The responsible authority according to the Data Protection Act is Schörghuber Stiftung & Co. Holding KG Möhlstraße 10 D-81675 München Telephone +49 89 30749170 E-mail kontakt@schoerghuber.group Legal information The controller (entity acting as data controller) regularly verifies and updates the information on its websites. Despite the due care taken, it is possible that some of the information may have changed. Therefore, no liability can be assumed or guarantee given that the information is always current, correct and/or complete. The same applies to all other websites referred to via hyperlinks. The controller is not responsible for the content of the websites that are linked in this way. The content and design of the website are copyrighted. Any reproduction of the pages or their contents requires the prior written consent of the controller, unless such reproduction is permitted by law. Privacy policy Welcome to our website and thank you for your interest in our privacy policy. The protection of your personal data is important to us. Therefore the processing of data belonging to visitors to our website, interested parties and customers is performed in accordance with the applicable laws and regulations for the protection of personal data, such as the European General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG-neu). This privacy policy provides you with information on which data will be collected and how it will be used, and the legal basis for doing this. We will also provide you with information about your rights and who you can contact if you have any questions about data protection or complaints. Personal data Personal data is detailed information about personal or material circumstances of an identified or identifiable natural person. This includes information such as your name, your address, your telephone number and your date of birth. Information that is not directly related to your actual identity is not considered personal data. General purposes of data collection Data is only collected, stored and processed for our own business purposes. Our websites are available to all users without requiring them to disclose personal data. Personal data will only be requested, processed and used to the extent necessary to provide the services or content that you have requested. Server logs When you visit our website, our web servers temporarily store information in so-called server log files. This information includes the IP address assigned to your computer, the webpages you visit, the date and duration of your visit, the type of browser and operating system type used, and the website from which you are visiting us. This data is processed for the purpose of enabling use of the website (establish a connection), system security, technical administration of the network infrastructure and optimizing our Internet presence. This involves only information that does not permit any conclusions to be drawn about your person. Contact form If you contact us by email or using the contact form, the information you provide will be saved for the purpose of processing your request and for possible follow-up questions. The personal data transmitted to us in this way will of course only be used for the purpose for which you made it available to us when contacting us. The provision of this information is entirely voluntary and is performed with your consent. If the information involved is information relating to communication channels (such as postal address, e-mail address, telephone number), you also agree that we may contact you via these communication channels in order to respond to your request. You can of course revoke your declarations of consent at any time in the future. To do this, please contact our data protection officer, whose contact details are listed below. Collection of personal data for personalized use In addition to the use of our website for purely informational purposes, we also offer various services and products that you can use if interested. To do this, you will usually have to provide additional personal data that we will use to provide the respective service. Optional information is marked accordingly. We only collect, process and use the personal data that is required for your use of the website and/or for the performance of a contract concluded with us, or which you specify yourself. This includes in particular the following inventory data and usage data, which may be transmitted by means of forms on our website or contractual documents:

• Company
• Name (form of address, first name, last name)
• Address
• Company
• Telephone number
• E-mail address
• User's registration and login data

We use inventory data and usage data to establish, if applicable, a contractual relationship with you, to define its nature, to change or terminate it, to fulfill our contractual obligations, to log the user onto the website, and to contact you if requested to do so by you or required or legally permitted to do so within the scope of the contractual relationship. If you have provided us with your consent, we also collect your data for the purpose of sending information material, brochures, advertising, event management, managing press contacts and the management of charity events for example. If we provide you with contractual or precontractual services in accordance with Art. 6 para. 1(b) GDPR, the data to be processed, the type, the scope, the purpose and the need for its processing are determined by the underlying mandate. This includes inventory and master data (name, address, etc.) as well as contact data (e-mail address, telephone number, etc.). Furthermore, it may be necessary to collect other contract data (nature of the task, fees, terms, information about the brokered companies/services) and payment data. We may also process information on the characteristics and circumstances of persons or property belonging to them if this is forms part of the task we are to perform, for example the rental or sale of commercial or residential property. This can include information on personal circumstances, movable and immovable property for example. Data protection relating to job applications and the application process The controller collects and processes the applicants' personal data for the purpose of carrying out the application process. Processing may also be performed electronically. This applies in particular if an applicant sends the relevant application documents to the controller by electronic means, for example via e-mail or using a web form available on the website. If the controller concludes an employment contract with an applicant, the transmitted data will be stored for the purpose of handling the employment relationship in compliance with statutory provisions. If the controller does not conclude an employment contract with the applicant, the application documents will be deleted automatically six months after that applicant has been notified of the decision to reject his or her application, provided that no other legitimate interests of the controller prevent their deletion. Other legitimate interest in this context would be the burden of proof in proceedings under the General Equal Treatment Act (AGG) for example. Use and disclosure of personal data If we disclose data to other persons or companies (processors or third parties) during our processing operation, transmit the data to them or otherwise grant them access to the data, this will only take place on the basis of a legal authorization (e.g. if transmission of the data to third parties is required for contract performance pursuant to Art. 6 para. 1(b) DSGVO), if you have consented, if a legal obligation provides for this, or on the basis of our legitimate interests (e.g. when using agents, web hosts, etc.). If we commission third parties with the processing of data within the framework of a so-called "order processing contract", this is done on the basis of Art. 28 GDPR. Deletion or blocking of data We adhere to the principles of data avoidance and minimization. Legislators have stipulated a number of storage-related obligations and storage periods. Once these time periods have expired, the corresponding data is routinely deleted or blocked in accordance with statutory provisions. Where data is not subject to such statutory time limits, it will be deleted or blocked once the reasons for which it was collected cease to apply. If you have agreed to your data being stored, processed and used for a longer period of time, we will delete or block your data after this period has expired or if you your revoke your consent. Cookies So-called cookies are used to improve the content of our website. These are small files that are transmitted from a web server to your browser and which are sent to us by your browser every time you access one of our webpages. The data stored is collected for the purpose of market research and allows us to tailor our offering to your particular needs and is used exclusively for this purpose. Please note that you can configure your browser in such a way that you prevent the use of cookies or are informed when a cookie is being set. If you want to know how to change your cookie settings, click on the "Help" field in your browser. Web analysis using Google Analytics This website uses Google Analytics, a web analysis service provided by Google Inc. ("Google"). Google Analytics uses so-called cookies, i.e. text files that are stored on your computer, to allow an analysis of how you use the site. The information that the cookie generates about your use of this website is transmitted to and stored on a server operated by Google in the USA. IP address anonymization is activated on this website. This means that Google will abbreviate your IP address in advance within member states of the European Union or other contracting parties to the Agreement on the European Economic Area. The complete IP address will only be transmitted to a Google server in the US and abbreviated there in exceptional cases. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, compile reports about website activities for the website operator and provide other services related to the use of the website and of the Internet. The IP address conveyed by your browser within the context of Google Analytics will not be linked to any other Google data. You will find more information about how Google Analytics uses the data and how you can control the information that is sent to Google here. You can prevent the use of cookies by selecting the appropriate settings in your browser. In this case, however, we would like to point out that you might not be able to make full use of all the features of this website. You can also prevent the data generated by the cookie about your interaction with the website (including your IP address) from being conveyed to Google and being processed by Google by downloading and installing the browser plug-in available via the following link: An opt-out cookie will be set which prevents your data from being collected when you visit this website in the future Disable Google Analytics Social bookmarks So-called social bookmarks are integrated in our website. Social bookmarks are Internet bookmarks that allow users of such a service to collect links and news items. These are merely integrated in our website as links to the corresponding services. After clicking on the embedded graphic, you will be forwarded to the website of the respective provider. This means user information will only be transmitted to the respective provider from that point on. For information on how your personal information is handled when you use these websites, please consult the respective provider’s data protection regulations.

• Xing SE, Dammtorstraße 30, 20354 Hamburg, DE;http://www.xing.com/privacy
• Facebook Inc., 1601 S California Ave, Palo Alto, California 94304, USA; http://www.facebook.com/policy.php.
• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland; https://www.google.com/policies/privacy/partners/?hl=de.
• Twitter, Inc., 1355 Market St, Suite 900, San Francisco, California 94103, USA; https://twitter.com/privacy.
• Instagram LLC., 1601 Willow Road, Menlo Park, CA 94025, USA;  https://help.instagram.com/155833707900388/
• LinkedIn Corporation, 2029 Stierlin Court, Mountain View, California 94043, USA; http://www.linkedin.com/legal/privacy-policy
• Vimeo, LLC, 555 West 18th Street, New York, New York 10011, USA; http://vimeo.com/privacy
• VK, LLC "V Kontakte" of 1-N, bld. 12-14, Lit. A, Khersonskaya st., St. Petersburg, Russia, 191024;https://vk.com/privacy

Youtube We have integrated Youtube videos into our website where appropriate; these are stored on www. Youtube.com and can be played directly from our website. These are all integrated in the "enhanced data protection mode", i.e. no data about you as a user will be transmitted to Youtube if you do not play the videos. Only when you play the videos will the third party provider be informed that you have accessed the corresponding subpage of our website. We have no influence over the transmission of this data. The data protection regulations published by Youtube, which can be accessed at www.google.de/intl/de/policies/privacy/, provide information about the collection, processing and use of personal data by Youtube and Google. Use of Google Maps This website uses Google Maps API to display geographical information visually where appropriate. When using Google Maps, Google also collects, processes and uses data about the visitors' use of the map functions. You can find more information about Google's data processing in Google's privacy policy. This is also where you will find the data protection center, where you can change your personal data protection settings. Address for Google Inc. and the URL for its privacy policy: Google LLC, 1600 Amphitheatre Parkway, Mountain View, California 94043, USA; https://www.google.com/policies/privacy/partners/?hl=de Links to websites operated by other providers Our websites include links to websites operated by other providers that are not covered by this data privacy policy. Insofar as the use of websites operated by other providers involve the collection, processing or use of personal data, please take account of the privacy policy provided by the respective website operator. Legal basis for data collection In accordance with Articles 13 and 14 of the GDPR, we wish to provide you with information regarding the legal basis for our data processing.

• Insofar as we obtain the consent for the processing of personal data from the data subject, Art. 6 para. 1(a) GDPR serves as the legal basis.
• When processing personal data that is required for the performance of a contract to which the data subject is a party, Art. 6 para. (1)(b) GDPR serves as the legal basis. This also applies to processing operations that are necessary for the execution of precontractual measures.
• Insofar as the processing of personal data is required for compliance with a legal obligation to which our company is subject, Art. 6 para. 1(c) GDPR serves as the legal basis.
• The legal basis for the temporary storage of data and log files is Art. 6 para. 1(f) GDPR .
• The legal basis for the processing of personal data using cookies that are technically necessary is Art. 6 para. 1(f) GDPR. The legal basis for the processing of personal data using cookies for analytical purposes is Art. 6 para. 1(f) GDPR.
• After you register for our newsletter, we will save your e-mail address for the purpose of sending you the newsletter. The legal basis is Art. 6 para. 1(a)XXOK GDPR.
• If processing is required to safeguard a legitimate interest of our company or a third party and if the interests, fundamental rights and freedoms of the data subject do not override the first-mentioned interest, Art. 6 para. 1(f) GDPR serves as the legal basis for processing.
• If the processing of personal data is based on Art. 6 1(f) GDPR, it is in our legitimate interest to conduct our business for the benefit of well-being of all our employees and our shareholders.

Security We have taken comprehensive technical and operational security measures to protect your data from intentional or unintentional manipulation, loss, destruction or access by unauthorized persons. Our security procedures are monitored regularly and updated in line with technological progress. SSL encryption To protect the security of your data during transmission, we use state-of-the-art encryption methods (e.g. TLS) via HTTPS. Server location Our hosting partner's systems are located in the Federal Republic of Germany. Your rights / right to information, objection, deletion, rectification and complaint The user and other persons concerned have the following rights with regard to their personal data:

• Right to information pertaining to the relevant personal data (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to deletion (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right of objection to processing if the processing of data is based on Art. 6 para. 1(e/f) GDPR (Art. 21 GDPR ); see also the following reference to the right of objection under Art. 21 GDPR
• Right to data portability (Art. 20 GDPR)
• Right to revoke consent given at any time, without affecting the legality of the processing carried out on the basis of the consent until revocation, if the data processing is based on consent pursuant to Art. 6 para. 1(a) or Art. 9 para. 2(a) GDPR

You also have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data (Art. 77 GDPR). Reference to the right to object under Art. 21 GDPR A. Objection on grounds relating to the particular situation You have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data that is based on Art. 6 para 1e (public safety) or 1f (data processing on the basis of a balancing of interests) of the GDPR; this includes profiling based on those provisions. We no longer process personal data unless we can prove compelling grounds for processing this data that outweigh your interests, rights and freedoms, or if the processing serves to assert, exercise or defend legal claims. B. Right to object to direct advertising If we process your personal data for the purpose of direct marketing, you have the right to object at any time to the processing of you personal data for the purpose of such advertising; this also applies to profiling insofar as it is associated with such direct marketing. If you object to the processing for direct marketing purposes, your personal data will no longer be processed for these purposes. C. Exercising your right to object The right of objection can be exercised informally. Simply contact our data protection contact named at the end of this privacy policy. Contact data for the data protection officer If you have any questions about data protection or would like further information, please contact our data protection officer: Schörghuber Stiftung & Co. Holding KG Datenschutzbeauftragter Möhlstraße 10 D-81675 München E-mail: datenschutz@schoerghuber.group Contact data for the responsible supervisory authority Bayerisches Landesamt für Datenschutzaufsicht (Bavarian State Ministry for Data Privacy Protection) Postal address: Postfach 606 D-91511 Ansbach Telephone: +49 981 53-1300 Telefax: +49 981 53-981300 E-mail: poststelle@lda.bayern.de Amendment to our data protection regulations We reserve the right to make amendments to this privacy policy on occasion so that it corresponds to the current legal requirements or in order to incorporate changes in our services in the privacy policy, e.g. for the introduction of new services.  The new privacy policy will then apply to your next visit.

Data protection policy for our LinkedIn page

At Schörghuber Stiftung & Co. Holding KG, we take the protection of personal data very seriously. This policy informs you about how personal data are collected when you use our LinkedIn page. Should you have any further questions about the handling of your personal data, please contact our data protection officer. 1. General information Social media has become an integral part of the internet and of modern communication. In order to connect with and keep in touch with applicants and employees, we have set up our own LinkedIn page. LinkedIn is a service of the LinkedIn Corporation, 1000 W Maude Ave, Sunnyvale, CA 94085-2810, USA. The LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland is the data controller for users in the EU, the European Economic Area and Switzerland. We hereby expressly point out that, as the controller, LinkedIn collects the personal data of users who visit our page, for example through the use of cookies. LinkedIn may also collect such data from visitors to our page who are not registered or logged in to LinkedIn. We have no control over the processing and further use of these data, as LinkedIn is solely responsible for all data processing. We do not have information about the scope, location or duration of data storage, the extent to which data are linked or analyzed, or the recipients to whom data may be disclosed. Furthermore, we have neither knowledge of nor influence over deletion deadlines, i.e. whether and to what extent such deadlines are observed. If you are a LinkedIn member and are logged in to your LinkedIn user account, LinkedIn can associate your visit to our page with your user account. Information about how LinkedIn collects and processes personal data can be found in LinkedIn’s Privacy Policy. 2. Scope of data collection and storage  Schörghuber Stiftung & Co. Holding KG does not have full or independent access to the data collected by LinkedIn or to your profile data. Each time you visit our LinkedIn page, LinkedIn collects and processes various types of usage data concerning your visit. In addition to typical log file data, such as your IP address, screen resolution, etc., LinkedIn also tracks your use of the specific services that it provides. The data tracked include whether you view/click on content or advertisements, any searches you perform and whether you share articles or apply for a job via LinkedIn. To this end, LinkedIn uses login credentials, cookies, device information and IP addresses to identify you and create a log of your visit. LinkedIn also tracks your user behavior for advertising purposes. More detailed information regarding which data LinkedIn collects for which purposes and on which basis can be found in LinkedIn’s Privacy Policy and Cookie Policy. You do not need to be a member of LinkedIn to access content on our LinkedIn page. If you have created a LinkedIn profile, we can only view the information in your profile that you have made public. You can choose which information is made public in the settings for your LinkedIn profile. If you have a LinkedIn profile or subscribe to our page, we will also see your first and last name as well as the time of your visit. As a rule, we only store personal data for as long as is necessary to fulfill the purpose for which the data were collected. For example, as part of a business relationship with you, we may store the personal data necessary for this relationship for at least as long as the relationship continues. We also store data as required by statutory retention obligations. Such obligations may be contained, for example, in the German Commercial Code (HGB) or the German Fiscal Code (AO). LinkedIn provides us with the aforementioned data on the basis of our legitimate interest (Art. 6 (1)(f) GDPR), so that we can connect with and keep in touch with applicants, business partners and employees. We also see our desire to inform you about our company, products and services as grounds for our legitimate interest in processing personal data. We do not automatically collect or analyze personal profile data from LinkedIn users. Automated decision-making, including profiling, in accordance with Art. 22 GDPR does not occur. LinkedIn additionally provides us with anonymized statistics on the use of our page. The statistics we receive from LinkedIn contain the following information: • Number of people who follow us as well as growth/changes in follower numbers within a defined period. • Number of people who see each of our posts. Number of interactions with/about each of our posts. We use these statistics to determine, for example, which content our community finds most interesting. These statistics help us to continually improve our LinkedIn page and our posts and ensure that they better reflect the interests of our users. The statistics cannot be associated with specific users or with the profile data of users who follow us.   3. Disclosure and use of personal data Recipients or categories of recipient LinkedIn When you interact on LinkedIn, LinkedIn naturally has access to your data. In particular, not only the LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland, but also the LinkedIn Corporation, 1000 W Maude Ave, Sunnyvale, CA 94085-2810 USA may have access to your data. The LinkedIn Corporation is located in a non-secure third country, where data protection standards are less stringent. Schörghuber Stiftung & Co. Holding KG does not disclose your profile data to third parties. 4. Your rights Provided that the conditions specified in the regulation are met, you have the following rights: • Right of access Art. 15 GDPR • Right to rectification Art. 16 GDPR • Right to erasure Art. 17 GDPR • Right to blocking/restriction of processing Art. 18 GDPR • Right to object Art. 21 GDPR • Right to data portability Art. 20 GDPR • Right to lodge a complaint with a supervisory authority Art. 77 GDPR • Right to withdraw consent with future effect, where consent has been given Art. 7 (3) GDPR In accordance with Art. 21 GDPR, you have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data on the basis of Article 6 (1)(e) or (f) GDPR; this also applies to profiling based on these provisions. If personal data are processed for the purposes of direct marketing, you additionally have the right to object to the processing of your personal data for such marketing at any time; this also applies to any profiling in connection with such direct marketing efforts. 5. Contact details of the controller and the data protection officer The controller within the meaning of the General Data Protection Regulation (GDPR) is: Schörghuber Stiftung & Co. Holding KG Möhlstraße 10 81675 Munich, Germany Tel.: +49 (0) 89 3074917-0 E-mail: kontakt@schoerghuber.group If you have any further questions about data protection, please do not hesitate to contact us. For questions about the collection, processing or use of your personal data or to access, rectify, block or delete data or withdraw previously given consent, please contact: Schörghuber Stiftung & Co. Holding KG Data protection officer Möhlstraße 10 81675 Munich, Germany E-mail: datenschutz@schoerghuber.group 6. Further information For more information on safely using social networking sites, please consult the following page on the website of the German Federal Office for Information Security: https://www.bsi-fuer-buerger.de/BSIFB/DE/DigitaleGesellschaft/SozialeNetze/sozialeNetze_node.html (in German).  

Data protection policy for our XING page

At Schörghuber Stiftung & Co. Holding KG, we take the protection of personal data very seriously. This policy informs you about how personal data are collected when you use our XING page. Should you have any further questions about the handling of your personal data, please contact our data protection officer. 1. General information Social media has become an integral part of the internet and of modern communication. In order to connect with and keep in touch with applicants and employees, we have set up our own XING page. XING is a service of NEW WORK SE, Dammtorstrasse 30, 20354 Hamburg, Germany. We hereby expressly point out that, as the controller, XING collects the personal data of users who visit our page, for example through the use of cookies. XING may also collect such data from visitors to our page who are not registered or logged in to XING. We have no control over the processing and further use of these data, as XING is solely responsible for all data processing. We do not have information about the scope, location or duration of data storage, the extent to which data are linked or analyzed, or the recipients to whom data may be disclosed. Furthermore, we have neither knowledge of nor influence over deletion deadlines, i.e. whether and to what extent such deadlines are observed. If you are a XING member and are logged in to your XING user account, XING can associate your visit to our page with your user account. Information about how XING collects and processes personal data can be found in XING’s Privacy Policy. 2. Scope of data collection and storage  Schörghuber Stiftung & Co. Holding KG does not have full or independent access to the data collected by XING or to your profile data. Each time you visit our XING page, XING collects and processes various types of usage data concerning your visit. In addition to typical log file data, such as your IP address, screen resolution, etc., XING also tracks your use of the specific services that it provides. This tracking includes click paths and personal recommendations. XING also tracks your user behavior for advertising purposes; you will be asked for your consent to this the first time you visit a XING page. More detailed information regarding which data XING collects for which purposes and on which basis can be found in XING’s privacy policy: https://privacy.xing.com/en/privacy-policy. You do not need to be a member of XING to access content on our XING page. If you have created a XING profile, we can only view the information in your profile that you have made public. You can choose which information is made public in the settings for your XING profile. If you have a XING profile or subscribe to our page, we will also see your first and last name as well as the time of your visit. As a rule, we only store personal data for as long as is necessary to fulfill the purpose for which the data were collected. For example, as part of a business relationship with you, we may store the personal data necessary for this relationship for at least as long as the relationship continues. We also store data as required by statutory retention obligations. Such obligations may be contained, for example, in the German Commercial Code (HGB) or the German Fiscal Code (AO). XING provides us with the aforementioned data on the basis of our legitimate interest (Art. 6 (1)(f) GDPR), so that we can connect with and keep in touch with applicants, business partners and employees. We also see our desire to inform you about our company, products and services as grounds for our legitimate interest in processing personal data. We do not automatically collect or analyze personal profile data from XING users. Automated decision-making, including profiling, in accordance with Art. 22 GDPR does not occur. XING additionally provides us with anonymized statistics on the use of our page. The statistics we receive from XING contain the following information: • Number of people who follow us as well as growth/changes in follower numbers within a defined period. • Number of people who see each of our posts. Number of interactions with/about each of our posts. We use these statistics to determine, for example, which content our community finds most interesting. These statistics help us to continually improve our XING page and our posts and ensure that they better reflect the interests of our users. The statistics cannot be associated with specific users or with the profile data of users who follow us. 3. Disclosure and use of personal data Recipients or categories of recipient XING When you interact on XING, XING naturally has access to your data. In particular, it is possible that NEW WORK SE, Dammtorstrasse 30, 20354 Hamburg, Germany, will have access to your data. Schörghuber Stiftung & Co. Holding KG does not disclose your profile data to third parties. 4. Your rights Provided that the conditions specified in the regulation are met, you have the following rights: • Right of access Art. 15 GDPR • Right to rectification Art. 16 GDPR • Right to erasure Art. 17 GDPR • Right to blocking/restriction of processing Art. 18 GDPR • Right to object Art. 21 GDPR • Right to data portability Art. 20 GDPR • Right to lodge a complaint with a supervisory authority Art. 77 GDPR • Right to withdraw consent with future effect, where consent has been given Art. 7 (3) GDPR In accordance with Art. 21 GDPR, you have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data on the basis of Article 6 (1)(e) or (f) GDPR; this also applies to profiling based on these provisions. If personal data are processed for the purposes of direct marketing, you additionally have the right to object to the processing of your personal data for such marketing at any time; this also applies to any profiling in connection with such direct marketing efforts. 5. Contact details of the controller and the data protection officer The controller within the meaning of the General Data Protection Regulation (GDPR) is: Schörghuber Stiftung & Co. Holding KG Möhlstraße 10 81675 Munich, Germany Tel.: +49 (0) 89 3074917-0 E-mail: kontakt@schoerghuber.group If you have any further questions about data protection, please do not hesitate to contact us. For questions about the collection, processing or use of your personal data or to access, rectify, block or delete data or withdraw previously given consent, please contact: Schörghuber Stiftung & Co. Holding KG Data protection officer Möhlstraße 10 81675 Munich, Germany E-mail: datenschutz@schoerghuber.group 6. Further information For more information on safely using social networking sites, please consult the following page on the website of the German Federal Office for Information Security: https://www.bsi-fuer-buerger.de/BSIFB/DE/DigitaleGesellschaft/SozialeNetze/sozialeNetze_node.html (in German).

Data protection policy for our YouTube channel

At Schörghuber Stiftung & Co. Holding KG, we take the protection of personal data very seriously. This policy informs you about how personal data are collected when you use our YouTube channel or view the videos that we upload to our YouTube channel. Should you have any further questions about the handling of your personal data, please contact our data protection officer. 1. General information Social media has become an integral part of the internet and of modern communication. In order to connect with and keep in touch with customers, employees and other interested parties, we have set up our own YouTube channel. YouTube is a service of YouTube, LLC, 901 Cherry Ave, San Bruno, CA 94066, USA, which is owned by Google, LLC, Amphitheatre Parkway, Mountain View, CA 94043, USA. We hereby expressly point out that, as the controller, YouTube collects the personal data of users who visit our page, for example through the use of cookies. YouTube may also collect such data from visitors to our channel who are not registered or logged in to YouTube/Google. We have no control over the processing and further use of these data, as YouTube is solely responsible for all data processing. We do not have information about the scope, location or duration of data storage, the extent to which data are linked or analyzed, or the recipients to whom data may be disclosed. Furthermore, we have neither knowledge of nor influence over deletion deadlines, i.e. whether and to what extent such deadlines are observed. If you have a YouTube/Google account and are logged in, YouTube can associate your visit to our channel with your user account. Information about how YouTube collects and processes personal data can be found in Google’s Privacy Policy. 2. Scope of data collection and storage  Schörghuber Stiftung & Co. Holding KG does not have full or independent access to the data collected by YouTube or to your profile data. Each time you visit our YouTube channel, YouTube collects and processes various types of usage data concerning your visit. In addition to typical log file data, such as your IP address, screen resolution, etc., YouTube also tracks your use of the specific services that it provides. The data tracked include whether you view/click on videos, advertisements or other content, as well as any searches you perform. To this end, YouTube uses data such as login credentials, cookies, device IDs and IP addresses as well as information about your location to identify you and create a log of your visit. YouTube also tracks your user behavior for advertising purposes. You can control how targeted advertising is displayed in your YouTube settings. More detailed information regarding which data YouTube collects for which purposes and on which basis can be found in Google’s Privacy Policy. You do not need a YouTube/Google account to access content on our YouTube channel. If you have created a YouTube/Google account and you publicly comment on our posts, we can only view the information in your profile that you have made public. If you have subscribed to our YouTube channel, we will also see your user name. YouTube provides us with the aforementioned data on the basis of our legitimate interest (Art. 6 (1)(f) GDPR). We see our desire to inform you about our company, products and services as grounds for our legitimate interest in processing personal data. We do not automatically collect or analyze personal profile data from YouTube users. Automated decision-making, including profiling, in accordance with Art. 22 GDPR does not occur. We do not store any personal data outside of YouTube. YouTube additionally provides us with anonymized statistics on the use of our page. The statistics we receive from YouTube contain the following information: • Number of people who subscribe to our channel as well as growth/changes in subscriber numbers within a defined period. • Number of people who see each of our posts. Number of interactions with/about each of our posts. We use these statistics to determine, for example, which content our community finds most interesting. These statistics help us to continually improve our YouTube channel and our posts and ensure that they better reflect the interests of our users. The statistics cannot be associated with specific users or with the data of people who subscribe to our channel. 3. Disclosure and use of personal data Recipients or categories of recipient YouTube  When you interact on YouTube, YouTube, LLC, 901 Cherry Ave, San Bruno, CA 94006, USA, naturally has access to your data. Since YouTube, LLC, 901 Cherry Ave, San Bruno, CA 94066, USA, is owned by Google, LLC, Amphitheatre Parkway, Mountain View, CA 94043, USA, and YouTube refers users to Google’s Privacy Policy, Google will also have access to your data. Schörghuber Stiftung & Co. Holding KG does not disclose your profile data to third parties. 4. Your rights Provided that the conditions specified in the regulation are met, you have the following rights: • Right of access Art. 15 GDPR • Right to rectification Art. 16 GDPR • Right to erasure Art. 17 GDPR • Right to blocking/restriction of processing Art. 18 GDPR • Right to object Art. 21 GDPR • Right to data portability Art. 20 GDPR • Right to lodge a complaint with a supervisory authority Art. 77 GDPR • Right to withdraw consent with future effect, where consent has been given Art. 7 (3) GDPR In accordance with Art. 21 GDPR, you have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data on the basis of Article 6 (1)(e) or (f) GDPR; this also applies to profiling based on these provisions. If personal data are processed for the purposes of direct marketing, you additionally have the right to object to the processing of your personal data for such marketing at any time; this also applies to any profiling in connection with such direct marketing efforts. 5. Contact details of the controller and the data protection officer The controller within the meaning of the General Data Protection Regulation (GDPR) is: Schörghuber Stiftung & Co. Holding KG Möhlstraße 10 81675 Munich, Germany Tel.: +49 (0) 89 3074917-0 E-mail: kontakt@schoerghuber.group If you have any further questions about data protection, please do not hesitate to contact us. For questions about the collection, processing or use of your personal data or to access, rectify, block or delete data or withdraw previously given consent, please contact: Schörghuber Stiftung & Co. Holding KG Data protection officer Möhlstraße 10 81675 Munich, Germany E-mail: datenschutz@schoerghuber.group 6. Further information For more information on safely using social networking sites, please consult the following page on the website of the German Federal Office for Information Security: https://www.bsi-fuer-buerger.de/BSIFB/DE/DigitaleGesellschaft/SozialeNetze/sozialeNetze_node.html (in German).

Information on data protection on our Instagram page

The Schörghuber Group attaches great importance to the protection of personal data. In the following, we inform you about the collection of personal data when you visit our Instagram page. If you have any further questions regarding the handling of your personal data, please do not hesitate to contact our data protection officer. 1. General information Social media have become an integral part of the Internet and modern communication. In order to stay in contact with our customers, interested parties and applicants, we have also set up our own Instagram page. Instagram is an online service for sharing photos and videos by Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA. Facebook Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (hereinafter: "Facebook") in Ireland is responsible for the operation of the network as well as for the social network Facebook. We expressly draw your attention to the fact that Facebook stores data (e.g. IP address, preferences and personal interests (e.g. through hashtags and groups with which a user is connected), behaviour on Instagram pages, personal information possibly stored on Instagram, etc.) of users and uses it for business purposes. We have no influence on the processing and further use of this data, as Facebook alone determines the processing. To what extent, where and for how long the data is stored, to what extent the data is linked and evaluated and to whom the data is passed on is currently not comprehensible to us. We also have no insight or influence with regard to deletion periods, i.e. whether and to what extent deletion periods are adhered to. Information from Facebook itself about what information is collected can be found in Facebook's Instagram privacy policy, which can be viewed HERE. If you are an Instagram member and logged into your Instagram user account, Facebook can associate your visit to our site with your user account. If you would like to prevent Facebook from linking data about your visit to our Instagram page with your membership data stored on Instagram, you should - log out of Instagram before each visit to our Instagram page - delete the cookies on your device - and close and restart your browser. However, even after you have taken these steps, Facebook may still recognise you through so-called unique identifiers, such as device IDs and other identifiers, such as those of games, apps or accounts you use or family device IDs (or other identifiers unique to the Facebook companies' products associated with the same device or account). 2. scope of data collection and storage You do not need to be a member of Instagram to view the content on our Instagram Page. However, data is collected, stored and used by Facebook every time you visit our Instagram Page. The moment you visit our Instagram Page, your browser establishes a connection with a Facebook server. In the process, data may be transferred to countries outside the European Union. In any case, regardless of whether you are registered with Instagram or not, your IP address is transmitted and cookies are set. If you are an Instagram member and logged into your Instagram user account, Facebook can assign your visit to our site to your user account. According to Facebook, the cookies used by Instagram are used for authentication, security, website and product integrity, advertising and measurement, website features and services, performance, analytics and research. For more information, please visit the Instagram help section at the following link: https://help.instagram.com/1896641480634370. Unless you have an Instagram account, you can manage interest-based online ads through the European Interactive Digital Advertising Alliance settings and through your mobile device settings. The data collection and storage through the use of the above-mentioned cookies by Facebook can additionally, but also at any time with effect for the future, be objected to via the following opt-out link: http://www.youronlinechoices.com/de/praferenzmanagement/. Under the aforementioned link, you can manage your preferences regarding usage-based online advertising. If you object to usage-based online advertising with a specific provider using the preference manager, this only applies to the specific business data collection via the web browser currently in use. The preference management is cookie-based. Deleting all browser cookies will also remove the preferences you have set using the preference manager. You can also configure your browser before visiting our Instagram Page so that no cookies are stored by Facebook. Information on how to adjust the settings for cookies in your browser can be found in the help section of the browser you are using. We have no influence on whether and which cookies Facebook sets via our Instagram Page and how this data is processed. The processing of your data by us when you contact us or interact with us via our Instagram page is based on our legitimate interest pursuant to Art. 6 (1) sentence 1 lit. f) DSGVO. Our overriding legitimate interest is to contact and communicate with our interested parties and to respond to their specific requests. If your message is directed towards the conclusion of a contract or concerns the implementation of an existing contractual relationship, the legal basis for the processing is also Art. 6 para. 1 sentence 1 lit. b) DSGVO. In the case of contact by potential applicants for the purpose of establishing an employment relationship, the legal basis is Section 26, Paragraph 1, Sentence 1 BDSG. We generally only store data that can be linked to a person for six months. In addition, we store data if and insofar as we are subject to statutory retention obligations. Such obligations may arise, for example, from the German Commercial Code (HGB) or the German Fiscal Code (AO). If you have given us consent for a processing operation, the data related to the granting of consent will be stored until revoked or at the longest for the duration of the processing operation and after its termination within the scope of the statute of limitations. Personal data in the context of application procedures will be deleted after completion of the respective procedure after 6 months at the latest, provided that deletion does not conflict with any other legitimate interests on our part or you have not given us consent for longer storage. There is no legal or contractual obligation to provide us or Facebook with your personal data. Failure to provide it will not have any negative consequences. 3. Instagram Insights For statistical evaluation purposes, we use the Instagram Insights function. In this context, we receive anonymised data in the form of statistics, which Facebook collects via cookies and pixels, among other things, on the visitors to our Instagram page. This does not allow us to draw any conclusions about your person. The following information is provided to us by Facebook with Instagram Insights: - Followers: Number of people who follow us - this also includes development within a maximum period of 30 days. - Demographic data: Average age of visitors, gender, place of residence, language. - Activity data: Times at which most users from the community are active. - Reach: Number of people who see our shared post. Number of interactions with our post. This gives us the opportunity to deduce which content is more interesting to the community than others. - Ad performance: Number of people reached and interacted with a post or paid ad. - Activity on our Instagram page: Number of clicks on our buttons (to plan a route, to email us, to our website). - Views: Number of times our Instagram Page has been viewed. Facebook provides more detailed information on the Insights functions in its Instagram privacy policy (https://instagram.com/about/legal/privacy). In the Instagram help section, you will find instructions explaining which settings need to be made in order to decide in which form targeted advertising is displayed. You can access this by going to the link https://help.instagram.com/, selecting the tab "Manage your account" and then "Instagram ads". Automated decision-making including profiling pursuant to Art. 22 DSGVO does not take place with the data collected via our Instagram page by the Schörghuber Group. 4. Disclosure and use of personal data It cannot be ruled out that data will be transferred to countries outside the European Union (including the USA) and processed there. The USA is currently considered an unsafe third country in terms of data protection law, as the high European level of data protection does not exist there. It is possible that personal data may be subject to access by US authorities for control and monitoring purposes, against which neither effective legal remedies nor data subject rights may be enforceable. Recipient or Categories of recipients Facebook Ireland Limited Facebook Inc. Insofar as you interact within the framework of Instagram, Facebook naturally also has access to your data. In particular, it is possible that Facebook Inc., 1601 Willow Road, Menlo Park, California 94025, USA, has access to your data. Facebook is located in an insecure third country here, where the level of data protection is lower. According to information from Facebook's Instagram privacy policy, standard contractual clauses are used for data transfers from the EEA to the USA and other countries, among other things. In addition, since 31/08/2020, Facebook has made available online a "Facebook EU Data Transfer Addendum", which is intended to incorporate the standard contractual clauses in cases where Facebook Ireland Limited processes data from the EU/EEA as a processor and transfers it to Facebook Inc. as a sub-processor. 5. your rights Provided that the conditions specified in the law are met, you are entitled to the following rights: - Information Art. 15 DSGVO - Correction Art. 16 DSGVO - Deletion Art. 17 DSGVO - Blocking/restriction of processing Art. 18 DSGVO - Objection Art. 21 DSGVO - Data portability Art. 20 DSGVO - Right of appeal to the competent supervisory authority Art. 77 DSGVO - Right of withdrawal with effect for the future if consent has been given Art. 7(3) DSGVO You have the right, pursuant to Art. 21 DSGVO, to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Article 6(1)(e) or (f) DSGVO; this also applies to profiling based on these provisions. If personal data are processed for the purpose of direct marketing, you also have the right to object at any time to the processing of personal data concerning you for the purpose of such marketing; this also applies to profiling insofar as it is related to such direct marketing.   6. contact details of the responsible person and data protection officer Responsible If you transmit personal data to us via our Instagram Page and we alone decide on the purposes and means of the processing, the Schörghuber Stiftung & Co. Holding KG Möhlstraße 10 81675 Munich Telephone +49 89 3074917-0 E-mail kontakt@schoerghuber.group solely responsible for the processing.   Insofar as personal data is processed in connection with our Instagram Page and Facebook alone decides on the purposes and means of the processing, the following is responsible for the processing Facebook Ireland Ltd. 4 Grand Canal Square , Grand Canal Harbour, Dublin 2 Ireland sole controller of the processing. If you have any further questions about data protection when we process your personal data, please contact us. If you have any questions about the collection, processing or use of your personal data, or if you would like to request information, correct, block or delete data, or withdraw your consent, please contact: Schörghuber Stiftung & Co. Holding KG Data Protection Officer Möhlstraße 10 81675 Munich E-mail: datenschutz@schoerghuber.group   7. Further information Further information on the safe use of social networks can be found on the website of the Federal Office for Information Security at https://www.bsi-fuer-buerger.de/BSIFB/DE/DigitaleGesellschaft/SozialeNetze/sozialeNetze_node.html.