Business
Knorr Bremse : Information of Data-Security (AGM 2026 Information of Data Security)
Knorr Bremse : Information of Data-Security (AGM 2026 Information of Data
About this update from Knorr-bremse Ag
2026 Annual General Meeting of Knorr-Bremse AG Informationen on Data Protection for Shareholders Compliance with the provisions of data protection law is very important to Knorr-Bremse Aktiengesellschaft. In the following, Knorr Bremse Aktiengesellschaft would like to inform its shareholders and, as applicable, shareholder representatives as well as other participants attending the Annual General Meeting about the processing of their personal data and about their rights under data protection law. The Controller The Controller of the processing of personal data is Knorr-Bremse Aktiengesellschaft. Knorr-Bremse Aktiengesellschaft can be reached using the following contact information: Knorr-Bremse Aktiengesellschaft Moosacher Str. 80 80809 Munich, Germany +49 89 3547 182121 [email protected] The data protection officer of Knorr-Bremse Aktiengesellschaft can be reached at: Knorr-Bremse Aktiengesellschaft Data Protection Officer (Datenschutzbeauftragte) Moosacher Str. 80 80809 Munich, Germany [email protected] Purposes and legal bases of the processing Knorr-Bremse Aktiengesellschaft processes the personal data of its shareholders and, as applicable, of shareholder representatives and other participants attending the Annual General Meeting in full compliance with the provisions of the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (Bundesdatenschutzgesetz), the German Stock Corporation Act (Aktiengesetz, "AktG") and all other applicable laws and regulations. To the extent that personal data is processed on the basis of the company's legitimate interests, there is no statutory or contractual obligation that the personal data must be provided. Knorr-Bremse Aktiengesellschaft generally receives the shareholders' and, as applicable, shareholder representa-tives' personal data via the registration office of the credit institution that the shareholders or, as applicable, the shareholder representatives have entrusted with the safekeeping of the bearer shares. In some cases, Knorr-Bremse Aktiengesellschaft may receive personal data directly from the shareholders or, where applicable, shareholder representatives. Knorr-Bremse Aktiengesellschaft uses the personal data (e.g., last name and first name, address, email address, number and class of shares, type of ownership of shares, absentee votes/instructions, admission ticket number, number of the voting right card and registration information for the online service for participation in the virtual Annual General Meeting) as well as, where applicable, further personal data of its shareholders or, where applicable, shareholder representatives for the purposes provided for in the AktG, particularly for communicating with the shareholders and, where applicable, shareholder representatives and for organizing and holding the Annual General Meeting of Knorr-Bremse Aktiengesellschaft. In the password-protected online service of Knorr-Bremse Aktiengesellschaft, as a rule, the sharehold-ers' and, as applicable, shareholder representatives' personal data is used for the purpose for which the shareholders and, as applicable, shareholder representatives have made the data available to Knorr-Bremse Aktiengesellschaft, for instance, in order to allow the shareholders and, as applicable, shareholder representatives access to the General Meeting services, including the possibility of attending a General Meeting by electronic means; for the documentation of votes; for the documentation of the representation by a shareholder representative on the basis of a power of attorney as well as any instructions issued; for any revocation of powers of attorney; for the casting of votes by absentee voting (where this is offered); for lodging objections in the case of virtual General Meetings; and for communication in the event of contact and service requests in connection with a General Meeting or in order to provide the shareholders and, as applicable, shareholder representatives with access to specific information. The legal basis for the processing of the shareholders' and, as applicable, the shareholder representatives' personal data in this respect is point (c) of Art. 6 (1) sentence 1 GDPR in conjunction with Secs. 67e, 118 et seqq. and 130a AktG. If the personal data is not provided, it is not possible to participate in the Annual General Meeting. In addition, to the extent it is conducive to the organization of the virtual Annual General Meeting, personal data may be processed on the basis of the legitimate interests of Knorr-Bremse Aktiengesellschaft (point (f) of Art. 6(1) sentence 1 GDPR). This relates to, inter alia, the processing of contact information of guests attending the Annual General Meeting and the production of visual and audio recordings in the context of the Annual General Meeting. These visual recordings may show shareholders, shareholder representatives and other participants of the Annual General Meeting who are attending virtually. The recordings will be stored, processed and possibly published for the purpose of documenting the event and as part of the public relations work of Knorr-Bremse Aktiengesellschaft. Knorr-Bremse Aktiengesellschaft would like to point out that information available on the internet can be accessed worldwide, be found using search engines and be linked to further information, all of which makes it possible to create personality profiles. Information posted on the internet, including photographs, can easily be copied and shared, and there are archiving services specializing in permanently documenting the status of certain websites at certain points in time. Thus, information disclosed on the internet may still be found online even after it has been erased from the original website. Additionally, when you visit the online service, data is processed automatically that is technically necessary in order to display to you our website. This data includes, for example, your IP address, the type of device, the type of browser, the date, and the time of each visit request. Our legitimate interest is in ensuring the proper functioning and security of our website. In addition, the storage of cookies on the relevant end device is necessary for the operation of the online service. In addition, we use technical security cookies provided by Akamai Technologies GmbH, which help to ensure the security and stability of the shareholder portal. These cookies detect and prevent potentially harmful activities, such as attacks by bots, thereby contributing to the integrity of the portal. The legal basis for this data processing is Sec. 25 (2) no. 2 of the German Telecommunication-Digital-Services-Data-Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz). These cookies are necessary for technical reasons in order to ensure the functionality of the website. The data collected via cookies for using the online service will not be combined to create customer or profile data. Finally, Knorr-Bremse Aktiengesellschaft processes the personal data of shareholders and, as applicable, shareholder representatives, where necessary, to comply with other legal obligations, e.g., regulatory requirements and record retention requirements under stock corporation, commercial and tax laws. In the context of the authorization of the company-nominated proxies for the Annual General Meeting, for example, Knorr-Bremse Aktiengesellschaft is obligated under the provisions of the German Stock Corporation Act to keep a verifiable record of the data provided as proof of the authorization. In this case, the respective legal provisions in conjunction with point (c) of Art. 6(1) sentence 1 GDPR form the legal basis for the processing of personal data. In the event that Knorr-Bremse Aktiengesellschaft intends to process the shareholders' and, as applicable, shareholder representatives' personal data for a purpose that has not been previously mentioned, Knorr-Bremse Aktiengesellschaft will inform the shareholders and, as applicable, the shareholder representatives in advance in accordance with and subject to applicable statutory provisions. Recipients of the shareholders' and shareholder representatives' data For the purpose of organizing the virtual Annual General Meeting (e.g., for conducting the Annual General Meeting), Knorr-Bremse Aktiengesellschaft employs, to an extent, third-party service providers as well as group-affiliated companies, which receive access to shareholders' and, as applicable, shareholder representatives' or other participants' of the Annual General Meeting personal data to the extent necessary in order to complete the tasks assigned to them. In the context of this commissioned data processing, Knorr-Bremse Aktiengesellschaft's service providers are carefully selected and are obligated pursuant to Art. 28 GDPR to observe Knorr-Bremse Aktiengesellschaft's data protection standards. The service providers commissioned by Knorr-Bremse Aktiengesellschaft and the group-affiliated companies process the shareholders' and shareholder representatives' personal data exclusively as instructed by Knorr-Bremse Aktiengesellschaft and only to the extent this is necessary for the performance of the services commissioned. All employees of Knorr-Bremse Aktiengesellschaft and the group of companies as well as the staff of commissioned service providers who have access to and/or process the shareholders' and, as applicable, shareholder representatives' personal data have committed to treating the data confidentially. Furthermore, personal data of shareholders and, as applicable, shareholder representatives exercising their voting rights, in particular their names, will be made available to other shareholders and shareholder representatives subject to the statutory requirements (in particular as regards the list of participants pursuant to Sec. 129 AktG). This, for example, also applies to comments (Sec. 130a (3) AktG) as well as to questions asked at the meeting by shareholders and, as applicable, shareholder representatives who are attending the meeting by electronic means in the context of exercising their right to speak by way of video communication (Sec. 130a (5) AktG). Personal data of shareholders and, as applicable, shareholder representatives will also be published or made available to other shareholders and shareholder representatives, as well as intermediaries and shareholders' associations, under certain conditions and subject to the statutory requirements in the event of requests for additions to the agenda, counter-motions, election proposals or lodged objections. Furthermore, to the extent necessary for the proper holding of the Annual General Meeting or for the purposes of its legitimate interests, the company will, where applicable, transmit personal data to notaries and lawyers retained by it who are under a duty of professional secrecy. The legal basis in these cases is point (c) of Art. 6(1) sentence 1 GDPR in conjunction with the statutory provision from which the publication requirement is derived, or, to the extent that there is no legal obligation to publish the name, point (f) of Art. 6(1) sentence 1 GDPR. Knorr-Bremse Aktiengesellschaft may provide visual and audio recordings taken at its Annual General Meeting to press representatives, who may process these recordings for journalistic purposes. Additionally, other persons following the public broadcast of the Annual General Meeting may be recipients of personal data if that personal data is disclosed during the Annual General Meeting. The legal basis for the data processing is point (f) of Art. 6(1) sentence 1 GDPR (legitimate interests of the company). Furthermore, Knorr-Bremse Aktiengesellschaft may be obligated by law to transmit the personal data of shareholders and, as applicable, shareholder representatives to further recipients such as, for instance, government authorities, in order to comply with statutory reporting obligations. The legal basis is point (c) of Art. 6(1) sentence 1 GDPR in conjunction with the statutory provision from which the requirement is derived. Transfer of data to third countries In the event that Knorr-Bremse Aktiengesellschaft transfers personal data to service providers located outside the European Economic Area (EEA), the transfer will only take place to the extent that the EU Commission has confirmed that the third country offers an adequate level of data protection or that other adequate data protection safeguards are in place (e.g., binding internal rules at the relevant company on data protection or the EU Commission's standard contractual clauses and, to the extent required, data transfer impact assessments). Detailed information in this regard as well as on the level of data protection offered by service providers located in third countries may be requested using the contact information indicated above. Storage period As a rule, Knorr-Bremse Aktiengesellschaft erases or anonymizes the personal data of shareholders and, as applicable, shareholder representatives in compliance with the applicable statutory provisions as soon as and to the extent that the statutory record retention periods have expired, the personal data is no longer required for the aforementioned purposes, the personal data is no longer required for any administrative or court proceedings, no other statutory obligations to furnish evidence or record retention requirements (e.g., under the German Stock Corporation Act, the German Commercial Code (Handelsgesetz-buch) or the German Tax Code (Abgabenordnung)) apply and there are no other reasons justifying the retention. Rights of the data subjects Subject to the statutory requirements, the fulfillment of which must be verified on a case-by-case basis, shareholders and, as applicable, shareholder representatives and other persons whose personal data is processed by the company have the right to receive information about their processed personal data (Art. 15 GDPR) and to request the rectification (Art. 16 GDPR) or erasure (Art. 17 GDPR) of their personal data or the restriction of the processing thereof (Art. 18 GDPR). Furthermore, shareholders and, as applicable, shareholder representatives and other subjected persons may also contact the competent supervisory authority and receive their personal data in a structured, commonly used and machine-readable format (data portability) (Art. 20 GDPR). Right to object (Art. 21 GDPR): Where Knorr-Bremse Aktiengesellschaft processes the data of the shareholders and, as applicable, shareholder representatives or of other subjected persons for the purposes of the legitimate interests of Knorr-Bremse Aktiengesellschaft (point (f) of Art. 6(1) sentence 1 GDPR), they may object to the processing. Knorr-Bremse Aktiengesellschaft will then check whether there are any grounds relating to the particular situation that conflict with such data processing. 3 To assert your rights or for any other questions regarding data protection, please contact the Knorr-Bremse data protection organization at [email protected] . Knorr-Bremse AG Moosacher Str. 80 80809 Munich Germany Tel: +49 89 3547-0 Fax: +49 89 3547-2767 www.knorr-bremse.com