Primetals Technologies Privacy Policies
Primetals Technologies Austria GmbH ............................................................................................ 2
Primetals Technologies Belgium nv/sa ............................................................................................ 7
Primetals Technologies Germany GmbH ....................................................................................... 12
Primetals Technologies Japan, Ltd................................................................................................. 17
Primetals Technologies, Limited .................................................................................................... 22

1/26

November 24th, 2023

Primetals Technologies Austria GmbH
Data Privacy Policy

1. General information
Primetals Technologies Austria GmbH (hereinafter also referred to as PTAT) takes theprotection of your personal data (hereinafter also referred to as data) very seriously. We
process your data in accordance with the applicable legal data protection requirements
for the purposes listed below. Personal data in the sense of this privacy policy is all
information that is related to you personally. Relevant data are in particular yourpersonal data (e.g. name, address, contact data, date of birth), your billing data (e.g.
bank data) etc. In the following you will learn how we handle this data. What data isprocessed in detail and how it is used depends largely on the intended use. Therefore,
not all parts of this information may apply to you.

2. Responsible office and contact
The "Controller" responsible for the processing of your data is
Primetals Technologies Austria GmbH, Turmstraße 44, 4031 Linz, Austria, e-mail:contact@primetals.com.
If you have any questions or comments about PTAT's data protection (e.g. about
information and updating your data), you can also contact our data protection person
responsible at contact@primetals.com.

3. What sources and data do we use?
We process personal data that we receive from our customers, suppliers, business
partners or other data subjects within the framework of our business relationship(including pre-contractual phase). In addition, we process personal data to the extent
necessary for the provision of our services, which we may obtain from publicly
accessible sources (e.g. company registers, commercial registers, land registers, debtor
registers, press, internet) or which is legitimately transmitted to us by other companies of
the Primetals Group.
Relevant personal data are master data (name, address and other contact data), orderdata (e.g. personal data for the order), data from the fulfilment of our contractual
obligations (e.g. data for payment processing), documentation data (e.g. businesscorrespondence, minutes of meetings) and other data comparable with the categories
mentioned.

2/26

November 24th, 2023

4. The purposes for which your data are collected and processed and their legal
bases
4.1 For the fulfilment of contractual obligations (Art. 6(1) point (b) GDPR)
PTAT processes your personal data to fulfil the contract with you or to carry out precontractual measures, which are generally taken upon request. The actual processing
depends on the respective business relationship and can include communication,correspondence, needs analyses, consulting, project execution and support, billing,
payment processing as well as the execution of transactions. Without this dataprocessing we cannot conclude or fulfil the contract.
4.2 Within the framework of the weighing of interests (Art. 6(1) point (f) GDPR)
If necessary, we process your data above and beyond the actual performance of thecontract to protect our legitimate interests. Examples of this could be:

4.3-

To assert legal claims and for defence in legal disputes;-

To guarantee IT security and the IT operation of PTAT;-

To prevent and investigate criminal offences, video surveillance for theprotection of property rights, to collect evidence in cases of robbery and fraud.
Other measures to secure property rights;-

Measures to ensure building and system security (e.g. access controls);-

Measures for managing the business and further developing services andproducts;-

For risk management in the Primetals Group;
On the basis of your consent (Art. 6(1) point (a) GDPR)

If you have given us your consent to the processing of personal data for certain
purposes (e.g. passing on of data within the Primetals Group, photographs within theframework of events, newsletter dispatch, advertising material), the lawfulness of thisprocessing is given on the basis of your consent. A given consent can be withdrawn at
any time and without providing reasons. This also applies to the withdrawal of
declarations of consent issued to us prior to the validity of the GDPR, i.e. before 25 May
2018. The withdrawal of consent is only effective for the future and does not affect thelawfulness of the data processed before your withdrawal of consent.
4.4

Due to legal requirements (Art. 6(1) point (c) GDPR)

In addition, we are required to process your data in order to comply with various
statutory provisions (e.g. fulfilment of tax control and reporting obligations). This

3/26

November 24th, 2023

processing is of course limited to the data required to comply with the relevant statutory
provisions.
5. Recipients of your personal data
5.1 Third parties and processors
Your personal data will also be used by other companies working on behalf of PTAT
(processors) or in the context of PTAT's business partnerships (third parties). These canbe companies of the Primetals Group (PT Group) or external companies and partners(PTAT partners). You can find a list of all companies of the PT Group here:
https://www.Primetals.com/contact-us/locations. Furthermore, possible recipients of yourdata are companies in the categories of IT services, logistics, telecommunications, etc.
5.2 Recipients outside the European Union (EU)PTAT has outsourced individual services by carefully selected and commissioned
service providers based outside the European Economic Area (third country), e.g. IT
service providers to guarantee IT operations. In these cases transfer to a third country
takes place.
We would like to point out that the persons authorised to process the data are obliged tomaintain confidentiality regarding all related information. Furthermore, we ensure thatstate-of-the-art measures are taken to protect your data.
We also intend to transfer data to locations in third countries in the following cases:-

if it is necessary to fulfil our contractual obligations;-

if required by law (e.g. tax reporting obligations) or-

if you have given us your consent.

To the extent required by law to provide an adequate level of protection for your data,
PTAT uses guarantees that comply with the legal requirements to establish an
adequate level of data protection, including EU standard contractual clauses. In thiscase your data will have the same protection as in the EU. If you wish to receive further
information on this subject, you can contact PTAT using the contact details mentioned
under point 2.

6. Data storage and data erasure
PTAT processes and stores your personal data as long as this is necessary to fulfil ourcontractual and legal obligations. If the contractual relationship with you is terminated, allmutual claims are fulfilled and no other legal storage obligations or legal justification
bases for storage exist, your data will be deleted.

4/26

November 24th, 2023

However, our legitimate interests may constitute an additional legal basis for the further
processing of your data after termination of a contractual relationship. Our legitimate
interests are, for example, to interest you once again in our products and services. Inline with the weighing of interests in sending you direct advertising during our business
relationship with you, our interests also prevail when using your data for this postcontractual advertising purpose. If you object, you have the option of stopping thisprocessing at any time. PTAT uses this data appropriately in accordance with theprocessing purpose described above.

7. Automated decisions
We do not use any fully automated decisions in accordance with Art. 22 GDPR toestablish and implement our business relationships.

8. Profiling
We do not do profiling pursuant to Art. 22 GDPR.

9. Provision of your personal data
Within the framework of our business relationship, you must provide those personal data
which are necessary for the establishment, execution and termination of a business
relationship and for the fulfilment of the associated contractual obligations or which weare legally entitled to collect. Without this information, we will usually not be able to enter
into, execute and terminate a contract with you.

10. Your privacy rights
10.1 Access, rectification, erasure, restriction of processing
You have the right to have access to your personal data. Under certain conditions, youalso have the right to rectification and erasure of your data. Furthermore, you have theright to restrict processing if the legal prerequisites are given.
10.2 Right to object
You have the right to object at any time for reasons arising from your particular situation
to the processing of personal data concerning you under Art. 6(1) point (e) GDPR (public
interest data processing) and Art. 6(1) point (f) GDPR (data processing on the basis of aweighing of interests). If you object, we will no longer process your personal data unless
we can prove compelling legitimate reasons for the processing which outweigh your

5/26

November 24th, 2023

interests, rights and freedoms, or the processing serves to assert, exercise or defend
legal claims.
You have the right to object to the processing of your data for advertising purposes at
any time. If you object to the processing for direct advertising purposes, we will nolonger process your personal data for these purposes.
10.3 Right of withdrawal
If you have given PTAT express consent to the processing of your data, you can
withdraw this consent at any time and without stating any reasons. The lawfulness ofthe processing of your data before your withdrawal of consent remains unaffected by
the withdrawal.
10.4 Right to data portability
You have the right to receive the personal data concerning you in a structured, common
and machine-readable format. You are entitled to transfer this data to other controllers.
If technically feasible, you have the right to obtain a transmission from us directly toanother controller.
To exercise the rights referred to in point 10, you may contact PTAT using the contact
details referred to in point 2.
10.5 Questions or complaints
You have the right to contact the competent supervisory authority, the Austrian dataprotection authority, with questions or complaints. You can reach them at the following
e-mail address: dsb@dsb.gv.at or at the following address: Wickenburggasse 8, 1080
Vienna.

11. Updating of our data privacy policy
We will update our data privacy policy accordingly, if necessary, in case data protection
regulations or business needs change.

6/26

November 24th, 2023

Primetals Technologies Belgium nv/sa
Data Privacy Policy

1. General information
Primetals Technologies Belgium nv/sa (hereinafter also referred to as PTBE) takes theprotection of your personal data (hereinafter also referred to as data) very seriously. We
process your data in accordance with the applicable legal data protection requirements
for the purposes listed below. Personal data in the sense of this privacy policy is all
information that is related to you personally. Relevant data are in particular yourpersonal data (e.g. name, address, contact data, date of birth), your billing data (e.g.
bank data) etc. In the following you will learn how we handle this data. What data isprocessed in detail and how it is used depends largely on the intended use. Therefore,
not all parts of this information may apply to you.

2. Responsible office and contact
The "Controller" responsible for the processing of your data is
Primetals Technologies Belgium nv/sa, W.A Mozartlaan 4, 1620 Drogenbos, Belgium, email: secretariat.BE@primetals.com.
If you have any questions or comments about PTBE's data protection (e.g. about
information and updating your data), you can also contact our data protection person
responsible at secretariat.BE@primetals.com.

3. What sources and data do we use?
We process personal data that we receive from our customers, suppliers, business
partners or other data subjects within the framework of our business relationship(including pre-contractual phase). In addition, we process personal data to the extent
necessary for the provision of our services, which we may obtain from publicly
accessible sources (e.g. company registers, commercial registers, land registers, debtor
registers, press, internet) or which is legitimately transmitted to us by other companies of
the Primetals Group.
Relevant personal data are master data (name, address and other contact data), orderdata (e.g. personal data for the order), data from the fulfilment of our contractual
obligations (e.g. data for payment processing), documentation data (e.g. businesscorrespondence, minutes of meetings) and other data comparable with the categories
mentioned.

7/26

November 24th, 2023

4. The purposes for which your data are collected and processed and their legal
bases
4.1 For the fulfilment of contractual obligations (Art. 6(1) point (b) GDPR)PTBE processes your personal data to fulfil the contract with you or to carry out precontractual measures, which are generally taken upon request. The actual processing
depends on the respective business relationship and can include communication,correspondence, needs analyses, consulting, project execution and support, billing,
payment processing as well as the execution of transactions. Without this dataprocessing we cannot conclude or fulfil the contract.
4.2 Within the framework of the weighing of interests (Art. 6(1) point (f) GDPR)
If necessary, we process your data above and beyond the actual performance of thecontract to protect our legitimate interests. Examples of this could be:

4.3-

To assert legal claims and for defence in legal disputes;-

To guarantee IT security and the IT operation of PTBE;-

To prevent and investigate criminal offences, video surveillance for theprotection of property rights, to collect evidence in cases of robbery and fraud.
Other measures to secure property rights;-

Measures to ensure building and system security (e.g. access controls);-

Measures for managing the business and further developing services andproducts;-

For risk management in the Primetals Group;
On the basis of your consent (Art. 6(1) point (a) GDPR)

If you have given us your consent to the processing of personal data for certain
purposes (e.g. passing on of data within the Primetals Group, photographs within theframework of events, newsletter dispatch, advertising material), the lawfulness of thisprocessing is given on the basis of your consent. A given consent can be withdrawn at
any time and without providing reasons. This also applies to the withdrawal of
declarations of consent issued to us prior to the validity of the GDPR, i.e. before 25 May
2018. The withdrawal of consent is only effective for the future and does not affect thelawfulness of the data processed before your withdrawal of consent.
4.4

Due to legal requirements (Art. 6(1) point (c) GDPR)

In addition, we are required to process your data in order to comply with various
statutory provisions (e.g. fulfilment of tax control and reporting obligations). This
processing is of course limited to the data required to comply with the relevant statutory
provisions.

8/26

November 24th, 2023

5. Recipients of your personal data
5.1 Third parties and processors
Your personal data will also be used by other companies working on behalf of PTBE
(processors) or in the context of PTBE's business partnerships (third parties). These canbe companies of the Primetals Group (PT Group) or external companies and partners(PTBE partners). You can find a list of all companies of the PT Group here:
https://www.Primetals.com/contact-us/locations. Furthermore, possible recipients of yourdata are companies in the categories of IT services, logistics, telecommunications, etc.
5.2 Recipients outside the European Union (EU)PTBE has outsourced individual services by carefully selected and commissioned
service providers based outside the European Economic Area (third country), e.g. IT
service providers to guarantee IT operations. In these cases transfer to a third country
takes place.
We would like to point out that the persons authorised to process the data are obliged tomaintain confidentiality regarding all related information. Furthermore, we ensure thatstate-of-the-art measures are taken to protect your data.
We also intend to transfer data to locations in third countries in the following cases:-

if it is necessary to fulfil our contractual obligations;-

if required by law (e.g. tax reporting obligations) or-

if you have given us your consent.

To the extent required by law to provide an adequate level of protection for your data,
PTBE uses guarantees that comply with the legal requirements to establish an
adequate level of data protection, including EU standard contractual clauses. In thiscase your data will have the same protection as in the EU. If you wish to receive further
information on this subject, you can contact PTBE using the contact details mentioned
under point 2.

6. Data storage and data erasure
PTBE processes and stores your personal data as long as this is necessary to fulfil ourcontractual and legal obligations. If the contractual relationship with you is terminated, allmutual claims are fulfilled and no other legal storage obligations or legal justification
bases for storage exist, your data will be deleted.
However, our legitimate interests may constitute an additional legal basis for the further
processing of your data after termination of a contractual relationship. Our legitimate

9/26

November 24th, 2023

interests are, for example, to interest you once again in our products and services. Inline with the weighing of interests in sending you direct advertising during our business
relationship with you, our interests also prevail when using your data for this postcontractual advertising purpose. If you object, you have the option of stopping thisprocessing at any time. PTBE uses this data appropriately in accordance with theprocessing purpose described above.

7. Automated decisions
We do not use any fully automated decisions in accordance with Art. 22 GDPR toestablish and implement our business relationships.

8. Profiling
We do not do profiling pursuant to Art. 22 GDPR.

9. Provision of your personal data
Within the framework of our business relationship, you must provide those personal data
which are necessary for the establishment, execution and termination of a business
relationship and for the fulfilment of the associated contractual obligations or which weare legally entitled to collect. Without this information, we will usually not be able to enter
into, execute and terminate a contract with you.

10. Your privacy rights
10.1 Access, rectification, erasure, restriction of processing
You have the right to have access to your personal data. Under certain conditions, youalso have the right to rectification and erasure of your data. Furthermore, you have theright to restrict processing if the legal prerequisites are given.
10.2 Right to object
You have the right to object at any time for reasons arising from your particular situation
to the processing of personal data concerning you under Art. 6(1) point (e) GDPR (public
interest data processing) and Art. 6(1) point (f) GDPR (data processing on the basis of aweighing of interests). If you object, we will no longer process your personal data unless
we can prove compelling legitimate reasons for the processing which outweigh yourinterests, rights and freedoms, or the processing serves to assert, exercise or defend
legal claims.

10/26

November 24th, 2023

You have the right to object to the processing of your data for advertising purposes at
any time. If you object to the processing for direct advertising purposes, we will nolonger process your personal data for these purposes.
10.3 Right of withdrawal
If you have given PTBE express consent to the processing of your data, you can
withdraw this consent at any time and without stating any reasons. The lawfulness ofthe processing of your data before your withdrawal of consent remains unaffected by
the withdrawal.
10.4 Right to data portability
You have the right to receive the personal data concerning you in a structured, common
and machine-readable format. You are entitled to transfer this data to other controllers.
If technically feasible, you have the right to obtain a transmission from us directly toanother controller.
To exercise the rights referred to in point 10, you may contact PTBE using the contact
details referred to in point 2.
10.5 Questions or complaints
You have the right to contact the competent supervisory authority, the Belgian dataprotection authority, with questions or complaints. You can reach them at the following
e-mail address: contact@apd-gba.be or at the following address: Drukpersstraat 35,
1000 Brussel or via their website: https://www.dataprotectionauthority.be/contact-us

11. Updating of our data privacy policy
We will update our data privacy policy accordingly, if necessary, in case data protection
regulations or business needs change.

11/26

November 24th, 2023

Primetals Technologies Germany GmbH
Data Privacy Policy

Information on data protection pursuant to Art. 13 and Art. 14 GDPR
1. General information
Primetals Technologies Germany GmbH (hereinafter also referred to as PTDE) takes
the protection of your personal data (hereinafter also referred to as data) very seriously.
We process your data in accordance with the applicable legal data protection
requirements for the purposes listed below. Personal data in the sense of this privacy
policy is any personal data that is related to you. Relevant data include in particular yourpersonal data (e.g. name, address, contact details, date of birth), your billing data (e.g.
bank details) etc. Below you will learn how we handle this data. The data which we
process in detail and how it is used will depend largely on the intended purpose of use.
Therefore, not all parts of this Data Privacy Policy may apply to you.
2. Responsible office and contact
The "Controller" responsible for the processing of your data is
Primetals Technologies Germany GmbH, Bunsenstraße 43, 91058 Erlangen, Germany,e-mail: contact@primetals.com .
If you have any questions or comments about PTDE's data protection (e.g. about
information and updating your data), you can also contact our data protection officer at
e-mail: datenschutz.de@extprimetals.com.
3. What sources and data do we use?
We process personal data that we receive from our customers, suppliers, business
partners or other persons concerned during our business relationship (including theprecontractual phase). In addition, we process personal data to the extent necessary forthe provision of our services, which we may obtain from publicly accessible sources (e.g.
company registers, commercial registers, land registers, debtor registers, press,
Internet) or which is legitimately transmitted to us by other companies of the Primetals
Group. Relevant personal data consist of master data (name, address and other contactdata), order data (e.g. personal data for the order), data arising from the fulfilment of ourcontractual obligations (e.g. data for payment processing), documentation data (e.g.
business correspondence, minutes of meetings) and other data comparable with theafore-mentioned categories.
4. The purposes for which your data is collected and processed and the legal bases
for such data collection and processing
4.1 For the fulfilment of contractual obligations (Art. 6 (1) point (b) GDPR1)
12/26
November 24th, 2023

PTDE processes your personal data to fulfil the contract with you or to carry out
precontractual measures, which, in principle, are only taken upon request. The actual
processing depends on the respective business relationship and can include
communication, correspondence, needs analyses, consulting, project execution andsupport services, billing, payment processing as well as the execution of transactions.
Without this data processing we cannot conclude or fulfil the contract.
4.2 In the context of a weighing of interests (Art. 6 (1) point (f) GDPR)
To the extent necessary, we may process your data beyond the actual performance ofthe contract to protect our legitimate interests. Examples of this could be:-

To assert or defend legal claims in legal disputes;
To guarantee IT security and the IT operations of PTDE;
To prevent and investigate criminal offences, video surveillance for the protectionof property rights, to collect evidence in cases of robbery and fraud. Other
measures to secure property rights;- Measures to ensure building and system security (e.g. access controls);- Measures for managing the business and further development of services andproducts;- For risk management in the Primetals Group.
4.3 On the basis of your consent (Art. 6 (1) point (a) GDPR)
If you have given us your consent to the processing of personal data for certain
purposes (e.g. passing on of data within the Primetals Group, newsletter dispatch,advertising material), the lawfulness of this processing is given on the basis of yourconsent. Consent given can be revoked at any time and without stating reasons. This
also applies to the withdrawal of declarations of consent issued to us prior to the validityof the GDPR, i.e. before 25 May 2018. The revocation of consent is only effective for the
future and does not affect the lawfulness of the data processed prior to your revocationof consent.
4.4 Due to legal requirements (Art. 6 (1) point (c) GDPR)
In addition, we are required to process your data in order to comply with various
statutory provisions (e.g. fulfilment of tax control and reporting obligations). This
processing is, of course, limited to the data required to comply with the relevant statutory
provisions.
4.5 General data processing as part of your job application
We process data from your job application that we need in the context of the application.
This may include contact details, as well as all data related to the application (CV,certificates, qualifications, answers to questions, etc.). The legal basis for this arises
from section 26 of the German Federal Data Protection Act as well as from Art. 6 (1)point (b) of the GDPR for initiating or performing contractual relationships. Furthermore,
we may process personal data from you during your job application process, provided
this is necessary for the compliance with legal obligations on the legal basis of Art. 6 (1)
13/26
November 24th, 2023

point (c) of the GDPR) or on the legal basis of Art. 6 (1) point (f) of the GDPR to defend
against asserted claims against us. The legitimate interest in this case is, for example, aburden of proof in proceedings under the German General Equal Treatment Act (AGG).
If there is an employment relationship between you and us, we may, in accordance with
Art. 88 of the GDPR in conjunction with section 26 of the German Federal Data
Protection Act (BDSG) further process the personal data already received from you forpurposes of the employment relationship, insofar as this is necessary for the
performance or termination of the employment relationship or for the exercise or thefulfilment of the rights and obligations of the employee's representation of interests
arising from a law or a collective wage agreement, a works or service agreement(collective agreement).
5. Recipients of your personal data
5.1 Third parties and processors
Your personal data will also be used by other companies working on behalf of PTDE
(processors) or in the context of PTDE's business partnerships (third parties). These canbe companies of the Primetals Group (PT Group) or external companies and partners(PTDE partners). You can find a list of all companies of the PT Group at:https://www.Primetals.com/contact-us/locations. Furthermore, other possible recipientsof your data include IT service, logistics and telecommunications companies, etc.
5.2 Recipients outside the European Union (EU)PTDE has outsourced individual services by carefully selected and commissioned
service providers based outside the European Economic Area (third country), e.g. IT
service providers to guarantee IT operations. In these cases transfer to a third country
takes place.
We would like to point out that the persons authorised to process the data are obliged tomaintain confidentiality regarding all related information. Furthermore, we ensure thatstate-of-the-art measures are taken to protect your data.
We also intend to transfer data to locations in third countries in the following cases:- if it is necessary to fulfil our contractual obligations;- if required by law (e.g. tax reporting obligations) or- if you have given us your consent.
To the extent required by law to provide an adequate level of protection for your data,
PTDE grants the appropriate guarantees in accordance with the legal requirements inorder to establish an adequate level of data protection, including EU standard
contractual clauses. In this case your data will have the same protection as in the EU. If
you wish to receive further information on this topic, you can contact PTDE at thecontact address specified in paragraph 2.
6. Storage of data and data erasure

14/26

November 24th, 2023

PTDE processes and stores your personal data as long as this is necessary to fulfil ourcontractual and legal obligations. If the contractual relationship with you is terminated, allmutual claims are fulfilled and no other legal or statutory basis for storage obligations
exist, your data will be deleted.
However, our legitimate interests may constitute an additional legal basis for the further
processing of your data after termination of a contractual relationship. Our legitimate
interests include, for example, to convince you anew of the benefits of our products andservices. In accordance with the balance of interests, we may send you directadvertising during our business relationship, our interests also prevail when using yourdata for this post-contractual advertising purpose. You may object to the processing ofdata for such purpose at any time. PTDE uses this data appropriately in accordance withthe processing purpose as described above.
7. Automated decisions
We do not use any fully automated decisions in accordance with Art. 22 GDPR toestablish and implement our business relationships.
8. Profiling
Profiling pursuant to Art. 22 GDPR does not occur.
9. Provision of your personal data
During our business relationship, you must provide personal data which is necessary forthe establishment, execution and termination of the business relationship and for thefulfilment of the associated contractual obligations or personal data which we are legally
entitled to collect. Without this information, we will usually not be able to enter into,
execute and terminate a contract with you.
10. Your privacy rights
10.1 Access, rectification, erasure, restriction of processing
You may exercise your rights of access to your personal data. Under certain conditions,
you also have the right to rectification and erasure of your data. Furthermore, you havethe right to restrict processing if the legal prerequisites are given.
10.2 Right to object
You have the right to object at any time for reasons arising from your particular situation
to the processing of your personal data under Art. 6 (1) point (e) GDPR (public interest
data processing) and Art. 6 (1) point (f) GDPR (data processing on the basis of aweighing of interests). If you object, we will no longer process your personal data unless
we can prove compelling legitimate reasons for the processing which outweigh yourinterests, rights and freedoms, or the processing serves to assert, exercise or defend
legal claims.
You have the right to object to the processing of your data for advertising purposes at
any time. If you object to the processing for direct advertising purposes, we will nolonger process your personal data for such purposes.
15/26
November 24th, 2023

10.3 Right to withdraw consent
If you have given PTDE express consent to the processing of your data, you can
withdraw this consent at any time and without stating any reasons. The lawfulness of theprocessing of your data before your withdrawal of consent remains unaffected by thewithdrawal.
10.4 Right to data portability
You have the right to receive the personal data concerning you in a structured, common
and machine-readable format. You are entitled to transfer this data to other controllers. If
technically feasible, you have the right to obtain a transmission from us directly toanother controller.
To exercise the rights referred to in paragraph 10, you may contact PTDE at the contact
address referred to in paragraph 2.
10.5 Questions or complaints
You have the right to contact the competent supervisory authority, the Data Protection
Authority of Bavaria for the Private Sector, with questions or complaints at the following
address:
Street Address:
Promenade 18
91522 Ansbach
Germany

Postal address:
Postfach 1349
91504 Ansbach
Germany

Contact information
Phone: +49 (0) 981 53 1300
Fax: +49 (0) 981 53 98 1300
E-Mail: poststelle@lda.bayern.de
11. Updating of our data privacy policy
If necessary, we will update our Data Privacy Policy accordingly, in the event that thedata protection regulations or our business requirements change.

16/26

November 24th, 2023

Primetals Technologies Japan, Ltd.
Data Privacy Policy
1. Privacy Policy
We at Primetals Technologies Japan, Ltd. (hereafter "PTJ") deal with various informationin the course of our business activities (the manufacturing and sale of steel-making
machinery and related equipment), including proprietary information concerning our
products and information provided by our customers. We recognize that all of this isvaluable information and must be handled and protected with the utmost care, and wehave done so to date.
In light of the above history, we have formulated the following personal information
protection policy and guidelines, and have consequently established a management
system. We will endeavor to appropriately protect personal information by notifying andeducating our officers and employees on this policy and these guidelines.
2.

Our Personal Information Protection Policy

PTJ will not acquire any personal information through false or other improper means.
PTJ will use personal information only to the extent and for the purposes specified,
which will be announced or noticed to persons to whom the information pertains.
PTJ will endeavor to keep such personal information accurate and up-to-date.
PTJ will take necessary and appropriate measures to maintain the security of such
personal information.
PTJ will furnish its employees and contactors handling such information with thenecessary and appropriate guidance and supervision.
PTJ will not provide personal information to any third party without the consent of theperson involved.
If PTJ receives an inquiry from a person about the use or content of personal information
related to that person, it will provide a reasonable response.
If PTJ receives any complaints regarding the handling of personal information, it will
resolve such complaints in a prompt and appropriate manner.
PTJ will establish rules and management systems for proper handling and protection of
personal information and will thoroughly adhere to them.
PTJ will engage in a strong effort to continually enhance personal information protection
system by regularly reviewing the handling of personal information, and update andimprove all rules and procedures, including this policy, as necessary.
PTJ will comply with all applicable Japanese laws and regulations regarding thehandling of personal information.

17/26

November 24th, 2023

For information regarding the business purposes, the practical handling method of
personal information by PTJ, refer to the following:
3. Use of Personal Information
PTJ will acquire and use personal information only as needed for its businessperformance according to its business purposes, which is manufacturing and sale ofsteel-making machinery and related equipments. The business purposes of personal
information are:
To make applications for transactions between PTJ and its customers and other parties
concerned with its business; obtain confirmation regarding customers and other parties
concerned; review and assess transactions; execute and manage agreements; andconduct termination and other proceedings following termination of agreements withcustomers and contractors.
To issue notices regarding improvement of PTJ products and services and of associatedproducts and services, and respond to customer inquiries regarding such products andservices.
To respond to inquiries about the products and services provided by parties having
business relations with PTJ.
To confirm applications for and participation in various exhibitions and seminars,
communicate with lecturers, and report on the results of studies and events to thepersons involved, and also to provide visitors with access to PTJ’s facilities.
To make contact with the members of any organizations in which PTJ is a member, andissue various notices from PTJ according to the purposes of activity of suchorganizations.
To send publications issued by PTJ to persons who request them.
To communicate and enter into joint contracts with various research institutes based on
PTJ’s R&D activities, to which the paragraph (1) above shall apply accordingly;
participate in academic societies; make recommendations for prizes awarded byacademic societies; and make and manage joint patent applications.
To communicate with journalists and analysts in publicity activities.
To receive applications for employment, communicate with and issue the notification of
employment to the applicants, and other issues concerning recruitment activities.
To communicate and conduct transactions with public accountants, attorneys and patent
attorneys concerned with the business activities of PTJ.
To communicate with the officers, directors, employees or any related persons in thesubsidiaries and affiliates of PTJ in the course of performance of business activities
other than those as stated above.
To issue notices to PTJ’s retired employees and to communicate with the families of
PTJ’s employees.

18/26

November 24th, 2023

To exchange necessary information between PTJ and its cooperative, non-regular,
temporary, part-time and student workers in execution of contracts with them andperformance of their works.
To provide personal information with regard to any order-based works within PTJ’s
scope of business.
To issue useful notices incidental to the above purposes of use from PTJ and its groupcompanies.
PTJ may provide personal information to a third party with the approval of each
respective individual, consign the handling of personal information, or share personal
information with a PTJ group company to the extent that such personal information isrequired for the business purposes as stated above. (Please refer to Item 4 below“Provision of Personal Information to Third Parties")
If any personal information is acquired or used for any other business purposes thanthose described above, a notice or announcement will be issued separately.
4. Definition of Personal Information“Personal Information? Eherein is defined as private information pertaining to surviving
individuals of our customers, business partners and other parties concerned which
include names, dates of birth or other descriptions, numbers, symbols, codes or images
individually assigned to each person, or audio signs which enable identification of
specific individuals (including such information which itself cannot identify individuals but
which can easily refer to other information and thereby make it possible to identify
specific individuals). Furthermore, in addition to information which can identify
individuals, all other information which expresses facts, judgments or evaluations of
attributes such as physical, properties, types of job or titles is included within the
personal information category.
5. Personal Information Management
PTJ will take necessary and appropriate measures to ensure the security of the personal
information possessed by it and endeavor to maintain the contents of such personal
information as accurate and up-to-date to the extent necessary for business purposes.
Personal information which is no longer necessary for business purposes will bedisposed of promptly in an appropriate method.
6. Provision of Personal Information to Third Parties
PTJ will not provide the personal information of any person to any third party without
such person’s approval, except the following cases:
the provision of the personal information will be suspended upon the individual's request
and the matters stipulated for this provision in the Personal Information Protection Act
are noticed or easily known to such person;
the work of handling personal information is entrusted, in whole or in part, to any third
party to the extent necessary for PTJ's business purposes, provided that a confidentiality
agreement shall be entered into by and between PTJ and such entrusted company andthat PTJ will provide necessary and appropriate supervision of such entrusted company;
19/26
November 24th, 2023

that PTJ will disclose the personal information of any specific person with any of its
group companies to the extent necessary for business purposes, provided that suchdisclosure nature of the disclosed personal information, the purposes of such disclosure,the name of the responsible party for the management of such personal information
shall be noticed or easily known to the person whose personal information has been
disclosed;
and such disclosure of personal information to any third party is otherwise authorizedunder any applicable law or regulation.
7. Contact for Personal Information
For information regarding the specific business purposes, the disclosure, correction andsuspension of use of the contents of personal information (hereinafter "inquiries about
personal information"), contact the following department of PTJ. (To make inquiries
about personal information, it is necessary to submit a completed request form including
a valid form of identification. Request forms will be sent from PTJ on request.
In the event the department to which the personal information was provided is unknown,
or for any inquiry for general information on the process of handling personal information,
contact:[For inquiry, contact]
Primetals Technologies Japan, Ltd. President Office
Address: 6-22, Kanonshin-Machi, 4-Chome, Nishi-ku, Hiroshima 733-8553, Japan(c/o Mitsubishi Heavy Industries Ltd., Hiroshima Machinery Works)
Phone : +81-82-291-2181
Business hours: 08:15-17:15 (Except on Sat., Sun. and national holidays)
8. Inquiry by mail:In case of making inquiry by mail, send your inquiry to the following address by filling in
the necessary items.
Mail to:Primetals Technologies Japan, Ltd. President Office
Address: 6-22, Kanonshin-Machi, 4-Chome, Nishi-ku, Hiroshima 733-8553, Japan(c/o Mitsubishi Heavy Industries Ltd., Hiroshima Machinery Works)
Fax: +81-82-294-0952【Items to be filled in】
Content of inquiry (mandatory)
Your name (mandatory)
Name of your company (or school) and department
E-mail address
If you do not have an e-mail address, please fill in the following items.

20/26

November 24th, 2023

Postal CodeYour address
Telephone number*The personal information sent to us by mail will be appropriately destroyed
right after we have replied to the inquiry, therefore we will not possess
the personal information.
9. How to Handle Personal Information on the Website(1) Security in obtaining personal information
In obtaining the personal information of an PTJ customer from the Website, PTJ uses
the Secure Socket Layer (SSL) and other encrypting means to protect the personal
information inputted through a communications link. The SSL is a general technology
used for security of communications on Webnet, which can encrypt the input data before
it is transmitted to Internet and prevent the input data from being intercepted or tapped.
If you use any browser that is not compatible with the SSL, you could not access to thispage from the intranet of your company due to the settings of Firewall or any othersoftware.
(2) Collection of Browsing History
The Website may use the technology such as access logs or Cookie to acquire yourbrowsing history for your more convenience of use of the Website. The collected
historical information is used only for the purposes of higher convenience of use,monitoring the use conditions of the Website and statistic use such as sum-up andanalysis for service planning and better service. Access logs include records of user IP
addresses and part of the operating environment, but they cannot identify users. Cookie
is a technology to identify the user computers from the Web server. The use of Cookie
can identify user computers, but not the users themselves unless their personal
information is inputted. You can reject to receive Cookie or indicate a warning when you
receive Cookie by setting the browser accordingly. If you reject to receive Cookie, you
can use the PTJ Website, but not a part of service.
(3) Others
PTJ cannot have any responsibility for maintaining the security of your personal
information on any other Website linked with the PTJ Website. If you have any query or
inquiry regarding the handling of personal information, make direct access to eachrelevant Website.

21/26

November 24th, 2023

Primetals Technologies, Limited
Data Privacy Policy

1. General information
Primetals Technologies Limited (hereinafter also referred to as PTUK) takes theprotection of your personal data (hereinafter also referred to as data) very seriously. We
process your data in accordance with the applicable legal data protection requirements
for the purposes listed below. Personal data in the sense of this privacy policy is all
information that is related to you personally. Relevant data is in particular: your personal
data (e.g. name, address, contact data, date of birth) and your billing data (e.g. bankdata) etc. In this document you will learn how we handle this data. What data isprocessed in detail and how it is used depends largely on the intended use. Therefore
not all parts of this information may apply to you.

2. Responsible office and contact
The "Controller" responsible for the processing of your data is
Primetals Technologies, Limited, Building 11 Chiswick Park, 566 Chiswick High Road,
London, England, W4 5YA.
If you have any questions or comments about PTUK's data protection (e.g. about
information and updating your data), you can contact our data protection person
responsible at dataprotection.gb@primetals.com.

3. What sources and data do we use?
We process personal data that we receive from our customers, suppliers, business
partners or other data subjects within the framework of our business relationship(including pre-contractual phase). In addition, we process personal data to the extent
necessary for the provision of our services, which we may obtain from publicly
accessible sources (e.g. company registers, commercial registers, land registers, debtor
registers, press, internet) or which is legitimately transmitted to us by other companies of
the Primetals Group.
Relevant personal data is master data (name, address and other contact data), orderdata (e.g. personal data for the order), data from the fulfilment of our contractual
obligations (e.g. data for payment processing), documentation data (e.g. businesscorrespondence, minutes of meetings) and other data comparable with the categories
mentioned.

22/26

November 24th, 2023

4. The purposes for which your data are collected and processed and their legal
bases
4.1 For the fulfilment of contractual obligations (Art. 6(1) point (b) GDPR)PTUK processes your personal data to fulfil the contract with you or to carry out precontractual measures, which are generally taken upon request. The actual processing
depends on the respective business relationship and can include communication,correspondence, needs analyses, consulting, project execution and support, billing,
payment processing as well as the execution of transactions. Without this dataprocessing we cannot conclude or fulfil the contract.
4.2 Within the framework of the weighing of interests (Art. 6(1) point (f) GDPR)
If necessary, we process your data above and beyond the actual performance of thecontract to protect our legitimate interests. Examples of this could be:

4.3-

To assert legal claims and for defence in legal disputes;-

To guarantee IT security and the IT operation of PTUK;-To prevent and investigate criminal offences, video surveillance for theprotection of property rights, to collect evidence in cases of robbery and fraud.
Other measures to secure property rights;-

Measures to ensure building and system security (e.g. access controls);-

Measures for managing the business and further developing services andproducts;-

For risk management in the Primetals Group;
On the basis of your consent (Art. 6(1) point (a) GDPR)

If you have given us your consent to the processing of personal data for certain
purposes (e.g. passing on of data within the Primetals Group, photographs within theframework of events, newsletter dispatch, advertising material), the lawfulness of thisprocessing is given on the basis of your consent. A given consent can be withdrawn at
any time and without providing reasons. This also applies to the withdrawal of
declarations of consent issued to us prior to the validity of the GDPR, i.e. before 25 May
2018. The withdrawal of consent is only effective for the future and does not affect thelawfulness of the data processed before your withdrawal of consent.

23/26

November 24th, 2023

4.4

Due to legal requirements (Art. 6(1) point (c) GDPR)

In addition, we are required to process your data in order to comply with various
statutory provisions (e.g. fulfilment of tax control and reporting obligations). This
processing is of course limited to the data required to comply with the relevant statutory
provisions.

5. Recipients of your personal data
5.1 Third parties and processors
Your personal data will also be used by other companies working on behalf of PTUK
(processors) or in the context of PTUK's business partnerships (third parties). These canbe companies of the Primetals Group (PT Group) or external companies and partners(PTUK partners). You can find a list of all companies of the PT Group here:
https://www.Primetals.com/contact-us/locations. Furthermore, possible recipients of yourdata are companies in the categories of IT services, logistics, telecommunications, etc.
5.2 Recipients outside the European Union (EU)PTUK has outsourced individual services by carefully selected and commissioned
service providers based outside the European Economic Area (third country), e.g. IT
service providers to guarantee IT operations. In these cases transfer to a third country
takes place.
We would like to point out that the persons authorised to process the data are obliged tomaintain confidentiality regarding all related information. Furthermore, we ensure thatstate-of-the-art measures are taken to protect your data.
We also intend to transfer data to locations in third countries in the following cases:-

if it is necessary to fulfil our contractual obligations;-

if required by law (e.g. tax reporting obligations) or-

if you have given us your consent.

To the extent required by law to provide an adequate level of protection for your data,
PTUK uses guarantees that comply with the legal requirements to establish an
adequate level of data protection, including EU standard contractual clauses. In thiscase your data will have the same protection as in the EU. If you wish to receive further
information on this subject, you can contact PTUK using the contact details mentioned
under point 2.

24/26

November 24th, 2023

6. Data storage and data erasure
PTUK processes and stores your personal data as long as this is necessary to fulfil ourcontractual and legal obligations. If the contractual relationship with you is terminated, allmutual claims are fulfilled and no other legal storage obligations or legal justification
bases for storage exist, your data will be deleted.
However, our legitimate interests may constitute an additional legal basis for the further
processing of your data after termination of a contractual relationship. Our legitimate
interests are, for example, to interest you once again in our products and services. Inline with the weighing of interests in sending you direct advertising during our business
relationship with you, our interests also prevail when using your data for this postcontractual advertising purpose. If you object, you have the option of stopping thisprocessing at any time. PTUK uses this data appropriately in accordance with theprocessing purpose described above.

7. Automated decisions
We do not use any fully automated decisions in accordance with Art. 22 GDPR toestablish and implement our business relationships.

8. Profiling
We do not do profiling pursuant to Art. 22 GDPR.

9. Provision of your personal data
Within the framework of our business relationship, you must provide those personal data
which are necessary for the establishment, execution and termination of a business
relationship and for the fulfilment of the associated contractual obligations or which weare legally entitled to collect. Without this information, we will usually not be able to enter
into, execute and terminate a contract with you.

10. Your privacy rights
10.1 Access, rectification, erasure, restriction of processing
You have the right to have access to your personal data. Under certain conditions, youalso have the right to rectification and erasure of your data. Furthermore, you have theright to restrict processing if the legal prerequisites are given.

25/26

November 24th, 2023

10.2 Right to object
You have the right to object at any time for reasons arising from your particular situation
to the processing of personal data concerning you under Art. 6(1) point (e) GDPR (public
interest data processing) and Art. 6(1) point (f) GDPR (data processing on the basis of aweighing of interests). If you object, we will no longer process your personal data unless
we can prove compelling legitimate reasons for the processing which outweigh yourinterests, rights and freedoms, or the processing serves to assert, exercise or defend
legal claims.
You have the right to object to the processing of your data for advertising purposes at
any time. If you object to the processing for direct advertising purposes, we will nolonger process your personal data for these purposes.
10.3 Right of withdrawal
If you have given PTUK express consent to the processing of your data, you can
withdraw this consent at any time and without stating any reasons. The lawfulness ofthe processing of your data before your withdrawal of consent remains unaffected by
the withdrawal.
10.4 Right to data portability
You have the right to receive the personal data concerning you in a structured, common
and machine-readable format. You are entitled to transfer this data to other controllers.
If technically feasible, you have the right to obtain a transmission from us directly toanother controller.
To exercise the rights referred to in point 10, you may contact PTUK using the contact
details referred to in point 2.
10.5 Questions or complaints
You have the right to contact the UK data protection authority, the Information
Commissioner’s Office, with questions or complaints.

11. Updating of our data privacy policy
We will update our data privacy policy accordingly, if necessary, in case data protection
regulations or business needs change.

26/26

November 24th, 2023