HAWESKO HOLDING AG GROUP INVESTORS PRESS CAREERS CONTACT DE EN PRIVACY POLICY Data Controller Hawesko Holding AG Große Elbstraße 145d 22767 Hamburg Germany phone number: +49 40 30 39 21 00 e-mail: ir@hawesko-holding.com Local court: Hamburg HRB 66708 Management Board: Thorsten Hermelink (CEO), Alexander Borwitzky, Raimund Hackenberger Contact details Data Protection Hawesko Holding Aktiengesellschaft - Data Protection - Große Elbstraße 145 d 22767 Hamburg Germany e-mail: datenschutz@hawesko-holding.com BASIC DETAILS OF DATA PROCESSING AND ITS LEGAL BASIS This privacy statement informs you of the nature, scope and purposes of processing personal data within our online offering and the websites, functions and content associated with it (hereinafter referred to collectively as “online offering” or “website”). The privacy statement applies across all the domains, systems, platforms and devices (e.g. desktop or mobile) on which the online offering is presented. With regard to a number of terms used such as “personal data” or its “processing”, we refer to the definitions in Art. 4 of the General Data Protection Regulation (GDPR). According to this privacy policy the term “user” comprises all categories of persons who are affected by the processing of the data. They include our business partners, customers, interested parties and other visitors to our online offering. The terms used such as “user” are intended to be gender-neutral. The personal data of users processed as part of this online offering includes inventory data (e.g. names and user data from forms), usage data (this means data that a provider needs to enable and bill for the usage of its telemedia service. Usage data therefore arises from any interaction between the user and the service, e.g. the websites of our online offering visited, interest in our content), and content data (this means data that relates to the content of a communication, e.g. entries in the contact form). We process personal data of users only in compliance with the relevant privacy policy. This means for example that user data is only processed if statutory authorisation exists, for example if processing of the data is necessary or required by law to deliver our contractual services (e.g. processing of orders) and online services, the consent of users exists or we have a legitimate interest in its processing within the meaning of Art. 6 (1) point f) of GDPR. That is the case with regard to the analysis, optimisation, economic operation and security of our online offering. We point out that the legal basis of the consent is Art. 6 (1) point a. and Art. 7 of GDPR, the legal basis for processing in order to fulfil our services and carry out contractual measures is Art. 6 (1) point b. of GDPR, the legal basis for processing to fulfil our legal obligations is Art. 6 (1) point c. of GDPR, and the legal basis for processing to uphold our legitimate interests is Art. 6 (1) point f. of GDPR. For the purpose of fulfilling our contractual obligations and profiling services (Art. 6 (1) point b) of GDPR) we process inventory data (e.g. names and addresses as well as contact data of users) and contractual data (e.g. services used, names of contact persons, payment information). When contact is made with us, we also process the user’s particulars in order to process the contact request and handle it pursuant to Art. 6 (1) point b) of GDPR. Every time our website is called up, we capture data and information using an automated system. This is saved in the server’s log files (Art. 6 1f) of GDPR, Section 15 (1) German Telemedia Act (TMG). The following data can be captured in this process: Information about the browser type and the version used The user’s operating system The user’s internet service provider The user’s IP address Date and time of access Websites from which the user’s system reaches our website (referrers) Websites that are called up by the user’s system via our website The processing of data is to deliver the content of our website, guarantee the functioning of our IT systems and optimise our website. The data in the log files is always saved separately from other personal data of the users. We, or rather our hosting provider, collect data on the basis of our legitimate interests within the meaning of Art. 6 para. 1 lit. f. GDPR, we collect data about each access to the server on which this service is located (so-called server log files). The access data includes the name of the website accessed, file, date and time of access, amount of data transferred, notification of successful access, browser type and version, the user's operating system, referrer URL (the previously visited page), IP address and the requesting provider. The Logfile-information is stored for security reasons (e.g. for the clarification of abuse or fraud) for a maximum of 7 days and will be deleted thereafter. Data whose further storage is required for evidentiary purposes is exempt from deletion until the respective incident is finally clarified. NEWSLETTERS AND DOWNLOADS We make a range of newsletters and downloads available on the websites. To register for subject-specific newsletters (press distribution list) and mail shots, it is necessary to disclose your e-mail address. If you subscribe to e-mail newsletters for which disclosure of personal data is necessary, you will receive a confirmation e-mail to the e-mail address you have provided. Your registration will only be complete once you have activated the link contained in that e-mail. Once consent has been given, it may be revoked at any time by using the unsubscribe link in the newsletters or by sending an e-mail to ir@hawesko-holding.com. SECURITY MEASURES We take organisational, contractual and technical security measures in line with the state of the art to ensure that the requirements of data protection laws are met, and consequently to protect the data we process against accidental or deliberate manipulation, loss, destruction or against access by unauthorised persons. COOKIES & REACH MEASUREMENT We use temporary and permanent cookies, i.e. small files that are saved on user devices. To some extent cookies enhance security or are required to operate our online offering (e.g. to display the website). In the context of balancing interests, this serves to uphold our overriding legitimate interests in an optimised display of our offering pursuant to Art. 6 (1) sentence 1 point f of GDPR. Cookies are small text files that are saved automatically on your device. Some of the cookies we use are deleted again when the browser session is ended, in other words when your browser is closed (session cookies). Other cookies remain on your device and enable us to recognise your browser upon your next visit (persistent cookies). The overview in your web browser’s cookie settings shows how long they are saved for. You can set your browser to inform you of the placing of cookies so that you can decide whether to accept them on an individual basis, accept cookies in certain cases or generally reject them. Each browser differs in terms of how it manages the cookie settings. For many services, above all tracking, a general rejection of the use of the cookies used for online marketing purposes can be declared via the US site http://www.aboutads.info/choices/ or the EU site http://www.youronlinechoices.com/ In addition it is possible to prevent the saving of cookies by disabling them in the browser settings. Please refer to the help settings or manuals for details of how to disable cookies. Please note that you may then not be able to use all functions of this online offering. On our website, we use a language Cookie (pll_language) from WP SYNTEX S.A.R.L., 28, rue Jean Sebastien Bach, 38090 Villefontaine, France (Polylang). The Cookie stores in which language (German or English) our website will be displayed to you. This cookie remains stored for 1 year. The cookie is necessary for the technical operation of our website. SHARING DATA WITH THIRD PARTIES AND THIRD-PARTY PROVIDERS Data is only shared with third parties subject to the statutory requirements. We share the data of users with third parties only if that is necessary for contractual purposes e.g. on the basis of Art. 6 (1) point b) of GDPR or if it is for in the economical and effective conducting of our business based on legitimate interests pursuant to Art. 6 (1) point f) of GDPR. To the extent that we use subcontractors to provide our services, we take appropriate legal precautions as well as corresponding technical and organisational measures to ensure that personal data is protected in accordance with the relevant statutory requirements. To the extent that, in the context of this privacy statement, content, tools or other means are used by other providers (hereinafter referred to collectively as “third-party providers”) and their declared domicile is in a third country, it is to be assumed that a data transfer to the countries of domicile of the third-party providers takes place. Third countries means countries in which GDPR is not directly applicable law, i.e. fundamentally countries outside the EU or European Economic Area. The transfer of data to third countries takes place either on the basis of an appropriate level of data privacy, consent by the users or other legal permission. Hosting We or our hosting providers, on the basis of our legitimate interests within the meaning of Art. 6 (1) point f. of GDPR, collect data on every access to the server on which this service is located (so-called server log files). The access data includes the name of the website accessed, the file, date and time of access, data volume transferred, report on successful access, browser type with version, the operating system of the user, referrer URL (the page previously visited), IP address and the requesting provider. For security reasons (e.g. to detect cases of abuse or fraud), log file information is saved for a maximum of 7 days, then deleted. Data which needs to be retained for longer as proof is excepted from deletion until the case in question has been definitively cleared up. Functions of the d.vinci service Functions of the d.vinci service. These functions are offered by delphi Managementberatung GmbH, Nagelsweg 37-39, 20097 Hamburg. If you visit our careers page, content is called up from d.vinci’s servers, as a result of which your IP address is transferred in the saving of a log file (see above). We point out that we, the provider of the pages, receive no knowledge of the content of the data transferred or how they are used by d.vinci, unless you are logged in with d.vinci and contact us using the contact functions. Privacy statement: https://www.dvinci.de/datenschutz. Functions of the EQS service We use the services of EQS Group AG, Karlstraße 47, 80333 Munich to display the capital market notices relating to our company on our website. Information from servers of EQS Group AG is loaded when our page is visited. For further information on data capture by EQS Group AG, please refer to the privacy statement of that provider at https://www.dgap.de/dgap/DGAP/Datenschutzhinweise/. Functions of the Google Maps service If required, Maps of the “Google Maps” service are provided by the third-party provider Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland. Privacy statement: https://www.google.com/policies/privacy/, opt-out: https://www.google.com/settings/ads/. If we integrate Google Maps into our website, your IP address will be transmitted to Google Ireland Limited. Functions of the Google Fonts service External fonts of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland, https://www.google.com/fonts (“Google Fonts”). Google Fonts are integrated by accessing a server at Google. Privacy statement: https://www.google.com/policies/privacy/, opt-out: https://www.google.com/settings/ads/. Functions of the Google reCAPTCHA service We use "Google reCAPTCHA" to check whether the entered data on this website is made by a human user or by an automated program. The service is provided by the third-party provider Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland. Privacy statement: https://www.google.com/policies/privacy/. RIGHTS OF USERS; REVOCATION AND OBJECTION You have the right to object to the processing of your data at any time for reasons arising from your particular situation, if the legal requirements are met. If you wish to object to the processing of your data or revoke a granted consent, a short message to datenschutz@hawesko-holding.com or by post to our above address is sufficient. You can unsubscribe from our press distribution list by using the unsubscribe link in the newsletters or by sending an e-mail to ir@hawesko-holding.com. The legitimacy of the processing undertaken until the objection or revocation remains unaffected by this. If you have any questions about the processing of your personal data by us, we will of course provide you with information about the data concerning you (Art. 15 GDPR). In addition, you have a right to rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and objection (Art. 21 GDPR) if the legal requirements are met. You also have the right to data portability (Art. 20 GDPR). In all these cases, please contact the communication address on data protection issues mentioned under "Data controller". Finally, you have the right to complain at a responsible data protection supervisory authority (Art. 77 GDPR, § 19 German Federal Data Protection Act). DELETION OF DATA The data we save is deleted as soon as it is no longer needed for its intended purpose and no statutory retention obligations stand in the way of deletion. If data of users is not deleted because it is necessary for other and legally permissible purposes, its processing will be restricted. The data will then be blocked and not processed for other purposes. That will be the case e.g. for user data that needs to be retained for reasons of commercial or fiscal law. According to statutory requirements certain data is retained for 6 years pursuant to Section 257 (1) of the German Commercial Code (trading books, inventories, opening balance sheets, annual financial statements, commercial papers, accounting documents, etc.) as well as for 10 years pursuant to Section 147 (1) of the German Fiscal Code (AO) (books, records, management reports, accounting documents, commercial and business papers, documents relevant for taxation, etc.). AMENDMENTS TO THE PRIVACY STATEMENT We reserve the right to amend the privacy statement in order to bring it in line with changes in the legal position or the service, and also with changes in data processing. However this only applies with regard to data processing declarations. If user consent is necessary or components of the privacy statement contain provisions of the contractual relationship with the users, the amendments are made only with the consent of the users. The users are requested to enquire about the content of the privacy statement on a regular basis. Stand: March 2021 DOWNLOADS Current material regarding the Hawesko Holding can be found here for download. ANNUAL REPORT IMPRINT Our imprint can be found here. Our privacy policy can be found here. HAWESKO HOLDING Elbkaihaus Große Elbstraße 145d 22767 Hamburg Germany Tel. +49 (0)40-30 39 21 00 Fax +49 (0)40-30 39 21 05