Data Privacy

Information on data processing for this website in accordance with Art. 13 of the EU General Data Protection Regulation (GDPR) when collecting personal data from the data subject (Version: GDPR 2.1 of September 2025)

GLW GmbH is responsible for this website and, as a provider of a teleservice, must inform you at the beginning of your visit about the type, scope, and purposes of the collection and use of personal data in a precise, transparent, understandable, and easily accessible form in clear and simple language. This content must be available to you at all times.

We attach great importance to the security of your data and compliance with data protection regulations. The processing of personal data is subject to the provisions of the currently applicable European and national laws.

The following data protection information is intended to show you how we handle your personal data and how you can contact us:

GLW GmbH Steinbeisstr. 2 D-88353 Kisslegg Germany

Managing Directors: Florian Geier, Leonie Schelling, Felix Weiland

Phone: +49 7563 9123-0 Email: info@glw.de

Our data protection officer Sven Lenz Datenschutzkanzlei Lenz GmbH & Co. KG Bahnhofstraße 50 87435 Kempten Germany

If you have any questions about data protection or other data protection issues, please feel free to send an email to the data protection team: dsb@glw.de

A. General

For the sake of clarity, we do not differentiate between genders. In the interests of equal treatment, the relevant terms apply to all genders. The meaning of the terms used, such as “personal data” or “processing,” can be found in Art. 4 GDPR.

The personal data processed within the scope of this website includes

• inventory data (e.g., names and addresses of customers),
• usage data (e.g., pages visited on our website), and
• content data (e.g., entries in online forms).

B. Specific

Data protection information We guarantee that we will only process your data in connection with the processing of your inquiries, for internal purposes, and to provide the services or content you have requested.

Principles of data processing We process your personal data only in compliance with the relevant data protection regulations and on the following legal bases:

-Processing for the performance of our services and the implementation of contractual measures Art. 6 (1) lit. b) GDPR

-Processing for the fulfillment of our legal obligations Art. 6 (1) lit. c) GDPR

-Consent Art. 6 (1) (a) and Art. 7 GDPR

-Processing to safeguard our legitimate interests Art. 6 (1) (f) GDPR Data transfer to third parties We would like to point out that when using our website, data may be transferred if you select services offered via the “cookie consent tool” provided on the website. If you do not select any services, no data will be transferred to third parties.

As part of website hosting, the service provider used may have access to your data. We have outlined which web host we use in this privacy policy.

If we use subcontractors to provide our services, we take appropriate legal precautions and technical and organizational measures to ensure the protection of personal data in accordance with the relevant legal provisions.

Data transfer to a third country or an international organization Third countries are countries in which the GDPR is not directly applicable law. This basically includes all countries outside the EU or the European Economic Area.

We would like to point out that when using our website, data may be transferred to a third country if you select services offered via the “cookie consent tool” provided on the website. If you do not select any services, no data will be transferred to a third country.

The adequacy decision of the EU Commission is taken into account here. This states that it is a safe third country or a safe international organization that offers an adequate level of protection.

The following applies to data transfers to the US: Since July 2023, there has been an adequacy decision by the EU Commission (Data Privacy Framework), which identifies the US as a third country with a level of data protection comparable to that of the EU. The adequacy decision can now serve as the basis for data transfers to certified organizations in the US.

The US services used are certified under the Data Privacy Framework. Details can be found in the individual services.

Storage period of your personal data We adhere to the principles of data minimization and data avoidance. This means that we only store your data for as long as is necessary to fulfill the aforementioned purposes or as stipulated by the various storage periods provided for by law. If the respective purpose no longer applies or after the expiry of the corresponding periods, your data will be routinely blocked or deleted in accordance with the statutory provisions.

Contact When you contact us electronically (e.g., via contact form or email), personal data is processed. The information you provide will be stored exclusively for the purpose of processing your inquiry and for possible follow-up questions.

We would like to inform you of the legal basis for this: • Processing for the fulfillment of our services and the implementation of contractual measures Art. 6 (1) (b) GDPR

We would like to point out that emails can be read or altered without authorization and without notice during transmission. We would also like to point out that we use software to filter unwanted emails (spam filter). The spam filter may reject emails if they are incorrectly identified as spam due to certain characteristics. What are your rights? a) Right to information You have the right to obtain information about your stored data free of charge. Upon request, we will inform you in writing which personal data we have stored about you. This also includes the origin and recipients of your data as well as the purpose of data processing.

b) Right to correction You have the right to have your data stored by us corrected if it is incorrect. In this case, you can request a restriction of processing, e.g. if you dispute the accuracy of your personal data.

c) Right to blocking Furthermore, you can have your data blocked. In order for your data to be blocked at any time, this data must be stored in a block file for control purposes.

d) Right to erasure You can request the erasure of your personal data, provided that there are no legal retention obligations. If such an obligation exists, we will block your data upon request. If the relevant legal requirements are met, we will also erase your personal data without your request.

e) Right to data portability You are entitled to request that we provide the personal data you have submitted to us in a format that allows it to be transferred to another location.

f) Right to lodge a complaint with a supervisory authority You have the option of lodging a complaint with one of the data protection supervisory authorities.

The data protection authority responsible for us:

The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg Postal address: P.O. Box 10 29 32, 70025 Stuttgart, Germany Street address: Lautenschlagerstraße 20, 70173 Stuttgart, Germany Phone +49 711 615541–0 Fax: +49 711 615541–15 Email: poststelle@lfdi.bwl.de Website: https://www.baden-wuerttemberg.datenschutz.de

You can open the complaint form via the following link: https://www.baden-wuerttemberg.datenschutz.de/online-beschwerde

Note: Complaints may also be submitted to any data protection supervisory authority within the EU.

g) Right to object You have the right to object to the processing of your data at any time for reasons arising from your particular situation; this also applies to profiling based on these provisions.

We will then no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing serves to assert, exercise, or defend legal claims.

If personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for the purpose of such marketing; this also applies to profiling insofar as it is related to such direct marketing. In the event of such an objection, we will no longer process your personal data for direct marketing purposes. To do so, simply send us an email.

h) Right of revocation You have the option at any time to revoke your consent to the processing of your data with effect for the future without giving reasons. Revocation will not result in any disadvantages for you. To do so, simply send us an email.

However, such revocation does not affect the lawfulness of the processing carried out up to the time of revocation on the legal basis of Art. 6 (1) (a) GDPR.

To assert your rights as a data subject, please send us an email to one of the above-mentioned email addresses.

Protection of your personal data We take state-of-the-art contractual, technical, and organizational security measures to ensure compliance with data protection laws and to protect the processed data against accidental or intentional manipulation, loss, destruction, or access by unauthorized persons.

The security measures include, in particular, the encrypted transmission of data between your browser and our server. For this purpose, 256-bit SSL (AES 256) encryption technology is used.

Your personal data is protected in the following ways (excerpt): a) Maintaining the confidentiality of your personal data In order to maintain the confidentiality of your data stored with us, we have taken various measures to control access and access rights.

b) Maintaining the integrity of your personal data In order to maintain the integrity of your data stored with us, we have taken various measures to control data transfer and input.

c) Maintaining the availability of your personal data In order to maintain the availability of your data stored with us, we have taken various measures to control orders and availability.

The security measures in use are continuously improved in line with technological developments. Despite these precautions, we cannot guarantee the security of your data transmission to our website due to the uncertain nature of the Internet. Therefore, any data transmission by you is at your own risk.

Protection of minors Persons under the age of 16 may only provide us with personal information if they have the express consent of their legal guardians. This data will be processed in accordance with this privacy policy.

Server log files The provider of the pages automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These are:

• Browser type and browser version • Operating system used • Referrer URL • Host name of the accessing computer • Time of the server request • IP address

This data is not merged with other data sources.

The basis for data processing is our legitimate interest pursuant to Art. 6 (1) lit. f) GDPR.

Online applications via a form We offer applicants a career section on our website where we advertise vacant positions. Applications for these positions can be submitted via an online form, which is accessed via a redirect to a subpage. In order to be included in the application process, applicants must provide us with all the personal data required for a sound and informed assessment and selection via the form.

Information obligations within the scope of the application process are provided directly in the form as a link.

Login for dealers We offer a “MY GLW” section on our website. This is an internal area for our dealers. If you are interested in login details, please contact us and we will provide you with the relevant access data.

Cookies Cookies are small text files that are stored locally in the cache of your Internet browser. Cookies enable, for example, the recognition of the Internet browser. The files are used to help the browser navigate through the website and to make full use of all functions.

Cookie consent tool We use a so-called “cookie consent tool” to obtain effective user consent for cookies and cookie-based applications that require consent.

This website uses the cookie consent tool “Cookiebot.” Cookiebot is a company of Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark.

The “cookie consent tool” is displayed to users when they visit the site in the form of an interactive user interface, on which consent for certain cookies and/or cookie-based applications can be given by ticking a box. When using this tool, all cookies/services requiring consent are only loaded if the respective user grants the corresponding consent by ticking the box. This ensures that such cookies are only set on the user's device if consent has been given.

The tool sets technically necessary cookies to store your cookie preferences. Personal user data is not processed in this process.

If, in individual cases, the storage, assigning or logging cookie settings, this is done in accordance with Art. 6 (1) lit. f GDPR on the basis of our legitimate interest in legally compliant, user-specific, and user-friendly consent management for cookies and, consequently, in the legally compliant design of our website.

A further legal basis for processing is Art. 6 (1) (c) GDPR. As the controller, we are subject to the legal obligation to make the use of technically unnecessary cookies dependent on the respective user consent.

Further information about the operator and the setting options of the cookie consent tool can be found directly in the corresponding user interface on our website.

Server log files The provider of the pages automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These are:

• Browser type and browser version • Operating system used • Referrer URL • Host name of the accessing computer • Time of the server request • IP address

This data is not merged with other data sources.

The basis for data processing is our legitimate interest pursuant to Art. 6 (1) lit. f) GDPR.

Online applications via a form We offer applicants a career section on our website where we advertise vacant positions. Applications for these positions can be submitted via an online form, which is accessed via a redirect to a subpage. In order to be included in the application process, applicants must provide us with all the personal data required for a sound and informed assessment and selection via the form.

Information obligations within the scope of the application process are provided directly in the form as a link.

Login for dealers We offer a “MY GLW” section on our website. This is an internal area for our dealers. If you are interested in login details, please contact us and we will provide you with the relevant access data.

Cookies Cookies are small text files that are stored locally in the cache of your Internet browser. Cookies enable, for example, the recognition of the Internet browser. The files are used to help the browser navigate through the website and to make full use of all functions.

Cookie consent tool We use a so-called “cookie consent tool” to obtain effective user consent for cookies and cookie-based applications that require consent.

This website uses the cookie consent tool “Cookiebot.” Cookiebot is a company of Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark.

The “cookie consent tool” is displayed to users when they visit the site in the form of an interactive user interface, on which consent for certain cookies and/or cookie-based applications can be given by ticking a box. When using this tool, all cookies/services requiring consent are only loaded if the respective user grants the corresponding consent by ticking the box. This ensures that such cookies are only set on the user's device if consent has been given.

The tool sets technically necessary cookies to store your cookie preferences. Personal user data is not processed in this process.

If, in individual cases, the storage, assigning or logging cookie settings, this is done in accordance with Art. 6 (1) lit. f GDPR on the basis of our legitimate interest in legally compliant, user-specific, and user-friendly consent management for cookies and, consequently, in the legally compliant design of our website.

A further legal basis for processing is Art. 6 (1) (c) GDPR. As the controller, we are subject to the legal obligation to make the use of technically unnecessary cookies dependent on the respective user consent.

Further information about the operator and the setting options of the cookie consent tool can be found directly in the corresponding user interface on our website.

Website hosting We use the system of the following provider to host our website and display the page content: IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany.

All data collected on our website is processed on the provider's servers. We have concluded a data processing agreement with the provider that ensures the protection of our website visitors' data and prohibits unauthorized disclosure to third parties.

Google Tag Manager We use the Google Tag Manager service from Google. " Google is a group of companies consisting of Google Ireland Ltd. (service provider), Gordon House, Barrow Street, Dublin 4, Ireland, Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, and other companies affiliated with Google LLC.

Google Tag Manager is a support service and only processes personal data for technically necessary purposes. Google Tag Manager ensures that other components are loaded, which in turn may collect data. Google Tag Manager does not access this data.

To the extent required by law, we have obtained your consent to the processing of your data as described above in accordance with Art. 6 (1) lit. a GDPR in conjunction with § 25 TDDDG. You can revoke your consent at any time with effect for the future. To exercise your right of revocation, deactivate this service in the “Cookie Consent Tool” provided on the website.

Data may be transferred to a third country (in this case, the USA) or an international organization. Since July 2023, there has been an adequacy decision by the EU Commission (Data Privacy Framework), which identifies the USA as a third country with a level of data protection comparable to that of the EU. The adequacy decision can now serve as a basis for data transfers to certified organizations in the USA. According to the list of certified companies published by the US Department of Commerce, Google LLC is listed as a certified company.

For more information about Google Tag Manager, please refer to Google's privacy policy: https://policies.google.com/privacy?hl=de&gl=de

hCaptcha (bot/spam protection) Our website uses the “hCaptcha” service from Intuition Machines Inc., 1065 SW 8th St #704 Miami, FL 33130, USA to protect against spam software and abuse by non-human visitors (so-called “bots”). To do this, hCaptcha analyzes the behavior of the website visitor based on various characteristics. The analysis is performed in “invisible mode” and therefore takes place entirely in the background. The process starts automatically as soon as you visit the website with hCaptcha activated. For the analysis, hCaptcha evaluates various information, such as the IP address or mouse movements. Data processing is based on Art. 6 (1) (f) GDPR. Our legitimate interest is to protect our website from misuse and spam.

When using hCaptcha, personal data may also be transferred to the servers of Intuition Machines Inc. in the USA.

Since July 2023, there has been an adequacy decision by the EU Commission (Data Privacy Framework), which identifies the USA as a third country with a level of data protection comparable to that of the EU. The adequacy decision can now serve as a basis for data transfers to certified organizations in the USA. According to the list of certified companies published by the US Department of Commerce, Google LLC is listed as a certified company.

Further information on data processing in connection with hCaptcha can be found at https://www.hcaptcha.com/privacy.

Use of YouTube videos We use the YouTube implementation function to display and play videos from the provider “YouTube,” which belongs to Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”).

To the extent required by law, we have obtained your consent to the processing of your data as described above in accordance with Art. 6 (1) (a) GDPR in conjunction with § 25 TDDDG.

You can revoke your consent at any time with effect for the future. To exercise your right of revocation, deactivate this service in the “Cookie Consent Tool” provided on the website.

Data is transferred to a third country (in this case, the USA) or an international organization. Since July 2023, there has been an adequacy decision by the EU Commission (Data Privacy Framework), which identifies the USA as a third country with a level of data protection comparable to that of the EU. The adequacy decision can now serve as a basis for data transfers to certified organizations in the USA. According to the list of certified companies published by the US Department of Commerce, Google LLC is listed as a certified company.

According to YouTube, cookies are set for purposes including collecting video statistics, improving user-friendliness, and preventing abusive behavior. If you are logged in to Google, your data will be directly associated with your account when you click on a video. If you do not want this association with your YouTube profile, you must log out before activating the button.

Google stores your data (even for users who are not logged in) as usage profiles and evaluates them. You have the right to object to the creation of these user profiles, whereby you must contact YouTube to exercise this right. Regardless of whether the embedded videos are played, a connection to the Google network is established each time this website is accessed, which may trigger further data processing operations beyond our control. Further information on data protection at YouTube can be found in the provider's privacy policy at: https://www.google.de/intl/de/policies/privacy

Newsletter If you subscribe to our email newsletter, we will send you regular information about our offers. Personal data is collected for this purpose. The only mandatory information required to send the newsletter is your email address. The provision of any further data is voluntary and will be used to address you personally.

We use this data for our own advertising purposes in the form of the email newsletter and for tracking, provided you expressly consent to this by clicking the “Submit” button.

We use the double opt-in procedure to send the newsletter.

This means that we will only send you the email newsletter once you have expressly confirmed that you agree to receive it. We will then send you a confirmation email. This means that we will only send you an email newsletter once you have expressly confirmed that you consent to receiving the newsletter. We will then send you a confirmation email asking you to confirm that you wish to receive the newsletter in future by clicking on the corresponding link.

By activating the confirmation link, you give us your consent to use your personal data in accordance with Art. 6 (1) (a) GDPR. When you register for the newsletter, we store your IP address entered by your Internet service provider (ISP) as well as the date and time of registration in order to be able to trace any possible misuse of your email address at a later date.

You can unsubscribe from the newsletter at any time using the link provided in the newsletter or by sending us a message to info@glw.de. Once you have unsubscribed, your email address will be immediately deleted from our newsletter distribution list and added to a block file to ensure that your withdrawal is respected.

Newsletter dispatch via CleverReach Our email newsletters are sent via the technical service provider CleverReach GmbH & Co. KG, Mühlenstr. 43, 26180 Rastede (“CleverReach”), to whom we pass on the data you provided when registering for the newsletter. This transfer is carried out in accordance with Art. 6 (1) lit. f GDPR and serves our legitimate interest in using an effective, secure, and user-friendly newsletter system. The data you enter for the purpose of receiving the newsletter (e.g., email address) is stored on CleverReach's servers in Germany or Ireland.

CleverReach uses this information to send and statistically evaluate the newsletters on our behalf. For evaluation purposes, the newsletters sent by email contain so-called web beacons or tracking pixels, which are single-pixel image files stored on our website. This allows us to determine whether a newsletter message has been opened and which links, if any, have been clicked on. With the help of so-called conversion tracking, it is also possible to analyze whether a predefined action (e.g., purchase of a product on our website) took place after clicking on such links. In addition, technical information is collected (e.g., time of access, IP address, browser type, and operating system). The data is collected exclusively in pseudonymized form and is not linked to your other personal data; direct personal reference is excluded. This data is used exclusively for the statistical analysis of newsletter campaigns. The results of these analyses can be used to better tailor future newsletters to the interests of the recipients.

If you wish to object to data analysis for statistical evaluation purposes, you must unsubscribe from the newsletter.

We have concluded a data processing agreement with CleverReach, which obliges CleverReach to protect our customers' data and not to pass it on to third parties.

Further information on data analysis by CleverReach can be found here: https://www.cleverreach.com/de/funktionen/reporting-und-tracking/

You can view CleverReach's privacy policy here: https://www.cleverreach.com/de/datenschutz/ Social networks In addition to this online offering, we also maintain a presence on various social media platforms, which you can access via the corresponding buttons on our website. When you visit such a presence, personal data may be transmitted to the provider of the social network. It is possible that, in addition to storing the data you specifically enter in this social medium, further information may also be processed by the provider of the social network.

Further information can be found in our social media privacy policy at the following link: https://www.glw.de/datenschutz-socialmedia

Changes to our privacy policy We reserve the right to amend our data protection information at short notice so that it always complies with current legal requirements or to implement changes to our services. This may, for example, relate to the introduction of new services. The new data protection information will then apply to your next visit.