Privacy Notice for Phone and Video Conferences via Teams

We, Carrera Toys GmbH (Carrera“we”),
use the online platform Teams
(“Teams”) for interactive communication
. In the following provisions,
we inform
you about the nature, scope, and purposes of the collection and use of
your
personal data in connection with
the use of Teams. Personal data refers to any
information relating to an identified or identifiable
natural person. This includes, in particular, your name and your
email address.

Teams is a service provided by Microsoft Corporation, One
Microsoft Way, Redmond, WA 98052-6399, which is headquartered in the United States
(“Microsoft”). Further information from Microsoft regarding data protection for Teams
can be foundhere.

. A detailed report dated November 15.The 2025 statement by
the Hessian Commissioner for Data Protection and Freedom of Information regarding
the use
of Microsoft 365, along with additional information on data protection, can be foundhere.

1. Data
Controller
and

Data Protection Officer
The data controller
within the meaning of data protection law is

CarreraToysGmbH, Renn
bahn Allee
15, 41
2 Puch/Salzburg
,

Austria. Management

: Stefan Krings, Manuel Blehle
. Tel.: +43 662 88921-0
Email: shop@carrera-revell.com

Carrera You can contact the data protection officer at Carrera

krupna LEGAL
Tel.: +49 (0)40 – 319 769 27
https://www.krupna.legal/
Email:office@krupna.legal

2. Microsoft’s Responsibility:

If you
visit Microsoft’s website to use Teams
, Microsoft is responsible for data processing.
However, visiting the website is only necessary to
download the software
required to use Teams. You can also use Teams by

entering the relevant meeting ID and, if necessary, other meeting access credentials
directly in the Teams app. If you do not wish to use the Teams app,
the basic functions are
also available via a browser version.

To the extent that Microsoft

processes personal data in connection with its own legitimate
business operations, Microsoft is
the independent
data controller for this processing.
For more information on
data protection at Microsoft, please visithere.

3. Purpose of Processing and Types of Personal Data

We use Teams
to

conduct telephone conferences and/or video conferences,
particularly in connection
with online seminars for prospective clients and professional audiences and/or
employment relationships (“online meetings”).

When
using Teams, we process various types of personal data.
The nature and scope of the data depend, in particular, on the information you
provide before
or during your participation in an online meeting.
However, in
order
for us to identify you as
an authorized
participant, you must at least
provide your
name. You can
disable the video or microphone functions at any time via the
Teams application. With regard to the personal data
processed in
connection with Teams, we refer specifically to theinformation provided by Microsoftand, in addition,to thereportby the Hessian Commissioner for Data Protection and Freedom of Information on
the use of Microsoft 365.

4. Data
Processing Carrera and Legal Basis:

To the extent that we process personal data of employees,
the legal basis
for such data processing is generally Article 6(1)(b) of the GDPR
. If special categories of personal
data are involved, the processing is governed by Article 9(2)(b) of the GDPR.


However
, if personal
data collected in connection with the use of Teams

is not
necessary for the establishment, performance, or termination of
the employment relationship,
the legal basis for data processing is generally Article 6(1
)(
f) of the GDPR.
In these cases, our interest lies
in the effective conduct of online meetings. Furthermore,
the legal basis for data processing when conducting online
meetings is

Article 6(1)(b) of the GDPR, provided that the meetings
are held within the framework of
contractual relationships. In specific cases (z.B. such as the recording of online meetings) where
you are asked to provide your consent in advance,
the legal basis is
Article 6(1)(a) of the GDPR.

4. Data
Processing Carrera and Legal Basis:

To the extent that we process personal data of employees,
the legal basis
for such data processing is generally Article 6(1)(b) of the GDPR
. If special categories of personal
data are involved, the processing is governed by Article 9(2)(b) of the GDPR.


However
, if personal
data collected in connection with the use of Teams

is not
necessary for the establishment, performance, or termination of
the employment relationship,
the legal basis for data processing is generally Article 6(1
)(
f) of the GDPR.
In these cases, our interest lies
in the effective conduct of online meetings. Furthermore,
the legal basis for data processing when conducting online
meetings is

Article 6(1)(b) of the GDPR, provided that the meetings
are conducted within the framework of
contractual relationships. In specific cases (z.B. such as the recording of online meetings) where
you are asked to provide your consent in advance,
the legal basis is
Article 6(1)(a) of the GDPR.

5. Data

Transfer:
Your personal data will only be transferred to third parties or other recipients
if there is legal authorization to do so or if
you have given
your prior consent
. Where necessary, we havez.B.

entered into data processing agreements with the recipients of your data, suchz.B.
as Microsoft, in accordance with Article 28
of the GDPR. We disclose your data to government agencies only to the extent
required by
law or pursuant to an official order or
court decision.

For further information, please refer toMicrosoft’s privacy policy.

5. Data

Transfer:
Your personal data will only be transferred to third parties or other recipients
if there is legal authorization to do so or if
you have given
your prior consent
. Where necessary, we havez.B.

entered into data processing agreements with the recipients of your data, suchz.B.
as Microsoft, in accordance with Article 28
of the GDPR. We disclose your data to government agencies only to the extent
required by
law or pursuant to an official order or
court decision.

For further information, please refer toMicrosoft’s privacy policy.

6. Data
transfer
to countries outside the

EU: Teams is a service
provided by a vendor based in the
United States. This
means that personal data is also processed
in a third country. We have
entered into a
data processing agreement with Microsoft
in accordance with Article 28 of the GDPR.
An adequate level of data protection is generally
ensured through the adoption of the so-called
EU Standard Contractual Clauses. In addition
U.S. ,Microsoft is
an active
participant in the EU U.S. Data Privacy Framework, which
ensures the secure
transfer of personal data to the United States. Further
information can be found here:https://www.dataprivacyframework.gov/list.

Information on
how Microsoft
handles requests from law enforcement agencies and other
government authorities can be found inMicrosoft’s Law Enforcement Requests Report.

7. Period for Which Personal Data Is Stored/Criteria for
Determining the Duration

Carrera
: Your personal data will be Carrera
stored for Carrera
as long as
necessary for the aforementioned processing purposes
, provided that, in the event of an objection, there

Carreraare no compelling legitimate
grounds to Carrerathe contrary,
Carreraor, in the event of a withdrawal of consent
, there is no other
legal basis for data processing. In certain cases,z.B.

however,z.B.
where a statutory retention obligation applies, your personal
data will
not be
deleted immediately but will first be blocked.


You can find Microsoft’s statement on the storage of personal
datahere.

8. Your Rights

: Within the framework of legal requirements
Carrera

  • , you Carreragenerally have
    Carrerathe right to

    • obtain confirmation as to whether
      personal data concerning you
      Carrerais being processed by Carrera
    • [company name],
    • to receive information about this data
      and the circumstances of the processing,
    • rectification if such
      data is inaccurate,
    • erasure if

      there is no justification for the
      processing and no obligation to retain the data (any longer)
      ,
    • restriction of
      processing in specific cases prescribed by law,
    • objection in the event
      of data processing based on Article 6(1)(f) of the GDPR; and
    • the right to have your
      personal data—to the extent you have provided it—transferred
      to you or
      to a
      third party in a structured, commonly used, and machine-readable format.

    To the extent that the processing of your
    personal data is based on your consent, you have the right
    to withdraw your
    consent at any time, with the result that the processing
    of your personal data will no longer be permitted going forward.

    However, this does

    not affect the
    lawfulness of the
    processing carried out on the basis of your consent prior to its withdrawal
    .

    Please submit your specific request
    in writing or by email, clearly identifying
    yourself,
    to:

    CarreraToys GmbH
    Rennbahn Allee 1
    5 412 Puch/Salzburg

    Austria Managing Directors: Stefan
    Krings, Manuel Blehle Phone

    : +43 662
    8892
    1-0 Email

    :shop@carrera-revell.com

    Finally, we would like to
    inform you of
    your right to file a complaint with the supervisory authority.

9. No Automated Individual Decision-Making

: We do not use your personal data
for automated individual decision-making.

9. Changes to
the Privacy

Policy: New legal requirements, business
decisions, or technological developments may require
changes to our privacy policy.
You can always find the most
current version on our website.