Privacy Policy for Telephone Conferences and Webinars via"Zoom"
This privacy policy informs you about our treatment of personal data when using "Zoom".

1.

Name and contact details of the controller and the data protection officer
The data controller (which is also referred to as "we" or “our” in this Privacy Policy) forprocessing the personal data is the respective Roland Berger entity, which conducts
telephone conferences, online meetings, video conferences and/or webinars (hereinafter:"Online Meetings"). The address and name of this Roland Berger entity can be found here.
You can contact our Data Protection Officer at the aforementioned address or at this email
address: dataprotection@rolandberger.com
Note: If you access the "Zoom" website, the provider of "Zoom" is responsible for dataprocessing. For more information you can find the "Zoom Privacy Statement" here:
https://zoom.us/privacy. However, calling up the Internet site is only necessary for the use of"Zoom" in order to download the software for the use of "Zoom".
You can also use "Zoom" if you enter the respective meeting ID and, if necessary, other accessdata for the meeting directly in the "Zoom" app.
If you do not want to or cannot use the "Zoom" app, the basic functions can also be used with abrowser version that you can also find on the "Zoom" website.

2. Processing of personal data
2.1 Purpose of the data processing
We use the "Zoom" tool to conduct "Online Meetings". "Zoom" is a service of Zoom VideoCommunications, Inc. which is based in the USA.
2.2 Type of data
When using "Zoom", different types of data are processed. The extent of the data also depends
on the information you provide before or during participation in an Online Meeting.
The following personal data are subject to processing:User information: first name, last name, telephone (optional), email address, password (if"Single-Sign-On" is not used), profile picture (optional), Department (optional)
Meeting metadata: Topic, description (optional), participant IP addresses, equipment/hardware
information
For recordings (optional): MP4 file of all video, audio and presentation recordings, M4A file of
all audio recordings, text file of online meeting chat.
When dialing in by phone: information on incoming and outgoing phone number, country
name, start and end time. If necessary, further connection data such as the IP address of thedevice can be saved.

Text, audio and video data: You may be able to use the chat, question or survey functions in
an Online Meeting. To this extent, the text entries you make are processed in order to display
and, if necessary, log them in the Online meeting. In order to enable the display of video andthe playback of audio, the data from the microphone of your terminal device and from any video
camera of the terminal device will be processed for the duration of the meeting. You can switch
off or mute the camera or microphone yourself at any time using the "Zoom" applications.
In order to participate in an Online Meeting or to enter the "meeting room", you must at least
provide information about your name.
2.3 Extent of processing
We use "Zoom" to conduct Online Meetings. If we want to record Online Meetings, we will
inform you of this transparently in advance and - if necessary - ask for your consent. The fact ofthe recording will also be displayed in the "Zoom" app.
If it is necessary for the purpose of recording the results of an Online Meeting, we will record
the chat content. However, this will usually not be the case.
In the case of webinars, we may also process questions asked by webinar participants for thepurposes of recording and follow-up of webinars.
If you are registered as a user at "Zoom", reports of Online Meetings (meeting metadata,telephone dial-in data, questions and answers in webinars, survey function in webinars) can be
stored for up to one month at "Zoom".
Automated decision-making or profiling within the meaning of Art. 22 GDPR is not used.

3. Legal basis of data processing
If personal data of Roland Berger employees is processed, Art. 6 para. 1 lit. b) GDPR inconnection with local laws like Art. 26 para. 1 s. 1 of the German Data Protection Act is the legal
basis for data processing. If, in connection with the use of "Zoom", personal data are notrequired for the establishment, execution or termination of the employment relationship, but arenevertheless an elementary component in the use of "Zoom", Art. 6 para. 1 lit. f) GDPR is thelegal basis for data processing. In these cases, our legitimate interest lies in the effective
implementation of Online Meetings.
Furthermore, the legal basis for data processing when Online Meetings are held is Art. 6 para. 1lit. b) GDPR, insofar as the meetings are held within the framework of contractual relationships.
If no contractual relationship exists, the legal basis is Art. 6 para. 1 lit. f) GDPR. Here too, ourlegitimate interest lies in the effective implementation of Online Meetings.

4. Transfer of personal data
4.1 Transfer of data to third parties
Personal data processed in connection with participation in Online Meetings will not be passed
on to third parties, unless they are specifically intended to be passed on. Please note that thecontents of Online Meetings as well as personal meetings are often used to communicate

2information with customers, interested parties or third parties and are therefore intended to bepassed on.
Further recipients: The provider of "Zoom" necessarily obtains knowledge of the abovementioned data, insofar as this is provided for in the context of our data processing agreementwith "Zoom".
4.2 Transfer of data to countries outside the European Economic Area
"Zoom" is a service provided by a US operator. Processing of personal data therefore also takes
place in a third country. We have concluded a data processing agreement with the provider of"Zoom" which meets the requirements of Art. 28 GDPR. An adequate level of data protection isguaranteed by the conclusion of the EU standard contractual clauses. As additional safeguards,"Zoom" provides encryption of the connection between your device and "Zoom".

5. Duration of data storage
When your data is no longer necessary for the purpose for which it was originally collected andthere are no statutory retention periods or other statutory grounds for further retention, your data
will be routinely erased. Other reasons for further retention may be, for example, reasons ofpublic interest or the assertion, exercise or defense of legal claims.

6. Your rights
You have the right:> to obtain information regarding the personal data that we store about you at all times> to demand rectification of inaccurate data or supplementation of incomplete data
> to demand erasure or restriction of personal data relating to you> to have the data you provided, which we process on the basis of your consent or in theperformance of a contract, handed to you or a third party in a commonly used, machinereadable format. If you demand the direct transfer of the data to another controller, it will bedone to the extent technically feasible> to lodge a complaint with a supervisory authority> if your personal data is processed on the basis of legitimate interests pursuant to Art. 6 para. 1lit. f) GDPR, to object to the processing of your personal data pursuant to Article 21 GDPR ongrounds relating to your particular situation

7. Updates to this privacy policy
This privacy policy is regularly reviewed and updated. You can check this page for the latest
changes at any time.
Last update: May 2023

3