Privacy policy
Protecting your personal data is a central concern of the HOMAG Group.
We are very delighted that you have shown interest in our enterprise. Data protection
is of a particularly high priority for the management of the HOMAG Group AG. The
use of the Internet pages of the HOMAG Group AG is possible without any indicationof personal data; however, if a data subject wants to use special enterprise services
via our website, processing of personal data could become necessary. If theprocessing of personal data is necessary and there is no statutory basis for suchprocessing, we generally obtain consent from the data subject.
The processing of personal data, such as the name, address, e-mail address, or
telephone number of a data subject shall always be in line with the General Data
Protection Regulation (GDPR), and in accordance with the country-specific dataprotection regulations applicable to the HOMAG Group AG. By means of this dataprotection declaration, our enterprise would like to inform the general public of thenature, scope, and purpose of the personal data we collect, use and process.
Furthermore, data subjects are informed, by means of this data protection
declaration, of the rights to which they are entitled.
As the controller, the HOMAG Group AG has implemented numerous technical andorganizational measures to ensure the most complete protection of personal dataprocessed through this website. However, Internet-based data transmissions may inprinciple have security gaps, so absolute protection may not be guaranteed. For thisreason, every data subject is free to transfer personal data to us via alternativemeans, e.g. by telephone.
With the following privacy policy we would like to inform you which types of yourpersonal data (hereinafter also abbreviated as "data") we process for which purposes
and in which scope. The privacy statement applies to all processing of personal datacarried out by us, both in the context of providing our services and in particular on our
websites, in mobile applications and within external online presences, such as oursocial media profiles (hereinafter collectively referred to as "online services").
The terms used are not gender-specific.

Name and Address of the controller
Controller for the purposes of the General Data Protection Regulation (GDPR), otherdata protection laws applicable in Member states of the European Union and otherprovisions related to data protection is:
HOMAG Group AG
Homagstr. 3-5
72296 Schopfloch
Germany
Phone: +49 7443 130 0
Email: info@homag.com
Website: www.homag.com
Internal use only

Name and Address of the Data Protection Officer
The Data Protection Officer of the controller is:
Data Protection Officer
Norbert Mensak
HOMAG Group AG
Homagstr. 3-5
72296 Schopfloch
Germany
Phone: +49 7443 13 2405
Email: norbert.mensak@homag.com
Website: www.homag.com
Any data subject may, at any time, contact our Data Protection Officer directly with allquestions and suggestions concerning data protection.
Wenbin Xiao
IT
685 Fangta North Road
Songjiang District
Shanghai, China
Tel: +86 21 3774 7019

Overview of processing operations
The following table summarises the types of data processed, the purposes for which
they are processed and the concerned data subjects.

Categories of Processed Data
•
•
•
•
•
•
•
•
•
•
•

Inventory data.
Payment Data.
Contact data.
Content data.
Contract data.
Usage data.
Meta/communication data.
Job applicant details.
Images and/ or video recordings.
Audio recordings.
Event Data (Facebook).

Categories of Data Subjects••••

Customers.
Employees.
Prospective customers.
Communication partner.

Internal use only

•
•
•
•

Users.
Job applicants.
Participants in sweepstakes and competitions.
Business and contractual partners.

Purposes of Processing
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•

Provision of contractual services and customer support.
Contact requests and communication.
Security measures.
Direct marketing.
Web Analytics.
Office and organisational procedures.
Remarketing.
Conversion tracking.
Affiliate Tracking.
Managing and responding to inquiries.
Job Application Process.
Conducting sweepstakes and contests.
Feedback.
Polls and Questionnaires.
Marketing.
Profiles with user-related information.
Custom Audiences.
Authentication processes.
Provision of our online services and usability.
Assessment of creditworthiness.

Automated Individual Decision-Making•

Credit report.

Legal Bases for the Processing
In the following, you will find an overview of the legal basis on which we base theprocessing of personal data.
•

Consent•

Performance of a contract and prior requests•

Compliance with a legal obligation•

Job application process as a pre-contractual or contractual relationship•

Performance of a contract and prior requests

Internal use onlySecurity Precautions
We take appropriate technical and organisational measures in accordance with thelegal requirements, taking into account the state of the art, the costs ofimplementation and the nature, scope, context and purposes of processing as well as
the risk of varying likelihood and severity for the rights and freedoms of natural
persons, in order to ensure a level of security appropriate to the risk.
The measures include, in particular, safeguarding the confidentiality, integrity andavailability of data by controlling physical and electronic access to the data as well as
access to, input, transmission, securing and separation of the data. In addition, we
have established procedures to ensure that data subjects' rights are respected, thatdata is erased, and that we are prepared to respond to data threats rapidly.
Furthermore, we take the protection of personal data into account as early as thedevelopment or selection of hardware, software and service providers, in accordancewith the principle of privacy by design and privacy by default.
Masking of the IP address: If IP addresses are processed by us or by the service
providers and technologies used and the processing of a complete IP address is notnecessary, the IP address is shortened (also referred to as "IP masking"). In thisprocess, the last two digits or the last part of the IP address after a full stop are
removed or replaced by wildcards. The masking of the IP address is intended toprevent the identification of a person by means of their IP address or to make such
identification significantly more difficult.
SSL encryption (https): In order to protect your data transmitted via our online
services in the best possible way, we use SSL encryption. You can recognize suchencrypted connections by the prefix https:// in the address bar of your browser.

Transmission of Personal Data
In the context of our processing of personal data, it may happen that the data istransferred to other places, companies or persons or that it is disclosed to them.
Recipients of this data may include, for example, service providers commissioned
with IT tasks or providers of services and content that are embedded in a website. In
such a case, the legal requirements will be respected and in particular corresponding
contracts or agreements, which serve the protection of your data, will be concluded
with the recipients of your data.
Data Transmission within the Group of Companies: We may transfer personal data toother companies within our group of companies or otherwise grant them access tothis data.

Joint CRM system
The companies of the Dürr Group - which include the HOMAG Group - operate a joint
customer database (CRM system).
You can view the companies of the Dürr Group here https://www.durrgroup.com/fileadmin/durr-group.com/Home/duerr-privacy-notice.pdf.

Internal use onlyService provider: salesforce.com Germany GmbH, Erika-Mann-Str. 31, 80636
München, Germany
We fully comply with applicable law in operating this joint customer database.

International data transfers
If we data a third country , this will only take place in accordance with the legal
requirements.

Erasure of data
The data processed by us will be erased in accordance with the statutory provisions
as soon as their processing is revoked or other permissions no longer apply (e.g. if
the purpose of processing this data no longer applies or they are not required for the
purpose).
If the data is not deleted because they are required for other and legally permissible
purposes, their processing is limited to these purposes. This means that the data will
be restricted and not processed for other purposes. This applies, for example, to datathat must be stored for commercial or tax reasons or for which storage is necessary
to assert, exercise or defend legal claims or to protect the rights of another natural or
legal person.
In the context of our information on data processing, we may provide users withfurther information on the deletion and retention of data that is specific to therespective processing operation.

Use of Cookies
Cookies are small text files or other data records that store information on end
devices and read information from the end devices. For example, to store the login
status in a user account, the contents of a shopping cart in an e-shop, the contents
accessed or the functions used. Cookies can also be used for various purposes, e.g.
for purposes of functionality, security and convenience of online offers as well as thecreation of analyses of visitor flows.
We use cookies in accordance with law. For example, we obtain prior consent fromusers, except when it is not required by law. You can also change your cookie
settings at any time.

Business services
We process data of our contractual and business partners, e.g. customers andinterested parties (collectively referred to as "contractual partners") within the context
of contractual and comparable legal relationships as well as associated actions andcommunication with the contractual partners or pre-contractually, e.g. to answer
inquiries.

Internal use onlyWe process this data in order to fulfill our contractual obligations. Contractual
partners will be informed about further forms of processing, e.g. for marketing
purposes, within the scope of this privacy policy.

Consulting
We process the data of our clients, clients as well as interested parties and otherclients or contractual partners (uniformly referred to as "clients") in order to provide
them with our consulting services. The data processed, the type, scope and purposeof the processing and the necessity of its processing are determined by theunderlying contractual and client relationship.
Insofar as it is necessary for the fulfilment of our contract, for the protection of vitalinterests or by law, or with the consent of the client, we disclose or transfer theclient's data to third parties or agents, such as authorities, courts, subcontractors,
third parties in the field of IT, or third parties providing comparable services 1.
Project and Development Services
We process the data of our customers and clients (hereinafter uniformly referred toas "customers") in order to enable them to select, acquire or commission the selected
services or works as well as associated activities and to pay for and make available
such services or works or to perform such services or works.
The required information is indicated as such within the framework of the conclusionof the agreement, order or equivalent contract and includes the information required
for the provision of services and invoicing as well as contact information in order tobe able to hold any consultations. Insofar as we gain access to the information of end
customers, employees or other persons, we process it in accordance with the legal
and contractual requirements.
Software and Platform Services
We process the data of our users, registered and any test users (hereinafter
uniformly referred to as "users") in order to provide them with our contractual
services. The required details are identified as such within the context of theconclusion of the agreement, order or comparable contract and include the details
required for the provision of services and invoicing as well as contact information inorder to be able to hold any further consultations.
Technical and Engineering services
We process the data of our customers and clients (hereinafter uniformly referred toas "customers") in order to enable them to select, acquire or commission the selected
services or works as well as associated activities and to pay for and make available
such services or works or to perform such services or works.

Internal use only

The required information is indicated as such within the framework of the conclusionof the agreement, order or equivalent contract and includes the information required
for the provision of services and invoicing as well as contact information in order tobe able to hold any consultations. Insofar as we gain access to the information of end
customers, employees or other persons, we process it in accordance with the legal
and contractual requirements.

Consulting
Insofar as it is necessary for our contractual performance or required by law, or if theconsent of the customer has been obtained, we disclose or transfer the customer's
data to third parties or agents, such as authorities, courts, third parties in the field of
IT, or third parties providing comparable services, in compliance with the contractualand legal requirements2.
Processed data types: Inventory data (e.g. names, addresses); Payment Data (e.g.
bank details, invoices, payment history); Contact data (e.g. e-mail, telephone
numbers); Contract data (e.g. contract object, duration, customer category); Usage
data (e.g. websites visited, interest in content, access times); Meta/communication
data (e.g. device information, IP addresses).

Provision of online services and web hosting
In order to provide our online services securely and efficiently, we use the services of
one or more web hosting providers from whose servers (or servers they manage) the
online services can be accessed. For these purposes, we may use infrastructure andplatform services, computing capacity, storage space and database services, as well
as security and technical maintenance services.
The data processed within the framework of the provision of the hosting services may
include all information relating to the users of our online services that is collected in
the course of use and communication. This regularly includes the IP address, which
is necessary to be able to deliver the contents of online services to browsers, and all
entries made within our online services or from websites.

Special Notes on Applications (Apps)
We process the data of the users of our application to the extent necessary toprovide the users with the application and its functionalities, to monitor its security
and to develop it further. Furthermore, we may contact users in compliance with thestatutory provisions if communication is necessary for the purposes of administrationor use of the application.
Legal basis: The processing of data is necessary for the provision of thefunctionalities of the application.

.

Internal use only

Contact and Inquiry Management
When contacting us (e.g. via contact form, e-mail, telephone or via social media) as
well as in the context of existing user and business relationships, the information of
the inquiring persons is processed to the extent necessary to respond to the contact
requests and any requested measures.
The response to the contact inquiries as well as the management of contact andinquiry data in the context of contractual or pre-contractual relationships is carried out
to fulfill our contractual obligations or to respond to (pre)contractual inquiries andotherwise on the basis of legitimate interests in responding to the inquiries andmaintaining user or business relationships.
Processed data types: Basic data (e.g. names, addresses); Contact data (e.g. e-mail,telephone numbers); Content data (e.g. text input, photographs, videos); Payment
Data (e.g. bank details, invoices, payment history); Contract data (e.g. contract
object, duration, customer category); Usage data (e.g. websites visited, interest incontent, access times); Images and/ or video recordings (e.g. photographs or video
recordings of a person).

Video Conferences, Online Meetings, Webinars andScreen-Sharing
We use platforms and applications of other providers (hereinafter referred to as"Conference Platforms") for the purpose of conducting video and audio conferences,webinars and other types of video and audio meetings (hereinafter collectively
referred to as "Conference"). When using the Conference Platforms and theirservices, we comply with the legal requirements.
Data processed by Conference Platforms: In the course of participation in a
Conference, the Data of the participants are processed.
Participants please refer to the data privacy information of the Conference Platforms
for details on the processing of your data.
We ask users for their consent to use Conference Platforms. Service providers:Microsoft Ireland Operations Limited, One Microsoft Place, South County Business
Park, Leopardstown, Dublin 18, Ireland.TeamViewer GmbH, Jahnstr. 30, 73037
Göppingen, Germany.

Job Application Process
The application process requires applicants to provide us with the data necessary for
their assessment and selection. The information required can be found in the job
description or, in the case of online forms, in the information contained therein.
In principle, the required information includes personal information such as name,address, a contact option and proof of the qualifications required for a particularInternal use only

employment. Upon request, we will be happy to provide you with additional
information.
Processing of special categories of data3: If special categories of personal data arerequested from applicants, the applicant needs to first provide separate consents.
Erasure of data: In the event of a successful application, the data provided by theapplicants may be further processed by us for the purposes of the employment
relationship. Otherwise, if the application for a job offer is not successful, theapplicant's data will be deleted. Applicants' data will also be deleted if an application
is withdrawn, to which applicants are entitled at any time. Subject to a justified
revocation by the applicant, the deletion will take place at the latest after the expiry ofa period of six months, so that we can answer any follow-up questions regarding theapplication and comply with our duty of proof under the regulations on equal
treatment of applicants. Invoices for any reimbursement of travel expenses arearchived in accordance with tax regulations.
Admission to a talent pool - Admission to a talent pool, if offered, is based onconsent. Applicants are informed that their consent to be included in the talent pool isvoluntary, has no influence on the current application process and that they can
revoke their consent at any time for the future.
Duration of data retention in the applicant pool in months: 3
Processed data types: Job applicant details (e.g. Personal data, postal and contact
addresses and the documents pertaining to the application and the information
contained therein, such as cover letter, curriculum vitae, certificates, etc., as well asother information on the person or qualifications of applicants provided with regard toa specific job or voluntarily by applicants).

Cloud Services
We use Internet-accessible software services (so-called "cloud services" or "Software
as a Service") provided on the servers of its providers for the following purposes:
document storage and administration, calendar management, e-mail delivery,
spreadsheets and presentations, exchange of documents, content and information
with specific recipients or publication of websites, forms or other content andinformation, as well as chats and participation in audio and video conferences.
Within this framework, personal data may be processed and stored on the provider'sservers. This data may include in particular basic data and contact data of data
subjects, data on processes, contracts, other proceedings and their contents. Cloud
service providers also process usage data and metadata that they use for security
and service optimization purposes.
If we use cloud services to provide documents and content to other users or publicly
accessible websites, forms, etc., providers may store cookies on users' devices forweb analysis or to remember user settings.

Internal use only

The legal basis for such data processing is consent or for entering into or
implementing contracts.

Newsletter and Electronic Communications
We send newsletters, e-mails and other electronic communications (hereinafterreferred to as "newsletters") only with the consent of the recipient.

Commercial communication by E-Mail, Postal Mail, Faxor Telephone
We process personal data for the purposes of promotional communication, which
may be carried out via various channels, such as e-mail, telephone, post or fax, in
accordance with the legal requirements.
The recipients have the right to withdraw their consent at any time or to object to theadvertising communication at any time.
Processed data types: Basic data (e.g. names, addresses); Contact data (e.g. e-mail,telephone numbers).

Surveys and Questionnaires
The surveys and questionnaires ("surveys") carried out by us are evaluatedanonymously unless we have your consent. Processed data types: Contact data (e.g.
e-mail, telephone numbers); Content data (e.g. text input, photographs, videos);Usage data (e.g. websites visited, interest in content, access times);
Meta/communication data (e.g. device information, IP addresses).

Internal use only