Protection class: Public

Privacy Policy for Telephone Conferences and Webinars via"Microsoft Teams"
This privacy policy informs you about our treatment of personal data when using "MicrosoftTeams".

1.

Name and contact details of the controller and the data protection officer
The data controller (which is also referred to as "we" or "our" in this Privacy Policy) forprocessing the personal data is the respective Roland Berger entity, which conducts
telephone conferences, online meetings, video conferences and/or webinars(hereinafter: "Online Meetings"). The address and name of this Roland Berger entity canbe found here.
You can contact our Data Protection Officer at the postal address here or at this email
address: dataprotection@rolandberger.com
Note: If you access the "Microsoft Teams" website, the provider of "Microsoft Teams" isresponsible for data processing. However, calling up the Internet site is only necessary
for the use of "Microsoft Teams" in order to download the software for the use of"Microsoft Teams".
If you do not want to or cannot use the "Microsoft Teams" app, the basic functions canalso be used with a browser version that you can also find on the "Microsoft Teams"
website.

2. Processing of personal data
2.1 Purpose of the data processing
We use "Microsoft Teams" to conduct Online Meetings. "Microsoft Teams" is a service ofMicrosoft Ireland Operations Ltd., One Microsoft Court, South County Business Park,Leopardstown, Dublin 18, D18 DH6k, Microsoft Privacy Statement (“Microsoft”).
2.2 Type of data
When using "Microsoft Teams", different types of data are processed. The extent of thedata also depends on the information you provide before or during participation in anOnline Meeting.
The following personal data are subject to processing:User details: e.g., display name, email address, profile picture (if applicable), preferredlanguage
Meeting metadata: e.g., date, time, meeting ID, phone numbers (if applicable), location
Text, audio, and video data: You may have the option of using the chat function in an
Online Meeting. In this respect, the text entries you make will be processed to display
them in the Online Meeting. To enable the display of video and the playback of audio,
the data from the microphone of your terminal device and from any video camera of theProtection class: Public

terminal device will be processed accordingly for the duration of the meeting. You canturn off or mute the camera or microphone yourself at any time via the "Microsoft Teams"
applications.
2.3 Extent of processing
We use "Microsoft Teams" to conduct Online Meetings. If we want to record Online
Meetings, we will inform you of this transparently in advance and - if necessary - ask foryour consent. The fact of the recording will also be displayed in the "Microsoft Teams"
app.
Automated decision-making or profiling within the meaning of Art. 22 of the General Data
Protection Regulation (GDPR) is not used.

3. Legal basis of data processing
If personal data of Roland Berger employees is processed, Art. 6 para. 1 lit. b) GDPR is
the legal basis for data processing. If, in connection with the use of "Microsoft Teams",
personal data is not required for the establishment, execution or termination of theemployment relationship, but is nevertheless an elementary component in the use of"Microsoft Teams", Art. 6 para. 1 lit. f) GDPR is the legal basis for data processing. In
these cases, our legitimate interest lies in the effective implementation of Online
Meetings.
Furthermore, the legal basis for the data processing during Online Meetings is Art. 6para. 1 lit. b) GDPR, insofar as the meetings take place within the framework ofcontractual relationships.
If no contractual relationship exists, the legal basis is Art. 6 para. 1 lit. f) GDPR. Here too,
our legitimate interest lies in the effective implementation of Online Meetings.

4. Transfer of personal data
4.1 Transfer of data to third parties
Personal data processed in connection with participation in Online Meetings will not bepassed on to third parties, unless they are specifically intended to be passed on. Please
note that the contents of Online Meetings as well as personal meetings are often used tocommunicate information with clients, interested parties or third parties and are therefore
intended to be passed on.
Further recipients: Microsoft as our data processor necessarily obtains knowledge of theabove-mentioned data, therefore we have concluded a data processing agreement with
Microsoft that complies with the requirements of Art. 28 GDPR.
In other cases, we will only transfer your personal data if this is permitted by relevant
legal provisions, if we are obliged to do so, for example by law or by an official or court

2Protection class: Publicorder (Art. 6 para. 1 sentence 1 lit. c GDPR) or if you have consented to the transfer (Art.
6 para. 1 sentence 1 lit. a GDPR).
4.2 Transfer of data to countries outside the European Economic Area
In principle, data is not processed outside the European Union (EU), as we have limited
our storage location to data centers in the European Union. However, we cannot exclude
the possibility that data is routed via Internet servers located outside the EU. This may be
the case if participants in Online Meetings are located in a third country.
If we transfer personal data to a country outside the European Economic Area (EEA), wewill only do so after ensuring that appropriate safeguards are in place, for example in theform of standard data protection clauses.
In any event, data is encrypted during transmission over the Internet to protect it fromunauthorized access by third parties.

5. Duration of data storage
When your data is no longer necessary for the purpose for which it was originallycollected and there are no statutory retention periods or other statutory grounds forfurther retention, your data will be routinely erased. Other reasons for further retention
may include reasons of public interest or the assertion, exercise, or defense of legalclaims.

6. Your rights
You have the right:•

to obtain information regarding the personal data that we store about you at all times.

•

to demand rectification of inaccurate data or supplementation of incomplete data.

•

to demand erasure or restriction of personal data relating to you.

•to have the data you provided, which we process based on your consent or in theperformance of a contract, handed to you or a third party in a commonly used,machine-readable format. If you demand the direct transfer of the data to anothercontroller, it will be done to the extent technically feasible.

•to lodge a complaint with a supervisory authority.

•if your personal data is processed based on legitimate interests pursuant to Art. 6para. 1 sentence 1 lit. f GDPR, to object to the processing of your personal data
pursuant to Article 21 GDPR on grounds relating to your particular situation.

3

Protection class: Public

7. Updates to this privacy policy
This privacy policy is regularly reviewed and updated. You can check this page for the latest changes
at any time. We therefore reserve the right to amend it from time to time and to make changes in thecollection, processing, or use of your data. The most current version of this privacy policy is always
available athttps://www.rolandberger.com/publications/publication_pdf/rolandberger_ms_teams_onlinemeetings_privacynotice.pdf.

Last update: May 20234