Privacy Notice for Phone and Video Conferences via Teams

We, Carrera Toys GmbH (Carrera“we”),
use the online platform Teams
(“Teams”) for interactive communication. In the following provisions,
we informyou about the nature, scope, and purposes of the collection and use
of your personal data in connection with
the use of Teams. Personal data is
any information relating to an identified or identifiable
natural person. This includes,in particular, your name and
your email address.

Teams is a service provided by Microsoft Corporation, One
Microsoft Way, Redmond, WA 98052-6399, which is headquartered in the United States
(“Microsoft”). Further information from Microsoft regarding data protection in Teams
can be foundhere.

. A detailed report dated November 15, 2025,
from the Hessian Commissioner for Data Protection and Freedom of Information on
the useof Microsoft 365, containing additional information on data protection, can be foundhere. .

1. Data
Controller and

Data Protection Officer The data controller
within the meaning of data protection law is

CarreraToys GmbH,
Rennbahn Allee
15, 412 Puch /

Salzburg, Austria. Management: Stefan Krings, Manuel Blehle. Tel
.: +43 662 88921-0 Email
: shop@carrera-revell.com

CarreraYou can contact the Data Protection Officer at

krupna LEGAL Tel
.: +49 (0)40 – 319 769 27
https://www.krupna.legal/
Email:office@krupna.legal

2. Microsoft’s Responsibility: If

you
visit Microsoft’s website to use Teams, Microsoft is responsible for data processing.
However, visiting the website is only necessary to
download the softwarerequired to use Teams. You can also use Teams by

entering the relevant meeting ID and, if necessary, other meeting access credentialsdirectly in the Teams app. If you do not wish to use the Teams app,
the basic functions are also available via a browser version.

To the extent that
Microsoft
processes personal data in connection with its ownlegitimate business operations, Microsoft is
the independent data controller for this processing.
For more informationon data protection at Microsoft, please visithere.

3. Purpose of Processing and Types of Personal Data

We use Teams
to

conduct telephone conferences and/or video conferences,particularly in connectionwith online seminars for prospective clients and professional groupsand/or employment relationships (“online meetings”).

When
using Teams, we process various types of personal data.
The nature and scope of the data depend, in particular, on the information you
provide before or during your participation in an online meeting.
However, in order for us to identify you as an authorized participant , you must at least
provide your name. You can
disable the video or microphone functions at any time viathe Teams application. With regard to the personal data
processed in connection with Teams, we refer specifically to theinformation provided by Microsoftand, in addition,to the reportby the Hessian Commissioner for Data Protection and Freedom of Information
on the use of Microsoft 365.

4. Data Processing
Carrera and Legal Basis

: To the extent that we process personal data of employees,
the legal basis
for such data processing is generally Article 6(1)(b) of the GDPR. If special categories of personal
data are involved, the processing is governed by Article 9(2)(b) of the GDPR.


However
, if, in connection with the use of Teams, personal datais notnecessary for the establishment, performance, or terminationof the employment relationship,
the legal basis for data processing is generally Article 6(1)(f) ofthe GDPR.
In these cases, our interestlies in the effective conduct of online meetings. Furthermore,
the legal basis for data processing when conducting
online meetings isArticle 6(1)(b) of the GDPR, provided that the meetings
are conducted within the frameworkof contractual relationships. In specific cases (z.B. such as the recording of online meetings)
where you are asked to provide your consent in advance,
the legal basis isArticle 6(1)(a) of the GDPR.

4. Data Processing
Carrera and Legal Basis

: To the extent that we process personal data of employees,
the legal basis
for such data processing is generally Article 6(1)(b) of the GDPR. If special categories of personal
data are involved, the processing is governed by Article 9(2)(b) of the GDPR.


However
, if, in connection with the use of Teams, personal datais notnecessary for the establishment, performance, or terminationof the employment relationship,
the legal basis for data processing is generally Article 6(1)(f) ofthe GDPR.
In these cases, our interestlies in the effective conduct of online meetings. Furthermore,
the legal basis for data processing when conducting
online meetings isArticle 6(1)(b) of the GDPR, provided that the meetings
are conducted within the frameworkof contractual relationships. In specific cases (z.B. such as the recording of online meetings)
where you are asked to provide your consent in advance,
the legal basis isArticle 6(1)(a) of the GDPR.

5. Data

Transfer
: Your personal data will only be transferred to third parties or other recipients
if there is legal authorization to do so or ifyou have given your prior consent
. Where necessary, we havez.B.

entered into data processing agreements with the recipients of your data, such. as Microsoft, in accordance with Article 28 of the GDPR . We disclose your data to government agencies only to the extent
required by law or pursuant to an official order
or court decision.

For furtherinformation, please refer to Microsoft’s privacy policy.

5. Data

Transfer
: Your personal data will only be transferred to third parties or other recipients
if there is legal authorization to do so or ifyou have given your prior consent
. Where necessary, we havez.B.

entered into data processing agreements with the recipients of your data, such. as Microsoft, in accordance with Article 28 of the GDPR . We disclose your data to government agencies only to the extent
required by law or pursuant to an official order
or court decision.

For furtherinformation, please refer to Microsoft’s privacy policy.

6. Data transfer to
countries outside the

EU: Teams is a service
provided by a vendor based in theUnited States.This
means that personal data is also processedin a third country. We have
entered into a data processing agreement with Microsoftin accordance with Article 28 of the GDPR.
An adequate level of data protection is generally
ensured through the adoption of the so-called EU Standard Contractual Clauses. In addition
U.S. , Microsoft isan active participant in the EU Data. Privacy Framework, which
ensures thesecure transfer of personal data to the United States.
For more information, click here: https://www.dataprivacyframework.gov/list.

Information
on how Microsoft
handles requests from law enforcement agencies andother government authorities can be found inMicrosoft’s Law Enforcement Requests Report.

7. Duration for Which Personal Data Is Stored/Criteria for
Determining the Duration

: Your personal data will be Carrera
stored for as long as is
necessary for the aforementionedprocessing purposes , provided that, in the event of an objection,
Carrera there are no compelling legitimate groundsto the contrary, or, in the event of a withdrawal of consent
, there is noother legal basis for data processing. In certain cases,z.B.

however,.where a statutory retention obligation applies, your personal data willnot bedeleted immediately but will first be blocked.


You can find Microsoft’s statement on the storage of personal datahere.

8. Your Rights

: Within the framework of legal requirements
, you Carrera generally have the right

  • to obtain confirmation as to whether
    personal data concerning you Carrera is being processed by [company
  • name],to receive information about this data
    and the circumstances of its processing,
  • rectification if such
    data is inaccurate,
  • erasure if

    there is no (longer) any justification forthe processing or any obligation to retain it,
  • restriction
    of processing in specific cases prescribed by law,
  • objection in the event
    of data processing based on Article 6(1)(f) of the GDPR;
  • and the transferof
    your personal data—to the extent you have provided it—to you or
    a third party in a structured, commonly used, and machine-readable format. 

To the extent that the processing
of your personal data is based on your consent, you have the right
to withdraw your consent at any time, with the result that the
processing of your personal data will no longer be permitted going forward.

However, this doesnot affectthe lawfulness of the processingcarried out on the basis of your consent prior to its withdrawal.

Please submit your specific request
in writing or by email, clearly identifying
yourself,to:

Carrera Toys GmbH
Rennbahn Allee
15 412 Puch /

Salzburg Austria Managing Directors:
Stefan Krings, Manuel Blehle Tel

.: +43
66288921-0 Email

:shop@carrera-revell.com

Finally, we would like to
inform you ofyour right to file a complaint with the supervisory authority.

9. No Automated Individual Decision-Making:

We do not use your personal data
for automated individual decision-making.

9. Changes
to the Privacy Policy

: New legal requirements, business
decisions, or technological developments
may necessitatechanges to our privacy policy.
You can always find themost current version on our website.