1 DATA PROTECTION AT ONE GLANCE

This section gives you a brief overview about the collection, processing and use of your personal data and the use of cookies when you visit and/or interact with this Website, its content and services. The details of our practices and your rights in that regard are explored in greater detail throughout this privacy policy.

In order to provide this Website to you, we collect, process and use the following data.

Access data: With regard to each of your visits to this Website, our web-servers record technical information which your browser automatically transmits. This includes the internet protocol (IP) address used to connect your computer or mobile device to the internet, the browser type and version you use, the operating system and date and time of your access.

Personal data you provide to us: We collect information about you that you actively provide to us by using special functions of this Website, such as our contact or survey forms. These data includes your email address and/or other details which are necessary for the provision and use of the respective services. The same applies in case you subscribe to our email newsletter or in case you participate in sweepstakes, contest.

Usage Data: In addition we actively collect further information about your visit to this Website and your usage of its services and content. That information includes the full uniform resource locators (URL) clickstream to, through and from this Website (including date and time), visited sub-pages, information you searched for, response times, length of visits to certain pages, email openings and which banners or links on the website or in an email were clicked on. We use such data for a variety of purposes. For example we use this information to better understand your needs and preferences so that we can improve this Website and its functions and to provide you with more relevant and interest-based contents. .

Cookies and similar tracking technologies: We automatically collect such usage data with the help of cookies and similar technologies. We may store unique identifiers in such cookies that can be used to identify your browser on subsequent visits to this Website.

Third-Party technologies: We also allow selected third parties to use cookies or similar technologies on this website. These third parties include analytics, advertising networks and other service providers that assist us in providing, evaluating, and improving this website and our services and to provide targeted advertising based on your browsing activities and interests.

Social media networks and other platforms: We may use plugins from social media networks and other platforms on this website that may allow you to share content with these networks/platforms or use their services on our Website, e.g. Google Maps. If you use these features, these networks/platforms may use their own cookies to collect data about you.

Disclosure to third parties: We may disclose some of your information to business partners in connection with the redemption of promotional offers published on this Website, to affiliated companies who provide joint content and services (such as newsletter and customer support) or to service providers who perform certain services on our behalf, but only to the extent necessary to perform the respective services. Some of the service providers may be located in a country outside Switzerland and the EU/EEA. However, we exclusively work with companies that offer an appropriate data protection level.

2 WHO WE ARE AND WHAT WE DO

This website (“Website”) provides you with free information about current online bargains, discounts, last-minute vouchers and/or similar promotional offers ("offers").

Operator of this Website is Atolls Malaysia, Unit 8c , 8th Floor, Wisma Ypr, no. 1 Lorong Kapar, off Jalan Syed Putra, 58000 Kuala Lumpur W.P. Kuala Lumpur, Malaysia "Local Group Company"), a company of Atolls GmbH, Radlkoferstraße 2, 81373 Munich, Germany ("Atolls"). Within Atolls, CoopoNation GmbH, Radlkoferstraße 2, 81373 Munich, Germany (“CoopoNation”), is responsible for the overall strategy, restructuring, product development, marketing strategy and quality assurance for the entire group. In this function CoopoNation also decides about the purposes and means of the processing of personal data that is collected in connection with the websites of Atolls. Therefore the data which is collected via the Website will be shared with CoopoNation and CoopoNation and the Local Group Company (“we”, “us”) are joint controllers with respect to such data. The legal basis for the joint processing and transmission of personal data between CoopoNation and the Local Group Company lies in the legitimate interests of the companies’ under Art. 6 (1) clause 1 lit. f in conjunction with recital 48 of the General Data Protection Regulation, Regulation (EU) 2016/679 ("GDPR"). CoopoNation and the Local Group Company have executed a contractual arrangement, reflecting their respective roles and duties. We will provide you with the essential content of this arrangement upon request.

In order to provide a good and efficient customer service, the customer relationship with you will be primarily managed by the Local Group Company. For example, the Local Group Company answers to requests that you may submit through this Website or where otherwise necessary to handle the customer relationship with you. However you may exercise your rights under the GDPR in respect of and against each of the controllers. We have appointed a privacy team acting as the main point of contact for any data protection issues and requests by data subjects relating to personal data that is collected in connection with this website. For further information please refer to sections 12 and 13 of this privacy policy.

3 ACCESSING AND USING THE WEBSITE

3.1 Access data (Log files)

With each call of this Website our servers automatically store general access data about this process in server log files.

These data include:

• the called Website
• the IP address of the requesting system
• the type of browser and version used
• the operating system used

We do not aggregate such data with other data sources. The temporary storage of the IP address in logfiles is necessary for technical reasons and to ensure the security of our system, in particular relating to the recognition of misuse. These purposes also constitute our legitimate interest according to Art. 6 Para. 1 lit. f GDPR. We only retain such data for as long as it is necessary for the stated purposes. IP addresses will be deleted or masked after 14 days at the latest.

3.2 Other data that we may collect

In addition we collect and process information about your use of this Website and interaction with its content and services.

For this purpose we use cookies and similar technologies which contain a unique identifier, consisting of a string which enables websites to recognize devices used to access a website on each subsequent visit throughout its lifetime. These identifiers do not allow us to draw any conclusions as to your identity. For more information about the specific types of cookies and similar technologies served through this website, their purposes and your options to manage them, please refer to our Cookie policy.

The information collected may include:

• Java on / off
• Cookies on / off
• IP-address in a shortened form (last three digits of the IP address are deleted)
• Referrer-URL (i.e. the previously visited site)
• Operating system
• Date and time of the visit
• Your browsing activity (such as scroll positions, clicks and mouse movements)
• Time and duration of page interactions
• Search queries made
• Clicks on banners and links
• Other information about how you interacted with this Website

We may use and disclose such information for the following purposes:

• to provide, customize, measure and improve this Website, its content and functionalities
  
  This includes our use of the data to provide, manage and improve the technical and functional aspects of the Website, to design the Website more user-friendly as well as to optimise the selection of its contents and functionalities. This also includes internal business purposes such as troubleshooting, data analysis, testing and research.


• to process and record your redemption of promotional offers
  
  As we finance ourselves through commissions to provide our service free of charge to you, we may use information about your visit to our website, i.e. your click on of promotional offers for reporting purposes in order to bill and collect our commission from business partners.


• to provide you with personalised content
  
  We also use this information to tailor our content and promotional offers we may display on this Website or send to you to your interests. For this purpose we create pseudonymised usage profiles. These usage profiles help us to better understand your needs and preferences so that we can provide you with individual and interest-based contents and promotional offers. Pseudonymous usage profiles do not allow us to draw any conclusions as to your identity and we do not combine such profiles with data that directly identifies you (e.g. email address), unless you have explicitly allowed us to do so (e.g. as part of your newsletter subscription as explained in Section 5 of this privacy policy).


• for Advertising and (Re-)Targeting purposes
  
  We or more specifically the advertising partners referred to inclause 10.2 of this privacy policy also use this information in order to deliver targeted advertising on this Website or on websites of third parties which is based on your prior visit to this Website.

We consider these purposes as in our legitimate interest within the meaning of Art. 6 Para. 1 lit. f) GDPR. Our users expect us to provide offers to them, which reflect their current interests.

We retain this information as long as necessary and relevant for the aforementioned purposes or until you make legitimate use of your right to object to our use of such information. Pseudonymous user profiles are stored for a maximum of 24 months.

You have the right to object at any time to the display of personalised advertising by our advertising partners via the opt-out links provided under clause 10.2 of this privacy policy. In addition, you can prevent the storage of the cookies used for such purposes by adjusting the cookie settings in your browser software. For more information, please see our Cookie policy.

4 SPECIAL FUNCTIONS OF THE WEBSITE

4.1 Registration on our Website

You might have the possibility to register on our Website for a customer account by entering personal data into the registration mask. If you take this opportunity you may be asked to enter the following personal data:

• name
• surname
• email address
• password (encrypted)
• sex

In addition your IP address and the date and time of registration will also be automatically stored on our servers. The collection of this data is necessary in order to understand the (possible) misuse of an email address at a later date, and it therefore serves us to prove that our process is in line with legal requirements.

We process your data exclusively for the purpose of granting you access to your customer account.

We store the data collected during the registration process for the duration of the registration. Registered persons are able to change the personal data specified during the registration at any time in their customer account, or to have them completely deleted from our data stock. If you exercise this right we will delete the customer account and the personal data stored therein without delay. You can also exercise the right at any time by sending your request by email.

4.2 Contacting us

We collect your personal data that you voluntarily disclose to us when you contact us via e-mail or through a contact form provided on the Website for general or specific queries.

The contact form may ask for the following personal data to be entered:

• name
• email address
• message text
• further details for specific queries or reports, if applicable

In addition your IP address and the date and time of contact will also be automatically stored on our servers. The collection of this data is necessary in order to understand the (possible) misuse of the e-mail address at a later date, and it therefore serves us to prove that our process is in line with legal requirements.

Your request/enquiry will be transmitted and handled by one of our employees who is responsible for handling the topics addressed in your request/enquiry. Your data will only be used to handle your request/enquiry, e.g., to provide you with the service information you asked for, and will not be used for any other purpose, unless expressly permitted or required by applicable law.

We retain the personal data you provide to us when contacting us for the duration of the respective conversation with you, but no longer than for 6 months after the conversation is closed, unless applicable laws require longer retention periods in individual cases. The conversation will be considered as closed if the circumstances indicate that all relevant facts have been clarified or if you instruct us to delete your data. All personal data which were stored in the context of your conversation with us will be deleted immediately in this case.

4.3 Online Surveys

From time to time we may conduct online surveys by a questionnaire provided via this Website. Participation in these surveys is completely voluntary and you may choose whether or not to participate and therefore disclose information to us. When participating in a survey we may ask you to provide your name, email address, age and/or location. Surveys will be analysed by one of our employees who is responsible for the evaluation of surveys. We use the information submitted via the surveys solely for research and measurement purposes, including the measurement of the effectiveness and optimisation of our content and promotional activities.

We use the technical infrastructure and software solution of third parties for the creation, implementation and evaluation of such surveys. Currently we use the following third party services:

• Google Forms which is provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google").
• TYPEFORM S.L., Carrer Bac de Roda 163, 08018 Barcelona, Spain.

When participating in a survey, the IP address of the user, information on the time and duration of the survey as well as the information provided in the survey form by the user are transferred to these service providers. Our service providers will process the information provided via the surveys as our data processor only on our behalf and in accordance with our instructions. Our service provider in particular transfer the survey results into an exportable and structured form.

We only retain personal data for as long as it is necessary for the respective survey. Personal data will then be made anonymous or will be deleted.

4.4 WhatsApp-Alert

This website may offer you the possibility to register for free WhatsApp-alerts. If you make use of this service we will send current vouchers, discount codes and/or similar offers directly to your smartphone.

In order to subscribe to the WhatsApp-alert you must click on the button featuring the WhatsApp logo, save the phone number that appears as a contact on your mobile phone and send a message via WhatsApp saying "START". You will now start receiving messages from us.

In order to be able to offer the WhatsApp-alert we use a service, provided by the MessengerPeople GmbH, Otto-Lindenmeyerstraße 28, 86153 Augsburg. MessengerPeople provides the technical infrastructure for our WhatsApp-alerts. In order to do this MessengerPeople will collect and store your phone number, the given username and the type of device upon subscription. We only have access to your username and any messages sent by you to us.

Any data collected through this service will be stored by us and MessengerPeople for as long as your subscription is active. You can unsubscribe from our WhatsApp alert at any time by sending us a message via WhatsApp with the text "STOP". Upon the reception of such text, you will not receive any further alerts until you subscribe again. If you want any and all communication data to be deleted, please send a message with the text "DELETE ALL DATA".

For further information please refer to the privacy statement of MessengerPeople, available at:https://www.messengerpeople.com/privacy/.

4.5 DISQUS-commenting function

This Website may use the comment system of Disqus, Inc., 301 Howard Street, Suite 300, San Francisco, CA 94105, USA ("DISQUS").

Disqus offers an online public comment sharing platform where users may login and create profiles to participate in conversations with peers. By registering with DISQUS you can comment on any website that offers this function. Disqus offers various ways of registering: You can either register directly with your own DISQUS account or through your existing accounts on Facebook, Twitter or Google Plus. If you register via one of these social media networks, the respective provider may collect and process information relating to your use of the comment system. More detailed information can be found in the data privacy policies of the respective networks. DISQUS also allows you to use the commenting function as a "guest" without registration. However some functions may not be available in that case.

If you log in using your DISQUS log-in data, a connection will be made to the DISQUS server and DISQUS will be informed that you are visiting this website and using the comment function. This information may be associated with your DISQUS account and DISQUS may use such information to deliver targeted content and advertising to you. If you prefer to opt-out of this information being collected, DISQUS allows you to do so by clicking on the“opt-out” button on this website:https://disqus.com/data-sharing-settings/.

We receive the following information from DISQUS when you make a comment: the content of your comment, your name, your email address, your password (encrypted) and the IP address assigned to you by your provider at the time you make the comment. We require the comment text in order to be able to publish this. We exclusively use such information in order to be able to get in contact with you regarding any queries relating to your comments or in order to avoid abuse. Under certain circumstances it may legally be required to delete comments or exclude them from publication (e.g. insulting comments). Otherwise the comments shall remain on this Website until the commented content is deleted by its author.

For further information regarding the processing of personal data by DISQUS please refer to DISQUS Terms of Service and Privacy Policy underhttp://docs.disqus.com/help/30/andhttp://docs.disqus.com/help/29/.

5 NEWSLETTER SUBSCRIPTION

You are free to subscribe to our newsletter. Our newsletter informs you regularly about the most recent vouchers, discount codes or other online saving opportunities for various product categories such as fashion, travel and/or electronics in connection with deals published on the websites of Atolls (www.CoopoNation.com.au). You will receive these emails from us and the Local Group Company, which is responsible for handling your customer relationship on local level. Your email address will only be passed to third parties, if you have given your express consent to do so in order to receive newsletters about certain products or services of these third parties.

5.1 Data collection with the registration and Double-opt in

When subscribing to our newsletter we will ask you to enter your email address in the registration mask. Further details such as last name, first name and/or sex may be entered optionally in some cases. We will use such data solely to provide you with our newsletter.

When you subscribe to our newsletter, your IP address and the date and time of the registration will also be automatically stored on our servers. The collection of this data is necessary in order to understand the (possible) misuse of the email address of a user at a later date, and it therefore serves us to prove that our registration process is in line with legal requirements.

After you have submitted your newsletter request, we will send a confirmation email to the given email address. This confirmation email contains a link that you need to click on to confirm your subscription. This so-called double-opt-in-procedure helps us to ensure that the email-account holder has actually authorised the receipt of our newsletter.

5.2 Use of newsletter service providers

We use technical service providers which help us managing the newsletter subscriptions and providing related marketing services (“Newsletter Service Providers"). This includes service providers which may have their registered seat and servers in a state outside of the European Union e.g. in the USA. However, we exclusively work with companies that offer an appropriate data protection level in line with the stipulations of the GDPR. You can find further information relating to the sharing of data to third parties outside of the European Union underSection 11.4.

Currently we work with the following Newsletter Service Providers:

• “MailChimp", a service of Rocket Science Group, LLC, 675 Ponce De Leon Ave NE #5000, Atlanta, GA 30308, USA .
• “ExactTarget", a service of salesforce.com, Inc, The Landmark @ One Market, Suite 300, San Francisco, California 94105, USA.

Our Newsletter Service Provider will process your email addresses and other personal data as described in section 5.3 as our data processor only on our behalf and in accordance with our instructions to help us evaluate the usage of our newsletter, to personalize your newsletter communications, to compile reports on newsletter activity and to provide other statistical and analytical services relating to the usage of our newsletter. Our Newsletter Service Providers are in no way authorised to use the data of our newsletter subscribers in order to contact them themselves or to forward the data to third parties.

5.3 Newsletter-Tracking

We will track and evaluate your usage of our newsletter, such as email-opens and email-clicks, by means of a tracking technology made available by the Newsletter Service Provider. For this purpose the HTML-emails sent with our newsletter may contain web beacons (also called pixel tags, tracking pixel or GIFs), automatically embedded by our Newsletter Service Providers. A web beacon is a small graphic that contains unique identifiers that allow an analysis of the success or failure of our Newsletter campaigns. Our Service Provider records each subscribers email address, IP address, date, and time associated with each open and click in order to provide us with aggregated reports about how an email campaign performed and what actions subscribers took.

As part of your registration, we may ask for your consent to tailor the content of our newsletter to your personal interests. This is done by evaluating the data about your interactions with our newsletter and your use of this Website. That means that the pseudonymous Usage Data, we collected about you in the past and we will collect in the future will be attributed to your email address. This single record helps us to understand your needs and preferences even better so that we can adjust the contents of the newsletter optimally to your personal interests and to provide you with relevant content. We only combine your data as described and provide you with personalized content, if we have your express consent to do so.

The wording of your consent declaration given when subscribing for our newsletter can be viewed at the bottom of this Privacy Policy.

5.4 Retention period and right to object

We will retain your personal data for the stated purposes as long as your subscription to our newsletter is active. You may cancel your newsletter subscription and withdraw your consent in that regard at any time either via the link provided at the bottom of each newsletter or by sending an email to: privacy.au@joingsg.com.

If you merely would like to opt-out of the newsletter tracking you may configure your email program in a way that emails are presented in text form instead of HTML format. This way the web beacons will not be able to work. You can also configure your browser settings in a way that no cookies are stored on your computer. Web beacons typically only work in conjunction with cookies. However, in these cases the newsletter will not be displayed to you in full and you may not be able to use all functions.

6 SWEEPSTAKES, CONTESTS etc

From time to time you may have the opportunity to participate in sweepstakes, contests, raffles or similar promotional activities (“Promotional Activities”) through this Website. We typically ask you for certain personal data in order for you to participate in such Promotional Activities, such as your name, surname, age, address, phone number, social media account, consumer behaviour and/or email address. We collect this information solely to administer the respective Promotional Activity (e.g. to verify your eligibility, to determine the winner and to present the award and/or to publish the winner´s name on this Website), unless you have given your explicit consent to use such data for specified other purposes. All Promotional Activities conducted via this Website are subject to the terms and conditions of each individual Promotional Activity. Such terms and conditions may provide additional information related to the processing of your personal data. Unless expressly otherwise specified, personal data collected by us in respect of Promotional Activities will not be stored any longer than is required to fulfill the purpose of the respective Promotional Activity.

7 INFORMATION FROM BUSINESS PARTNERS

7.1 Information in relation to our commission

As we finance ourselves through commissions, we may receive information from our business partners (e.g. merchants) about your online purchases, which you may place on websites of third parties (e.g. online-shops) after a visit to this Website. Such information is transmitted to us automatically with the help of tracking cookies. We never receive information that can directly identify you but merely commission related information such as the value of your purchase and date and time of the transaction. We also work with several so-called affiliate networks (“Affiliate Networks”), which connect us with merchants and take over the technical and billing process. In these cases we receive the respective information from such Affiliate Networks. We solely use this information for billing purposes.

7.2 Personalized Coupons

Under certain circumstances our business partners offer you the possibility to redeem vouchers for goods or services offered on their website. If you have created a shopping basket but have not checked-out yet, and subsequently call this Website, some business partners may share information regarding your open shopping basket (for example purchase value and product category). For this purpose we and our respective business partners use a technology (DoubleClick for Publishers) provided by Google Inc. This technology enables us to tailor and display vouchers on this website based on the content of your shopping basket. This form of advertising is carried out completely automatically and does not allow us to draw any conclusions about your identity. We can merely stipulate general criteria of the segmentation, such as product categories, on the basis of which certain vouchers are issued. For detailed information on Google DoubleClick for Publishers and how to prevent the processing of your data by Google, please see Section 10.2.

8 COOKIES

When you first visit this Website, we will inform you about the use of cookies and similar technologies served through this website and ask for your consent to the use of such cookies. The wording of the Cookie Consent declaration can be viewed at the bottom of this Privacy Policy. You can also change your cookie preferences at any time with effect for the future.

The specific types of cookies served through this website, their purposes and your options to manage them are described in further detail in our Cookie policy.

9 INTEGRATION OF SOCIAL NETWORKS AND OTHER PLUGINS

We may implement so called plug-ins (“Plugins”) from social networks ( “Social Networks”) and other platforms ( “Platforms”) on certain webpages of this Website such as “Share” or “Like” buttons, video player or interactive maps. We use such Plugins in order to give you the possibility to share or recommend interesting offers in Social Networks, to use interactive maps on our Website or to watch videos and to promote our services. We consider these purposes as in our legitimate interest within the meaning of Art. 6 Para. 1 lit. f) GDPR.

You may find the following Plugins on this Website:

• Plugins of the social network facebook.com which is operated by Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA ("Facebook")
• Plugins of the social network instagram.com which is operated by Instagram LLC., 1601 Willow Road, Menlo Park, CA, 94025, USA ("Instagram")
• Plugins of Google+ and Google Maps which are operated by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google")
• Plugins of the video platform YouTube which is operated by YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, USA, - belongs to Google Inc. - ("YouTube")
• Plugins of Twitter which is operated by Twitter Inc., 1355 Market St, Suite 900, San Francisco, CA 94103, USA ("Twitter")

The Plugins can be clearly identified as they feature the logo of the associated Social Network/Platform (e.g. white "f" on blue background for Facebook).

The integration of Plugins enables the respective Social Network or Platform to collect data about you as you access a website that contains the respective Plugin. Your browser will establish a direct connection to the servers of the respective Social Network/Platform. We have no influence on the extent of the data collected by these Social Networks/Platforms via the Plugins. If you visit a website that contains a Plugin while you are logged in with the corresponding Social Network/Platform, the provider of such Social Network/Platform will be able to correlate your account data with information about your visit to the respective website (including your IP address). This information is transmitted directly to the servers of the respective providers. In addition information you intended to share with Social Networks will be published and shown to your contacts on these Social Networks. For further information, please refer to the privacy policy of the respective Social Networks and Platforms.

Data protection policy of Facebook:http://www.facebook.com/policy.php

Data protection policy of Instagram:https://help.instagram.com/155833707900388/

Data privacy notices of Google:https://policies.google.com/privacy?hl=en&gl=ZZ

Data privacy notices of YouTube:https://policies.google.com/privacy?hl=en&gl=ZZ

Data protection policy of Twitter:https://twitter.com/en/privacy

To prevent the Plugins on our Website to collect your data, please change your Cookie policy.

10 USE OF THIRD PARTY TOOLS

We allow certain third parties to use cookies or similar technologies on this Website. These third parties include analytics, advertising networks and other service providers that assist us in providing, evaluating, and improving this Website and our services and to provide targeted advertising based on your browsing activities and interests.

These third parties may use cookies or similar technologies and collect data about your use of this Website and your interaction with its content and functions, including the total number of visitors to this Website, the websites our visitors have come from, the pages you visit, date, time and duration of your visit, frequency, clicked banners/links as well as information about type of device, browser version, language settings and geographic location (including country, city, region). They may also collect online-identifiers (e.g. User-ID) and/or IP-addresses. We do not have access to these cookies or to any personal identifiable data collected with these cookies that allow us to identify single users. We may however use information arising from such cookies provided by these third parties. All data collected is made available to us only anonymously and in statistical form.

Some of the service providers are based in a country outside the EU/EEA. However, we exclusively work with companies that offer an appropriate data protection level in line with the stipulations of the GDPR. For more information please see Section 11.4

Below we will give you an overview and description of third party provider technologies we may use for this Website.

10.1 Web analytics and A/B Testing tools

We have implemented all analytic tools with activated IP anonymization, so that the last three digits of the IP address are deleted directly after the data collection and only a portion of your IP address may be used and stored on the servers of the respective service providers.

10.1.1 Google Analytics

Google Analytics is a web analytics service provided by Google Inc., Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google") who reports on user interactions on this website.

The information collected by Google Analytics (including the anonymized IP address) will be transmitted to and stored by Google on servers in the United States. According to Google only in exceptional cases the full IP address may be transmitted directly to a Google server in the USA and encrypted there. Any user-identifiers (e.g. Cookie-ID) stored by Google Analytics will automatically be deleted from Google's´ servers after 14 months.

For further information please refer to Googles Analytics security and privacy principles:https://support.google.com/analytics/answer/6004245?hl=en.

Opt-Out: You can prevent the processing of your data by Google Analytics by installing the Google Analytics opt-out browser add-on available underhttps://tools.google.com/dlpage/gaoptout. The browser add-on is available for most modern browsers.

10.1.2 Parse.ly

Parse.ly is a web analysis service of Parsely, Inc., 33 East 33rd Street, 10th Floor, New York, NY 10016, USA ("Parse.ly").

The information generated by Parse.ly about your use of this Website (including the anonymized IP address) will be transmitted to and stored by Parse.ly on servers in the United States.

For further information please refer to the privacy policy of Parse.ly:https://www.parse.ly/privacy-policy/.

Opt-Out:http://srv.config.parsely.com/optout.

10.1.3 Xiti

Xiti is a web analysis service of Applied Technologies Internet S.A., 85 avenue Président JF Kennedy 33700 MERIGNAC France ("SA Internet").

All data collected by SA Internet on this Website (including the anonymized IP address) will be stored and processed on servers in France.

Opt-Out::http://www.xiti.com/en/optout.aspx

10.1.4 Pingdom

Pingdom is a monitoring service of Pingdom AB, Kopparbergsvägen 8, 722 13, Västerås, Sweden. With the help of this service we can analyse the loading behaviour and the availability of this Website, depending on the access location, browser and device type in order to optimise the access times.

All data collected by Pingdom on this Website (including the anonymized IP address) will be stored and processed on serves of Pingdom.

For further information please refer to the privacy policy of Pingdom:https://www.pingdom.com/legal/privacy-policy/.

10.1.5 Convert

Convert is an A/B-testing software of Convert Insights, Inc., 340 South Lmon Avenue 9512 Walnut, California 91789, USA ("Convert"). The software allows us to compare two versions of a Website in order to determine which version achieves a better performance. For this purpose the users of this Website may sometimes be divided equally into two groups. The one group is shown the initial version, whereas the other is shown the new version that is to be tested. Then it is analysed which version works best.

For further information please refer to the privacy policy of Convert:https://www.convert.com/privacy-policy/.

Opt-Out:https://www.convert.com/opt-out/

10.1.6 Google Optimize

Google Optimize is an A/B-testing software of Google Inc. 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States ("Google"). The software allows us to compare two versions of a Website in order to determine which version achieves a better performance. For this purpose the users of this Website may sometimes be divided equally into two groups. The one group is shown the initial version, whereas the other is shown the new version that is to be tested. Then it is analysed which version works best.

For further information please refer to the privacy policy of Google:https://policies.google.com/privacy?hl=en.

Opt-Out: You can prevent the processing of your data by Google Optimize by installing the Google Analytics opt-out browser add-on available underhttps://tools.google.com/dlpage/gaoptout?hl=en-GB. The browser add-on is available for most modern browsers.

10.1.7 Hotjar

Hotjar is a session recording and heat mapping service provided by Hotjar Ltd, Level 2, St Julians Business Centre, 3, Elia Zammit Street, St Julians STJ 1000, Malta.

For further information please refer to the privacy policy of Hotjar:https://www.hotjar.com/privacy.

Opt-Out:https://www.hotjar.com/opt-out.

10.2 Advertising tools

We use third-party advertising technologies on this Website to provide you with personalized content that we believe may be of interest to you. Such third party providers may use cookies to perform these services.

You have the option to opt-out from targeted advertising provided by the third parties we work with through the designated links provided below. When you opt-out, the respective third party providers will stop serving you targeted advertising based on the data collected via your browser, but may continue to collect and use information for other purposes. The use of cookies and the related collection of information by third party providers is beyond our control. The third party provider may combine data they collect about your use of this Website with personal data they may otherwise collect or have access to.

For detailed information about what information is collected via the third-party advertising tools, how it is used and shared, please refer to their respective privacy policies, which are linked below.

10.2.1 Google

We use marketing and remarketing-functions of Google Inc. 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States ("Google") on the Website. These functions allow us to display relevant content based on what pages you have visited on this Website and other websites.

The information collected by Google about your use of this Website (including your IP address) will be transmitted to and stored by Google on servers in the United States.

For further information about Google's handling of your data please refer to their privacy policy:https://policies.google.com/privacy.

(A) Google Adwords Conversion Tracking

As part of our Google AdWords' conversion tracking, Google places a cookie on your computer ("Conversion cookie") when you click on our ads placed in Google Search or on selected Google Display Network sites. This allows Google and us to determine the total number of users who clicked on our Google ads and later visited this Website. Google only makes data collected about you available to us anonymously and in statistical form, so we cannot draw any conclusions about your identity from such data. The information is used to generate conversion statistics and to optimize our ads on Google. Conversion cookies are not used by Google for personalized ad targeting and persist for a limited time only.

(B) Google Dynamic-Remarketing

In addition we use Google's remarketing technology which helps us to address our users also on other websites (within the Google Display Network) specifically with targeted advertising, which is based on their prior visits to this Website.

(C) Google Adsense

We use Google AdSense Advertising on our website, in order to serve ads to our users based on previous visits to our site and other sites on the Internet. The ads served will be targeted based on your previous browsing history.

(D) Google DoubleClick for Publishers

We use DoubleClick for Publishers on this Website for our Personalized Coupons (please see section 7.1). Google DoubleClick enables us and the respective retailers to provide you with vouchers based on the content of your shopping basket on the retailers website. If you have created a shopping basket but have not checked-out yet, and subsequently call this Website, information regarding your open shopping basket will be shared with Google (for example purchase value and product category). We can then offer you suitable vouchers. This service is carried out completely automatically. We do not get access to any personal identifiable information, but can only define general criteria of segmentation (such as purchase value, product category) on the basis of which certain vouchers are issued to our users.

If you have a Google Account, you may disable ad personalization through Google’s advertising settings:https://myaccount.google.com/intro/privacy#ads. You need to be signed in to Google services to do so and the settings only apply while you are signed in. Alternatively you can also disable ads personalization by installing the browser plugin available under this link:https://www.google.com/settings/ads/plugin?hl=enor by using the browser tool provided on the site of Digital Advertising Alliance:http://optout.aboutads.info/?c=2#!/.

In addition you may at any time opt-out of cookies used by Google for such purposes by changing your browser settings. For more information regarding cookies and how you can control your cookie settings please read our Cookie policy.

10.3 Facebook

We use pixels on this Website, which are provided by Facebook Ireland Ltd, 4 Grand Canal Square, Dublin 2, Ireland (“Facebook Ltd”).

(A) Custom Audiences from Website (USER-DEFINED TARGET GROUP)
With the help of these pixels, Facebook Ltd. is able to determine a target group for the display of ads for this Website within the social network ("Re-Targeting"). Accordingly, we use these pixels to address our users with targeted advertising based on their prior visits to this Website while they are logged in to Facebook.

(B) Conversion Tracking
The pixel also helps us to measure and evaluate the effectiveness of our Facebook ads for statistical and market research purposes. For example, with the help of the pixels Facebook may determine how many users clicked on an ad placed on our behalf and were subsequently redirected to this Website.

(C) Facebook Impressions
In addition we receive a report from Facebook with information about user interactions with our ads placed on Facebook (e.g. number of "views", "likes" or "comments").

Any data collected by Facebook Ltd. is transmitted directly to one of their servers and stored there. If you are logged in to Facebook or log in to Facebook after visiting this Website, Facebook Ltd. may correlate your visit to this Website directly with your Facebook profile and use this data for its own advertising purposes. If you visit other websites that also use Facebook Pixel, this information may also be linked to your Facebook profile.

For detailed information about what information Facebook collects and how it is used and shared, please refer to Facebook’s data policy:https://www.facebook.com/policy.php.

If you have a Facebook account, you may disable personalized advertising from Facebook through the advertising settings in your Facebook account:https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen. You must be signed in to your Facebook account to do so. Alternatively, you may disable personalized advertising from Facebook following the instructions on the website of the European Interactive Digital Advertising Alliancehttp://www.youronlinechoices.com/uk/your-ad-choices.

In addition you may at any time opt-out of cookies used by Facebook for such purposes by changing your browser settings. For more information regarding cookies and how you can control your cookie settings please read our Cookie policy.

11 DISCLOSURE OF YOUR PERSONAL DATA

We only disclose your personal data to third parties, if this is necessary for the purpose of providing this Website and services, we are obligated or entitled here to by contract or law or you have granted your explicit consent.

11.1 Business partners

When you click on a promotional offer we may assign a unique identifier to this click (“Clickout-ID”), and provide this Clickout-ID to the respective business partner, on whose behalf the promotional offer is displayed. If you subsequently register or purchase something on the website of our business partner (e.g. in an online-shop), our business partner will be able to identify you as having come from our Website and we will earn our commission. We also work with several Affiliate Networks, which connect us with merchants and offer to take over the technical and billing process. In these cases we pass on the Clickout-ID to such Affiliate Networks. These Affiliate Networks may set their own tracking cookies when you visit our Website and click on an offer (e.g. on a voucher).

11.2 Local group company

In order to provide a good and efficient customer service, the customer relationship with you will be managed directly at local level by the Local Group Company. For example, the Local Group Company answers to requests that you may submit through this Website or where otherwise necessary to handle the customer relationship with you. It also helps us managing the Newsletter and its content. For these purposes, the Local Group Company may get access to your personal data controlled by us and may process personal data by itself.

11.3 Service providers

We also work with technical service providers, who may have access to your personal data, but only to the extent necessary to perform their respective services. For instance we engage technical service providers to manage our Newsletter or to host or surveys. These service providers may not disclose your personal data to third parties or use these for any other purposes than instructed.

We use Amazon Web Services (“AWS”) for hosting this website. AWS is a service of Amazon Web Service Inc, P.O. Box 81226 Seattle, WA 98108-1226, USA (“Amazon”). The data is stored exclusively in a German data center (Frankfurt am Main), which is certified according to ISO 27001, 27017 and 2018 as well as PCI DSS Level 1. All data stored by us on Amazon’s system is under our sole control and is automatically encrypted. Amazon is not allowed to access or use our data for any purpose whatsoever. For more information on AWS and data protection, please visit https://aws.amazon.com/privacy/.

11.4 Data transfer outside of the EU

Some of these service providers are based in a country outside the EU/EEA. However, we exclusively work with companies that offer an appropriate data protection level in line with the stipulations of the GDPR. We also have appropriate agreements in place to ensure that the service providers will take all necessary measures to protect your personal data in accordance with applicable requirements.

The data transmission to service providers in the USA is carried out on the basis of the so-called “EU-US Privacy Shield” or on so-called “standard contractual clauses” of the EU-Commission. The EU-US Privacy-Shield is an agreement between the European Union and the USA that guarantees the compliance with European data protection standards in the USA. The standard contract clauses of the EU-Commission concerns a contract, in which the service provider is obligated to protect personal data, in line with the contractual regulations to process these at our order and in particular not to forward these to third parties. A free copy of the standard contract clauses will be provided to you upon request. For this purpose please contact us and send a stamped envelope for a reply to the address stated under Section 13.

12 YOUR RIGHTS

In respect to our processing of personal data related to you, you are entitled to the following rights free of charge.

12.1 Right to withdraw consent pursuant to art. 7 GDPR

If you have given us your consent to process your data but change your mind later, you have the right to withdraw your consent at any time by sending an email or written letter to our contact address as stated below. We will stop processing your data accordingly.

12.2 Right of access pursuant to Art. 15 GDPR

You have the right to obtain confirmation from us as to whether or not any personal data concerning your person is being processed by Atolls Malaysia and, if this is the case, you shall have the right to access your information pursuant to Art. 15 GDPR. However with regard to pseudonymised usage profiles created by us we are not able to allocate these to individual persons. Accordingly, we cannot provide any information relating to these data, unless you provide us with information, which enables us to allocate such data to your person. We will point this out to you in case of an inquiry.

12.3 Right to rectification pursuant to Art. 16

You have the right to request us to rectify any inaccurate or incomplete personal data we hold about you.

12.4 Right to erasure pursuant to Art. 17 GDPR

You have the right to obtain the erasure of your personal data we hold about you, if we do not have a legal reason to continue to process and hold it.

12.5 Right to restrict processing pursuant to Art. 18 GDPR

You have the right to ask us to restrict how we process your data subject to Art. 18 GDPR. In this case we will be permitted to store the data but not further process it.

12.6 Right to data portability pursuant to Art. 20 GDPR

You are entitled to receive personal data that you have provided to us with your consent in a structured, commonly used and machine-readable format or – if technically feasible – to demand that we transfer those data to a third party.

12.7 Right to object to data processing pursuant to Art. 21 GDPR

Under the requirements of Art. 21 GDPR you have the right to object to the processing of your personal data at any time on grounds relating to your particular situation (e.g. a possible risk to life or health). The aforementioned general right to object applies to all processing purposes described in this privacy policy, which are based on the legal basis of legitimate interest. In the event you make legitimate use of such right, we will no longer process your personal data, unless we demonstrate compelling legitimate grounds for the processing, which override your interests, rights and freedoms or for the establishment, exercise or defense of legal claims.

As far as your personal data is processed for direct marketing purposes you may object to this at any time without giving reasons. In order to object to the display of personalised advertising by our advertising partners, please use the opt-out links provided underclause 10.2 of this privacy policy. In addition, you can prevent the storage of the cookies used for such purposes by adjusting the cookie settings in your browser software. For more information, please see our Cookie policy.

12.8 Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with the competent supervisory authority if you feel that the processing of your data is carried out by us by breaching applicable law.

13 CONTACT DATA AND PROTECTION OFFICER

If you have questions relating to this privacy statement, if you wish to exercise any of your rights or if you have any other concerns regarding the processing of your personal data by us, please contact us by email at info@cooponation.com and provide the details of the request that you are making, for example by specifying personal data you want access to.

14 CHANGES TO THIS PRIVACY POLICY

We may change this privacy policy at any time with effect for the future. The then current version of this policy will be made available on the Website. While we do not intend to make changes to this policy very often, please always check our most current policy. The most recent version date is located at the bottom of this policy.