Deutsche Wohnen : Data Privacy Notice for shareholders authorised representatives and guests

Data Privacy Notice for shareholders of Deutsche Wohnen SE, authorised

representatives of shareholders and guests of the General Meeting

1. General Information a) Introduction

Deutsche Wohnen SE takes your privacy and the protection of your personal data very seriously. In this data privacy notice, we want to inform you about which personal data we process from you as our shareholder or your authorised representative in general and in connection with the preparation, conduction and follow-up of our General Meetings and which rights you have under Regulation EU 2016/679 (General Data Protection Regulation - GDPR) and the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG) with regard to the processing of your data. If you are another participant (guest) at the General Meeting, you will also find information on the processing of your personal data in this data privacy notice.

We will conduct the General Meeting in 2024 as a virtual General Meeting within the meaning of Sec. 118a of the German Stock Corporation Act (Aktiengesetz, AktG) in connection with section 13.10a of the company's statutes. Shareholders, their authorised representatives and guests can therefore not physically participate in the General Meeting. However, they can attend and follow the entire General Meeting by video and audio transmission via the password-protected online service Deutsche Wohnen InvestorPortal. It can be accessed via https://www.deutsche-wohnen.com/agm.In addition, to enable certain registered guests to follow the virtual General Meeting, we will provide a webcast with the support of our service provider Computershare Deutschland GmbH & Co. KG, Elsenheimerstr. 61, 80687 Munich, Germany, which can be accessed via a password-protected link.

b) Data controller

Deutsche Wohnen SE

Mecklenburgische Straße 57

14197 Berlin, Germany

E-mail: [e-mail]

For individual processing purposes, Deutsche Wohnen SE and Vonovia SE, Universitätsstraße 133, 44803 Bochum, Germany, are joint controllers within the meaning of Article 26 GDPR (see section 3).

c) Contact details of the Data Protection Officer

Deutsche Wohnen SE

c/o Dr. Stefan Drewes

Mecklenburgische Straße 57,

14197 Berlin

E-mail: [e-mail]

If you wish to share confidential information, we ask you to first request that we contact you directly via this e-mail address without sharing any confidential information.

2. Categories of data

We process the following personal data of our shareholders and their authorized representatives as well as guests, if applicable, in connection with the virtual General Meeting:

• Name and surname, title,
• Date of birth (only of shareholders),
• Nationality (only of shareholders),
• Contact details (e.g. address, email address,
• Data relating to shares (class of shares, type of ownership of the share, number of shares), and
• Other data arising in connection with the preparation and conduct of the General Meeting (e.g. granting of powers of attorney, requests for information, motions, election proposals, statements, video messages, speeches by way of video communication, objections, questions to be recorded).

If you use our InvestorPortal, via which the virtual General Meeting is held, we also process the following data:

• Login data for the InvestorPortal;
• Retrieved or requested data;
• Date and time of the retrieval;
• Message as to whether the retrieval was successful;
• Type of the web browser used;
• Referrer URL (the previously visited page);
• IP address;
• Shareholder number, Registration confirmation number, if any, and SessionID;
• Meetingkey/MeetingID;
• Login and password reset.

Your browser automatically transmits this data to us when you visit our InvestorPortal.

If you contact us, we additionally process the personal data required to answer the respective request, such as your e-mail address or telephone number.

3. Purpose and legal basis of the processing activities

The processing of the above-mentioned personal data serves the purposes described below.

1. Preparation, execution and follow-up of General Meetings

We process the personal data in order to prepare, conduct and follow up on the General Meeting, and to fulfill our legal obligations to shareholders and their authorized representatives in this regard, in particular

• to process the registration and participation or connection of shareholders and their authorised representatives and, if applicable, the guests to the General Meetings (e.g. identity check, verification of authorization to exercise shareholder rights and to access the InvestorPortal,
• • 2 -

creation of the list of attendees and keeping available for inspection, provision of voting cards for download),

• to enable the shareholders and their authorized representatives the exercise of their rights at the General Meeting (in particular granting and revoking powers of attorney and exercising of voting-,proposal-,statement-, speaking- and information-rights as well as the right to object to decisions of the General Meeting as described in each case in the invitation to the General Meeting).

We also process your personal data to provide corporate information ("ordering service" on our website) and to maintain contact with our shareholders (Investor Relations).

The processing of your personal data is necessary for the proper conduct of the General Meeting. If you do not provide us with the necessary personal data, we might not be able to allow your attendance or to exercise certain rights in the General Meeting.

The legal basis for the processing is Article 6(1)(c) GDPR in conjunction with Article Article 9(1)(c) (ii), 53 SE Council Regulation (SE-Regulation), Section 67e(1) AktG and our obligations under stock corporation law pursuant to Section 118 et seqq. AktG. With regard to the processing of personal data of guests, we process this data on the basis of our legitimate interest pursuant to Article 6 (1)(f) GDPR. Our legitimate interest is to enable interested shareholders and the general public to follow the General Meeting via the internet in accordance with the explicit authorization in the AktG and our articles of association.

In connection with the preparation, conduct and follow-up of the virtual General Meeting, we may also transfer your personal data to our legal advisors, tax advisors or auditors, as we have a legitimate interest to organize the virtual General Meeting in accordance with the relevant legal provisions and in obtaining external advice on this. The legal basis for this processing is Article 6(1)(f) GDPR.

With regard to the preparation, execution and follow-up of the General Meeting, Deutsche Wohnen SE processes the personal data of shareholders and, if applicable, their authorised representatives with Vonovia SE as joint controllers within the meaning of Article 26 GDPR, to the extent that this concerns internal legal advice on the General Meeting or Investor Relations. The rights of data subjects can be exercised as described in Section 8.

b) Fulfillment of legal and regulatory obligations.

We process your personal data in order to fulfill our legal obligations, such as regulatory requirements and obligations under stock, securities, tax and commercial law to retain data. The legal basis for this processing is Article 6 (1)(c) GDPR in conjunction with the respective legal regulations.

c) Other purposes

We also process the personal data in order to prepare statistics on our shareholders as well as on shareholder development. In this respect, Deutsche Wohnen SE also processes the personal data of shareholders and, if applicable, their authorised representatives with Vonovia SE as joint controllers within the meaning of Art. 26 GDPR. The rights of data subjects can be exercised as described in Section 8.

- 3 -

The legal basis for processing your personal data is Art. 6 (1) (f) GDPR. We have a legitimate interest in compiling statistics so that we can see how the shareholder structure of our company is composed.

The entire length of the General Meeting may be broadcasted live on the internet and made publicly accessible via video and audio. If necessary, a recording of the virtual General Meeting will be made up to the end of the speech by the Executive Board, which will be publicly accessible on demand on the internet after the end of the General Meeting. Apart from this, neither video nor audio recordings will be made. If you as a shareholder, authorized representative or guest are filmed during the recording activities at the General Meeting (e.g. in the context of exercising your right to comment or speak), this live transmission or recording may record your appearance and your speech. The legal basis for this processing is Art. 6 (1) (f) GDPR. Our legitimate interest is to enable interested shareholders and the public to follow the General Meeting via the Internet in accordance with the explicit permission in the AktG and our articles of association.

To the extent legally required, we will inform you in advance if we will process your personal data for purposes other than those stated here.

4. Cookies and others

We use technically necessary cookies, device information in web server log files, and web storage and local storage elements (collectively, "cookie features") in connection with the conduct of the General Meeting.

Our InvestorPortal uses HTML5 web storage techniques to dynamically design web pages and add various functionalities. In order to use all the functions of our InvestorPortal, JavaScript must be activated in your browser. The HTML5 web storage techniques we use place small text files on your terminal device and store them there. We use these techniques to store the following authentication information as well as some context information by means of the so-called session storage function, which recognizes the user when you return to our website during an active session.

We also use technically necessary cookies for our media gallery. Cookies are small files that are placed on your desktop, notebook or mobile device by a website you visit. From this, we can recognize, for example, whether there has already been a connection between your device and our media gallery. The cookies we use do not contain any personal data. You can set your browser so that you are informed about the setting of cookies and only allow cookies in individual cases, exclude the acceptance of cookies for certain cases or in general and activate the automatic deletion of cookies when closing the browser.

If you decide against the use of cookie features, it may be that not all functions of our media gallery or our InvestorPortal or their individual functions are only available to you to a limited extent.

The necessary session cookies we use are only used for the purpose of providing the media gallery. They are necessary for the functions of the media gallery and are deleted when you close your browser. Insofar as we wish to use cookies in the provision of the InvestorPortal that are not absolutely necessary for the operation of the InvestorPortal, such as function or performance cookies, we will only do so if you have given your consent. In this case, we will inform you about our cookies and associated data processing when you visit the InvestorPortal before using cookies and ask for your consent.

- 4 -

The legal basis for setting the cookie features and accessing the data stored therein, as well as the associated processing of personal data, is Section 25 (2) No. 2 of the German Telecommunications Telemedia Data Protection Act (TTDSG), as this is necessary to provide the InvestorPortal and the media gallery you have requested. The further processing of the information collected by means of the cookie features is required to protect our legitimate interest in enabling our shareholders and their authorised representatives to use the InvestorPortal and the media gallery. The legal basis for this processing is Article 6(1)(f) GDPR.

5. Recipients and categories of recipients of personal data

As part of the preparation, conduct and follow-up of General Meetings, we commission other service providers who receive personal data from data subjects (e.g. printing companies for sending General Meeting documents, security services for admission controls, service provider for keeping the list of attendees). This is in particular Computershare Deutschland GmbH & Co. KG, Elsenheimerstr. 61, 80687 Munich (Computershare). Computershare and the other service providers only receive such personal data from us that is necessary for the performance of the commissioned service. Computershare and the other service providers process the data exclusively on behalf and in accordance with the instructions of Deutsche Wohnen SE. All our employees and all employees of external service providers who have access to and/or process personal data are obliged to treat this data confidentially. In connection with the preparation, conduct and follow-up of the General Meeting, we may also transfer your personal data to our legal advisors, tax advisors or auditors.

In connection with the General Meeting, your personal data may be disclosed under certain circumstances to other duly registered shareholders or their authorized representatives and, where applicable, members of the public who visit the company's website or follow the publicly accessible video and audio broadcast of the General Meeting (e.g. by granting access to the legally required list of attendees, by publishing the motions you have submitted that are subject to publication requirements or other requests on the company's website, in the context of making comments available on the InvestorPortal under your name or in the context of other contributions you make in the preparation for or during the virtual General Meeting via the communication channels described in the invitation to the General Meeting).

Finally, we may be required to disclose your personal data to other recipients, such as when publishing notifications of voting rights in accordance with the provisions of the German Securities Trading Act (Wertpapierhandelsgesetz), or to authorities for the purpose of fulfilling statutory notification obligations.

Your data is generally being processed in countries belonging to the European Union. If persons from countries outside the European Union and the European Economic Area hold shares in our company, we will also send certain information to these shareholders (e.g. invitations to General Meetings). If personal data are also included in these notifications (e.g. motions to General Meetings with the name of the applicant being stated), this data will also be transferred to third countries. The provisions of the GDPR are not directly applicable in third countries. In the absence of an adequacy decision of the European Commission, these countries may provide a lower level of protection for your personal data. A transfer is nevertheless necessary in order to inform all shareholders equally, since we are not permitted to exempt shareholders from third countries from our duty to provide information. With the

- 5 -

transmission we fulfil our contractual obligations. The legal basis for the transmission is Article 49(1)(b) GDPR.

6. Data sources

If you purchase shares, your personal data will not be collected by us, but by the depository banks involved in the share transaction. This is carried out via Clearstream Banking AG, Mergenthalerallee 61, 65760 Eschborn, which, as the central securities depository, is responsible for the technical settlement of securities transactions and the deposit of shares for credit institutions.

If you contact us and use our Deutsche Wohnen InvestorPortal, we will receive the personal data directly from you. If you act as authorised representative of a shareholder, we receive your personal data from the shareholder who granted you the power of attorney and directly from you as far as your behaviour during the General Meeting is concerned.

If you attend the General Meeting as a guest or follow the virtual General Meeting, we will receive your data either directly from you, in particular if you yourself have applied for admission as a guest with us (e.g. as a representative of the media or authorities), from one of our shareholders who applies for your admission as a guest, or possibly in the course of our business activities from internal or external sources, some of which are also publicly accessible.

7. Storage period

In principle, we anonymise or delete personal data if it is no longer required for the above-mentioned purposes and if the anonymising or deleting does not conflict with legal requirements for proof and storage (e.g. under the German Stock Corporation Act, the German Commercial Code, the German Tax Code or other legal provisions). If we become aware that a shareholder is no longer a shareholder of our Company, we shall store the shareholder's personal data for a maximum of twelve months, subject to other statutory provisions pursuant to Section 67e (2) AktG.

To the extent required by law or if the company has a legitimate interest in the storage of personal data, for example in the event of court or out-of-court disputes at the General Meeting or in order to be able to track the application and voting behaviour, a longer storage of personal data is possible. In these cases, however, we do not necessarily store personal data of all the categories listed under section 2, but only those data which are absolutely necessary for achieving the respective purposes - for example to prove voting behaviour.

The access data we collect in connection with the operation of the InvestorPortal is stored by us for a period of three months and then processed exclusively in anonymized form for statistical purposes. We delete all other data collected in connection with the operation and use of the InvestorPortal no later than one month after your account on the InvestorPortal has been deleted. Either you can delete the account yourself or your account will be deleted automatically if you are no longer a shareholder of Deutsche Wohnen SE. Your data will only be stored further if this is required by law or if we have a legitimate interest in further storage, for example in the event of disputes in or out of court in connection with the operation of the InvestorPortal or in order to be able to track the application and voting behaviour. After the personal data are no longer needed for these purposes, they are anonymised or deleted.

8. Rights of data subjects

- 6 -

As a data subject, you can contact our data protection officer named in section 1. c) in order to exercise your legal rights in accordance with the GDPR. If the legal requirements are met, you may be entitled to the following rights:

• the right to obtain information on data processing and a copy of the data processed (right of access by the data subject, Article 15 GDPR)
• the right to obtain the rectification of inaccurate data or have incomplete data completed (right to rectification, Article 16 GDPR),
• the right to obtain the erasure of personal data without undue delay (right to erasure, Article 17 GDPR),
• the right to obtain restriction of processing personal data (right to restriction of processing, Article 18 GDPR)
• the right to receive the personal data concerning you, which you have provided to a controller, in a structured, commonly used and machine-readable format and the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided (right to data portability, Article 20 GDPR)

Where we process your personal data for the purposes of the legitimate interests pursued by Deutsche Wohnen SE or a third party, you also have the right to object, on grounds relatingto your particular situation, at any time to processing of personal data concerning you (right to object, Article 21 GDPR). The processing of personal data will then be cancelled, unless we demonstrate compelling legitimate grounds for the processing which override your interests,rights and freedoms or for the establishment, exercise or defence of legal claims.

Regardless of this, every shareholder, authorised representative and guest has the right to lodge a complaint with a competent supervisory authority pursuant to Article 77 GDPR.

9. Right of objection according to Section 67 AktG

According to Section 67(6) AktG you also have the right to object to the use of your data for advertising purposes.

Deutsche Wohnen SE

The Management Board

- 7 -