Encavis : data protection agm 2024

Data protection statement for Encavis AG shareholders and shareholder representatives

The following information serves to give you an overview of how we process your personal data, as well as your rights in accordance with data protection law as applicable within the scope of the 2024 Annual General Meeting.

This data protection statement outlines specifically how and what data is collected within the scope of the 2024 Annual General Meeting, why it is collected and to which persons it is communicated or disclosed.

Who is responsible for data processing and who can I contact on this topic?

Responsibility for data processing lies with:

Encavis AG

Große Elbstraße 59

22767 Hamburg, Germany

T: [phone] - 0

F: [phone] - 129

You can contact our data protection officer by email at: [e-mail]

For what purposes and on what legal basis will we process your data?

We process your personal data in compliance with the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), the German Stock Corporation Act (AktG) and all other relevant regulations.

We use your personal data for the purposes provided for in the German Stock Corporation Act. These include, in particular, our communication with you as a shareholder or shareholder representative and the organisation of the Annual General Meeting. Additionally, your data is processed only within the scope of the aforementioned purposes (in particular, the preparation of statistics, such as the presentation of shareholder development or for an overview of the largest shareholders). The legal basis for the processing of your personal data is the German Stock Corporation Act in conjunction with Art. 6(1)(c) and (4) GDPR. Your personal data may also be processed for reasons of compliance with other legal obligations, such as regulatory or securities law regulations, as well as share-based, commercial and tax-based retention obligations. When authorising the proxies appointed by the company for the Annual General Meeting, for example, we must record all data that serves as proof of authorisation in a verifiable manner and store it for 3 years with no third-party access so as to comply with the relevant stock corporation law provisions (Section 134 (3) sentence 5 AktG). The legal basis for the processing in this case is the respective statutory regulations in conjunction with Art. 6(1)(c) GDPR.

In addition to processing data on the basis of legal obligations, we also process personal data to safeguard our legitimate interests pursuant to Art. 6(1)(f) GDPR. We have a legitimate interest in organising the Annual General Meeting, as well as the debriefing after the Annual General Meeting, and in ensuring that it is conducted in an orderly fashion. If third parties are authorised to attend the Annual General Meeting, we will also process the name and address of the authorised repre- sentative.

Compliance with non-European securities regulations also constitute a legitimate interest. This may be the case with capital increases, for example, which might require us to exclude individual shareholders from information on share subscription offers due to their nationality or place of residence

Data protection statement for Encavis AG shareholders and shareholder representatives

1

so as to comply with the corresponding regulations.

We will inform you in advance within the scope of the statutory provisions should we intend to process your personal data for purposes not outlined above.

From where did we receive your data?

We process personal data pertaining to you that we have received from your financial services provider in order to organise the Annual General Meeting.

Which categories of recipients do we forward your data to, and who receives access?

Your data will be processed by those Encavis AG employees responsible for the organisation of the Annual General Meeting.

In addition, we also engage an external service provider in order to organise the Annual General Meeting. Said service provider is obliged to observe data protection law by way of a processing contract in accordance with Art 28 GDPR. The service provider in question is Better Orange IR & HV A, Haidelweg 48, 81241 Munich, Germany.

Furthermore, we transmit your data to recipients outside the company who then process your data under their own responsibility (Art. 4 no. 7 GDPR). Such recipients may include authorities that require this data for the fulfilment of legal reporting obligations (such as when statutory voting rights thresholds are exceeded).

How long do we store your personal data?

We generally anonymise or erase your personal data as soon as it is no longer essential for the above-mentioned purposes, insofar as we are not under any legal obligation to continue storing the data (such as in accordance with the German Stock Corporation Act, the German Commercial Code or the Fiscal Code of Germany). The storage period for data collected within the scope of the Annual General Meeting is up to three years.

In certain cases, we will also store personal data where necessary in connection with claims asserted for or against the company.

Which rights do you have regarding your personal data?

To the extent permitted by applicable law or regulation, your rights include:

• the right to access to your personal data (Art. 15 GDPR),
• the right to the rectification of inaccurate personal data and the right to have incomplete personal data completed (Art. 16 GDPR),
• erasure of personal data, provided no legal basis for its further storage exists (Art. 17 GDPR),
• the right to obtain from the controller restriction of processing (Art. 18 GDPR), in which case your data will continue to be stored but may be processed only under strictly defined condi- tions,
• the right to data portability concerning all data that you have provided to us (Art. 20 GDPR), which will be made available to you in a structured, commonly used and machine-readable format,
• the right to object to data processing (Art. 21 GDPR),
• the right to lodge a complaint with the company and/or the relevant data protection author- ity (Art. 77 GDPR in conjunction with Section 19 BDSG).

Data protection statement for Encavis AG shareholders and shareholder representatives

2

Information on your right to object in accordance with Art. 21 GDPR

You have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data based on Art. 6(1)(f) GDPR (data processing on the basis of abalancing of interests).

If you object, your personal data will no longer be processed unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or theprocessing serves to establish, exercise or defend legal claims.

To exercise this right, please contact us using the contact information listed above.

Data protection statement for Encavis AG shareholders and shareholder representatives

3