Medigene : Data protection information

Annual general meeting of Medigene AG on 24 June 2024

Convenience Translation

Data protection notice

Medigene AG processes your personal data (name, address, e-mail address, number of shares, class of shares, type of ownership of shares, admission ticket number and individual access data for the use of the password-protected internet service; if applicable, name, address and e-mail address as well as the individual access data for the use of the password-protected internet service of the shareholder representative designated by the respective shareholder, if applicable) in compliance with the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), the German Stock Corporation Act (AktG) and all other relevant legal provisions in order to comply with the (if applicable), taking into account the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), the German Stock Corporation Act (AktG) and all other relevant legal provisions in order to enable shareholders to exercise their rights at the Annual General Meeting.

The shares of Medigene AG are no-par value registered shares. Section 67 AktG stipulates that such registered shares must be entered in the Company's share register, stating the name, date of birth and address of the shareholder as well as the number of shares. The shareholder is generally obliged to provide the company with this information. The banks involved in the purchase, custody or sale of your Medigene shares regularly forward this information and other information relevant to the maintenance of the share register (e.g. nationality, gender and submitting bank) to the share register. This is done via Clearstream Banking Frankfurt, which as the central securities depository handles the technical processing of securities transactions and the safekeeping of shares for banks.

Medigene AG uses your personal data for the purposes provided for in the German Stock Corporation Act. These are, in particular, the maintenance of the share register and the organization of Annual General Meetings. The processing of your personal data is mandatory for your participation in the Annual General Meeting. Medigene AG is the controller responsible for the processing. The legal basis for the processing is the German Stock Corporation Act in conjunction with Art. 6 (1) c) General Data Protection Regulation. In addition, your data (name, date of birth, address, number of shares) may be used to compile statistics, e.g. to analyze trends. This is done on the basis of § 27 BDSG.

In addition, your personal data may also be processed to fulfill other legal obligations, such as regulatory requirements and retention obligations under stock corporation, commercial and tax law. For example, when authorizing the proxies appointed by the company for the Annual General Meeting, it is required that the data serving as proof of authorization be verifiably recorded and stored for three years with access protection (Section 134 para. 3 sentence 5 AktG). In this case, the legal basis for processing is the respective statutory provisions in conjunction with Art. 6 (1) c) GDPR. In individual cases, Medigene AG also processes your data if, for example, individual shareholders must be excluded from information on subscription offers in the event of capital increases due to their nationality or place of residence in order to comply with securities regulations in the countries concerned. The legal basis for this is Art. 6 para. 1 c) GDPR.

Should it be intended to process your personal data for another purpose, you will be informed in advance in accordance with the legal provisions.

1

You have a right of access, rectification, restriction, objection and erasure regarding the processing of your personal data at any time, as well as a right to data portability in accordance with Chapter III of the GDPR. You can exercise these rights against Medigene AG free of charge via the e-mail address

[e-mail]

or via the following contact details:

Medigene AG

Compliance Officer

Lochhamer Str. 11

82152 Planegg/Martinsried

Germany

You also have the right to lodge a complaint with the data protection supervisory authorities in accordance with Art. 77 GDPR.

You can reach our company data protection officer at

Sven Lenz

German data protection law firm - Datenschutzkanzlei Lenz GmbH & Co. KG Bahnhofstrasse 50

87435 Kempten Germany

E-Mail: [e-mail]

Further information on data protection can be found on the Medigene AG website at

https://www.medigene.de/datenschutz

to find.

Planegg/Martinsried, May 2024

The Executive Board

2