ID:

Data Protection
Information Requirements
Interested Party/Customer/
Other External Party DataDS026

Revision: 002

Status: Approved

Date: 12.12.2019

Information on processing personal data of Interested Party,
Customer and Other External Party per Art. 13 GDPR
Dear interested party / customer / external party,
We take the protection of your personal data very seriously. We process your data in accordance with the EU General Data Protection Regulation (GDPR) and the Data Protection Adaption and Implementation Act EU (DSAnpUG-EU). The following details how we process yourdata according to Art. 12 and 13 GDPR.

Who is responsible for data processing? (Art. 13.1 a, b GDPR)
Responsible for data processing:Interroll Engineering GmbH
Höferhof 16, 42929 Wermelskirchen
Phone: +49 (0) 219323 – 0
E-Mail: datenschutz@interroll.com
Ask questions about data protection to:Interroll Engineering GmbH
GDPR-Coordinator
Höferhof 16, 42929 Wermelskirchen
Phone: +49 (0) 219323 – 0
E-Mail: datenschutz@interroll.com

For what purposes and on what legal basis to we process your personal data?
(Art. 13.1 c, d and 2 f GDPR)
If your contact us for an offer, we store your data in our customer or supplier database so that
we can access it in the event of the conclusion of the contract (Art. 6.1f GDPR). If we only
respond to a request from you, we will only store your data for the purpose of answering yourrequest and will not use your data for any other purpose. We only process such data that wehave received from you directly in the context of the respective business transaction or in general communication, e.g. for the conclusion and execution of contracts. The legal basis is Art.
6.1b GDPR.
If we have received your consent (pursuant to Art. 6.1a), we process your data for the purposesof information and consulting on products and services as well as marketing.

ID:Data Protection
Information Requirements
Interested Party/Customer/
Other External Party Data

DS026

Revision: 002

Status: Approved

Date: 12.12.2019

If necessary, we will process your data to protect ours or third parties‘ legitimate interest inaccordance with Art. 6.1f GDPR, such as for the assertion of legal claims and defense in legal
disputes or for the guarantee of IT operations and security.
In order to comply with legal requirements, we may or must, if necessary, process your dataand pass it on to third parties (pursuant to Art. 6.1c).
We do not use your data in any way for automated decision making or profiling.

Who receives your personal data? (Art. 13.1e, f GDPR)
We generally do not pass on personal data to third parties unless you have given your consent(see above), there are legitimate interests (Art. 6.1f GDPR) or it is necessary for the executionof pre-contractual measures or the fulfillment of contractual obligations. Data can then also betransmitted to other companies of the Interroll Group. Various activities in the field of financial
accounting are assigned to Interroll Holding GmbH, which works as a service provider for Interroll Engineering GmbH. The processing of the data takes place there as order processing
according to Art. 28 GDPR. Furthermore, within the scope of contract processing, your data
may also be received by respective external service providers, which we have obligated tokeep confidential by means of corresponding contractual regulations (e.g. in accordance withArt. 28 GDPR).
We primarily process your data in Germany. Under certain circumstances, data is also exchanged with sales companies in other EU states, provided that we obtain your data for thepurposes of formulating or accepting a quotation. We have no intention of processing the datain third countries. An exception to this is Switzerland as this is where several Interroll companies are based. An adequacy decision applies to Switzerland. This decision is adopted by theEuropean Commission in accordance with Article 45 GDPR, which specifies that a third country (i.e. a country which is not bound to the GDPR) or an international organisation provides
an adequate level of protection for personal data. Provided that your data is not transmitted toa third country which has not been recognised as providing adequate protection within theInterroll Group, this is lawful in accordance with the provisions of Article 44 et seq. GDPR.

How long is the data stored? (Art. 13.2a GDPR)
In principle, we only store your data for as long as required by law. Data that we process
based on your consent will be stored until revoked. We store data that we process on the basis on a legitimate interest for as long as the legitimate interest exists.

What are your rights and obligations? (Article 13 (2b, c, d, e) GDPR)••

In accordance with Article 15 GDPR, you have right of access by the data subject. Thismeans that you can request confirmation from us on whether we are processing personal
data that concerns you.
In accordance with Article 16 GDPR, you have the right to rectification. This means thatyou can request that we rectify any incorrect personal data that concerns you.

ID:

Data Protection
Information Requirements
Interested Party/Customer/
Other External Party Data•••••DS026

Revision: 002

Status: Approved

Date: 12.12.2019

In accordance with Article 17 GDPR, you have the right to erasure ("right to be forgotten").
This means that you can request that we erase any personal data that concerns you without delay – unless we cannot erase your data because we must comply with legal retention
obligations, for example.
In accordance with Article 18 GDPR, you have the right to restriction of processing. Thismeans that we will virtually cease to process your personal data any further, apart fromstoring it.
In accordance with Article 20 GDPR, you have the right to data portability. This meansthat you have the right to receive the personal data that concerns you, which you haveprovided to us, in a structured, commonly used and machine-readable format, and totransmit that data to another controller.
In accordance with Article 7 (3) GDPR, you have the right to withdraw any given consent
at any time for the future.
In accordance with Article 13 GDPR, you have the right to lodge a complaint with thecompetent supervisory authority.

If you want to exercise your rights, please contact the data protection officer (see above forcontact details) in writing (by post or e-mail).
In addition, you have the right to object. This is explained in more detail at the end of this dataprotection information.
Competent supervisory authority
North Rhine-Westphalia (NRW) State Commissioner for the Protection of Data and Freedomof Information
Address: Kavalleriestr. 2 – 4, 40312 Düsseldorf
Postal address: Postfach 20 04 44, 40102 Düsseldorf
Phone: +49 (0) 211/38424-0
E-Mail: poststelle@ldi.nrw.deInformation about your right to object in accordance with Article 21 General Data
Protection Regulation (GDPR)
You have the right to object at any time, on grounds relating to your situation, to the processing of personal data that concerns you which is based on Article 6 (1f) GDPR (dataprocessing based on a balancing of interests); this includes any profiling based on this provision as defined in Article 4 (4) GDPR.
Should you object, we will cease to process your personal data unless we can provide
compelling legitimate grounds for doing so which outweigh your interests, rights and freedoms, or unless the processing is used to assert, exercise or defend legal claims.

ID:Data Protection
Information Requirements
Interested Party/Customer/
Other External Party Data

DS026

Revision: 002

Status: Approved

Date: 12.12.2019

You can send your objection without using any special forms and it should preferably be
addressed to our data protection officer (see above for contact details).

You only have to provide us with the personal data necessary for your business relationshipand the fulfillment of the associated contractual obligations or which we are legally obliged tocollect (e.g. money laundering law, trade and finance laws). Otherwise, we cannot or may nothave a business relationship with your or conclude and execute a contract with you.

ID:

Data Protection
Information Requirements
Interested Party/Customer/
Other External Party DataPurpose

Legal BaseDS026

Revision:002

Status: Approved

Date: 12.12.2019

Recipient

Storage Period

Answering general inquiries /general correspondence

Art. 6 para. 1 a) GDPR

Internal data processing

In accordance with legal retention periods

Quotation processing

Art. 6 para. 1 b) GDPR

Internal data processing

In accordance with legal retention periods

Order processing

Art. 6 para. 1 b) GDPR

Internal data processing

In accordance with legal retention periods

Customer master data

Art. 6 para. 1 b) GDPR

Internal data processing,In accordance with legal retention periods

Interroll Holding GmbH
Vendor master data

Art. 6 para. 1 b) GDPR

Internal data processing,In accordance with legal retention periods

Interroll Holding GmbH
InvoicingArt. 6 para. 1 b) GDPR

Internal data processing,In accordance with legal retention periods

Interroll Holding GmbH
Marketing / Advertising

Art. 6 para. 1 f) GDPR

Interroll AG Schweiz

In accordance with legal retention periods

Customer satisfaction

Art. 6 para 1 f) GDPR

Internal data processing

In accordance with legal retention periods

Supplier assessment

Art. 6 para 1 f) GDPR

Internal data processing

In accordance with legal retention periods

Establishing contacts

Art. 6 para 1 f) GDPR

Internal data processing

In accordance with legal retention periods

analysis