Westwing : Annual General Meeting (HV24 Westwing Information on data protection)

ANNUAL GENERAL MEETING

OF THE WESTWING GROUP SE ON 19 JUNE 2024

DATA PROTECTION INFORMATION FOR SHAREHOLDERS AND AUTHORISED

REPRESENTATIVES OF THE ANNUAL GENERAL MEETING

OF THE WESTWING GROUP SE

Westwing Group SE ("Westwing" or "we") will hold the Annual General Meeting in 2024 as an Annual General Meeting with the physical presence of shareholders and/or their authorised representatives. In connection with the preparation, organisation and follow-up of this Annual General Meeting, personal data of shareholdersGeneral and/or their proxies will be processed in

accordance with Regulation (EU) 2016/679 Data Protection Regulation ("GDPR") and the German Federal Data Protection Act ("BDSG").

I. DATA CONTROLLER

The data controller for this data processing is Westwing Group SE, Moosacher Straße 88, 80809 Munich, Germany, e-mail: [e-mail].

II. DATA PROTECTION OFFICER

The external data protection officer is Mr Christian Volkmer, Projekt 29 GmbH & Co KG, Ostengasse 14, 93047 Regensburg, Germany, e-mail: [e-mail].

III. PROCESSING OF PERSONAL DATA

In order to attend and exercise voting rights at the Annual General Meeting, shareholders and/or their authorised representatives must register and provide proof of their entitlement to attend the Annual General Meeting and exercise their voting rights.

We process the following personal data of shareholders and (if applicable) their authorised representatives in connection with the registration and participation in the Annual General Meeting and the provision of the relevant proof of entitlement: if applicable, access data for registration in the InvestorPortal as well as other data provided for registration for the virtual

Annual General Meeting or automatically processed in the context of participation (such as mobile phone numbers, data retrieved or requested, date and time URLof retrieval, notification ofaccessthe success

of a retrieval, information regarding the web browser used, data, IP addresses, and so- called session data, personal data provided to Westwing and service providers commissioned by Westwing, such as first name, surname, form of address (e.g. Mr., Mrs.), any title and session data. session data), personal data provided to Westwing and the service providers commissioned by Westwing, such as first name, surname, title (e.g. Mr, Mrs), any title (e.g. Dr), type of person (natural or legal person), address (consisting of country, town, postcode, street, house number), any different mailing address (with the same elements as the residential address), e-mail address if applicable, custodian bank, number of shares, class of shares and type of ownership of the share,

1

as well as the telephone number of the shareholders or their authorised representatives if this is provided to the employees of the Service Hotline on a voluntary basis.

In this context, the personal data of shareholders and/or their authorised representatives also includes information on their voting behaviour, on the granting or revocation of proxies and instructions, on the access data for the InvestorPortal, on the declaration of objections to resolutions of the Annual General Meeting and on motions, questions, election proposals and other requests submitted by shareholders and/or their authorised representatives in relation to the Annual General Meeting ("personal data").

When shareholders and/or their authorised representatives visit our InvestorPortal on the Internet, we also collect various technical data that is automatically transmitted by the browser of the respective shareholder or their authorised representative when they use the InvestorPortal.

We and our service providers receive the personal data from the shareholders and/or their authorised representatives personally, in some cases also automatically from their web browsers when using the InvestorPortal or from their custodian banks. We receive personal data of the authorised representatives from the shareholder who granted the power of attorney and directly from the authorised representatives if their conduct at the Annual General Meeting is affected. Shareholders and/or authorised representatives are not legally or contractually obliged to provide their personal data; however, the provision of their personal data is necessary for participation in the Annual General Meeting and the exercise of their rights at the Annual General Meeting.

IV. COOKIES

We use cookies on our website. Cookies are small text files that are transferred from an Internet server to your browser and stored on its hard drive.

Depending on the selection of cookies requested by the shareholders and/or their authorised representatives, the information stored in the cookies is sent to our website or to another website to which the cookie belongs the next time the website is accessed with the same end device. This helps us to optimise the design and display of our website according to the user's preferences. Under the "Cookie settings" button, website users can determine which cookies they wish to allow at any time. Strictly necessary cookies enable basic functions and are required for the website to function properly.

V. PURPOSES AND LEGAL BASIS OF THE PROCESSING

We process personal data exclusively to enable shareholders and/or authorised representatives to participate in the Annual General Meeting and exercise their rights as shareholders at the Annual General Meeting. The legal basis for the processing of personal data in this respect is Art. 6 para. 1 sentence 1 lit. c GDPR in conjunction with Sections 118 et seq. §§ Sections 118 et seq. German Stock Corporation Act (in German: AktG) and other provisions of the German Stock Corporation Act.

2

Furthermore, data processing also takes place in connection with voting rights notifications in accordance with the German Securities Trading Act (in German:commercialWpHG), to fulfil other legal

obligations, e.g. retention obligations under stock corporation,or tax law (see Art. 6 para. 1 sentence 1 lit. c GDPR in conjunction with the respective legal regulations).

In individual cases, we also process personal data to protect our legitimate interests in accordance with Art. 6 para. 1 sentence 1 lit. f GDPR. This is particularly the case if the processing of personal data is necessary to comply with non-European legal requirements (e.g. in the case of capital increases) or for the organisation of the Annual General Meeting and the participation of shareholders and/or their proxies (e.g. to respond to enquiries/register of participants).

The processing of certain personal data may also be based on the consent of the data subject in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR.

VI. RECIPIENTS OF PERSONAL DATA

If the shareholders and/or their authorised representatives use the InvestorPortal, Westwing will transmit the personal data to the relevant operator, Computershare Deutschland GmbH & Co KG. The InvestorPortal can be accessed at https://ir.westwing.com/agm in the Investor Relations section under the heading Annual General Meeting 2024.

Westwing also shares personal data with service providers for the purposes described above. These belong to the following categories: (organisational) AGM services, IT services, taxes, logistics, printing services.

Personal data may also be transferred to other recipients if this is necessary to fulfil legal obligations, e.g. to authorities or notaries, or if the data subject has given their consent to the transfer of data.

VII. DATA PROCESSING IN THIRD COUNTRIES

In principle, we only process personal data in the European Union. Personal data is only processed outside the European Union if there is a so-called "adequacy decision" by the European Commission for the country in question or if suitable guarantees are in place (see Art. 45 et seq. GDPR).

VIII. DELETION OF PERSONAL DATA

We store personal data for as long as this is necessary for the purposes described above and to comply with statutory retention periods, in particular under commercial, stock corporation, civil and tax law.

3

IX. RIGHTS OF DATA SUBJECTS

In accordance with the statutory provisions on data protection, the shareholders and/or authorised representatives concerned have the right to access their personal data at any time:

• to request information about the data processed by us and a copy of this data (right to information);
• to request the rectification of inaccurate data and, taking into account the purposes of the processing, the completion of incomplete data (right to rectification);
• to demand the deletion of the data if there are legitimate reasons (right to deletion);
• to demand the restriction of the processing of the data, provided that the legal requirements are met (right to restriction of processing);
• if the legal requirements are met, to receive the data provided in a structured, commonly used and machine-readable format and to transmit this data to another controller or, if technically feasible, to have it transmitted by Westwing (right to data portability);
• not to be subject to a decision based solely on automated processing, unless the legal requirements for this are met. Westwing does not currently carry out automated decision- making.

Insofar as the processing of personal data is based on our legitimate interest pursuant to Art. 6 para. 1 sentence 1 lit. f GDPR, data subjects have the right to object to the processing of their personal data on grounds relating to their particular situation by sending an email to: [e-mail]. We will then no longer process the personal data for these purposes, unless our legitimate interest prevails in the individual case.

If the processing of personal data is based on consent in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR, the data subjects have the right to withdraw their consent at any time with effect for the future by sending an email to [e-mail].

supervisoryData subjects also have the right to lodge a complaint with the competent data protection authority. For the assertion of your rights as well as for other enquiries and

ambiguities regarding the processing of personal data, the data subjects have the possibility to contact us by e-mail at: [e-mail].

4