our data protection officer. Therefore, if you wish to exchange confidential information, please first contact us directly via this email address.

You have the right to lodge a complaint with a data protection supervisory authority. You can reach the supervisory authority responsible for us as follows: Berlin Commissioner for Data Protection and Freedom of Information Friedrichstrasse 219 10969 Berlin Phone: +49 30 13889– 0 Fax: +49 30 2155050 E-Mail: mailbox@datenschutz-berlin.de.

11. Changes to this Data Protection Declaration

We will occasionally amend this Data Protection Declaration to ensure that it always reflects current legal requirements and actual circumstances (e.g. when new services or features are introduced). We recommend that you check this Data Protection Declaration regularly for possible changes.