Privacy Policy for Business Partners

1. General

Here you will find information on the collection and use of personal data (“data”) in connection with
our business activities. In this context, we are in a business relationship with you or your employer
or client, for example, in connection with the initiation, execution or termination of a contractual
relationship as part of our business activities.

1.1. Data controller

The data controller pursuant to Article 4(7) of the EU General Data Protection Regulation (GDPR)
is:

AUMUND Fördertechnik GmbH
Saalhoffer Str. 17
47495 Rheinberg
Germany
Tel.: +49-2843-72 0

1.2. Data Protection Officer

Our Data Protection Officer is:

Thomas Rosin
The Five GmbH
Klaus-Groth-Str. 4
23611 Bad Schwartau
Germany
Email: datenschutz@aumund.de

2. General information

We expressly point out that data transmission over the internet (e.g. when communicating by email)
is susceptible to security breaches and cannot be completely protected against access by third
parties. For a more secure transmission of data, we will be happy to provide you with alternative
methods of transmitting digital data upon informal request.

The use of our contact details for commercial advertising is expressly not desired, unless we have
given our prior consent or a business relationship already exists. We hereby object to any commercial
use or disclosure of our data.

Personal data

“Personal data consists of individual details relating to the personal or factual circumstances of an
identified or identifiable natural person (data subject).” Personal data includes, for example, name,
address, date of birth, occupation, company affiliation, as well as details such as professional skills,
hobbies, behaviour, etc. The purpose of the Federal Data Protection Act and other specific regulations
is to protect the rights and freedoms of data subjects with regard to their data against misuse.

3. Categories of data and source (direct collection, employer)

We process personal data that you provide to us in the course of our business relationship. Where
our business relationship is with your employer or client, we also collect personal data either from
you directly or from your employer or client. This comprises the following data or categories of data:

• Master data (e.g. name and title, job title/position)
• Contact details (e.g. telephone number, fax number, email address, postal address)
• Communication data (e.g. content of personal, telephone or written communications)

In addition, we process the following categories of personal data that we generate ourselves:

• Master data (e.g. customer number or contact number)
• Quotation and contract data (e.g. contract reference, contract history)

4. Data categories and sources (sales partners and AUMUND companies)

If you are in contact with one of our sales partners or another company within the AUMUND Group
and express a wish to purchase products or services from us, we collect your personal data via that
sales partner. This involves the following data or categories of data:

• Master data (e.g. name and title, job title/position)
• Contact details (e.g. telephone number, fax number, email address, postal address)
• Communication data (e.g. content of personal, telephone or written communications)

5. Purposes of processing

If you are a contracting party yourself, we process your personal data to fulfil contractual obligations
(Article 6(1), first sentence, point (b) of the GDPR), more specifically for the purpose of initiating,
performing or fulfilling a contract with you. This includes, for example, placing orders, internal sales
activities, the dispatch and payment for products and services, or contract negotiations.

If you are not a contracting party yourself – for example, if you are an employee of a business partner
– processing is carried out for the same purposes on the basis of a legitimate interest pursuant to
Article 6(1), first sentence, point (f) of the GDPR. In such cases, we are in the process of initiating or
performing a contractual relationship with your employer or client as part of our business activities.
We process your personal data for this purpose on the basis of your work for your employer or client.

Furthermore, where necessary, we process personal data to comply with legal requirements (Article
6(1), first sentence, point (c) of the GDPR) for the following purposes:

• Compliance with statutory record-keeping and retention obligations
• Compliance with statutory reporting obligations

In addition, we process personal data to safeguard the following legitimate interests (Article 6(1), first
sentence, point (f) of the GDPR):

• Maintaining the business relationship
• Conducting training courses or other events
• Asserting legal claims and defending ourselves in legal disputes
• Inclusion in our contact database or maintaining contact following a business interaction (e.g. if you provide us with your business card)
• Direct marketing to customers or customers’ employees (e.g. information about products and services)

In addition, we may process personal data for which you have given us your consent (Article 6(1)(a)
of the GDPR). We obtain this consent separately, for example in the following cases:

• Sending newsletters
• Publication of photos/videos

6. Place of data processing

We process your personal data in Germany, within the European Union (EU) and, in connection with
the provision of our products and services, also internationally. Where processing in countries outside
the European Union (so-called third countries) is necessary, we ensure that an adequate level
of data protection is in place there. This is the case if the European Commission has issued an
‘adequacy decision’ (Article 45 of the GDPR) for the country in question, or if the recipient has put in
place ‘appropriate safeguards’ (Article 46 of the GDPR) or ‘internal data protection rules’ (Article 47
of the GDPR). Where necessary, we also agree on specific measures with the recipient. Further
information on this can be found on the European Commission’s website:

https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection_de.

7. Your rights

You have the following rights in relation to us regarding your personal data:

• Right of access (Article 15 of the GDPR),
• Right to rectification or erasure (Articles 16 and 17 of the GDPR),
• Right to restriction of processing (Article 18 of the GDPR),
• Right to data portability (Article 20 of the GDPR),
• Right to object to processing carried out on the basis of our legitimate interests (Article 21 of the GDPR); please see the further information at the end of this statement.

You also have the right to lodge a complaint with a data protection supervisory authority regarding
our processing of your personal data.

Should there ever be a valid reason to make a complaint, you are also welcome to contact our Data
Protection Officer, as mentioned above, at any time.

8. Recipients of data

The personal data processed in connection with our business activities may be disclosed to the
following categories of recipients:

• Providers of services (e.g. IT services), all of whom are engaged by us as data processors.
• Telecommunications and logistics service providers
• Authorities and other public bodies, where applicable legal obligations exist
• Credit reference agencies, financial service providers
• Sales partners and companies within the AUMUND Group (https://aumund.com/de/aumund-group/aumund-gruppe-weltweit/)
• and the external data protection officer

9. Retention period

We process your personal data for as long as it is necessary for the purposes set out above. Once
the business relationship has ended, your data will be retained for as long as we are legally obliged
to do so. This arises from legal obligations regarding evidence and record-keeping, which are
governed, amongst other things, by the German Commercial Code (HGB) and the German Fiscal
Code (AO). The retention period is up to ten years. Furthermore, it may be necessary to retain certain
personal data for as long as claims can be brought against us (limitation period of three to ten years,
rarely up to thirty years).

10. Further information

There is no legal obligation to provide your data. However, without the processing of personal data,
we are unable to enter into or fulfil a contractual relationship with you or your employer or client.

Where applicable, the provision of your data is necessary for the performance of a contract. Please
refer to the relevant contractual documents in force at the time for further information.

No automated decision-making that could have legal effects on you or similarly significantly affect
you takes place in connection with your use of this website.

11. Changes to this Privacy Policy

We reserve the right to amend this privacy policy in accordance with the statutory data protection
provisions. The currently valid version is available for you to view in the ‘Privacy’ section of our
website.

12. Information on your right to object under Article 21 of the GDPR