With the following data protection declaration, we would like to inform you about the types of your personal data (hereinafter also referred to as "data") that we as Social Impact gGmbH (in the following: Social Impact) and/or our service provider Innoloft GmbH (in the following: Innoloft) process, for what purposes and to what extent. The data protection declaration applies to all processing of personal data carried out by us and/or Innoloft, on our websites, in mobile applications and within external online presences, such as our social media profiles (hereinafter collectively referred to as "online offer").

Modification and update of the privacy policy This status of the privacy policy is dated December 2024. We ask you to regularly inform yourself about the content of our privacy policy. We adapt the data protection declaration as soon as the changes in the data processing carried out by us make this necessary. We will inform you as soon as the changes require an act of cooperation on your part (e.g. consent) or other individual notification. Where we provide addresses and contact information of companies and organizations in this privacy statement, please note that the addresses may change over time and please check the information before contacting us.

Content 1. General Information 2. Data processing by Social Impact gGmbH 3. Joint data processing by Social Impact gGmbH and Innoloft GmbH 3.1. Joint controllers 3.2. Common point of contact for affected persons 3.3. Joint data processing 3.4. Your rights

1. General Information Processing overview The following overview summarizes the types of data processed and the purposes of their processing and refers to the data subjects. Types of data processed • Inventory data (e.g., names, addresses). • Content data (e.g. entries in online forms). • Contact information (e.g., email, phone numbers). • Meta/communication data (e.g. device information, IP addresses). • Usage data (e.g. web pages visited, interest in content, access times). • Event data (Facebook) ("Event data" is data that may be transmitted by us to Facebook, e.g. via Facebook Pixel (via apps or other means), and relates to persons or their actions; the data includes, for example, information about visits to websites, interactions with content, functions, app installations, product purchases, etc. Categories of affected persons • Communication partner. • Users (e.g., website visitors, users of online services). Processing purposes • Application Procedure. • Provision of our online offer and user-friendliness. • Office and organizational procedures. • Click tracking. • Content Delivery Network (CDN). • Feedback (e.g. collecting feedback via online form). • Heatmaps (mouse movements on the part of the user, which are combined to form an overall picture). • Contact requests and communication. • Profiles with user-related information (creation of user profiles). • Reach measurement (e.g. access statistics, recognition of returning visitors). • Safety measures. • Surveys and questionnaires (e.g., surveys with input options, multiple-choice questions). • Provision of contractual services and customer service. • Managing and responding to inquiries.

Relevant legal bases Below you will find an overview of the legal basis of the GDPR on which we base the processing of personal data. Please note that in addition to the provisions of the GDPR, national data protection provisions of your or our country of residence or domicile (both for Social Impact and Innoloft) may apply. Should more specific legal bases be relevant in individual cases, we will inform you of these in the data protection declaration. • Consent (Art. 6 (1) p. 1 lit. a. DSGVO) - The data subject has given his/her consent to the processing of personal data concerning him/her for a specific purpose or purposes. • Contract performance and pre-contractual requests (Art. 6 para. 1 p. 1 lit. b. DSGVO) - Processing is necessary for the performance of a contract to which the data subject is a party or for the performance of pre-contractual measures taken at the data subject's request. • Legitimate interests (Art. 6 (1) p. 1 lit. f. DSGVO) - Processing is necessary to protect the legitimate interests of the controller or a third party, unless such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data. National data protection regulations in Germany: In addition to the data protection regulations of the General Data Protection Regulation, national regulations on data protection apply in Germany. These include, in particular, the Act on Protection against Misuse of Personal Data in Data Processing (Federal Data Protection Act - BDSG). In particular, the BDSG contains special regulations on the right to information, the right to erasure, the right to object, the processing of special categories of personal data, processing for other purposes and transmission, as well as automated decision-making in individual cases, including profiling. Furthermore, it regulates data processing for employment purposes (Section 26 BDSG), in particular with regard to the establishment, implementation or termination of employment relationships as well as the consent of employees. Furthermore, state data protection laws of the individual federal states may apply.

Security measures Social Impact and Innoloft take appropriate technical and organizational measures to ensure a level of protection appropriate to the risk in accordance with the legal requirements, taking into account the state of the art, the implementation costs and the nature, scope, circumstances and purposes of the processing, as well as the different probabilities of occurrence and the extent of the threat to the rights and freedoms of natural persons. The measures include, in particular, safeguarding the confidentiality, integrity and availability of data by controlling physical and electronic access to the data as well as the access, input, transfer, safeguarding of availability and its separation. Furthermore, we have established procedures to ensure the exercise of data subjects' rights, the deletion of data, and responses to data compromise. Furthermore, Innoloft takes the protection of personal data into account as early as the development or selection of hardware, software and processes in accordance with the principle of data protection, through technology design and through data protection-friendly default settings. SSL encryption (https): To protect your data transmitted via our online offer, we use SSL encryption. You can recognize such encrypted connections by the prefix https:// in the address bar of your browser.

Transmission of personal data In the course of our processing of personal data, it may happen that the data is transferred to or disclosed to other bodies, companies, legally independent organizational units or persons. The recipients of this data may include, for example, service providers commissioned with IT tasks or providers of services and content that are integrated into a website. In such cases, we comply with the legal requirements and, in particular, conclude appropriate contracts or agreements that serve to protect your data with the recipients of your data. Data processing in third countries If we process data in a third country (i.e., outside the European Union (EU), the European Economic Area (EEA)) or the processing takes place in the context of the use of third-party services or the disclosure or transfer of data to other persons, entities or companies, this will only be done in accordance with the legal requirements. Subject to express consent or contractually or legally required transfer, we only process or have data processed in third countries with a recognized level of data protection, contractual obligation through so-called standard protection clauses of the EU Commission, in the presence of certifications or binding internal data protection regulations (Art. 44 to 49 DSGVO, information page of the EU Commission: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection_de). Data deletion The data processed by us will be deleted in accordance with the legal requirements as soon as their consents permitted for processing are revoked or other permissions cease to apply (e.g. if the purpose of processing this data has ceased to apply or it is not required for the purpose). If the data is not deleted because it is required for other and legally permissible purposes, its processing is limited to these purposes. I.e., the data is blocked and not processed for other purposes. This applies, for example, to data that must be retained for reasons of commercial or tax law or whose storage is necessary for the assertion, exercise or defense of legal claims or for the protection of the rights of another natural or legal person. As part of our privacy notices, we may provide users with additional information regarding the deletion as well as the retention of data that is specific to each processing operation.

Cookies use Cookies are text files that contain data from visited websites or domains and are stored by a browser on the user's computer. A cookie is primarily used to store information about a user during or after his visit within an online offer. Stored information may include, for example, language settings on a website, login status, a shopping cart, or where a video was watched. The term cookies also includes other technologies that perform the same functions as cookies (e.g., when user information is stored using pseudonymous online identifiers, also referred to as "user IDs"). The following cookie types and functions are distinguished: • Temporary cookies (also: session cookies): Temporary cookies are deleted at the latest after a user has left an online offer and closed his browser. • Permanent cookies: Permanent cookies remain stored even after the browser is closed. For example, the login status can be saved or preferred content can be displayed directly when the user visits a website again. Likewise, the interests of users used for reach measurement or marketing purposes can be stored in such a cookie. • First-party cookies: First-party cookies are set by us. • Third-party cookies (also: third-party cookies): Third-party cookies are mainly used by advertisers (so-called third parties) to process user information. • Necessary (also: essential or absolutely necessary) cookies: Cookies may be absolutely necessary for the operation of a website (e.g. to store logins or other user inputs or for security reasons). • Statistics, marketing and personalization cookies: Furthermore, cookies are generally also used in the context of range measurement and when a user's interests or behavior (e.g. viewing certain content, using functions, etc.) on individual websites are stored in a user profile. Such profiles are used, for example, to show users content that matches their potential interests. This process is also referred to as "tracking", i.e., tracking the potential interests of users. Insofar as we use cookies or "tracking" technologies, we will inform you separately in our privacy policy or in the context of obtaining consent. Notes on legal bases: The legal basis on which we process your personal data using cookies depends on whether we ask you for consent. If this is the case and you consent to the use of cookies, the legal basis for processing your data is your declared consent. Otherwise, the data processed with the help of cookies is processed on the basis of our legitimate interests (e.g. in a business operation of our online offer and its improvement) or, if the use of cookies is necessary to fulfill our contractual obligations. Storage period: If we do not provide you with explicit information about the storage period of permanent cookies (e.g. in the context of a so-called cookie opt-in), please assume that the storage period can be up to two years. General information on revocation and objection (opt-out): Depending on whether the processing is based on consent or legal permission, you have the option at any time to revoke any consent you have given or to object to the processing of your data by cookie technologies (collectively referred to as "opt-out"). You can initially declare your objection by means of your browser settings, e.g. by deactivating the use of cookies (whereby this may also restrict the functionality of our online offer). An objection to the use of cookies for online marketing purposes can also be declared by means of a variety of services, especially in the case of tracking, via the websites https://optout.aboutads.info and https://www.youronlinechoices.com/. In addition, you can obtain further instructions on how to object in the context of the information on the service providers and cookies used. Processing of cookie data based on consent: We use a cookie consent management procedure in which the consent of users to the use of cookies, or the processing and providers mentioned in the cookie consent management procedure, can be obtained and managed and revoked by users. In this context, the declaration of consent is stored in order not to have to repeat its request and to be able to prove the consent in accordance with the legal obligation. The storage can take place on the server side and/or in a cookie (so-called opt-in cookie, or with the help of comparable technologies), in order to be able to assign the consent to a user or their device. Subject to individual information on the providers of cookie management services, the following information applies: The duration of the storage of consent can be up to two years. A pseudonymous user identifier is created and stored with the time of consent, information on the scope of consent (e.g., which categories of cookies and/or service providers), as well as the browser, system and end device used. • Types of data processed: Usage data (e.g. web pages visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses). • Data subjects: Users (e.g., website visitors, users of online services). • Legal basis: Consent (Art. 6 para. 1 p. 1 lit. a. DSGVO), Legitimate Interests (Art. 6 para. 1 p. 1 lit. f. DSGVO).

Further types of data processed, data subjects, purposes of data processing, legal basis and services used as well as service providers are listed below: a) Provision of the online offer and web hosting • Types of data processed: Content data (e.g. entries in online forms), usage data (e.g. websites visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses). • Data subjects: Users (e.g., website visitors, users of online services). • Purposes of processing: Provision of our online offer and user-friendliness, Content Delivery Network (CDN). • Legal basis: Legitimate interests (Art. 6 para. 1 p. 1 lit. f. DSGVO). Services used and service providers: • Amazon Web Services (AWS): Services in the field of providing information technology infrastructure and related services (e.g., storage space and/or computing capacity); Service provider: Amazon Web Services, Inc., 410 Terry Avenue North, Seattle WA 98109, USA; Website: https://aws.amazon.com/de/; Privacy Policy: https://aws.amazon.com/de/privacy/?nc1=f_pr. • Mailjet: Email is sent via the service provider Mailjet (SAS Mailjet, 13-13bis, Rue de l'Aubrac, 75012 Paris, France). Your data is stored on Mailjet's servers in the EU. Mailjet may analyze your data for quality assurance purposes and to improve the quality of its own service. Your data will be used in a pseudonymous form, i.e. without assignment to a user. Mailjet's privacy policy applies: https://www.mailjet.de/privacy-policy/. b) Registration, login and user account • Types of data processed: inventory data (e.g. names, addresses), contact data (e.g. e-mail, telephone numbers), content data (e.g. entries in online forms), meta/communication data (e.g. device information, IP addresses). • Data subjects: Users (e.g., website visitors, users of online services). • Purposes of processing: provision of contractual services and customer service, security measures, management and response to requests. • Legal basis: Contract fulfillment and pre-contractual requests (Art. 6 para. 1 p. 1 lit. b. DSGVO), Legitimate Interests (Art. 6 para. 1 p. 1 lit. f. DSGVO). c) Community functions • Types of data processed: Usage data (e.g. web pages visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses) • Data subjects: Users (e.g., website visitors, users of online services). • Purposes of processing: provision of contractual services and customer service, security measures. • Legal basis: Contract fulfillment and pre-contractual requests (Art. 6 para. 1 p. 1 lit. b. DSGVO), Legitimate Interests (Art. 6 para. 1 p. 1 lit. f. DSGVO).

d) Single sign-on login • Types of data processed: inventory data (e.g. names, addresses), contact data (e.g. e-mail, telephone numbers). • Data subjects: Users (e.g., website visitors, users of online services). • Purposes of processing: provision of contractual services and customer service, registration procedure. • Legal basis: Consent (Art. 6 para. 1 p. 1 lit. a. DSGVO), Contract performance and pre-contractual requests (Art. 6 para. 1 p. 1 lit. b. DSGVO), Legitimate interests (Art. 6 para. 1 p. 1 lit. f. DSGVO). Services used and service providers: • Google Single-Sign-On: Authentication service; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; website: https://www.google.de; privacy policy: https://policies.google.com/privacy; opt-out: settings for display of ads: https://adssettings.google.com/authenticated. • Linkedin Single Sign-On: Authentication service; Service provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland; website: https://www.linkedin.com; privacy policy: https://www.linkedin.com/legal/privacy-policy e) Contact • Types of data processed: inventory data (e.g. names, addresses), contact data (e.g. e-mail, telephone numbers), content data (e.g. entries in online forms), usage data (e.g. websites visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses). • Affected persons: Communication partners. • Purposes of processing: contact requests and communication. • Legal basis: Contract fulfillment and pre-contractual requests (Art. 6 para. 1 p. 1 lit. b. DSGVO), Legitimate Interests (Art. 6 para. 1 p. 1 lit. f. DSGVO). Services used and service providers: • Stonly: For the support system we use Stonly. Address: 36 rue Chaptal, 92300 Levallois, France. Website: https://stonly.com. For information on the handling of user data, please see the corresponding privacy policy: https://stonly.com/privacy f) Chatbots and chat functions • Types of data processed: contact data (e.g. e-mail, telephone numbers), content data (e.g. entries in online forms), usage data (e.g. websites visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses). • Affected persons: Communication partners. • Purposes of processing: contact requests and communication, direct marketing (e.g. by e-mail or postal mail). • Legal basis: Consent (Art. 6 para. 1 p. 1 lit. a. DSGVO), Legitimate Interests (Art. 6 para. 1 p. 1 lit. f. DSGVO). Services used and service providers: • PubNub: For the platform-internal messaging system for communication between users, we use the services of PubNub. Address: PubNub, 60 Francisco Street, San Francisco, CA 94133, USA. Website: https://www.pubnub.com. Information on the handling of user data can be found in the corresponding privacy policy: https://www.pubnub.com/legal/privacy-policy/

g) Video conferencing, online meetings, webinars and screen sharing • Types of data processed: inventory data (e.g. names, addresses), contact data (e.g. e-mail, telephone numbers), content data (e.g. entries in online forms), usage data (e.g. websites visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses). • Data subjects: Communication partners, users (e.g. website visitors, users of online services). • Purposes of processing: provision of contractual services and customer service, contact requests and communication, office and organizational procedures. • Legal basis: Consent (Art. 6 para. 1 p. 1 lit. a. DSGVO), Contract performance and pre-contractual requests (Art. 6 para. 1 p. 1 lit. b. DSGVO), Legitimate interests (Art. 6 para. 1 p. 1 lit. f. DSGVO). Services used and service providers: • Google Hangouts / Meet: messenger and conferencing software; service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; website: https://hangouts.google.com/; privacy policy: https://policies.google.com/privacy. • Zoom: video conferencing, web conferencing and webinars; service provider: Zoom Video Communications, Inc, 55 Almaden Blvd, Suite 600, San Jose, CA 95113, USA; Website: https://zoom.us; Privacy Policy: https://zoom.us/docs/de-de/privacy-and-legal.html; Standard Contractual Clauses (ensuring level of data protection in case of processing in third countries): https://zoom.us/docs/de-de/privacy-and-legal.html (Designated as Global DPA). • Jitsi: For the provision of video conferencing within the platform, we use the services of Jitsi . Address: 8x8, Inc. 675 Creekside Way, Campbell, CA 95008 Website: https://jitsi.org. For information on how we handle user data, please see the corresponding privacy policy: https://jitsi.org/meet-jit-si-privacy/. h) Cloud services • Types of data processed: inventory data (e.g. names, addresses), contact data (e.g. e-mail, telephone numbers), content data (e.g. entries in online forms), usage data (e.g. websites visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses). • Affected persons: Communication partners. • Purposes of processing: office and organizational procedures. • Legal basis: Consent (Art. 6 para. 1 p. 1 lit. a. DSGVO), Contract performance and pre-contractual requests (Art. 6 para. 1 p. 1 lit. b. DSGVO), Legitimate interests (Art. 6 para. 1 p. 1 lit. f. DSGVO). Services used and service providers: • Google Cloud Services: Cloud storage services; Service Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; website: https://cloud.google.com/; privacy policy: https://www.google.com/policies/privacy, security notices: https://cloud.google.com/security/privacy; standard contractual clauses (ensuring level of data protection for processing in third countries): https://cloud.google.com/terms/data-processing-terms; https://cloud.google.com/terms/data-processing-terms. i) Newsletter • Types of data processed: inventory data (e.g. names, addresses), contact data (e.g. e-mail, telephone numbers), meta/communication data (e.g. device information, IP addresses), usage data (e.g. websites visited, interest in content, access times). • Affected persons: Communication partners. • Purposes of processing: direct marketing (e.g. by e-mail or postal mail). • Legal basis: Consent (Art. 6 para. 1 p. 1 lit. a. DSGVO), Legitimate Interests (Art. 6 para. 1 p. 1 lit. f. DSGVO). • Opt-out: You can cancel the receipt of our newsletter at any time, i.e. revoke your consent or object to further receipt. You will find a link to cancel the newsletter either at the end of each newsletter or you can otherwise use one of the above contact options, preferably e-mail, for this purpose. Services used and service providers: • „MailChimp“, eine Newsletterversandplattform des US-Anbieters Rocket Science Group, LLC, 675 Ponce De Leon Ave NE #5000, Atlanta, GA 30308, USA; Datenschutzbestimmungen: mailchimp.com/legal/privacy/. j) Web analysis, monitoring and optimization • Types of data processed: Usage data (e.g. web pages visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses). • Data subjects: Users (e.g., website visitors, users of online services). • Purposes of processing: Reach measurement (e.g. access statistics, recognition of returning visitors), profiles with user-related information (creation of user profiles), click tracking, feedback (e.g. collecting feedback via online form), heat maps (mouse movements on the part of users that are combined to form an overall picture.), surveys and questionnaires (e.g. surveys with input options, multiple choice questions), marketing. • Security measures: IP masking (pseudonymization of the IP address). • Legal basis: Consent (Art. 6 para. 1 p. 1 lit. a. DSGVO), Legitimate Interests (Art. 6 para. 1 p. 1 lit. f. DSGVO). Services used and service providers: • Google Analytics: Reach measurement and web analytics; service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; website: https://marketingplatform.google.com/intl/de/about/analytics/; privacy policy: https://policies.google.com/privacy. • Google Tag Manager: Google Tag Manager is a solution with which we can manage so-called website tags via an interface and thus integrate other services into our online offering (please refer to further information in this privacy policy). With the Tag Manager itself (which implements the tags), therefore, no profiles of users are created or cookies are stored, for example. Google only learns the IP address of the user, which is necessary to run the Google Tag Manager. Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; website: https://marketingplatform.google.com; privacy policy: https://policies.google.com/privacy.

k) Presence in social networks (social media) • Types of data processed: contact data (e.g. e-mail, telephone numbers), content data (e.g. entries in online forms), usage data (e.g. websites visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses). • Data subjects: Users (e.g., website visitors, users of online services). • Purposes of processing: contact requests and communication, feedback (e.g. collecting feedback via online form), marketing. • Legal basis: Legitimate interests (Art. 6 para. 1 p. 1 lit. f. DSGVO). Services used and service providers: • LinkedIn: social network; service provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland; website: https://www.linkedin.com; privacy policy: https://www.linkedin.com/legal/privacy-policy; opt-out: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out. • YouTube: Social network and video platform; service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; privacy policy: https://policies.google.com/privacy; opt-out: https://adssettings.google.com/authenticated. l) Plugins and embedded functions and content • Types of data processed: Usage data (e.g. websites visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses), event data (Facebook). • Data subjects: Users (e.g., website visitors, users of online services). • Purposes of processing: provision of our online offer and user experience, provision of contractual services and customer service, marketing, profiling with user-related information (creation of user profiles). • Legal basis: Legitimate interests (Art. 6 para. 1 p. 1 lit. f. DSGVO), consent (Art. 6 para. 1 p. 1 lit. a. DSGVO), contract performance and pre-contractual requests (Art. 6 para. 1 p. 1 lit. b. DSGVO). Services used and service providers: • Facebook plugins and content: Facebook Social Plugins and Content - This may include, for example, content such as images, videos or text and buttons that allow users to share content from this online offering within Facebook. The list and appearance of Facebook social plugins can be viewed here: https://developers.facebook.com/docs/plugins/; Service provider: Facebook Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; parent company: Facebook, 1 Hacker Way, Menlo Park, CA 94025, USA; website: https://www.facebook.com; privacy policy: https://www.facebook.com/about/privacy; opt-out: settings for advertisements: https://www.facebook.com/settings?tab=ads. • Google Maps APIs and SDKs: Interfaces to Google's map and location services that allow, for example, supplementing address entries, location determinations, distance calculations or providing supplementary information on locations and other places; service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; website: https://cloud.google.com/maps-platform; privacy policy: https://policies.google.com/privacy. • LinkedIn plugins and content: LinkedIn Plugins and Content- This may include, for example, content such as images, videos or text and buttons that allow users to share content from this online offering within LinkedIn. Service Provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland; Website: https://www.linkedin.com; Privacy policy: https://www.linkedin.com/legal/privacy-policy; Opt-out: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out. • Twitter plugins and content: Twitter plugins and buttons - This may include, for example, content such as images, videos or text and buttons that allow users to share content from this online offering within Twitter. Service Provider: Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2 D02 AX07, Ireland, Parent Company: Twitter Inc, 1355 Market Street, Suite 900, San Francisco, CA 94103, USA; Website: https://twitter.com/de; Privacy policy: https://twitter.com/de/privacy. • YouTube videos: Video content; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; website: https://www.youtube.com; privacy policy: https://policies.google.com/privacy; opt-out: opt-out plugin: https://tools.google.com/dlpage/gaoptout?hl=de, ad display settings: https://adssettings.google.com/authenticated. • Xing Plugins and Buttons: Xing Plugins and Buttons - This may include, for example, content such as images, videos or text and buttons that allow users to share content from this online offering within Xing. Service provider: XING AG, Dammtorstraße 29-32, 20354 Hamburg, Germany; Website: https://www.xing.com; Privacy policy: https://privacy.xing.com/de/datenschutzerklaerung. • Vimeo: Video content; Service provider: Vimeo Inc., Attention: Legal Department, 555 West 18th Street New York, New York 10011, USA; Website: https://vimeo.com; Privacy Policy: https://vimeo.com/privacy; Opt-Out: We point out that Vimeo may use Google Analytics and refer to the privacy policy (https://policies.google.com/privacy) as well as the opt-out options for Google Analytics (https://tools.google.com/dlpage/gaoptout?hl=de) or Google's settings for data use for marketing purposes (https://adssettings.google.com/). m) Management, organization and auxiliary tools • Types of data processed: inventory data (e.g. names, addresses), contact data (e.g. e-mail, telephone numbers), content data (e.g. entries in online forms), usage data (e.g. websites visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses). • Data subjects: Communication partners, users (e.g. website visitors, users of online services). • Purposes of processing: office and organizational procedures. • Legal basis: Consent (Art. 6 para. 1 p. 1 lit. a. DSGVO), Contract performance and pre-contractual requests (Art. 6 para. 1 p. 1 lit. b. DSGVO), Legitimate interests (Art. 6 para. 1 p. 1 lit. f. DSGVO). Services used and service providers: • calendly: online appointment scheduling; service provider: Calendly LLC., 271 17th St NW, Ste 1000, Atlanta, Georgia, 30363, USA; website: https://calendly.com/de; privacy policy: https://calendly.com/pages/privacy. • Jira: Web application for error management, problem handling and operational project management; service provider: Atlassian Inc. (San Francisco, Harrison Street Location), 1098 Harrison Street, San Francisco, California 94103, USA; Website: https://www.atlassian.com/software/jira; Privacy Policy: https://www.atlassian.com/legal/privacy-policy • MapTiler: We use the services of MapTiler to display maps. Address: MapTiler AG, Höfnerstrasse 98, 6314 Unterägeri, Switzerland. More information about the handling of user data can be found in the privacy policy of MapTiler: https://www.maptiler.com/privacy-policy/ • DeepL: We use the services of DeepL for automatic translation of platform content. Address: DeepL GmbH, Maarweg 165, 50825 Cologne, Germany. Website: https://www.deepl.com/. Information on the handling of user data can be found in the corresponding privacy policy: https://www.deepl.com/en/privacy/. • Stripe: We use Stripe for billing LoftOS fees. Address: Stripe Payments Europe, Limited, 3 Dublin Landings, North Wall Quay, Dublin 1, Ireland. Information on the handling of user data can be found in the corresponding privacy policy: https://stripe.com/en-de/privacy

2. Data processing by Social Impact gGmbH Controller: Social Impact gGmbH, Schiffbauergasse 7, D-14467 Potsdam Contact data protection officer: The data protection officer of Social Impact gGmbH can be reached via e-mail: datenschutz@socialimpact.eu. IITR Datenschutz GmbH, Dr. Sebastian Kraska, Marienplatz 2, D-80331 München