www.m.com

Data Protection Information for
OSRAM Shareholders
This privacy policy provides information on the collection andprocessing of your personal data by OSRAM Licht AG(“OSRAM”) in connection with your position as shareholder of theCompany, and information on the rights you have under current
data protection legislation.
Introduction
The protection of personal data is of great importance to OSRAM. OSRAM therefore
processes your personal data in accordance with the provisions of the European General Data
Protection Regulation (GDPR), the Bundesdatenschutzgesetz (BDSG–German Data
Protection Act), the Aktiengesetz (AktG–German Stock Corporation Act), and other applicablelegal provisions on the protection of personal data and on data security.
1. Data Controller
OSRAM Licht AG
Marcel-Breuer-Strasse 680807 Munich Germany
Telephone: +49 (0)89 6213 0
Fax: +49 (0)89 6213 2020
Email: privacy@ams-osram.com
You can contact Data Privacy Department by mail at the above postal address, using “DataPrivacy Department” as an added reference, or by email at privacy@ams-osram.com.
2. Processing Purpose, Categories of Data, and Legal Basis of Processing Activities
OSRAM-shares are registered shares. The credit institutions involved in the purchase and/ormanagement of your registered OSRAM shares regularly share with us such information asrequired by us for the purpose of maintaining the share register. This includes information
required under section 67 AktG, such as the name, date of birth, and address, and also thenationality of the shareholder. Data is transmitted through Clearstream Banking Frankfurt(CBF), the central securities depository that handles the technical processing of securities
transactions and holds the shares in custody for the credit institutions.
We use your personal data for the purposes described in the Stock Corporation Act. These
include, in particular, the maintenance of the share register, communications with you as ashareholder, and the organization and hosting of General Meetings. Beyond this, we use yourpersonal data only for purposes that are compatible with the aforementioned (in particular forthe preparation of statistics, e.g., to illustrate shareholder trends, the number of transactions,or overviews of the largest shareholders).
The legal basis for the processing of personal data are the provisions of the German StockCorporation Act (section 118 et seqq. AktG), including the relevant provisions of the Act onMitigation of the Consequences of the COVID19 Pandemic in Civil, Insolvency and Criminal
Procedure Law (Art. 2 sec. 1), in each case in conjunction with Art. 6 para. 1 sentence 1 lit. cGDPR. If you as a shareholder submit questions in the run-up to the virtual General Meetingand your questions are answered at the General Meeting by stating your name, we will process
your data to safeguard legitimate interests in accordance with Art. 6 (1) lit. f) GDPR. This dataprocessing is necessary to safeguard the legitimate interests of OSRAM Licht AG in order toenable the virtual General Meeting to run smoothly (without the physical presence ofshareholders or their representatives).
In addition, we may also process your personal data to fulfill other legal obligations such as
regulatory requirements or storage obligations pursuant to stock corporation, commercial andtax law.
In the context of the authorization of the proxies appointed by the Company for the General
Meeting, for example, we are obliged under the provisions of the AktG to keep a verifiable
record of the data provided by shareholders as proof of authorization. In this case, the relevant
provisions of the AktG and Article 6 (1) c GDPR constitute the legal basis for the processingof personal data.
In certain individual cases, we also process your data as necessary to pursue our legitimate
interests in accordance with Article 6 (1) f GDPR. This occurs, for example, in the event of acapital increase, when individual shareholders have to be excluded from the communicationof a rights offering based on their nationality or place of residence, in order to ensurecompliance with applicable securities laws in the relevant non-European countries.
If you request voting cards for the General Meeting for a person you have authorized to attend
on your behalf, it is your responsibility to inform this authorized person about the collection of
personal data by OSRAM. OSRAM collects the personal data of the authorized person
exclusively for the purposes of sending the voting cards and organizing the participation in theperson at the General Meeting, including their exercise of relevant rights and, especially, thevoting right.
In the event that we want to process your personal data for a purpose that is not specified inthis privacy policy, we will notify you of this planned processing activity in accordance with therelevant statutory requirements.
3. Transfer and Sharing of Personal Data
External service providers:
We use external service providers for certain tasks in relation to the administration andtechnical maintenance of the share register (share register service provider, IT serviceprovider) and the organization and hosting of General Meetings (AGM service provider,providers of printing and mailing services for shareholder notifications).

Data Protection Information for OSRAM ShareholdersDecember 2023

The OSRAM shareholder portal is made available and operated on behalf of OSRAM Licht
AG by Computershare Deutschland GmbH & Co. KG, Elsenheimerstrasse 61, 80687 Munich,Germany (‘Computershare’). On this portal, your personal data will be collected, processed,
and used only within the scope of a commissioned data processing agreement concluded
between OSRAM Licht AG and Computershare. Computershare is not permitted to use yourpersonal data for its own purposes.
Other recipients:
Personal data is shared with service providers outside the EU or EEA only if the European
Commission has confirmed that the relevant third country maintains appropriate dataprotection standards or if appropriate data protection guarantees (e.g. binding internal dataprotection requirements of the company or an agreement based on the standard contractual
clauses issued by the European Commission) are in place. Detailed information on this issue
and on the data protection standards of our service providers in third countries can berequested from the address specified in Item 1 of this privacy policy.
4. Storage Periods
We generally anonymize or erase your personal data as soon as it is no longer required forthe abovementioned purposes, unless we are required to continue storing it under statutory
record-keeping and retention obligations, e.g., pursuant to relevant provisions of the AktG, theHandelsgesetzbuch (HGB–German Commercial Code), or the Abgabenordnung (AO–German Tax Code).
The standard statutory retention period for data collected in connection with Annual General
Meetings is three years. The standard statutory retention period for data recorded in the shareregister is ten years from date of sale of the shares. Personal data is retained beyond theseretention periods only where required in specific cases for the assertion of claims against ourCompany (in such cases, the statutory retention period may be up to 30 years).
5. Right to Object
You have the right to object, for reasons arising from your particular personal
circumstances, to processing activities in relation to your personal data carried out on
the basis of Article 6 (1) f GDPR (pursuit of legitimate interests).
Upon receipt of your objection, we will cease to carry out such processing activities,
unless the processing activity is required in connection with overriding legitimate
interests of our Company that must be protected.
6. Your Rights to Access, Rectification and Erasure
You can demand access to your personal data stored by OSRAM Licht AG by contacting
OSRAM at the address specified in Item 1. Any relevant data about you that is recorded in theshare register can be accessed from the shareholder portal on the OSRAM website(www.osram-group.de/hauptversammlung). You can also notify us of any necessary
corrections through the shareholder portal or by contacting the address specified in point 1.
Under certain circumstances, you can also demand the erasure or a restriction of theprocessing of your personal data (e.g., if your data is being unlawfully processed). OSRAM'sdata protection organization will be happy to provide you with detailed information on yourrights as a data subject. To request information, please contact privacy@ams-osram.com.

Data Protection Information for OSRAM Shareholders

December 2023

7. Right to Lodge a Complaint
If you have a question or complaint, you can contact our Data Privacy Department (see point1) or a data protection supervisory authority.
The competent data protection supervisory authority for OSRAM is:
Bavarian State Office for Data Protection Supervision
Post office box 1349
91504 Ansbach
Germany
An overview of national data protection authorities in EU countries could be found under:
https://edpb.europa.eu/about-edpb/about-edpb/members_en

Data Protection Information for OSRAM Shareholders

December 2023