Data protection

Information on the processing of personal data pursuant to Art. 13 and 14 GDPR

Version: 30 September 2026

A. General Information and Principles

1. Preamble and Scope

The protection of your personal data is important to us. In this privacy policy, we inform you which personal data we – Pyrum Innovations AG (hereinafter “we” or “us”) – collect, for what purposes and on what legal basis we process it, and what rights you have.

This policy applies to all processing of personal data within our company. It has a modular structure: Part B covers the use of our website, Part C is addressed to job applicants, and Part D deals with further processing situations (customers, employees, suppliers, social media, etc.). The sections relevant to your situation apply to you.

“Personal data” means any information relating to an identified or identifiable natural person (Art. 4(1) GDPR), such as name, address, email address or IP address.

2. Controller

The controller within the meaning of Art. 4(7) GDPR is:

Pyrum Innovations AG
Dieselstraße 8
66763 Dillingen/Saar, Germany
Phone: +49 6831 959 48 0
Email: contact@pyrum.net
Represented by: the Executive Board

3. Data Protection Officer

You can contact our data protection officer at:

Mr Oliver Pikolleck, attorney at law, HiLevDATA GmbH & Co. KG
Email: pikolleck(at)hilevdata.de
Postal address: HiLevDATA GmbH & Co. KG, Amselweg 7, 66564 Ottweiler, Germany; phone: +49 681 37932-18

4. General Information on Data Processing

4.1 Scope of Processing

We process personal data of our users, customers, employees and other data subjects only to the extent necessary to provide a functional website and our services and to fulfil our contractual and legal obligations. Any processing beyond this generally takes place only with consent or on the basis of a legitimate interest.

4.2 Legal Bases

Where we obtain consent for processing operations, Art. 6(1)(a) GDPR serves as the legal basis. For processing necessary for the performance of a contract or to take steps prior to entering into a contract, Art. 6(1)(b) GDPR is the legal basis. Where processing is necessary for compliance with a legal obligation, we rely on Art. 6(1)(c) GDPR. Art. 6(1)(d) GDPR applies to the protection of vital interests. Where processing is necessary for the purposes of a legitimate interest and the interests or fundamental rights of the data subject do not override that interest, Art. 6(1)(f) GDPR serves as the legal basis.

4.3 Storage Period and Erasure

Personal data is erased or blocked as soon as the purpose of storage ceases to apply. Data may be stored beyond this where required by law, in particular to comply with retention periods under commercial and tax law (generally six or ten years pursuant to Section 257 of the German Commercial Code (HGB) and Section 147 of the German Fiscal Code (AO)). Erasure takes place after the respective period has expired, provided the data is no longer required for the performance or initiation of a contract.

4.4 Recipients and Processing on Our Behalf

Your data is only transferred to third parties within the framework of the statutory provisions. Where we use service providers that process personal data on our behalf (e.g. hosting, IT maintenance, shipping service providers), this is done on the basis of a data processing agreement pursuant to Art. 28 GDPR.

4.5 Transfers to Third Countries

Personal data is only transferred to recipients outside the EU/EEA (third countries) if there is an adequacy decision by the European Commission, appropriate safeguards within the meaning of Art. 46 GDPR – in particular EU standard contractual clauses – have been agreed, or one of the exceptions under Art. 49 GDPR applies. We provide information on the specific legal framework of each service in the description of the individual processing operations.

5. Your Rights as a Data Subject

If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis us:

  • Access (Art. 15 GDPR): You can request information about the data processed concerning you and a copy of this data.
  • Rectification (Art. 16 GDPR): You can request the immediate rectification of inaccurate data or the completion of data concerning you.
  • Erasure (Art. 17 GDPR): You can request the erasure of your data unless statutory retention obligations or other exceptions prevent this.
  • Restriction of processing (Art. 18 GDPR): You can request the restriction of processing under the conditions set out therein.
  • Data portability (Art. 20 GDPR): You can request to receive the data concerning you in a structured, commonly used and machine-readable format or to have it transmitted to another controller.
  • Objection (Art. 21 GDPR): You can object, on grounds relating to your particular situation, to processing based on Art. 6(1)(e) or (f) GDPR; you can object to processing for direct marketing purposes at any time.
  • Withdrawal of consent (Art. 7(3) GDPR): You can withdraw any consent given at any time with effect for the future. The lawfulness of processing carried out before the withdrawal remains unaffected.
  • Complaint to a supervisory authority (Art. 77 GDPR): Without prejudice to any other remedy, you can lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement.

The supervisory authority responsible for us is: Unabhängiges Datenschutzzentrum Saarland – Landesbeauftragte für Datenschutz und Informationsfreiheit (Independent Data Protection Centre Saarland), Fritz-Dobisch-Straße 12, 66111 Saarbrücken, Germany.

6. Right to Object in Detail

If the processing of your personal data is based on legitimate interests (Art. 6(1)(f) GDPR), you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data concerned unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

7. No Obligation to Provide Data; No Automated Decision-Making

Where the provision of personal data is required by law or contract or is necessary to conclude a contract, we point this out in the respective context. Decisions based solely on automated processing – including profiling – that produce legal effects concerning you within the meaning of Art. 22 GDPR do not take place unless expressly stated in an individual case.

B. Privacy Policy for Our Website

This part applies to the use of our website www.pyrum.net, including all subpages and functions accessible through it.

1. Provision of the Website and Server Log Files

Each time our website is accessed, our system automatically collects data and information from the accessing device. The following data is collected:

  • the IP address of the requesting device,
  • date and time of access,
  • the page or file accessed (name and URL),
  • the website from which the access originates (referrer URL),
  • the browser used and, where applicable, the operating system and the name of the access provider.

This data is stored in our system’s log files. This data is not stored together with other personal data of the user. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the technically error-free delivery, security and stability of the website and in defending against attacks. The log files are deleted after 60 days at the latest, unless they are exceptionally required for longer to investigate a security incident.

2. Hosting

Our website is operated by an external service provider (host). The personal data collected in this context is stored on the host’s servers. The host is used to provide our online services properly and securely (Art. 6(1)(f) GDPR). We have concluded a data processing agreement with the host pursuant to Art. 28 GDPR. Host: Visual Contact, owner Benno Leinen, Lindenstraße 88, 66787 Wadgassen, Germany.

3. Cookies and Similar Technologies

Our website largely does without cookies. The only cookie used is a technically necessary session cookie of the multilingual plugin WPML, which stores your language selection for the duration of your visit and is automatically deleted when you close the browser. This cookie is not used to track your usage behaviour.

As this cookie is strictly necessary to provide the service you requested – displaying the website in the language you selected – it is permitted without consent under Section 25(2) No. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG); the associated data processing is based on Art. 6(1)(f) GDPR. We do not use cookies that require consent, in particular for analysis or advertising purposes; a cookie banner is therefore not required. External content whose integration may involve access to your device is only loaded after you have actively enabled it (see Section 7 of this Part).

4. Contact (Contact Form and Email)

Our website offers a contact form that you can use to get in touch with us. Alternatively, you can contact us by email. If you use this option, the data entered in the form or sent by email (in particular subject, salutation, name, where applicable company and address, telephone number, email address and your message) is transmitted to us and stored.

If the contact serves the initiation or performance of a contract, the legal basis is Art. 6(1)(b) GDPR. In all other cases, the processing is based on our legitimate interest in responding to your enquiry (Art. 6(1)(f) GDPR). The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected and no statutory retention obligations apply.

If you separately consent in the contact form to receiving company communications by email, this processing is based on your consent pursuant to Art. 6(1)(a) GDPR; consent is voluntary and can be withdrawn at any time with effect for the future.

5. Newsletter

If you subscribe to our newsletter, we use the email address you provide to send it. Subscription takes place using the double opt-in procedure: after subscribing, you receive a confirmation email with which you confirm the subscription. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR. You can unsubscribe from the newsletter and withdraw your consent at any time, for example via the unsubscribe link at the end of each newsletter.

When you subscribe and confirm, we store your IP address as well as the date and time in order to be able to prove the subscription and to investigate any misuse of your email address (Art. 6(1)(c) and (f) GDPR in conjunction with Art. 7(1) GDPR). After you unsubscribe, we delete your data from the mailing list; your email address may be stored in a blocklist that serves exclusively to prevent future unwanted mailings (Art. 6(1)(f) GDPR).

Subscription to and delivery of the newsletter (“Pyrum Updates” or investor newsletter) are handled via the investor relations platform of EQS. The provider is EQS Group, Karlstraße 47, 80333 Munich, Germany. When the subscription form is loaded, a script is loaded from the server ir-api.eqs.com; for technical reasons, your IP address is transmitted to EQS in the process (Art. 6(1)(f) GDPR – functional provision of the form). EQS processes the data collected during subscription as a processor pursuant to Art. 28 GDPR exclusively in accordance with our instructions within the European Union.

Our newsletters contain a tracking pixel and measurable links to evaluate open and click rates. This performance measurement only takes place to the extent covered by your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG); you can end it at any time by unsubscribing from the newsletter.

6. Web Analytics / Reach Measurement

In order to design our website according to demand and to continuously optimise it, we use the open-source analytics software Matomo, which we operate ourselves at matomo.pyrum.net; analytics data is not transferred to third parties or to the software manufacturer. Matomo is configured so that no cookies are set and no information is stored on or read from your device; Section 25 TDDDG is therefore not affected. Your IP address is shortened (anonymised) before storage, so that the usage data collected – in particular pages accessed, time spent on the site, referrer URL and information on browser, operating system and approximate origin – can no longer be attributed to a specific person.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the statistical evaluation and improvement of our online services without involving external analytics services. You can object to the processing at any time pursuant to Art. 21(1) GDPR (Part A, Section 6).

7. Embedded Third-Party Services and Content

Share price data from Deutsche Börse AG (two-click solution): In the investor relations section (“Share”), we embed an iFrame from Deutsche Börse AG, Mergenthalerallee 61, 65760 Eschborn, Germany, to display current price data for the Pyrum share. When the page is loaded, no data is initially transmitted to Deutsche Börse AG. Only when you actively enable the content by clicking on it is a connection established to the servers of deutsche-boerse.com; in particular your IP address and browser information are transmitted, and the provider may store or read information on your device. The legal basis is the consent you give by enabling the content (Art. 6(1)(a) GDPR, Section 25(1) TDDDG); without your approval, the content remains disabled. Information on data processing by Deutsche Börse AG can be found at https://www.deutsche-boerse.com/dbg-de/meta/datenschutz.

Wordfence: To protect the website against cyber attacks and unauthorised access, we use the security service Wordfence provided by Defiant, Inc., 800 5th Ave Ste 4100, Seattle, WA 98104, USA. For this purpose, the website connects to Wordfence servers to compare requests against databases of known attacks and to block them where necessary; in particular, IP addresses are processed. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in ensuring network and information security (cf. Recital 49 GDPR). The transfer to the USA is safeguarded by the European Commission’s standard contractual clauses; a data processing agreement has been concluded with the provider.

Locally hosted content: The fonts used on the website and the available video files are hosted locally on our server; in this respect, no connection to third-party servers is established when a page is accessed. We do not currently embed any other third-party content or services.

8. Online Applications via the Website

If we offer the option of applying online via our website (e.g. careers portal or application form), the provisions in Part C of this privacy policy apply to the processing of your application data. The transmission is encrypted.

C. Privacy Policy for Job Applicants

With the following information, we inform you about the processing of your personal data in the application process and about your rights under the GDPR. The controller is the controller named in Part A, Section 2.

1. Purpose and Scope of Data Processing

We process your personal data in order to carry out the application process and to decide on establishing an employment relationship. In particular, we process the data you submit as part of your application:

  • master data (name, address, date of birth, contact details),
  • application documents (cover letter, CV, references, evidence of qualifications and work experience),
  • information on your professional background, education and qualifications,
  • other information you provide voluntarily (e.g. salary expectations, earliest possible start date, photo), and
  • for online applications, technical access data and, where applicable, metadata of the transmitted files.

2. Legal Bases

The legal basis for processing your application data is Section 26(1) sentence 1 of the German Federal Data Protection Act (BDSG) in conjunction with Art. 88 GDPR and – for the initiation of the employment relationship – Art. 6(1)(b) GDPR. Accordingly, data may be processed that is necessary for the decision on establishing an employment relationship.

If special categories of personal data within the meaning of Art. 9(1) GDPR are processed in the application process (e.g. health data in connection with a severe disability), this is done on the basis of Section 26(3) BDSG or Art. 9(2)(b) GDPR, insofar as the processing is necessary to exercise rights or fulfil obligations under employment law. Where consent is required, it is governed by Section 26(2) BDSG or Art. 9(2)(a) GDPR.

3. Voluntary Nature and Necessity of the Information

The provision of your application data is neither required by law nor by contract. You are not obliged to provide us with your data. However, without the information and documents required to assess your suitability, we cannot decide on your application or establish an employment relationship. Please only send us special categories of personal data that are necessary for the process.

4. Recipients of the Data

Within our company, only those departments and persons who need your application data to carry out the application process and decide on your application have access to it (in particular the HR department, the specialist and management level responsible for the position to be filled and, where applicable, the management board). If a works council exists, it is involved within the scope of its statutory participation rights (Section 99 of the German Works Constitution Act (BetrVG)).

5. Storage Period and Erasure

If an employment relationship is established, your application data is transferred to the personnel file system and further processed for the purposes of the employment relationship.

If no employment relationship is established, we generally delete your application data six months after the end of the application process (receipt of the rejection). Storage for this period is based on our legitimate interest in defending against possible claims (Art. 6(1)(f) GDPR), in particular with regard to the time limits of the German General Equal Treatment Act (Section 15(4) AGG). After this period has expired, the data is deleted or the documents destroyed, unless there is a statutory retention obligation or you have consented to further storage.

6. Inclusion in Our Talent Pool

If you expressly consent to further storage of your application data for future job offers, we will include you in our talent pool. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR. In this case, the data is stored for the period stated in the declaration of consent and then deleted. You can withdraw your consent at any time with effect for the future.

7. Source of the Data

As a rule, we collect application data directly from you. If we receive data from other sources – for example from a recruitment agency, a professional network or a job board – we will inform you of this in accordance with Art. 14 GDPR. In these cases, we process the contact and qualification data publicly available or transmitted there.

8. No Automated Decision-Making

No decision based solely on automated processing – including profiling – within the meaning of Art. 22 GDPR is made in the application process. The selection decision is made by the responsible persons.

9. Your Rights

As an applicant, you also have the rights set out in Part A, Section 5 (access, rectification, erasure, restriction, data portability, objection, withdrawal of consent and complaint to a supervisory authority).

D. Further Processing Situations

1. Customers, Prospects and Business Partners

We process personal data of our customers, prospects and business partners (in particular master, contact, contract and billing data) to initiate, conclude and perform contracts and to maintain business relationships. The legal basis is Art. 6(1)(b) GDPR (contract/pre-contractual measures), Art. 6(1)(c) GDPR for legal obligations and Art. 6(1)(f) GDPR for maintaining existing business relationships and direct marketing to existing customers. Erasure is governed by Part A, Section 4.3.

2. Employees

We process personal data of our employees to establish, perform and terminate the employment relationship. The legal basis is Section 26(1) BDSG in conjunction with Art. 88 GDPR and Art. 6(1)(b) and (c) GDPR. Details are set out separately in an internal employee privacy notice or works agreement.

3. Suppliers and Service Providers

To process orders, contracts and payments, we process the contact and contract data of our suppliers and service providers and their contact persons. The legal basis is Art. 6(1)(b) and (c) GDPR and, for handling the cooperation, Art. 6(1)(f) GDPR.

4. Social Media Presence

We maintain profiles on social networks (LinkedIn, Instagram, Facebook and YouTube) in order to communicate with users registered there and to provide information about our company. When you visit our profiles, the respective providers process personal data under their own responsibility; in some cases there is joint controllership pursuant to Art. 26 GDPR. The legal basis for our processing is our legitimate interest in public relations and communication (Art. 6(1)(f) GDPR). We have only limited influence on data processing by the platform operators; their privacy policies apply.

5. Video Surveillance

Where we use video surveillance on our business premises or company grounds, this serves to protect against criminal offences and to exercise our domiciliary rights. The legal basis is Art. 6(1)(f) GDPR. Signs draw attention to the surveillance. Recordings are deleted after 72 hours at the latest unless they are required to investigate a specific incident.

6. Whistleblower System

We have set up a whistleblower system in accordance with the German Whistleblower Protection Act (HinSchG) through which our employees and other persons who are in contact with us in connection with their professional activities can report legal violations confidentially – anonymously if they wish. The following external reporting office (ombudsperson) has been appointed:

Mr Oliver Pikolleck
Attorney at law
HiLevDATA GmbH & Co. KG
Amselweg 7, 66564 Ottweiler, Germany
Email: pikolleck(at)hilevdata.de

In connection with a report, we or the ombudsperson process the information on the reporting person (if provided), the information on the persons named in the report and the content of the report exclusively to receive and review the report and to take follow-up action. The legal basis is Art. 6(1)(c) GDPR in conjunction with Section 10 HinSchG. The identity of the whistleblower and of the persons affected by a report is treated confidentially in accordance with Section 8 HinSchG. The documentation of the report is deleted three years after completion of the procedure pursuant to Section 11(5) HinSchG, unless its further retention is necessary and proportionate to meet legal requirements or for the establishment, exercise or defence of legal claims. If the whistleblower provides their contact details, they will receive an acknowledgement of receipt within seven days and feedback on the follow-up action taken within three months (Section 17 HinSchG).

7. Data Security (Technical and Organisational Measures)

In accordance with Art. 32 GDPR, we take appropriate technical and organisational measures to ensure a level of protection appropriate to the risk, in particular to protect against unauthorised access, loss, alteration or disclosure of personal data. These include, among other things, the use of encryption (e.g. TLS/SSL for data transmission), access and authorisation concepts, pseudonymisation and regular review and updating of the measures.

8. Changes to This Privacy Policy

We will adapt this privacy policy as soon as changes to the data processing we carry out or to the legal framework make this necessary. The current version published on our website applies. Date of this version: 30 September 2026.