We have prepared this data protection and privacy statement to inform you about how we use your personal data.
Every data subject has the following rights:
- right of access (Art. 15 GDPR)
- right to rectification of data (Art. 16 GDPR)
- right to erasure and/or "right to be forgotten" (Art. 17 GDPR)
- right to restriction of the processing of personal data (Art. 18 GDPR)
- right to data portability (Art. 20 GDPR)
You may at any time object to the processing of your personal data for marketing purposes – including profiling in connection with direct marketing – without giving reasons.
Moreover, you have a general right to object (cf. Art. 21 para. 1 GDPR). In this case, reasons must be given for the objection.
To the extent data is processed on the basis of consent, such consent can be revoked at any time with future effect.
Should you wish to exercise your rights as a data subject, please refer to firstname.lastname@example.org .
Furthermore, you have the right to file a complaint with a Data Protection Authority against the data processings performed by us.
Purpose of processing, transfer of data in connection with the use of services / offers of Deutsche Messe AG
The use of the online services offered by Deutsche Messe AG requires the setting up of a customer account (Account). This is the basis for Deutsche Messe AG to offer to its customers various services in order to make participation in the event as interesting and pleasant as possible. The online services offered by Deutsche Messe AG come as a comprehensive package. The legal basis for the setting up and allocation of user accounts is Art. 6 (1) b GDPR.
Booking of exhibition space, including online exhibitor shop
If you wish to book exhibition space or further services via the online exhibitor shop, you need to set up an account. Via this account you can make required amendments / updates or book exhibition spaces for further trade fairs. After completion of your booking, you can deactivate your account at any time.
DMAG will process the personal data collected within the framework of booking exhibition space for purposes of contractual performance, accounting and customer administration.
Deutsche Messe AG will transfer the core data (company name, contact person, address, and contact details like phone number and email address) to other national companies based in Hannover within DMAG Group to ensure that identical core data are used and administrated by all group companies. This also includes the sharing of data updates of which we or one of our group companies becomes aware. Any updates will be made available to all other group companies involved. This helps us to simplify our internal processes and will save you the trouble of having to provide your core data again when contacting another group company. For an overview of our group companies please go to http://www.messe.de/de/unternehmen/tochtergesellschaften/deutschland/ .
In addition, the data collected in connection with the booking of exhibition space will be used to process any warranty claims or complaints. Your data may also be transferred to external auditors and/or tax authorities for auditing purposes. The data will be stored in accordance with statutory retention periods pursuant to Secs. 146 et seq. German Revenue Code (AO) and/or Sec. 257 German Commercial Code (HGB) and deleted upon expiry of the respective retention periods.
The mandatory information provided when setting up the customer account (name and address, company, contact person, trade fair and booth) will, to the extent required, be transferred to external service providers commissioned by Deutsche Messe AG who offer additional services in connection with the booth you have booked.
- setting up and allocation of user accounts: Art. 6 (1) b GDPR
- contractual performance including processing of complaints / warranty claims: Art. 6 (1) b GDPR
- transfer of data to other group companies of Deutsche Messe AG: Art. 6 (1) f GDPR
- transfer of data to service partners for the provision of services on behalf of Deutsche Messe AG: Art. 6 (1) b GDPR and/or Art. 6 (1) f GDPR
- storage of data pursuant to AO/HGB and, where applicable, audits by financial authorities / auditors: Art. 6 (1) c GDPR
Purchase of event tickets
Setting up a user account:
The purchase of event tickets (tickets for trade fairs, symposiums, or other events) requires the setting up of a customer account. Via this account you can also use further services and book further tickets. After completion of your purchase, you can deactivate such account at any time if you want to.
As an alternative to setting up an own customer account, you can use your social media account with Facebook, Google+, LinkedIn or Xing for the purchase of tickets. You will be forwarded to the site of the respective social media service, where you can log in with your user data. Such data will then be used for the setting up and allocation of your user account with Deutsche Messe AG.
If you use the social login via Facebook, Google+, LinkedIn or Xing, the social networks will transfer the following data to us:
- Facebook: name, first name, email address
- Google+: name, first name, email address
- LinkedIn: name, first name, email address
- Xing: name, first name, email address
After login to the online ticket shop via your existing social media account with Facebook, Google+, LinkedIn or Xing, you have the option to disconnect the link to the social media service. We will store the data provided to us by the social media service as long as they are needed for the processing of the ticket purchase and the event. Deutsche Messe AG will not transfer any data to social networks. Nonetheless, due to the transfer of data to DMAG occasioned by you the social network may store your registration with DMAG. In such case, the respective social network will have sole responsibility for any data processing.
Purchase of event tickets:
Once you are registered for our online ticket shop, you can use this platform for the purchase of event tickets (tickets for trade fairs, conferences). Guided Tour tickets are available at the separate Guided Tour shop. Deutsche Messe AG will process the mandatory data provided by you and the data relating to the selected event for your ticket purchase and to ensure entry to the selected events on the respective date(s). In addition, this data will be used to issue name badges for trade fair visits / conference attendances.
The data about the ticket purchase will be used for accounting purposes and, where applicable, to process any warranty claims or complaints. Moreover, your data may be transferred to external auditors and/or tax authorities for auditing purposes. The data about the ticket purchase will be stored in accordance with statutory retention periods pursuant to Secs. 146 et seq. German Revenue Code (AO) and/or Sec. 257 German Commercial Code (HGB) and deleted upon expiry of the respective retention periods.
- contractual performance including processing of warranty or other claims: Art. 6 (1) b GDPR
- setting up and allocation of user accounts: Art. 6 (1) b GDPR
- storage of data pursuant to AO/HGB and, where applicable audits by financial authorities / auditors: Art. 6 (1) c GDPR
Registration of professional visitor tickets and exhibitor passes (together "visitor tickets")
Registration for professional visitor tickets requires the setting up of an own user account. Via this account, you can also benefit from further services offered in connection with the trade fair. Registration for professional visitor tickets only serves as an example for the services offered by Deutsche Messe AG in connection with your customer account.
In connection with the registration for professional visitor tickets, Deutsche Messe AG will use the collected data to ensure entry to the trade fair for the professional visitor on the scheduled dates. In addition, the data will be used to issue name badges for the trade fair visit.
Since the costs for entry to the trade fair are borne by the exhibitor inviting the professional visitor, the data related to the ticket registration will also be transferred to the exhibitor who issued the invitation (core data and voluntary information).
- setting up and allocation of user accounts: Art. 6 (1) b GDPR
- contractual performance including processing of claims / warranty claims: Art. 6 (1) b GDPR
- transfer of core data to the exhibitor who issued the invitation: Art. 6 (1) f GDPR
Use of further trade fair services:
By setting up a user account, in particular when purchasing online tickets or registering for professional visitor tickets or exhibitor passes, trade fair attendees will get access to additional trade fair services offered by Deutsche Messe AG as part of a service package. This includes the following services:
- Lead Management
- Favourites Search
- Name badges
The following data processings are carried out in connection with the individual services:
If desired, Deutsche Messe AG can streamline the forwarding of stored visitor’s ticket registration data to exhibitors or other relevant companies, organizations or individuals taking part in the event (e.g. convention or forum participants, speakers, sponsors, etc. – hereinafter “Event Participants”). The Event Participant can scan the barcode on his/her ticket in order to see what data is stored by Deutsche Messe AG.
Favourites Search & Routing
Users of or our website or app can add exhibitors, products and events to their favourites list. On the basis of such favourites list, an optimal route will be generated for the user, which can be processed and stored in the user account. If you have installed the trade fair app – and consented to the use of your location – the app can show your specific route and your location.
- contractual performance including processing of warranty claims or complaints: Art. 6 (1) b GDPR
Processing of personal data by DMAG for marketing purposes:
DMAG and service providers engaged by it (e.g. letter shops) will use your name and address for further purposes in connection with customer retention and customer reactivation. This will include the delivery by post of information regarding further interesting products and services, because DMAG wishes to draw your attention to interesting offers and establish a long-lasting customer relationship.
Moreover, Deutsche Messe AG will use the mandatory data provided in connection with the use of its offers / services as well as voluntary information provided (see paragraphs 1-4 above) to personalise and constantly improve trade fair attendance for visitors and exhibitors and to provide future offers tailor-made to your interests. We process the data collected in connection with the use of our offers / services to provide you with the best possible support regarding your business development and to point out interesting options for trade fair visitors / exhibitors. Your data will be processed internally and in pseudonymised form in order to comply wit your legitimate interest to ensure protection of your personal data. The data processing allows us to provide you with personalised offers (website, email, post).
We will basically stop processing your personal data collected upon prior use of our offers / services for marketing purposes – including profiling within the scope of direct marketing – if you have not used any of the offers / services of DMAG for a period of up to 5 years with this exception: In the following two years we will continue to process your name, address, company affiliation, and status (professional visitor, exhibitor) as well as the last trade fair you attended for the purpose of direct mailings only.
As a principle, your email address will only be used for marketing purposes if we have obtained your consent.
As far as the telephone number owner comes from Germany, also the telephone number will only be used for marketing purposes if we have obtained your consent. Any telephone number outside of Germany will be used depending on the legal situation of the country concerned, provided you have not objected to commercial use
There are the following exemptions: To the extent DMAG obtains your email address in connection with the sale of products / services, we will use your email address to promote similar own products. You are entitled to object to the use of your data for marketing purposes at any time; this will be pointed out to you upon collection of any data as well as in any marketing communications. Moreover, Deutsche Messe AG will use professional phone numbers within Germany for marketing purposes, to the extent this is based on presumed consent, e.g. within the scope of an existing business relationship.
- data processing for marketing purposes, including profiling in connection with marketing purposes, and transfer: Art. 6 (1) f GDPR
- telephone marketing: Art. 6 (1) a GDPR and Sec. 7 para. 2 no. 2 alt. 2 German Unfair Com-petition Act (UWG)
- email marketing: Art. 6 (1) a GDPR and Sec. 7 para. 3 UWG
Transfer of personal data to group companies and sales partners of DMAG for marketing purposes:
Where trade fair visitors are not based in Germany, DMAG will transfer their postal address provided upon setting up of the customer account (excluding email address, including name, company, industry, function and position) to the company and/or sales partner locally responsible for the support of trade fair visitors. The aim is to establish a long-lasting business relationship between DMAG and trade fair visitors via its subsidiaries / sales partners and to point out further interesting events of DMAG and/or its subsidiaries.
- transfer of core data to regional subsidiaries and sales partners of Deutsche Messe AG Group: Art. 6 (1) f GDPR
Subscription to email newsletter:
We will only send you marketing communications via email if we have obtained your prior explicit consent. Notwithstanding, we may process your email address for marketing purposes as described in paragraph 5.
- email marketing: Art. 6 (1) a GDPR
Hereinafter we will explain what types of data processings are carried out in connection with the access to a website or an app of Deutsche Messe AG.
Processing of data upon access to our website – logfile data
When you access our website / app, some pieces of general information will automatically be collected. This information (server logfiles) includes e.g. the type of your browser, the operating system you use, the domain name of your internet service provider and similar information. In addition, your IP address will be transferred and used for the purpose of providing the service requested by you. This information is technically required to accurately provide the contents of websites you call up and are inevitably collected when using the internet.
In accordance with our IT security concept, the generated logfile data will be stored for a period of 3 weeks to enable us to detect and analyse any attacks against our website. The legal basis for this data processing is Art. 6 (1) sentence 1 f GDPR.
Processing of data in connection with the use of our website – your re-quests
If you send us a request via email or via our contact form, we will collect the data provided by you for processing and responding to such request. This information will remain stored for a period of up to two years for verification purposes. The legal basis for this data processing is Art. 6 (1) sentence 1 letter f GDPR.
Integration of external service providers
Linking with other services is a fundamental principle of the Internet. Therefore, we have integrated various external service providers into our website.
Integration of social plug-ins:
To offer you means of interacting with your contacts and more easily share interesting information, our website uses the social plug-ins of various social networks, e.g. Facebook.com, Twitter.com and Google+. The different plug-ins can be recognised by their respective network logos. We use a 2-click approach to ensure that access to our website as such will not trigger a transfer of data.
Only if you click on a plug-in, your browser will establish a direct connection with the servers of the respective network. The network transmits the content of the plug-in directly to your browser and your browser integrates such content into the website. To the extent a network has its seat outside the EU / the EEA, we cannot exclude that your data will be transferred to and processed by a server outside the EU / the EEA. Since we have no influence on the amount of data collected by the networks through the plug-ins or the respective period of use, we hereby inform you according to our present knowledge:
When clicking on a plug-in, the respective network will receive the information that you have accessed the link included in our website. If you are logged into a network, such network can connect this information with your profile. If you do not want the network to collect information on your access to our website, you have to log out before calling up our site. In principle, however, it is possible that a network detects and stores your IP address, even if you are not registered with or logged into such network. Furthermore, we have no information regarding the deletion of data collected by the respective plug-in providers.
The plug-in provider will store the data collected about you as a user profile to be used for purposes of marketing, market research and the demand-oriented design of its website. In particular, this evaluation takes place (also for users not logged in) to display demand-oriented advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of a user profile by service providers.
The legal basis for the use of plug-ins is Art. 6, para. 1 sentence 1 letter f GDPR. Please refer to the privacy guidelines of the respective social network for information regarding the purpose, duration and scope of the data collection, the further processing and use of your data, your respective rights, and setting options to protect your privacy:
- Facebook: http://www.facebook.com/policy.php
- Twitter: https://twitter.com/privacy?lang=de
- Google+: http://www.google.de/intl/de/policies/privacy
- LinkedIn: https://www.linkedin.com/legal/privacy-policy
- XING: https://www.xing.com/app/share?op=data_protection
Use of Google Tag Manager:
Use of Google Maps:
Our website uses Google Maps, a service offered by Google, Inc. This allows us to display interactive maps, to ensure easy traceability of the locations indicated on our website, and to facilitate convenient use of the map functions.
This application is retrieved directly from the Google servers. Google will therefore receive the IP-address currently assigned to you. When you access the function, Google will receive the information that you have called up our respective subsite. If, to what extent and for how long your IP address is stored and internally used by Google is beyond our knowledge. The legal basis for the use of this service is Art. 6 (1) sentence 1, letter f GDPR.
If you are registered with a Google service, Google can assign your visit to your user account. Even if you are not registered with Google or not logged in, it is possible that Google may store your IP address and use it for profiling purposes. Google will store the data collected about you as a user profile to be used for purposes of advertising, market research and/or the demand-oriented design of its websites. In particular, this evaluation takes place (also for user not logged in) to display demand-oriented advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of a user profile by Google.
Please note that data processings by Google may be performed outside the EU/EEA. Google will process your personal data also in the U.S. and has accepted the regulations of the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework . For further information on data protection by Google please go to https://www.google.de/intl/de/policies/privacy .
Use of YouTube:
Our website uses plug-ins of the website YouTube, which is operated by Google. The operator of the web pages is YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, U.S.A.
When you visit one of our web pages that uses the YouTube plug-in, a connection will be established to the servers of YouTube. The YouTube server will receive information on which of our web pages you have visited.
If you are logged into your YouTube account, YouTube will be able to assign your browsing behaviour directly to your personal profile. You can prevent this by logging out of your YouTube account.
We use YouTube in the interest of presenting our online offers in an attractive way; the legal basis therefore is Art. 6 (1) letter f GDPR. We only collect information on the frequency of call-ups of the YouTube videos integrated in our website and will delete the respective data after 2 years.
Use of reCAPTCHA:
To protect user enquiries via our internet contact form, online ticket registrations and subscriptions to our newsletter, Deutsche Messe AG uses the reCAPTCHA service of Google Inc. The legal basis is Art. 6 (1) letter f GDPR. The prompts of reCAPTCHA are used to discern whether an entry is made by a human being or, improperly, automated machine processing is used. The prompts include the transfer of IP addresses and any further data required by Google for the provision of reCAPTCHA. To this purpose, your entry will be transferred to and further used by Google. By using reCAPTCHA you agree that the recognition you have made will be incorporated in the digitalisation of old works. DMAG will not store any further data about your use of this service.
Our website uses so-called cookies. Cookies are small text files that are placed on your device and stored on your browser. Their purpose is to make our offer more user-friendly, more efficient, and more secure. We use temporary cookies that are automatically deleted when you shut down your browser (so-called “session cookies”) as well as permanent ("persistent") cookies.
You have the option to choose whether you want to allow the placing of cookies. You can adjust the settings of your browser accordingly. Your options are to accept all cookies, to be informed when cookies are placed, or to accept no cookies at all. If you opt for the third alternative, you may not be able to use our services to the full extent.
Cookies that are indispensable for the use of our website
We use session cookies that are indispensable for the use of our website. These include cookies that enable us to recognise you when you visit our site for a single session. These session cookies help to make our site more secure, e.g. by ensuring safe operation of the shopping cart function and payment processes. The legal basis for this data processing is Art. 6 (1) sentence 1 letter f GDPR.
Hereinafter, we provide you with an overview of the cookies we use if we have obtained your respective consent upon access to our website (Art. 6 (1) sentence 1 letter a GDPR). These cookies are used for the purpose of analysing user behaviour and for marketing purposes. Respective opt-out options are included in each description.
The use of tracking cookies allows us to "recognise" users when they revisit our website and to allocate usage events to an internal indicator (pseudonym). Thus, we can capture and analyse the repeated access to our website. We use the following tracking cookies:
To improve and design our website in a demand-oriented way, information regarding access to our website will be collected and stored with the help of technologies by econda GmbH. Moreover, such data will be used to set up user profiles in pseudonymised form. To this purpose, cookies may be used to facilitate the recognition of internet browsers. All IP addresses will be masked immediately upon receipt.
The legal basis for the storage of the cookie is consent pursuant to Art. 6 (1) sentence 1 letter a GDPR. The further evaluation of the collected data for a period of up to two years is based on Art. 6 (1) sentence 1 letter f GDPR.
Users of our website can object to this data collection and storage at any time with future effect by clicking here .
The objection only applies to the device and the browser on which the cookie was placed; you might have to repeat the opt-out procedure on all of your devices. If you delete the opt-out cookie, your access data will again be transferred to econda.
This website uses Google Analytics, a web analytics service of Google Inc. (“Google”). Google Analytics uses so-called “cookies”, text files that are stored on your computer and facilitate an analysis of your use of our website. The information about your use of this website generated by the cookie is usually transferred to a Google server in the U.S.A. and stored there. Since we have activated IP anonymisation on our website, Google will shorten your IP address within the member states of the European Union and contracting states of the agreement of the European Economic Area. Only in exceptional cases will your full IP address will be transferred to a server of Google in the U.S.A. and shortened there. Google uses this information on our behalf to analyse your use of this website, to compile reports on website activities and to provide additional services related to website and internet use. The IP address transferred by your browser in the context of Google Analytics will not be merged with other data of Google.
You can prevent the storage of cookies by adjusting the settings of your browser accordingly. Please note, however, that in such case you may not be able to use all functions of our website to their full extent. Moreover, you can prevent the collection of data related to your use of the website generated by the cookie (including your IP address) and the processing of such data by Google by downloading and installing the browser plugin available at: https://tools.google.com/dlpage/gaoptout?hl=en-GB
We use Google Analytics to analyse and constantly improve the use of our website. The resulting statistics help us to improve our offer and make it more attractive for our users. For exceptional cases where personal data is transferred to the U.S.A., Google has accepted the provisions of the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework . The legal basis for the storage of the cookie is consent pursuant to Art. 6 (1) sentence 1 letter a GDPR. The further evaluation of the collected data with the help of Google Analytics for a period of up to 2 years is based on Art. 6 (1) sentence 1 letter f GDPR.
For further information please also refer to http://tools.google.com/dlpage/gaoptout?hl=de ; for general information on Google Analytics and data protection please go to https://www.google.de/intl/de/policies/privacy/
Twitter Ads conversion tracking:
We use the online marketing programme “Twitter Ads”, including the conversion tracking function. When you click on an advertisement run by Twitter, a conversion tracking cookie will be placed on your computer. These cookies remain valid for a period of 30 days and do not serve the purpose of identifying individuals. Twitter will not transfer your private or personal information to advertising clients without your consent. Instead, advertising clients will e.g. receive reports containing details on how many users have viewed a certain ad or clicked on it, but not containing any information about who viewed or clicked on an ad. Such reports merely contain aggregated, public or non-personal data. If you call up a certain page of our website and the cookie is still valid, we and Twitter can detect that you have clicked on the ad and that you were forwarded to such page. Each client of Twitter Ads obtains a different cookie; this ensures that cookies cannot be tracked via the websites of Twitter Ads clients. The information collected via the conversion cookie is used to compile reports containing details on how many users have viewed a certain ad or clicked on it, but not containing any information on who viewed or clicked on an ad. These reports merely contain aggregated, public or non-personal data. Moreover, Twitter supports the “Do Not Track (DNT”) option. If you activate the DNT option on your browser, Twitter will not associate browser-related information with your account for the purpose of displaying personalised advertisements. For further information on DNT and on how you can activate this option on your browser, please refer to: http://optout.aboutads.info
Alternatively, you can adjust your personal Twitter settings at: https://twitter.com/personalization
We place the following cookies:
In addition to AdWords tracking, we also use Google Remarketing, a retargeting function that allows us to display interest-based advertisements beyond our own advertising space. With the help of this function, we can display our advertisements to you on other websites you visit based on the services / products you previously called up on our website. A “recognition” cookie stored on your browser allows Google to record your interest in certain products during your visit to our website and to display respective targeted advertisements on other websites you call up. According to Google, the data collected within the scope of remarketing will not be merged with any personal data about you stored by Google; in particular, remarketing data will be used in pseudonymised form.
We use this function for purposes of interest-based advertising and targeted promotion regarding our products. Google has accepted the provisions of the EU-US Privacy Shield. The legal basis for the storage of the cookie is consent pursuant to Art. 6 (1) sentence 1 letter a GDPR. The further evaluation of the collected data for a period of up to two years is based on Art. 6 (1) sentence 1 letter f GDPR.
By implementing this tool, your browser will automatically establish a connection to a Google server. Please note that in this context data processings outside the European Union / the European Economic Area may occur. Google has accepted the provisions of the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework . We have no influence on how the data is handled and further used by Google. The legal basis for the processing of your data for a period of up to two years is Art. 6, para. 1 sentence 1 letter f GDPR.
We also use the retargeting service offered by Outbrain Inc., 39 West 13th Street, 3rd floor, New York, NY 10011, U.S.A. With the help of this function, we can display interest-based advertisements to the users of our website and on other websites using Outbrain. When calling up our website, a tracking pixel will be stored on your browser. When you visit other websites using the Outbrain function, the tracking pixel establishes a connection to your device and you will be shown personalised advertisements based on the websites you previously visited. The legal basis for the storage of the cookie is consent pursuant to Art. 6 (1) sentence 1 letter a GDPR. The further evaluation of the collected data for a period of up to two years is based on Art. 6 (1) sentence 1 letter f GDPR.
We also use the remarketing service provided by Ligatus GmbH, Hohenstaufenring 30-32, D-50674 Köln, Germany. With the help of this function, we can display interest-based advertisements to the users of our website and on other websites using Ligatus. When calling up our website, a tracking pixel will be stored on your browser. When you visit other websites using the Ligatus function, the tracking pixel establishes a connection to your device and you will be shown personalised advertisements based on the websites you previously visited. The legal basis for the storage of the cookie is consent pursuant to Art. 6 (1) sentence 1 letter a GDPR. The further evaluation of the collected data for a period of up to two years is based on Art. 6 (1) sentence 1 letter f GDPR.
By implementing this tool, your browser will automatically establish a connection with a server of rtbLab. We have no influence on the handling and further use of the data by rtbLab. The responsibility for compliance with data protection regulations lies with rtbLab.
Furthermore, we use the rtbLab tool to display personalised advertisements. For this purpose, a hashed ID is shared with rtbLab. In addition to this ID, further statistical data about your company may be transferred to rtbLab and used for advertising purposes (e.g. company size or industry). This coded information helps us to display advertisements that may be of special interest to you.
As explained in this data protection notice, Deutsche Messe AG will in some cases transfer personal data to companies that are based in countries outside the EU / EEA, e.g. the transfer of contact data to subsidiaries and/or sales partners of Deutsche Messe AG where visitors / companies are based abroad.
Where data is transferred to controllers outside the EU / EEA, Deutsche Messe AG will provide for an adequate level of data protection by concluding EU model clauses, unless the recipient of the data is validly registered with the US Data Privacy Shield, the exemptions of Art. 49 GDPR apply, or the EU commission has decided that the recipient country provides for an adequate level of data protection.