Privacy Policy
for Visitors, Deliverers, external Employees andEmployees of Contractors accessing the Heraeus
Premises in Hanau, Kleinostheim andWehrheim
Information pursuant to Articles 13, 14 and 21 of the General Data Protection Regulation(GDPR)

1. GENERAL
1.1

Objective and responsibility
1)

The purpose of this Privacy Policy is to inform visitors, deliverers, external employees andemployees of contractors accessing the Heraeus premises in Hanau, Kleinostheim andWehrheim (hereinafter referred to as "visitors") about the nature, scope and purpose of theprocessing of personal data.

2)

The legal entity responsible for the processing of data within the meaning of data protection
legislation is Heraeus Site Operations GmbH & Co. KG (hereinafter referred to as "Heraeus").
Any inquiries or requests for information under data protection law must be directly
addressed to the responsible entity. Inquiries or requests for information under dataprotection law may also be directed to the Heraeus Data Protection Officer.

3)

The Heraeus Data Protection Officer may be contacted at
dataprotection@heraeus.com or:
Datenschutzbeauftragter
c/o Heraeusstr. 12-1463450 Hanau

1.2

Legal basisYour personal data is collected and processed on the following legal basis:
1)

Consent in accordance with Art. 6 (1) (a) of the General Data Protection Regulation (GDPR).
Consent is a statement of intent, freely given in a specific instance in an informed andunambiguous manner in the form of a declaration or another unequivocal affirmative act,
where the data subjects make it clear that they consent to the processing of their personaldata.

2)

Processing for compliance with a legal obligation in accordance with Art. 6 (1) (c) GDPR, i.e.,the data processing is required on the basis of a law or some other requirement.

3)

Processing to safeguard legitimate interests in accordance with Art. 6 (1) (f) GDPR, i.e., theprocessing is necessary to safeguard our legitimate interests or those of a third party,
provided the interests do not outweigh the fundamental rights and freedoms of users who
require the protection of personal data.

Privacy Policy for Visitors, Deliverers, external
Employees and Employees of Contractors

1I5

1.3 Data subject rights
You can assert your rights as a data subject with regard to your processed personal data at any time using
the contact details of the Data Protection Officer given above. As a data subject, you have the followingrights.
1)

Right to revoke consent: If personal data is processed on the basis of consent, you have theright to revoke this consent at any time for the future in accordance with Art. 7 GDPR.

2)

Right to information: In accordance with Art. 15 GDPR, you can request confirmation ofwhether their data is being processed. If this is the case, users have the right to information
regarding the information at no charge.

3)

Right to rectification: If personal data has been processed while incorrect, you have the right,
to request that this data be corrected immediately in accordance with Art. 16 GDPR.

4)

Right to erasure: If you have revoked your consent, objected to the processing of yourpersonal data (and there are no overriding legitimate reasons for the processing), yourpersonal data is no longer necessary for the original purpose of the processing, there is acorresponding legal obligation or personal data has been processed unlawfully, you have theright to request the deletion of their personal data in accordance with Art. 17 GDPR.

5)

Right to restriction of processing: Under the provisions of Art. 18 GDPR, you have the right todemand that the processing of their personal data be restricted.

6)

Right to data portability: In accordance with Art. 20 GDPR, you have the right to receive thepersonal data they provided in a structured, commonly used and machine-readable format.

7)

Right to object: If processing the personal data is necessary to safeguard the legitimate
interests of our company, you can object to the processing at any time in accordance with Art.
21 GDPR.

8)

Right to file a complaint: In accordance with Art. 77 GDPR, you have the right to lodge acomplaint with the responsible supervisory authorities.

1.4 Deletion of dataYour personal data is deleted as soon as the purpose for which it was collected has ceased to exist and there
are no other legal or contractual obligations to retain it.
1.5 Security measures
State-of-the-art organizational and technical security measures are in place to ensure compliance withrelevant legal provisions and to protect personal data against accidental or intentional manipulation, loss,destruction and unauthorized access.
1.6 Transfer of data to third parties and third-party providersr
1)

Heraeus transfers data to third parties exclusively in accordance with legal provisions. We onlytransfer user data to third parties if necessary (for example, for accounting purposes) or forother purposes necessary to meet our contractual obligations to users or legal requirements.

2)

Where we use sub-contractors to provide our services, we will take appropriate legal
precautions and technical and organizational measures to protect personal data in accordancewith applicable legal provisions.

3)

If, within the scope of this privacy policy, we use content, tools or resources of other providers(hereinafter collectively referred to as “third-party-providers“) whose registered office is in athird country, it must be assumed that data are transferred to such third countries.

Privacy Policy for Visitors, Deliverers, external
Employees and Employees of Contractors

2I54)

Third countries are countries in which the GDPR does not apply directly, i.e. in principle allcountries outside the EU or the European Economic Area. Data may only be transferred tothird countries if an adequate level of data protection is ensured, if visitors have given theirconsent or if the transfer of such data is permitted by law.

1.7 Automated decision-making process
We do not intend to use any personal information collected from you for any automated decision-making
process (including profiling).

2. DATA PROCESSING IN DETAIL
2.1 What sources are used and what data are processed by Heraeus?
Heraeus collects the following data:
Personal information of visitors (first and last name, address and other contact data, such as visitor'semployer, business address and other business contact datas , e-mailadress),visitors Heraeus internal
contact person, date/time of arrival on the premises of Heraeus, and date/time of leaving the premises ofHeraeus (visiting time).
If the visitor is allowed to drive onto the Heraeus site, the license plate number of the vehicle and thedriver's cell phone number for telephone will be available during the stay on the Heraeus site.
Visitors identify themselves with an identity document.
Heraeus uses the following as sources of personal data:a. Information provided by a Heraeus employee as part of the registration process of the visitor
b. Information provided by the visitor (e.g. in the case of a visit that has not already been automatically
pre-registered by our systems)c. Information provided by the person concerned to the security personnel at the entrance or reception
and/or to be taken from the identity document.
At the Heraeus sites in Hanau and Kleinostheim, the authenticity of the identification documents may also beverified by means of an optical scanner.
Visitors will receive a visitor badge stating their name and the name of their employer, where applicable. Thevisitor badge must be worn in a prominent position for the entirety of the visit and returned to the Heraeus
Site Security Office after the visit.
In the case of visitor groups, the personal details of individual members of the visitor group will be entered in
the visitor management software. No visitor badges will be issued to the individual members of a visitor group.
Moreover, Heraeus will also process data of photographs collected from visitors for whom a Heraeus ID card
is issued.
The Heraeus ID card must be worn in a prominent position for the duration of the visitor's stay at the Heraeus
facility. Heraeus also registers the times of arrival and departure of visitors who check in and out at theentrances using the Heraeus ID card. The data are recorded by reading devices installed at the entrance
turnstiles. The Heraeus ID card must be returned once the reason for the access authorization expires.
Video surveillance is performed in the marked areas of the Heraeus business premises.
2.2 How does Heraeus store visitor data?
Visitor data is recorded in the visitor management system.

Privacy Policy for Visitors, Deliverers, externalEmployees and Employees of Contractors

3I5

2.3 For which purpose does Heraeus process data and on which legal basis?
Heraeus processes personal data in accordance with the provisions of the General Data Protection Regulation(GDPR) and other applicable laws requiring and/or authorizing Heraeus to process the aforementioned dataof its visitors:
2.3.1

For compliance with legal obligations pursuant to Art. 6 (1) c) GDPR

To avoid hazardous incidents at the Heraeus sites in Hanau and Kleinostheim, Heraeus is required by the 12 thRegulation on the Implementation of the German Federal Immission Control Act (Hazardous IncidentsOrdinance) [BImSchV (StöV)] to take safety measures to prevent "interferences by unauthorized third parties".
Such measures include the adequate surveillance of visitors and contractors on the Heraeus businesspremises. For such surveillance, personal identification data will be collected from visitors, deliverers, external
employees and contractors' employees who are required to present their respective identification cards,
passports or alternative identity cards for such purpose.
2.3.2

For the safeguarding of legitimate interests pursuant to Art. 6 (1) f) GDPR

1)

For the protection of domestic authority, the visitor's identity, the purpose of the visit and thevisiting times are recorded;2)

video surveillance of entrance areas and traffic routes on the Heraeus company compound, as
well as building and plant security measures (e.g., access controls) for the protection ofdomestic authority and the protection of property, and all measures relating to IT security atHeraeus;

3)transmission of data to other Heraeus departments or other Heraeus companies to the extent
that such transmission serves the purpose of complying with legal or statutory obligations(e.g., transmission of data to the Heraeus Site Security Office, the visit receiving Heraeus
entity, Heraeus Corporate Centers where required e.g. accounting issues.);

4)transmission of data to third parties who assist Heraeus in the performance of its legal
obligations or in the protection of its rights (such as investigative authorities or policeauthorities).
2.3.3

Based on consent given pursuant to Art. 6 (1) a) GDPR

Heraeus also processes personal data for purposes to which visitors have expressly consented, for example
photo shoots in case of an event.
Any consent already given may be withdrawn at any time. This right of withdrawal also applies to any consent
given prior to the effective date of the GDPR. Such withdrawal of consent is only of effect for the future anddoes not affect the processing operations that were performed prior to such withdrawal.
2.4 How long will the data be stored?
The personal data of visitors is deleted as soon as the purpose for which it was collected no longer applies
and there are no other legal or contractual retention obligations.
They are archived in the visitor management system for 12 months. After that, they are automaticallydeleted.
Data are stored in order to prove compliance with the regulations of the German Federal Immission Control
Act in the event of an incident or in the case of official investigations relating to criminal or administrative
offenses.
Privacy Policy for Visitors, Deliverers, external
Employees and Employees of Contractors

4I5

Video recordings will be deleted within 30 days after the recording was made, unless they are needed for theinvestigation of crimes, statutory violations or accidents.
2.5 Are data transferred to third countries?
Visitor data will not be transferred to third countries (countries outside the European Economic Area – EEA).
2.6 Are visitors obliged to make personal data available to Heraeus?
Visitors have a right to information and access pursuant to Art. 15 GDPR, a right to rectification pursuant toArt. 16 GDPR, a right to erasure pursuant to Art. 17 GDPR, a right to restriction of processing pursuant to Art.
18 GDPR and a right to data portability pursuant to Art. 20 GDPR.
In addition, visitors have the right to lodge a complaint with a supervisory authority.
2.7 Information on your right of objection pursuant to Art. 21 GDPR
Visitors are entitled to object to the processing of their personal data at any time for reasons arising fromtheir particular situation if the processing of their data is carried out pursuant to Art. 6 (1) f) GDPR (dataprocessing for the safeguarding of interests).
Based on a visitor's objection, Heraeus will stop processing such visitor's personal data unless Heraeus canprove that the processing of the data is necessary for compelling legitimate reasons which outweigh thevisitor's interests, rights and freedoms, or if the processing of the visitor's data serves the assertion, exercise
or defense of legal claims of Heraeus.
The objection may be informal and should be addressed to:Widerspruch@heraeus.com
Visitors are asked to state as precisely as possible to which specific data processing operation they wish toobject. In the event of an objection, Heraeus may demand the return of the Heraeus ID card and deny thevisitor access to the Heraeus business premises.

3. CHANGES TO THE PRIVACY POLICY
We reserve the right to change the privacy policy in order to adapt to changes in the legal situation or tochanges in our services and data processing.
Visitor are requested to familiarize themselves regularly with the content of the privacy policy.
Last updated: March 2024
Version: 2.0

Privacy Policy for Visitors, Deliverers, external
Employees and Employees of Contractors

5I5