Austriacard Holdings AgATHEX: ACAG

Annual General Meeting (AGM 2026 Privacy notice)

· Issued by Austriacard Holdings Ag
PRIVACY NOTICE

for the

ANNUAL GENERAL MEETING

of

AUSTRIACARD HOLDINGS AG

on 22 June 2026

With this privacy notice, we, AUSTRIACARD HOLDINGS AG, would like to inform the participants (shareholders and voting rights representatives) of the annual general meeting of AUSTRIACARD HOLDINGS AG about the processing of personal data in connection with the participation in this annual general meeting and the recording of the annual general meeting.

The data controller for the respective data processing activities is AUSTRIACARD HOLDINGS AG, Lamezanstraße 4-8, 1230 Vienna, Austria.

  1. Which data categories are being processed?

    The following categories of personal data of shareholders are processed in the context of the preparation, execution, and follow-up of the annual general meeting: name, address, date of birth, securities account number, class and number of shares, shareholder's voting card number, participation status, participation and voting actions, as well as questions asked in writing, via email or at the annual general meeting and the corresponding answers. We receive this personal data, which is not publicly available, from the shareholders, their voting rights representatives or the depository credit institutions

    / financial service providers / central securities depositories.

    The following categories of personal data from voting rights representatives are processed in the context of the preparation, execution, and follow-up of the annual general meeting: name, date of birth and proof of authorization. We receive these personal data, which is not publicly available, from the shareholders or the voting rights representatives.

    Personal data (audio and video data) from shareholders and voting rights representatives are processed for the recording of the annual general meeting. The annual general meeting will be broadcast in real time to other rooms (via video with audio track) but will not be stored. Please note that shareholders or voting rights representatives who speak and step to the lectern will be shown in large format during the broadcast. In addition, only an audio recording of the annual general meeting is made by the public notary, which serves to prepare the minutes.

  2. What are the purposes for which personal data is being processed and what is the legal basis?

    The data is processed for the purpose of preparing, conducting, and following up on the annual general meeting, fulfilling legal obligations. The legal basis for this processing is compliance with legal obligations, such as in particular the verification of the right to participate including the right to vote at the annual general meeting (Art 6 para 1 lit c GDPR in conjunction with Sec 102 et seq Austrian Stock Corporation Act (Aktiengesetz)).

    The data processing in connection with the broadcast of the annual general meeting in real time to other rooms is carried out on the legitimate interest of AUSTRIACARD HOLDINGS AG (Art 6 para 1 lit f GDPR) and serves to support the conduct of the annual general meeting by employees of AUSTRIACARD HOLDINGS AG.

    The data processing in connection with the audio recording of the annual general meeting is carried out on the basis of the legitimate interest of AUSTRIACARD HOLDINGS AG and the public notary (Art. 6 para 1 lit f GDPR) and serves to support the public notary in the context of the minutes.

    Furthermore, personal data may in certain cases also be processed for the purposes of pursuing legal proceedings, enforcement of rights, or fraud prevention. The legal basis for these processing activities is the necessity to protect our legitimate interests or the legitimate interests of a third party in the effective pursuit and defence of claims (Art 6 para 1 lit f GDPR).

    There is no automated decision-making, including profiling, involved in these processes.

  3. Who are the recipients of the personal data?

    The personal data will be transferred to the following categories of recipients:

    • External service providers (HV Veranstaltungsservice GmbH (FN 332741 a) for the IT processing of the annual general meeting, public notary, legal advisors);

    • Participants of the annual general meeting (shareholders and voting rights representatives) with regard to the mandatory list of participants (Sec 117 AktG);

    • Public authorities such as, in particular, the competent company register court (Commercial Court of Vienna) or the Financial Market Authority and

    • courts and other authorities in the context of market surveillance and clarification of enforcement of claims in individual cases.

      Personal data will not be transferred to countries outside the EU/EEA.

  4. How long will the personal data be retained?

    The personal data will be retained only for the period necessary to achieve the purposes of processing and for as long as statutory retention obligations exist.

    Our retention obligations arise particularly from company and stock corporation law, from tax and duty law as well as from money laundering regulations. For example, obligations to provide evidence and retention under company and stock corporation law can be up to 7 years, under tax and duty law up to 10 years and under money laundering regulations usually 5 years. The aforementioned periods may also be longer in individual cases, for example if court or administrative proceedings are pending. If legal claims are made by shareholders against AUSTRIACARD HOLDINGS AG, or by AUSTRIACARD HOLDINGS AG, against shareholders, the storage of personal data serves to clarify and enforce claims in individual cases. In connection with court proceedings before civil courts, this may lead to the storage of this data during the period of limitation (up to 30 years according to the Austrian Civil Code (Allgemeines Bürgerliches Gesetzbuch).

    Minutes of the annual general meeting and the associated lists of participants are kept for the duration of the company. This is done to safeguard the legitimate interest of the controller in the traceability of significant events under company law (Art 6 para 1 lit f GDPR).

  5. What rights do data subjects have?

Each data subject affected by the processing of personal data has, subject to the legal requirements, the right to obtain information, rectification, restriction, objection and erasure of their personal data. They also have the right to data portability regarding the personal data concerning them. These rights can be exercised free of charge by contacting us using the following contact details:

AUSTRIACARD HOLDINGS AG

Lamezanstraße 4-8, 1230 Vienna, Austria dataprotection.austria@austriacard.com

Furthermore, data subjects have the right to lodge a complaint with a data protection supervisory authority, in particular at the place of work or residence of the data subject. In Austria, data subjects can contact the Austrian Data Protection Authority (https://www.dsb.gv.at) in particular.

Finally, we would like to point out that no automated decision-making takes place in the context of this data processing.