FlatexDEGIRO : Information on data protection for shareholders

Annual General Meeting

of flatexDEGIRO AG on 04 June 2024

Information on data protection for shareholders

We, flatexDEGIRO AG, process your personal data and, if applicable, the personal data of your representatives (e.g. name, address, email address, number of shares, class of shares, type of ownership of the shares and registration confirmation number) when registering for the virtual Annual General Meeting, when granting voting authorisation as well as in the context of using the password- protected online service and participating in the virtual Annual General Meeting as a controller within the meaning of Article 4 no. 7 of the General Data Protection Regulation (GDPR). Our shares are registered shares. The processing of personal data is legally required for the proper preparation and conduct of the virtual Annual General Meeting, for the exercise of shareholders' voting rights, for participation by electronic means and for the maintenance of the shareholder register. It is not possible to participate in the Annual General Meeting without the processing of the personal data of the shareholders or shareholder representatives. The legal basis for processing is Art. 6(1), sentence 1, lit.

1. GDPR in conjunction with Sections 67, 67d, 67e and 118 et seq. AktG. In addition, data required for the organization of the virtual Annual General Meeting may be processed on the basis of overriding legitimate interests (Article 6(1), sentence 1, lit. f) GDPR). If shareholders do not provide their personal data themselves, we generally receive it from the final intermediary (Article 14 GDPR, Section 67d AktG). We broadcast the virtual Annual General Meeting on the internet in a closed user group.

The service providers commissioned by us for the purposes of holding the virtual Annual General Meeting process the personal data of the shareholders or shareholder representatives exclusively in accordance with our instructions on the basis of an agreement on the processing of personal data on behalf of our company (Article 28 GDPR) and only insofar as this is necessary for the performance of the commissioned service. All employees of flatexDEGIRO AG and employees of contracted service providers who have access to and/or process personal data of shareholders or shareholder representatives are obliged to treat this data confidentially. In addition, personal data of shareholders or shareholder representatives exercising their voting rights can be viewed by other shareholders and shareholder representatives within the framework of the statutory provisions (in particular the list of participants pursuant to Section 129 AktG). The same applies to personal data contained in opinions submitted prior to the virtual Annual General Meeting as well as the speeches and questions raised during the Annual General Meeting. The company may specify the name and, if applicable, the registered office/address of the shareholders or their authorized representatives who submit questions or comments or make speeches. The speeches will be made available to the shareholders and shareholder representatives in audiovisual form during the Annual General Meeting. The company reserves the right to name the questioner when answering the question.

We will delete your personal data in accordance with the statutory provisions, in particular if your personal data is no longer necessary for the original purposes of collection or processing, the data is no longer required for any disputes concerning the passing or effectiveness of resolutions at the Annual General Meeting in connection with any administrative or judicial proceedings; and there are no statutory retention obligations. Data relating to participation in Annual General Meetings is retained for a period of ten years in accordance with the statutory provisions.

This document is a convenience translation of the German original for English-speaking readers. The original German version is the sole legally binding version.

If the relevant statutory requirements are met, you have the right to access pursuant to Article 15 of the GDPR, to rectification pursuant to Article 16 of the GDPR, to erasure pursuant to Article 17 of the GDPR, to restriction of processing pursuant to Article 18 of the GDPR, to object pursuant to Article 21 of the GDPR and to data portability pursuant to Article 20 of the GDPR. You can assert these rights against flatexDEGIRO AG free of charge using the following contact details:

flatexDEGIRO AG

Omniturm, Große Gallusstraße 16-18, 60312 Frankfurt am Main, Germany [phone]

[e-mail]

In addition, you have the right to lodge a complaint with the responsible data protection supervisory authority pursuant to Article 77 of the GDPR.

If you have any comments or queries regarding the processing of your personal data, please contact our data protection officer at:

flatexDEGIRO AG

Data Protection Officer

Omniturm, Große Gallusstraße 16-18, 60312 Frankfurt am Main, Germany [phone]

[e-mail]

This document is a convenience translation of the German original for English-speaking readers. The original German version is the sole legally binding version.