Data Protection

The protection of your privacy rights when personal data is being processed is important to TRATON. Personal data collected when users visit our website is processed in accordance with the statutory provisions of the country in which the body responsible for processing the data has its legal domicile.

1. Controller and point of contact

TRATON SE
Hanauer Str. 26
80992 Munich, Germany

To contact the Data Protection team or to exercise your data subject rights, please use the contact form.

2. Collection and processing of personal data

When you visit our website, our web servers store the IP address and the domain from which access is obtained, the date and time of the visit, the website that you visit with us, and technical information on the visit (http method, http version, http status code, length of the transmitted data, browser used) as standard.

Hosters of the (sub-)domains:

1. General information

a) Introduction
The protection of your privacy rights during the processing of personal data is important to companies in the TRATON GROUP (hereinafter referred to as “TRATON”). We process personal data in compliance with the provisions of the EU General Data Protection Regulation (GDPR) and in accordance with the legal regulations of the country in which the controller of the data processing is located.

Furthermore, TRATON companies have undertaken to provide comprehensive and uniform protection of personal data through the implementation of a binding Group policy. Within TRATON, this ensures a level of protection worldwide that is comparable to that in Germany and the European Union. Moreover, our employees are obliged to maintain confidentiality with regard to the handling of personal data.

b) Controller and point of contact
The controller as defined by data protection law is the TRATON company that processes your data as part of an existing or incipient contractual relationship. In the event of questions relating to data protection, please contact the data protection officer/data protection coordinator at the TRATON company with which you have or are initiating a contractual relationship. The ultimate holding company of the TRATON GROUP is TRATON SE (TRATON SE, Hanauer Str. 26, 80992 Munich, Germany). To contact the Data Protection team or to exercise your data subject rights, please use the contact form.

2. Collection and processing of personal data

a) Purpose limitation and legal basis
TRATON processes your personal data in order to execute and manage an existing or incipient contractual relationship with you. In this context, your personal data is processed for various purposes as part of a range of processing activities.

b) Data sources
As a rule, your personal data is collected directly from you as part of an existing or incipient contractual relationship.

c) Obligation to provide data
You must provide to the controller the personal data required to execute the contractual relationship. If you do not provide this data, TRATON cannot fulfill the relevant legal obligations or enter into the contractual relationship.

d) Intended purpose of processing activities
An overview of the intended purpose of our processing activities is provided below:

Putting services and materials out to tender
Sending requests, calling in outstanding quotes, commercial review and completeness check of quotes, and performing negotiations.

Order processing (materials, services)
Writing, submitting, sending, and tracking orders in the system.

Supplier support
Communication regarding products or services, responding to inquiries and requests, and bottleneck and risk management.

Procurement controlling and service provider controlling
Figures regarding suppliers.

Compliance with legal obligations
Compliance with retention obligations, ensuring that compliance requirements are met through checks (e.g., sanctions list checks and money laundering, references to legal infringements), operating an internal control system (ICS) and other monitoring systems for ensuring that business processes comply with regulations.

The processed data can be classified into the following data categories:

• Professional contact and (work) organizational data
• IT usage data
• Data on personal/professional circumstances and characteristics
• Creditworthiness and bank data
• Contractual data
• Photo, video, and audio material

The aforementioned processing activities are justified by the following legal basis:

• Consent to one or more specified purposes (point (a) of Article 6(1) of the GDPR)
• Fulfillment of the contract or contract initiation (point (b) of Article 6(1) of the GDPR)
• Fulfillment of legal obligations (point (c) of Article 6(1) of the GDPR)
  • Balancing of interests (point (f) of Article 6(1) of the GDPR)
  • The existence of a relevant and appropriate relationship between the controller and the data subject
  • Prevention of fraud
  • Direct advertising
  • Transfer of data within a corporate group for internal management purposes (including customer and employee data)

3. Transfer of personal data

In certain cases, your personal data may also be disclosed to other bodies: if the disclosure of your personal data is necessary in order to execute or initiate the contractual relationship. We also disclose your personal data to service providers commissioned by us within the framework of order processing. Your core data and contact details are disclosed for the purpose of ensuring an up-to-date database and for credit checking. Other affiliated companies of the TRATON GROUP are also able to access this database. If we are required to comply with country-specific legal requirements regarding the disclosure of your personal data, e.g., for transfer to financial authorities, courts, or auditors, we will fulfill this obligation.

4. Data retention and erasure

We erase your personal data as soon as it is no longer required for the purposes stated above. Your personal data is stored for as long as we are required to do so by law, or for as long as statutory limitation periods apply. This regularly arises due to legal obligations to provide proof and preserve records, governed by legislation including the Bürgerliches Gesetzbuch (BGB — German Civil Code), Handelsgesetzbuch (HGB — German Commercial Code), and the Abgabenordnung (AO — German Tax Code). Beyond this, data is only saved if there are further statutory or contractual storage obligations to do so.

5. Your rights

You have the right to be informed about the data that relates to you and the right to have your data rectified. Provided that there are no statutory regulations to the contrary, you also have the right to have your data erased and to object to the processing of your data, and the right to restrict the processing of your data. Furthermore, you have the right to data portability. If we collect and process your personal data on the basis of your consent, you also have the right to revoke the consent you granted with effect for the future. The legality of the data processing carried out with your consent until you revoke it remains unaffected by your withdrawal of consent. If necessary, we need to verify your identity before we can process your requests. If, in spite of our efforts to maintain accurate and up-to-date data, incorrect information has been saved, we will correct such information upon corresponding request. In the event of complaints, there is the possibility to contact a data protection supervisory authority.

6. Automated decision-making

We do not perform automated individual decision-making within the meaning of Article 22(1) & (4) of the GDPR.

7. Security

TRATON uses technical and organizational security measures to protect your data against accidental or premeditated manipulation, loss and destruction, and access by unauthorized persons. Our security measures, such as data encryption, are regularly improved in accordance with technological development.

In order to avoid the risk of significant financial losses from fines, disgorgement and liability for damages, or criminal prosecution vis-à-vis the TRATON GROUP or its employees, it is important that possible regulatory violations are identified at an early stage. Information regarding potential regulatory violations can be reported via several channels within the TRATON GROUP.

When you submit a tip-off, we process your personal data when we receive, assess, and investigate your tip-off in accordance with this information on data protection.

Incoming tip-offs are handled by a small group of expressly authorized and specially trained employees of TRATON SE’s GRC Investigation Office (GIO). The TRATON Investigation Office checks the facts of the tip-off and, if necessary, conducts a further case-related investigation together with other investigation units of the company concerned. Tip-offs are always treated confidentially.

Confidentiality cannot be guaranteed if you deliberately submit false information with the aim of discrediting a person (denunciation).

Please read this information on data protection carefully before submitting a tip-off. You can decide whether you want to submit an anonymous or non-anonymous tip-off.

1. General information

Data protection
The protection of your privacy rights during the processing of personal data is important to TRATON SE. We process personal data in compliance with the provisions of the EU General Data Protection Regulation (GDPR) and in accordance with the national legal provisions.

Controller and point of contact
The controller as defined by data protection law for the data processing relating to the receipt, assessment, and investigation of the tip-off is:

TRATON SE
Hanauer Str. 26
80992 Munich, Germany

which, in the context of the investigation process, acts in joint responsibility with the remaining Group companies of the Volkswagen Group according to Article 26 of the GDPR.

To contact the Data Protection team or to exercise your data subject rights, please use the contact form.

2. Collection and processing of personal data

Purpose
TRATON SE processes your data for the following purposes:
Assessing and processing your tip-off and conducting necessary investigations against the affected person(s) associated therewith, and, where appropriate, for communication with authorities and courts in connection with your tip-off, communication with international attorneys and auditors or other investigating persons engaged by TRATON SE as well as other Group companies affiliated with TRATON SE.

Obligation to provide your personal data
You can submit a tip-off without sharing your personal data (anonymous tip-off). You are therefore under no obligation to provide your personal data.

Type of personal data collected
We collect the following personal data and information when you submit a tip-off:

• your name and/or private contact and identification data, should you disclose your identity (non-anonymous tip-off)
• your professional contact and (professional) organization data, if disclosed by you (non-anonymous tip-off), and, where applicable,
• the names of persons and other personal data of the persons named in your tip-off.

Legal basis
The processing of your personal data is justified by the following legal basis:

• Collection of your personal data in case of a non-anonymous tip-off: consent to the processing of personal data for the aforementioned purposes (implied consent) (point (a) of Article 6(1) of the GDPR).
• Collection, processing, and disclosure of personal data of the persons included in your tip-off: for the purposes of safeguarding the legitimate interests pursued by the controller or by a third party (point (f) of Article 6(1) of the GDPR ). It is a legitimate interest of TRATON SE to identify, process, rectify, and sanction violations of the law and severe breaches of duty of employees throughout the Group in an effective manner with a high level of confidentiality to avert damage and liability risks for the TRATON GROUP pursuant to sections 30, 130 of the Gesetz über Ordnungswidrigkeiten (OWiG — German Act on Regulatory Offenses). Point 4.1.3. of the German Corporate Governance Code requires the establishment of a whistleblower system to enable employees and third parties to disclose reports on legal violations within the company safely and in an adequate manner.
• Disclosure of personal data in case of non-anonymous tip-off to other recipients: processing is necessary for compliance with a legal obligation (point (c) of Article 6(1) of the GDPR).

3. Disclosure of personal data

In certain cases, your personal data may be transmitted to other recipients: in substantiated individual cases, while processing a tip-off, or as part of an internal investigation, it may be necessary to share information with other employees of TRATON SE or of other companies affiliated with TRATON SE, e.g., if the information relates to activities in TRATON SE’s subsidiaries. If required by the investigation, information can be shared with TRATON GROUP subsidiaries in a country outside the European Union or the European Economic Area, based on appropriate data protection guarantees designed to protect those affected (e.g., EU standard data protection clauses or other exceptional derogations according to Article 49 of the GDPR). We always ensure compliance with the relevant data protection provisions in connection with the disclosure of information.

In the event of a corresponding legal obligation or if TRATON SE or a third party has a legitimate interest in investigating the information, further possible categories of recipients are criminal prosecution authorities, antitrust authorities, other administrative authorities, courts as well as international attorneys and auditors engaged by TRATON SE or another Group company affiliated with TRATON SE.

In certain cases, TRATON SE is obliged by data protection legislation to inform the suspects of the charges made against them. This is a legal requirement in cases where it can be objectively established that the disclosure of information to the suspect can no longer have an adverse effect on the investigation in question. If you disclosed your name or other personal data (non-anonymous tip-off), your identity as a whistleblower will not be disclosed, as far as it is legally possible, and steps will also be taken to ensure that no conclusions can be drawn as to your identity as the whistleblower.

4. Data retention and erasure

Personal data will be stored for as long as it is required for the purposes of the investigation and the subsequent assessment, and, in addition, for as long as we are obliged to store it under national legal, contractual, or statutory retention periods.

Once the report has been processed, the data will be deleted or anonymized in accordance with the national legal requirements. In case of anonymization, the reference to your identity as a whistleblower is permanently and irreversibly removed.

5. Your rights

In addition to the right to be informed about the data that relates to you, and the right to have your data rectified, you also have the right to demand erasure and restriction of processing (blocking) of your data, insofar as there are no legal provisions to the contrary. Furthermore, you have the right to data portability. If we process your personal data on the basis of your consent, you have the right to withdraw your consent at any time with effect for the future. Your withdrawal does not affect the lawfulness of the collection and processing of your name based on your consent until then, nor does it affect the processing of your name on any other legal basis (e.g., law or legitimate interests). If we have already disclosed your data to authorities or courts, you must contact these authorities in order to assert your rights. If necessary, we need to verify your identity before we can process your respective request.

In the event of data protection breaches, you have a data subject right to contact a supervisory authority of your choice. A list of the data protection supervisory authorities of the German federal states as well as their contact details can be obtained via the link below:

https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html

To revoke your consent (in case of a tip-off that is not anonymous) or to exercise your rights regarding your personal data, please use the contact information provided under “Controller and point of contact.”

Information on the right to object to processing of your personal data at any time pursuant to Article 21(4) in conjunction with (1) of the GDPR

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you that is necessary to safeguard our legitimate interests or the legitimate interests of a third party. Please use the contact information provided under “Controller and point of contact” to raise an objection and state its grounds.

We will assess whether we are obliged to erase your data due to your objection on the basis of the reasons you have provided. Please note that a further processing of your personal data might be necessary despite your objection. This is the case if compelling legitimate grounds override your interests, rights, and freedoms or if we have to establish, exercise, or defend legal claims. We will inform you about the result of our assessment.

General questions about whistleblowing:

If you have any general questions about whistleblowing, please contact the TRATON SE Investigation Office at investigation-office@traton.com or TRATON SE, Hanauer Str. 26, 80992 Munich, Germany.

1. General information

a) Information on data protection
The protection of your privacy rights during the processing of personal data is of the utmost concern to TRATON SE. Data collected through the use of our website is handled in compliance with the law of the country in which the company responsible for data processing is located. Furthermore, the companies in the TRATON GROUP have undertaken to provide comprehensive and uniform protection of personal data through the implementation of a binding Group policy. Within the TRATON GROUP, this ensures a level of protection around the globe that is comparable to that in Germany and the European Union.

b) Controller and contact person
The controller for your data pursuant to data protection legislation is the TRATON GROUP company that advertised the position you applied for. For general questions and questions about data protection, please contact the HR contact person that is specified in the advertisement for the job you have applied for. Alternatively, you can contact the Data Protection team, who will forward your query to those responsible on site. To contact the Data Protection team or to exercise your data subject rights, please use the contact form.

2. Information regarding TRATON job advertisements

a) The TRATON career website
With this information on data protection, we provide you with information as to what personal data we may collect, process, and use when you visit the TRATON careers website (https://traton.com/en/career/job-vacancies.html).

The term “personal data” refers to all information relating to an identified or identifiable natural person. A natural person is considered to be identifiable if they can be identified, either directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier, or to one or more particular characteristics that are an expression of the physical, physiological, genetic, psychological, economic, cultural, or social identity of this natural person.

The purpose of the TRATON career website is to provide you with information about job vacancies at TRATON SE and TRATON AB.

b) Collection of general information
When you access our TRATON career website, information of a general nature is automatically collected. This information contains, for example, the type of web browser, the operating system used, the domain name of your Internet service provider, and other similar information. This only concerns information that does not permit conclusions to be drawn about your person. This data is also generated during access to every other website on the Internet. It is therefore not a specific function of the TRATON career website. Information of this type is only collected in an anonymized form and evaluated by us statistically. The better our understanding of your preferences, the faster you can find the information you want on our website. Further and more detailed information can be found under https://traton.com/en/data-protection.html, section “Information on data protection.”

c) Collection and processing of personal data
Personal data is only collected if you provide it of your own accord, e.g., within the context of registration.

d) Security
As a general rule, TRATON SE protects your data by means of technical and organizational security measures in order to prevent accidental or intentional manipulation, loss, destruction, or access by unauthorized persons. Our security measures, such as data encryption, are regularly improved in line with technological development.

e) Links to other providers’ websites
Our website may contain links to the websites of other providers. TRATON SE checked the directly linked websites at the time of link creation and was satisfied that these were free of legal violations. However, TRATON SE has no influence of any kind on the content of linked websites and is not able to monitor these on an ongoing basis. TRATON SE therefore assumes no liability for the content of linked websites that have been modified after the creation of the link. This data protection notice does not apply to the linked websites of other providers.

f) Cookies
For information on the cookies used, see https://traton.com/en/cookies.html.

3. Information about the TRATON application process

a) Job vacancies and applications
You do not have to provide any personal data in order to simply view job vacancies. Only the data referred to in point 2b) is collected.

The link https://traton.com/en/career/job-vacancies.html gives you an overview of the current vacancies. Here you can select the individual job vacancies to get to the specific job description, which you can also download as a PDF document.

If you would like to apply for a job or send us an unsolicited application, this is currently only possible by e-mail (jobs@traton.com) or by post.

Should you send us your application documents by e-mail, we kindly ask you to encrypt them according to the state of the art and to inform us of the password via a separate communication channel, e.g., by phone or text.

When we receive your application documents, we assume that you have taken note of these data protection regulations that apply to the TRATON application process.

b) Legal basis for processing
The legal basis for data collection and processing is TRATON SE using your information to decide whether to enter into an employment relationship with you (section 26 (1) sentence 1 of the Bundesdatenschutzgesetz (BDSG — German Federal Data Protection Act)).

c) Limitation on use and transfer of personal data
We use your profile and application data exclusively as part of the selection process to fill a vacancy (vacancies).

Your data can also be viewed by affiliated companies as well as external service providers, who provide and technically operate basic IT services such as e-mail applications and file servers. Data protection agreements have been concluded with these companies to ensure a high level of data protection.

d) Data storage and erasure
Your application data will be required for a certain, very manageable period of time in order to enable us to assert, exercise, or defend legal claims. We are basing this on point (e) of Article 17(3) of the GDPR.

In order to be able to defend against unfounded claims and claims for damages under the Allgemeines Gleichbehandlungsgesetz (AGG — General Act on Equal Treatment) if necessary, application documents are also kept for a certain period of time after a job application has been rejected

In accordance with section 15 (4) of the AGG, claims for a violation of the prohibition of discrimination in the context of a job application must be asserted in writing within a period of two months after receipt of the rejection. In accordance with section 61b (1) of the Arbeitsgerichtsgesetz (ArbGG — Labor Court Act), a lawsuit for compensation pursuant to section 15 of the AGG must be brought in within three months of the above-mentioned claim being asserted in writing.

In order to take into account delays, e.g., due to absences, in the delivery of rejections to job applicants, and in the collection of claims or lawsuits, we keep applicant data for a further two months.

The complete and irrevocable erasure of the stored personal data will therefore only take place five months after the rejection has been sent to the job applicant.

For applicants who are hired, the application data and documents will become part of the personnel file.

4. Your rights

You have the right to be informed about the data that relates to you and the right to rectify your data. Provided that there are no statutory regulations to the contrary, you also have the right to erase and restrict the processing of your data, as well as the right to object to the processing of your data. Furthermore, you have the right to data portability.

If we process and/or forward your personal data on the basis of your consent, you also have the right to revoke the consent you granted. The legality of the data processing carried out with your consent until you revoke it remains unaffected by your revoking of consent.

To revoke your consent or exercise your rights with respect to your data, please contact (jobs@traton.com). Alternatively, you can contact the data protection officer of TRATON SE by post (TRATON SE, Data Protection Officer, Hanauer Str. 26, 80992 Munich, Germany). The contact form in the information on data protection on the TRATON website can also be used for these purposes.

Please note that you will be unable to apply for job vacancies at TRATON without your data being processed.

Complaints may be made to a data protection supervisory authority. In Bavaria, this is the Bavarian State Office for Data Protection Supervision (BayLDA for short).

5. Disclaimer

In order to keep pace with the continuous development of the Internet, TRATON SE may adapt this information on data protection at any time while adhering to the provisions of data protection legislation.

Information on data protection according to Article 13 of the GDPR for Facebook fan page visitors/subscribers

a) Controller

We are pleased that you are visiting our Facebook fan page (hereinafter referred to as “fan page”) of TRATON SE, Hanauer Str. 26, 80992 Munich, Germany, registered in the commercial register of the Munich Local Court under the number HRB 246068. In the following, we inform you about the collection, processing, and use of your data.

b) General information

Below, TRATON SE informs you about the processing of your personal data within the framework of the fan page provided by TRATON SE. In its ruling of June 5, 2018, the European Court of Justice confirmed the joint responsibility of the fan page operator and Facebook. Information on data processing by Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland (hereinafter referred to as “Facebook”), can be found in its Privacy Policy.

c) Collection, processing, and use of your personal data

The fan page you visit gives you the opportunity to react to our posts, to comment on them, to create your own user post, and to send us private messages with personal concerns. The data provided by you in this context that may be accessible to us (e.g., Facebook user name, pictures, interests, contact details) will be used by us exclusively for the purpose of customer and prospective customer communication due to a predominant legitimate interest (point (f) of Article 6(1) of the GDPR). Our interest lies in offering you a platform on which we can display current information and with the help of which you can address your request to us and we can respond to your request as quickly as possible. As far as possible, your data will be deleted when the fan page operation is discontinued.

d) Tracking tools

TRATON SE does not use the fan page to carry out any data processing other than the basic functions. Please note that Facebook Ireland Limited may use Tracking Tools as well as cookies, regardless of how TRATON SE uses the fan page. You can find more information on this in Facebook’s Privacy Policy.

e) Your rights

You may assert your following rights against TRATON SE at any time free of charge, insofar as this is possible for TRATON SE within the framework of the provision of fan pages. For the enforcement of further rights, please contact Facebook Ireland Limited, 4 Grand Canal Square, Dublin2, Ireland.

For information on exercising your rights with TRATON SE, please refer to section f).

Right of access: You have the right to obtain information from us about the processing of your personal data.

Right to rectification: You have the right to ask us to rectify any inaccurate or incomplete personal data concerning you.

Right to erasure: You have the right to demand the erasure of your data if the conditions specified in Article 17 of the GDPR are met. Thereafter you may, for example, request the erasure of your data insofar as it is no longer necessary for the purposes for which it was collected. You can also request erasure if we process your data on the basis of your consent and you revoke this consent.

Right to restriction of processing: You have the right to demand restriction of the processing of your data if the requirements of Article 18 of the GDPR are met. This is the case, for example, if you dispute the accuracy of your data. You can then demand that the processing be restricted while the correctness of the data is being checked.

Right to object: If the processing is used in an overriding interest or your data is used for the purpose of direct marketing, you have the right to object to the processing of your data. An objection is permissible if the processing is either in the public interest or in the exercise of official authority or due to a legitimate interest of TRATON SE or a third party. In the event of objection, we ask you to inform us of the reasons for which you object to data processing. In addition, you have the right to object to data processing for direct marketing purposes. This also applies to profiling as far as it is related to direct advertising.

Right to data portability: If data processing is based on consent or fulfillment of a contract and this is also carried out using automated processing, you have the right to receive your data in a structured, commonly used, and machine-readable format and to transfer it to another data processor.

Right of withdrawal: If the data processing is based on consent, you have the right to withdraw the data processing within the scope of said consent with effect for the future at any time free of charge.

Right of complaint: You also have the right to complain to a supervisory authority (e.g., the Bavarian State Office for Data Protection) about our processing of your data.

f) Your contact

To contact the Data Protection team or to exercise your data subject rights, please use the contact form.

I. CONTROLLER

The controller for any processing of your personal data is TRATON SE:

TRATON SE
Hanauer Str. 26
80992 Munich
Germany
Tel.: +49 (0) 89 36098 70
E-mail: hv.traton@traton.com

(hereinafter referred to as “TRATON SE” or “we”)

Please use the contact form provided on our data protection page to contact the data protection team or to exercise your rights as data subject.

II. PURPOSE, CATEGORIES, AND LEGAL BASIS OF PROCESSING

We process your personal data in compliance with the requirements of the European General Data Protection Regulation (GDPR), the Bundesdatenschutzgesetz (BDSG — German Federal Data Protection Act), as well as any other relevant data protection requirements where this is required to comply with statutory obligations and the processing purposes provided for by law, in particular to carry out virtual general meetings.

In the context of running our Annual General Meeting, we process the following personal data (hereinafter referred to as “data”):

The following data and device information are recorded in the web server log files:

Your browser automatically forwards this data to us whenever you visit our Shareholder Portal.

We also process personal data in order to prepare for, run, and follow up on our Annual General Meeting. This includes, in particular:

This data will not be merged with data from any other sources.

The legal basis of the aforementioned processing is point (c) of sentence 1 of Article 6(1) of the GDPR in conjunction with sections 67e, 118ff. of the Aktiengesetz (AktG — German Stock Corporation Act).

You are also required to save certain cookies to your end device in order to operate the Shareholder Portal. We only use cookies that are a technical prerequisite for the use of the Shareholder Portal. You can block cookies by configuring your browser to not allow any cookies to be stored. However, blocking all cookies may stop you from using the Shareholder Portal. The legal basis of this processing is section 25 (2) no. 2 of the Gesetz über den Datenschutz und den Schutz der Privatsphäre in der Telekommunikation und bei Telemedien (TTDSG — German Federal Act on Privacy in Telecommunications and Telemedia).

In addition, we also process personal data on the basis of point (f) of sentence 1 of Article 6(1) of the GDPR, provided this is required to safeguard predominant legitimate interests of TRATON SE in the individual case, including

Furthermore, TRATON SE is subject to various other legal obligations that may require your personal data to be processed. These legal obligations may arise as a result of provisions under stock corporation, sanction, commercial, and tax law, for example. The legal basis of processing in these cases are the relevant statutory regulations in conjunction with point (c) of sentence 1 of Article 6(1) of the GDPR.

III. RECIPIENTS OF YOUR DATA

Within TRATON SE, only authorized employees in relevant areas of responsibility have access to your personal data.

We use external service providers to run certain aspects of the Annual General Meeting who also receive access to your personal data within the framework of their duties. These providers were carefully selected as part of personal data processing and are obliged to comply with TRATON SE’s data protection standards in accordance with Article 28 of the GDPR. The processors we commission only process your personal data as instructed by us and only insofar as this is required to perform the commissioned service. We use the services of Computershare Deutschland GmbH & Co. KG, Elsenheimerstraße 61, 80687 Munich, Germany, (hereinafter referred to as “Computershare”) for the provision and operation of our Shareholder Portal. The personal data processing agreement required under Article 28 of the GDPR has been concluded with Computershare.

Furthermore, we also commission legal advisors, auditors, and notaries to run and process the Annual General Meeting and transmit personal data to them — restricted in scope as necessary — since it is in our interest to hold the Annual General Meeting in compliance with the relevant legal requirements. The legal basis of this processing is point (f) of sentence 1 of Article 6(1) of the GDPR.

All TRATON SE employees and any employees of the commissioned service providers that have access to and/or process shareholders’ and/or authorized representatives’ personal data are obliged to treat said data as confidential.

In addition, your personal data is made available to other shareholders and their authorized representatives within the framework of statutory requirements, particularly with regard to the list of participants (section 129 of the AktG) and when shareholder rights are exercised. For example, this applies to statements that you submitted in advance (section 130a (1) through (4) of the AktG). Personal data contained in motions to extend the agenda, countermotions, election proposals, verbal contributions, and questions and/or corresponding answers is also published or made available or provided to other shareholders and shareholder representatives in this context.

We may also be obligated to pass on your personal data to other recipients, for example the authorities, in order to fulfil our statutory notification obligations.

The legal basis in these cases is point (c) of sentence 1 of Article 6(1) of the GDPR and, provided no statutory obligation to publish personal data applies, point (f) of sentence 1 of Article 6(1) of the GDPR.

IV. STORAGE PERIOD AND DATA ERASURE

We will erase or anonymize your personal data as soon as it is no longer required for the purposes outlined above and provided we are under no obligation to comply with the evidence required by law and no statutory retention periods apply (e.g., under the AktG, the Handelsgesetzbuch (HGB — German Commercial Code), the Abgabenordnung (AO — German Tax Code), or other legal provisions). We also store data if this is required in connection with claims made against or by our Company or required to safeguard the legitimate interests outlined above.

V. RIGHTS OF DATA SUBJECTS

Subject to statutory requirements, you have the right to use the contact details provided above to request information (Article 15 of the GDPR) on your personal data that is processed as well as to request the correction (Article 16 of the GDPR) or erasure (Article 17 of the GDPR) of your personal data or to restrict its processing (Article 18 of the GDPR), as well as to request to transfer your personal data (Article 20 of the GDPR).

In the event that we process your data to safeguard legitimate interests (point (f) of sentence 1 of Article 6(1) of the GDPR), you can object to this data being processed at any time with effect for the future (Article 21 of the GDPR) where your particular situation gives rise to grounds against this processing. Please direct your objection using the contact details under “I. CONTROLLER” or use the integrated contact form.

Irrespective of the above, as a data subject you have the right to lodge a complaint with a relevant supervisory authority pursuant to Article 77 of the GDPR.

Contacting Data Protection team and exercising data subject rights