ThyssenKrupp : Note on data protection

Information about the processing of personal data for shareholders and proxies of

the virtual Annual General Meeting of thyssenkrupp AG

Your personal data is important to us.

thyssenkrupp AG ("we", "us", "our") takes the protection of your data very seriously. This privacy statement explains how and what information is collected, why it is collected, and to whom it will be forwarded or disclosed. Please therefore read this statement very carefully.

1. Who is responsible for the processing?

Controller for the processing is:

thyssenkrupp AG thyssenkrupp Allee 1 45143 Essen, Germany P: [phone] - 0

F: [phone] - 536000

Our data protection officer can be reached at:

thyssenkrupp AG

Der Datenschutzbeauftragte thyssenkrupp Allee 1

45143 Essen, Germany P: [phone] - 0

E-Mail: [e-mail]

2. Which personal data do we process?

When you authorize a proxy, we will process personal data on you and/or your authorized proxy:

• Name
• Contact details (e.g. address, email address)

We also process the following data on shareholders and/or their proxies:

• Share-relateddata (e.g. number of shares, type of share, type of share ownership)
• Annual General Meeting-related data (e.g. admission ticket number)

3. For what purposes for how long and on what legal basis is data processed?

We process the personal data provided by you/your depository bank for the following purposes:

• To allow you to participate in the virtual Annual General Meeting
• To meet requirements under stock corporation law (e.g. for the list of participants)
• To allow shareholders to exercise their rights (e.g. to ask questions and vote)

We process your personal data for as long as it is required for the aforementioned purposes. Your data will then be deleted unless statutory retention obligations exist.

The legal basis for data processing is the Stock Corporation Act and Act Concerning Measures Under the Law of Com- panies, Cooperative Societies, Associations, Foundations and Commonhold Property to Combat the Effects of the COVID-19 Pandemic (GesRuaCOVBekG) in conjunction with Art. 6 para. 1 c) General Data Protection Regulation. We also process personal data to protect the following legitimate interests (Art. 6 para. 1 f) GDPR):

• Organization and orderly execution of the Annual General Meeting which goes beyond the points already mentioned above
• Defence in the event of legal disputes
• Information for shareholders and the general public about the Annual General Meeting

At the instruction of the Chairman of the Meeting, thyssenkrupp AG will transmit the Annual General Meeting live on the internet (basis §118 (4) Stock Corporation Act (AktG) in conjunction with the Articles of Association).

4. Who receives your data?

Your data will be processed within thyssenkrupp AG by the employees involved in the organization of the virtual Annual General Meeting.

Within our group of companies your data will be transmitted to certain companies when they perform centralized data processing tasks for the group's affiliated companies.

In addition, to fulfill our contractual and legal obligations, we sometimes use different external service providers who are required by data processing agreements to observe data protection laws, Article 4 No. 8 GDPR.

In addition, we transmit your data to other recipients outside the company who process your data at their own responsibility, Article 4 No. 7 GDPR. For example, this may include the following categories of responsible persons:

• Public institutions due to statutory provisions (e.g. supervisory authorities)

5. Which data protection rights can you claim as the person affected?

Where permitted by applicable law or regulation, you have the right to:

• Information about your personal data
• Information about the origin of the data, the purpose and end of processing, details of the data controllers, the data processors, and the parties to whom the data may be disclosed
• Rectification and updating of your personal data and completion of any incomplete personal data
• Erasure of your personal data, if no longer needed to fulfill the above referenced purposes
• Right to object to the processing of your personal data explained in more detail at the end of this section
• Right to file a complaint with us and/or the competent data protection authority

Information about your right of objection according to Art. 21 of the General Data Protection Regulation (GDPR)

For reasons that arise from your particular situation, you have the right to object to the processing of your personal data at any time pursuant to Article 6 para. 1 f) of the GDPR (data processing on the basis of a balance of interests).

If you file an objection, we will no longer process your personal data unless we can establish compelling legitimate grounds for processing that outweigh your interests, rights

and freedoms, or the processing is for the purposes of asserting, exercising or defending legal claims.

To exercise your rights, please contact the responsible body or data protection officer listed under section 1.

The data protection authority responsible for us is:

Die Landesbeauftragte für Datenschutz

und Informationsfreiheit Nordrhein-Westfalen Postfach 20 04 44

40102 Düsseldorf, Germany

1. [phone] - 0

1. [phone] - 10 E-Mail: [e-mail].

6. Are you required to provide your data?

Yes, to meet requirements under stock corporation law and to enable shareholders to exercise their rights.

7. How long will your data be stored?

We will retain your personal data as long as a liability risk exists for us under the applicable legislation. We will not retain your personal data longer than necessary for the above referenced purposes.

Statutory retention requirements are complied with.

Only the opening of the Annual General Meeting by the Chairman of the Meeting and the speech by the CEO will be available as a recording after the virtual Annual General Meeting.

thyssenkrupp AG thyssenkrupp Allee 1 45143 Essen, Germany www.thyssenkrupp.com