FlatexDEGIRO : Information on data protection for shareholders

Annual General Meeting of flatexDEGIRO AG on 17 May 2022

Information on data protection for shareholders

We, flatexDEGIRO AG, as the responsible party within the meaning of Article 4 No. 7 of the EU General Data Protection Regulation ("GDPR") process your personal data and, if applicable, the personal data of your representatives (e.g. name, address, e-mail address, number of shares, class of shares, type of ownership of the shares and number of the registration confirmation) when you register for the virtual Annual General Meeting, issue a proxy and use the password-protected Internet service and connect to the virtual Annual General Meeting. Our shares are registered shares. The processing of personal data is legally necessary for the proper preparation and conduct of the virtual Annual General Meeting, for the exercise of shareholders' voting rights, as well as for following the Annual General Meeting by electronic connection and for the keeping of the share register. Without the processing of the personal data of the shareholders or shareholder representatives, participation in the Annual General Meeting is not possible. The legal basis for the processing is Art. 6 para. 1 sentence 1 lit. c) GDPR in conjunction with Sections 67, 118 et seq. German Stock Corporation Act ("AktG") as well as Section 1 of Art. 2 of the Act to Mitigate the Consequences of the COVID-19 Pandemic in Civil, Insolvency and Criminal Procedure Law of 27 March 2020 as amended on 10 September 2020 ("COVID-19 Act"). In addition, data processing that is necessary for the organization of the Virtual Annual General Meeting may be carried out on the basis of overriding legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR). To the extent that shareholders do not provide their personal data themselves, we generally receive it from the ultimate intermediary (Art. 14 GDPR). We broadcast the virtual Annual General Meeting (Section 1 para. 2 sentence 1 COVID-19 Act) on the Internet in a closed user group.

The service providers commissioned by us for the purpose of organizing the virtual Annual General Meeting process the personal data of the shareholders or shareholder representatives exclusively in accordance with our instructions on the basis of an agreement on the processing of personal data on behalf (Art. 28 GDPR) and only to the extent necessary for the performance of the commissioned service. All employees of flatexDEGIRO AG and the employees of the commissioned service providers who have access to and/or process personal data of shareholders or shareholder representatives are obliged to treat this data confidentially. In addition, personal data of shareholders or shareholder representatives exercising their voting rights can be viewed by other shareholders and shareholder representatives within the scope of the statutory provisions (in particular the list of participants, Section 129 AktG). The same applies in connection with the answering of questions that shareholders or shareholder representatives may have submitted in advance (Section 1 para. 2 sentence 1 no. 3 and sentence 2 of the COVID-19 Act). The Company reserves the right to name questioners in the course of answering questions.

We will delete your personal data in accordance with the law, in particular when your personal data is no longer necessary for the original purposes for which it was collected or processed, the data is no longer required for any disputes concerning the existence or effectiveness of resolutions of the Annual General Meeting in connection with any administrative or legal proceedings, and there are no legal obligations to retain the data. Data on attendance at Annual General Meetings is retained for a period of ten years in accordance with statutory provisions.

You have the right to information according to Art. 15 GDPR, to correction according to Art. 16 GDPR, to deletion according to Art. 17 GDPR, to restriction of processing according to Art. 18 GDPR, the right of objection according to Art. 21 GDPR as well as the right to data portability according to Art. 20 GDPR if the respective legal requirements are met. You can assert these rights free of charge against flatexDEGIRO AG via the following contact details:

flatexDEGIRO AG

Rotfeder-Ring 7, 60327 Frankfurt am Main [phone]

In addition, there is a right of appeal to the competent data protection supervisory authority in accordance with Art. 77 GDPR.

For comments and queries regarding the processing of your personal data, you can contact our data protection officer at:

flatexDEGIRO AG

Data Protection Officer

Rotfeder-Ring 7, 60327 Frankfurt am Main [phone]