Adler S A : Data protection notice (Data protection notice 207474.1 )

ADLER Group S.A.

Société anonyme

55, Allée Scheffer, L-2520 Luxembourg,

Grand Duchy of Luxembourg

RCS Luxembourg: B197554

(the "Company")

DATA PROTECTION NOTICE

The following notice (the "Data Protection Notice") shall provide an overview on the kind of Personal Data (as defined below) that ADLER Group S.A. (the "Company", "we", "us") collects and processes, how we use it, for which purposes we use it, with whom we share it and which rights you have regarding the Processing of it. This information is provided to you in the context of your relationship with us as a shareholder of the Company and in connection with the upcoming general meeting ("GM") of the Company.

1. Definitions

Personal Data: means any information relating to a natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, or an online identifier.

Processing: means any operation, which is performed on Personal Data, such as collection, recording, organising, structuring, storing, adaptation or any kind of disclosure or other use.

2. Information on the data controller

We, ADLER Group S.A., a public limited company incorporated and existing under the laws of the Grand Duchy of Luxembourg, having its registered office in 55, Allée Scheffer, L-2520, will act as data controller for the processing of your Personal Data. This means that we are responsible to ensure that your Personal Data is being processed in a correct manner and in accordance with applicable legislation.

3. Personal Data Processed

We collect Personal Data about you. The categories of information that we collect are the following:

1. Name
2. Address
3. Phone number
4. Email address
5. Number of shares you hold on the relevant record date according to the record date confirmation issued by your depositary bank that is safekeeping your shares;
6. Number of votes that you wish to cast for voting at the GM
7. The form of participation at the GM

1. The voting instructions you will provide to proxyholder who will represent you at the GM

We will receive this information through Computershare Deutschland GmbH & Co KG., acting as our agent for this purpose, who receives the information directly/indirectly from you or your individual depository banks.

In some cases, we may be legally obliged to Process additional Personal Data, notably in connection with any laws applicable to issuers whose securities are listed on a regulated market. However, we will contact you prior to processing your Personal Data for any purpose not listed below.

4. Purposes and legal basis for the Processing of your Personal Data

Your Personal Data is Processed exclusively in accordance with the European General Data Protection Regulation ("GDPR"), the applicable Luxembourg data protection laws, as amended from time to time, the Luxembourg Law of 10 August 1915 on Commercial Companies, as amended (loi modifiée du 10 août 1915 concernant les sociétés commerciales, hereafter the "Company Law"), and all other applicable laws.

We Process your Personal Data for the following purposes:

• To hold the GM;
• To enable you or your proxyholders to participate in the GM;
• To enable your proxyholders to exercise your rights as part of the GM (e.g. voting right); and
• To publish the attendance percentage and the voting results of our GM.

The Processing of your Personal Data will be based on one of the following legal basis:

• To comply with our legal obligations in connection with the holding of general meetings (Article 6 (1) c) GDPR in connection with the Luxembourg law of 24 May 2011 on the exercise of certain rights of shareholders in general meetings of listed companies, as amended, and the Company Law;
• To meet our legitimate interests, i.e. to enable the GM to be held in an orderly manner (Article 6 (1) f) GDPR).

5. Categories of recipients

We ensure that your Personal Data is only processed in accordance with the applicable data protection laws. Therefore, your Personal Data will be disclosed only insofar as reasonably necessary for the purposes set out in this Data Protection Notice. Within the scope of our data processing activities, your Personal Data may be disclosed to authorities in Luxembourg, and to our auditors and legal advisors, any Luxembourg notary and/or corporate service providers for the purposes of holding and organizing the AGM and the EGM

6. Information transfer

Your Personal Data will not be transmitted to countries outside of the European Union or to any international organisations.

7. Retention Periods

We strive to limit our Data Processing activities with respect to your Personal Data. Your Personal Data will, therefore, be retained only for as long as necessary for the purposes for which we have collected

it and as long as required by statutory retention provisions and will be deleted afterwards. Insofar as we are subject to legal accountability obligations, your Personal Data affected by these accountability obligations will be retained for 10 years.

8. Obligation for the Provision of Personal Data

As a shareholder, you are obliged to provide us the Personal Data set out above.

9. Your Rights

Depending on the specifics of the case, you may be entitled to exercise some or all of the following rights. You may:

• require confirmation as to whether or not Personal Data concerning you is undergoing Processing, and where that is the case, require access to the Personal Data retained and additional information via a copy that is provided free of charge;
• request proper rectification, erasure or restriction of your Personal Data, e.g. because it is incomplete or inaccurate, it is no longer needed for the purposes for which it was collected, or you have taken advantage of an existing right to object to the Data Processing; in case the Personal Data is processed by third parties, your request for rectification, erasure or restriction will be forwarded also to such third parties unless this proves impossible or involves disproportionate effort;
• take legal actions in relation to any potential breach of your rights regarding the Processing of your Personal Data, as well as to lodge complaints before the National Commission for Data Protection; and/or require not to be subject to any automated decision making, including profiling (automatic decisions based on Data Processing by automatic means, for the purpose of assessing several personal aspects) which produce legal effects on you or affects you with similar significance;
• object, on grounds relating to your particular situation, to processing of your personal data, in case such processing is either based on our or a third party's legitimate interests or on a performance of a task carried out in the public interest. In this case, please provide us with information about your particular situation. After the assessment of the facts presented by you, we will either stop processing your personal data or present you our compelling legitimate grounds for an ongoing processing.

10. Contact details

Please submit any questions, concerns or comments you have about this Data Protection Notice or any requests concerning your Personal Data to Ms Colleen Yorke, by email at [e-mail].

11. Changes to the Data Protection Notice

You may request a copy of this Notice from us using the contact details set out above. If we change this Data Protection Notice, the updated version will be posted on our website in a timely manner.

Effective from 24 May 2024