Protection class: InternalPrivacy Policy for Microsoft365 Cloud Services
This privacy policy informs you about our treatment of personal data when using
Microsoft365 cloud services provided by Roland Berger. This comprises – amongothers - Microsoft Teams, Microsoft OneDrive, Microsoft Forms, Microsoft PowerBI,
Microsoft SharePoint Online, Microsoft Stream (hereinafter "Microsoft365 CloudServices").
Please also make sure you have read our Terms of use for the Microsoft365 CloudServices.
Please also refer to our Privacy Policy for Telephone Conferences and Webinars via"Microsoft Teams" when participating in online meetings via Microsoft Teams
organized by Roland Berger.

1.

Name and contact details of the controller and the dataprotection officer
The controller for processing the personal data in relating to the use ofMicrosoft365 Cloud Services is Roland Berger Holding GmbH & Co. KGaA,Sederanger 1, 80538 Munich, Germany or one of its subsidiaries (hereinafter“Roland Berger”, “we”, “us” or “our”). The addresses and names of oursubsidiaries can be found here.
You can contact our Data Protection Officer at the aforementioned address orat this email address: dataprotection@rolandberger.com
Please note that this Privacy Policy only provides information about theprocessing of your personal data when you use Microsoft applications provided
by us. Should you require information about processing by Microsoft, pleaserefer to Microsoft's privacy policy at https://privacy.microsoft.com/enus/privacystatement for more information.

2. Processing of personal data
2.1 Usage data
We may process the following usage data recorded by Microsoft:•

Your IP address, which is used to access the Microsoft365 Cloud Services.

•Your username (access data to Microsoft365 Cloud Services), data within
the scope of the so-called multi-factor authentication, which you havestored in your Microsoft account (e.g., optionally your (private) mobilephone number).

•

Identification features: Information about you that identifies you as a user,
sender, or recipient of data within the Microsoft365 Cloud Services. Thisincludes, in particular, the following master data: Last name, first name,contact details including telephone number, email address, office fax
number, if provided by you. Other information (such as a profile picture, ifyou have one) can also be viewed in your profile at any time.

Protection class: Internal•

Data required for authentication and for the use of the license. In theMicrosoft365 Cloud Services, all user activities such as time of access,date, type of access, information about the data/files/documents accessed
and all activities in connection with the use, such as creating, changing,deleting a document, setting up a team (and channels in teams), taking
notes in the notebook, starting a chat and replying in the chat areprocessed.

The processing serves our legitimate interest (Art. 6 para. 1 sentence 1 lit. f of
the General Data Protection Regulation (GDPR)) in analyzing the use of
Microsoft365 Cloud Services and ensuring the best possible presentation ofthese services for our users.
2.2 Other data processing
As part of the provision of our services related to Microsoft365 Cloud Services,
we process the personal data made available there, such as those contained inyour communications, lists, tasks, and files/documents. The data is processed
for the performance of a contract (Art. 6 para. 1 sentence 1 lit. b GDPR)
because it is necessary for the provision of our services and the offering ofMicrosoft365 Cloud Services.

3. Transfer of personal data
3.1 Transfer of personal data to service providers
Where we use service providers to assist us in processing personal data orotherwise (for example, web designers, hosting providers or other IT serviceproviders) and they may have access to your personal data, this will only bedone after entering into a so-called data processing agreement that requires
our service providers to process personal data only in accordance only with ourinstructions and to keep such data confidential. Processors will only haveaccess to the personal data they need to perform their services for us.
Microsoft as our data processor necessarily obtains knowledge of the abovementioned usage data, therefore we have concluded a data processing
agreement with Microsoft that complies with the requirements of Art. 28 GDPR.
The processing of personal data by Microsoft takes place exclusively on servers
located in the EU.
3.2 Transfer of data to third parties
In other cases, we will only transfer your personal data if this is permitted byrelevant legal provisions, if we are obliged to do so, for example by law or by
an official or court order (Art. 6 para. 1 sentence 1 lit. c GDPR) or if you haveconsented to the transfer (Art. 6 para. 1 sentence 1 lit. a GDPR).
3.3 Data transfer to countries outside the EEA
If we transfer personal data to a country outside the European Economic Area(EEA), we will only do so after ensuring that appropriate safeguards are in place,for example in the form of standard data protection clauses.

2Protection class: Internal

4. Duration of data storage
Generally speaking, when your data is no longer necessary for the purpose forwhich it was originally collected and there are no statutory retention periods orother statutory grounds for further retention, your data will be routinely erased
or anonymized. Reasons for further retention may be, for example, reasons ofpublic interest or the assertion, exercise or defense of legal claims.
Login data and IP addresses will be deleted after 30 days at the latest, audit
logs after 90 days, unless we are entitled or obligated to store them longer.

5. Your rights
You have the right:•

to obtain information regarding the personal data that we store about you
at all times.

•to demand rectification of inaccurate data or supplementation ofincomplete data.

•to demand erasure or restriction of personal data relating to you.

•to have the data you provided, which we process based on your consent
or in the performance of a contract, handed to you or a third party in acommonly used, machine-readable format. If you demand the directtransfer of the data to another controller, it will be done to the extent
technically feasible.

•to lodge a complaint with a supervisory authority.

•if your personal data is processed based on legitimate interests pursuant
to Art. 6 para. 1 sentence 1 lit. f GDPR, to object to the processing of yourpersonal data pursuant to Article 21 GDPR on grounds relating to yourparticular situation.

6. Updates to this privacy policy
This privacy policy is regularly reviewed and updated. We therefore reserve theright to amend it from time to time and to make changes in the collection,processing, or use of your data. The most current version of this privacy policy
is always available at:https://www.rolandberger.com/publications/publication_pdf/MS365Cloud_Dat
a_Protection_Notice.pdf
Last update: May 2023

3