I. Name and Address of the Controller

The controller within the meaning of the General Data Protection Regulation and other national data protection laws of the member states as well as other data protection regulations is: Pneuhage Fleet Solution An der Rossweid 23 – 25 D-76229 Karlsruhe Phone: +49 721 6188-0 Fax: +49 721 6188-402 Email: backoffice@pneu.com

II. Name and Address of the Data Protection Officer

The Data Protection Officer of the controller is: Pneuhage Management GmbH & Co. KG Data Protection Officer An der Rossweid 23 – 25 D-76229 Karlsruhe Email: datenschutz@pneu.com Phone: +49 721 6188-0

III. General Information on Data Processing

• 1. Scope of the Processing of Personal Data We generally collect and use personal data of our users only to the extent necessary to provide a functional website as well as our content and services (initiation, commencement, execution, and fulfillment of service operations in the automotive sector for businesses). The collection and use of personal data of our users regularly takes place only after obtaining the user’s consent. An exception applies in cases where obtaining prior consent is not possible for practical reasons and the processing of the data is permitted by legal regulations.
• 2. Legal Basis for the Processing of Personal Data Insofar as we obtain the consent of the data subject for the processing of personal data, Art. 6 (1) lit. a of the EU General Data Protection Regulation (GDPR) serves as the legal basis. In the case of processing personal data that is necessary for the performance of a contract to which the data subject is a party, Art. 6 (1) lit. b GDPR serves as the legal basis. The same applies to processing operations required to carry out pre-contractual measures. Insofar as the processing of personal data is necessary for compliance with a legal obligation to which our company is subject, Art. 6 (1) lit. c GDPR is the legal basis. In the event that vital interests of the data subject or of another natural person make the processing of personal data necessary, Art. 6 (1) lit. d GDPR serves as the legal basis. If processing is necessary to safeguard the legitimate interests of our company or a third party, and if the interests, fundamental rights, and freedoms of the data subject do not override the first-mentioned interest, Art. 6 (1) lit. f GDPR serves as the legal basis for processing.
• 3. Data Deletion and Storage Duration The personal data of the data subject will be deleted or blocked as soon as the purpose of storage ceases to apply. If you submit application data to us voluntarily via our website or in another electronic form, we will delete the data immediately if we do not initiate an application process. If we initiate an application process, or if you submit application documents at our request, we will delete your data no later than four months after the conclusion of the application process, provided that no employment relationship results. Longer retention will only occur if you have expressly given your consent to it. Storage may also take place if required by European or national legislators in EU regulations, laws, or other provisions to which the controller is subject. Blocking or deletion of data will also take place when a storage period prescribed by the above standards expires, unless further storage of the data is required for the conclusion or performance of a contract.
• 4. Categories of Recipients Unless stated otherwise below, the recipient of the personal data processed via our website is generally the controller or the responsible company (see Section I of this privacy policy). Data is transmitted to third parties (service partners) only within the scope of fulfilling service operations. Transmission to third parties takes place in compliance with the GDPR, the Federal Data Protection Act (BDSG-new), and any other applicable data protection regulations, provided this is necessary as part of a contract concluded through our website (contract initiation, execution – including services commissioned that are provided entirely or in part by third parties – or processing, e.g. external service providers). Such a transfer may also occur if required by law, provided the conditions and requirements of such laws are met, and in individual cases after balancing the interests involved. An example of this might be in the course of criminal investigations. A transfer also takes place if a legally effective consent has been issued by you. If you submit your data to apply for a job at our company, your data will be transferred exclusively to the relevant department or departments within our company.

IV. Provision of the Website and Creation of Log Files

1. Description and Scope of Data Processing Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing device. The following data may be collected where necessary (e.g., for error analysis):

• Information about the browser type and version used
• The user’s operating system
• The user’s IP address
• Date and time of access

The data is also stored in the log files of our system. This data is not stored together with other personal data of the user. 2. Legal Basis for Data Processing The legal basis for the temporary storage of data and log files is Art. 6 (1) lit. f GDPR. 3. Purpose of Data Processing Temporary storage of the IP address by the system is necessary to enable the delivery of the website to the user’s computer. For this purpose, the IP address must remain stored for the duration of the session. Storage in log files is carried out to ensure the functionality of the website. In addition, the data helps us to optimize the website and ensure the security of our IT systems. The data is not evaluated for marketing purposes in this context. These purposes also constitute our legitimate interest in data processing pursuant to Art. 6 (1) lit. f GDPR. 4. Duration of Storage Data is deleted as soon as it is no longer necessary for achieving the purpose of its collection. In the case of data collection for providing the website, this is the case when the respective session has ended. In the case of data storage in log files, this happens after no more than 14 days, unless otherwise stated in this Privacy Policy. 5. Possibility for Objection and Removal The collection of data for the provision of the website and the storage of data in log files is essential for the operation of the website. Therefore, there is no option for the user to object.

V. Use of Cookies

When using our website, cookies are set and stored on your device by the service Google Analytics, version Google Analytics 4. Cookies are small text files containing information that is stored on your device and can be accessed by third-party services on the internet. In this way, for example, those who read the cookie can determine whether you have visited a website repeatedly, which websites you have visited in sequence, which links you have clicked, and so on.<br> More details about this and how to prevent Google Analytics 4 from setting cookies can be found in this Privacy Policy under section IX.

VI. Newsletter

1. Description and Scope of Data Processing You can subscribe to our newsletter via our website, through which we send you updates about our company, our products, special offers, and other informative advertisements. The newsletter subscription form can be accessed via a clearly labeled button. For the newsletter, we store your first and last name, your email address, and, where applicable, your product interests as provided in the registration form. 2. Legal Basis for Data Processing The legal basis for the processing of the data is your consent in accordance with Art. 6 (1) lit. a GDPR. An additional legal basis is Art. 6 (1) lit. b GDPR, as the data is required for the formation and performance of the newsletter subscription agreement. 3. Purpose of Data Processing The data is used to deliver the newsletter and to personalize its content. In addition, the submitted data is used for market research purposes, by tracking your interaction with the newsletter regarding our products, offers, and information and storing this together with your subscription data. Such data is also used in anonymous form for general statistical purposes without any personal reference. 4. Duration of Storage The data used for newsletter registration and personalization will be stored for as long as the subscription (newsletter service) is active. When the subscription ends, the data will be deleted. This does not apply to general statistical data derived from the newsletter subscription and interaction, which is anonymized and used solely for statistical analysis without personal reference. 5. Objection and Removal Options You can unsubscribe from the newsletter at any time by revoking your consent to receive it. Such revocation applies to the future only. You may send your revocation by email, post, via the unsubscribe link in any newsletter, or by phone.

VII. Branch Locator

1. Description and Scope of Data Processing Via our website, you can search for and display branches offering our services using a dedicated form (branch locator). In this case, your postal code, if and to the extent that you enter it, as well as the selection of one or more specific branches, will be captured but not stored by us. We do not collect location data. 2. Legal Basis for Data Processing The legal basis for processing the data is your consent pursuant to Art. 6 (1) lit. a GDPR. 3. Purpose of Data Processing The branch locator enables you to conveniently and quickly find our locations where the services displayed on our website are offered. 4. Duration of Storage The data collected via the branch locator is not stored by us. 5. Objection and Removal Options You can prevent the collection of your data by not entering a postal code in the branch locator.

VIII. Communication via Our Website

1. Description and Scope of Data Processing You can contact us with inquiries and information via the phone numbers, email addresses, and contact form provided on our website. The information you provide may be stored under general records or — if you are already a customer — as part of your customer profile, or associated with any provided email address or phone number. Information provided by phone is not recorded but may be noted in brief or in summarized form as a written phone log. The information stored typically includes your first and last name, email address, any content submitted through the message and comments field, your phone number, any provided address details, and an indication of whether you request a callback. 2. Legal Basis for Data Processing The legal basis for processing the data is your consent pursuant to Art. 6 (1) lit. a GDPR. If the data is transmitted in the course of sending an email, using the contact form, or by phone, the legal basis is Art. 6 (1) lit. f GDPR. If the communication is aimed at entering into a contract, an additional legal basis is Art. 6 (1) lit. b GDPR. 3. Purpose of Data Processing The processing of personal data serves to provide you with customized and detailed information about our products — including where applicable in advance of your expressed interest in our services. 4. Duration of Storage The data will be deleted as soon as it is no longer necessary to fulfill the purpose for which it was collected. For personal data entered in free text fields, this is the case once the service request has been completed and further storage is no longer necessary to protect contractual or legal interests. This depends on the content of the additional data you submitted. If the data qualifies as business correspondence, it will be retained for six years; if it is relevant to an annual financial statement, the retention period is ten years; otherwise, typically three years (based on contractual interest). 5. Objection and Removal Options The user may revoke their consent for processing personal data at any time. If the user contacts us by email, telephone, or via the contact form, they may object to the storage of their personal data at any time. In this case, the conversation cannot be continued. All personal data stored in the course of the communication will be deleted, unless retention is required by legal regulations (e.g., the Commercial Code or the Fiscal Code) or justified on the basis of data protection law after careful consideration of all interests involved.

IX. Google Analytics 4 (GA4)

1. Description and scope of data processing We use the analytics tracking tool Google Analytics version 4 (hereinafter GA) on our website. The tool is provided by the US-based company Google Inc., and for this particular service, by Google Ireland LTD, Gordon House, Barrow Street, Dublin 4, Ireland. GA allows us to collect, track, and analyze your browsing behavior across multiple devices and platforms (e.g., websites and apps). For this purpose, a code is embedded in our website that activates GA when you access it, capturing and storing your browsing behavior. As soon as you leave our website, the collected data is transmitted to Google servers. Your data is collected in pseudonymized form by assigning a user number stored in a cookie, which is further associated with our company via an additional ID. This user number can be retrieved on future visits to our or other websites and linked to you as a pseudonymous recurring user. If you use other Google services, such as the Android mobile OS or a Google email account, the data may be directly associated with you, and third-party data may be linked. Google stores the data on various servers worldwide.Google uses the data and additional information or predictions generated through GA’s machine learning functions to create statistical reports, which are then shared with us. These reports inform us about which groups of people are interested in our products, services, and website, how they interact with our site, how they reached it, how they responded to ads (so-called conversions), and what future behavior and preferences might be expected.
2. Legal basis for data processing The legal basis for processing your data is your consent pursuant to Art. 6 para. 1 lit. a GDPR. Another legal basis is our legitimate interest in processing the data, particularly for collecting statistical marketing data to optimize and adapt our services, products, advertising, and website presence, pursuant to Art. 6 para. 1 lit. f GDPR. Google also processes your data in the United States of America. The European Commission has determined by adequacy decision dated July 10, 2023, pursuant to Art. 45 (3) GDPR, that the processing of personal data in the USA offers a level of protection comparable to that of the GDPR within the European Union. (Download adequacy decision: Link)
3. Purpose of data processing By analyzing the statistical data provided by Google Analytics, we can tailor our website and services to your needs and offer content that is most relevant to you. The data also supports the development of our marketing and the optimization of our business processes.
4. Duration of storage Your data is stored by Google for a period of 6 months and deleted afterwards. We do not store any personal data about you beyond this. Aggregated reports that do not contain any personal references and only display general statistical information are stored by us as long as necessary for marketing evaluations.
5. Objection and removal options You can prevent GA from collecting your data by installing and running a tool provided by Google that disables the GA service. You can download and install the tool here. Alternatively, you can set your browser to prevent cookies from being stored on your device. These settings are usually found in the privacy settings of your browser. Since this can vary depending on your browser, please contact your browser provider to learn how to disable cookie storage on your device.

X. Link to LinkedIn

Description and scope of data processing In the footer of our website, you will find an icon displaying the logo of the provider LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland), hereinafter referred to as “provider.” This logo links to the login page of the respective service. By clicking on the link, the homepage of the provider is opened, allowing you to log in and access our company profile on that platform. We do not collect or store any personal data as a result of clicking the link. However, by clicking the link and accessing the external pages, the provider may collect personal data. This falls solely under the responsibility and control of the provider. If you already have an account with this provider, you have already agreed to the type, scope, and purpose of data processing carried out by them. Further information on LinkedIn’s data privacy policy can be found at: https://de.linkedin.com/legal/privacy-policy Legal basis for data processing The legal basis for data processing is the user’s consent in accordance with Art. 6 para. 1 lit. f GDPR. Purpose of data processing By accessing the provider’s homepage via the link on our website, you can quickly and conveniently access our company profile hosted by the provider. Duration of storage We do not store any data when you access LinkedIn through the link on our website. Objection and removal options You can prevent personal data from being transferred to LinkedIn by not clicking on or otherwise using the links provided on our website that lead to the provider’s services.

XI. Rights of the Data Subject

Right to Access If your personal data is being processed, you are considered a data subject under the GDPR and you have the right to obtain confirmation from the controller as to whether or not personal data concerning you is being processed. If such processing exists, you may request access to the following information: (1) the purposes of the processing; (2) the categories of personal data concerned; (3) the recipients or categories of recipients to whom the personal data has been or will be disclosed; (4) the envisaged period of storage, or if not possible, the criteria used to determine that period; (5) the existence of the right to rectification, erasure, restriction of processing, or objection to processing; (6) the right to lodge a complaint with a supervisory authority; (7) information available about the source of the data if not collected from you directly; (8) the existence of automated decision-making, including profiling, and meaningful information about the logic involved and the significance and envisaged consequences of such processing. You also have the right to be informed whether your personal data is transferred to a third country or international organization, and to be informed about appropriate safeguards pursuant to Art. 46 GDPR. Right to Rectification You have the right to obtain from the controller the rectification or completion of inaccurate or incomplete personal data concerning you without undue delay. Right to Restriction of Processing You may request restriction of processing if: (1) you contest the accuracy of the data for a period enabling the controller to verify its accuracy; (2) the processing is unlawful and you oppose erasure and request restriction instead; (3) the controller no longer needs the data, but you require it for legal claims; (4) you object to processing pursuant to Art. 21(1) GDPR and verification of overriding legitimate grounds is pending. Where processing has been restricted, such data shall, except for storage, only be processed with your consent or for the establishment, exercise, or defense of legal claims or for important public interest reasons. You will be informed before the restriction is lifted. Right to Erasure (“Right to be Forgotten”) a) Obligation to delete You have the right to request the immediate deletion of personal data concerning you, and the controller is obliged to erase it without undue delay if: (1) the data is no longer necessary for the purposes it was collected; (2) you withdraw your consent and there is no other legal basis; (3) you object pursuant to Art. 21(1) or (2) GDPR and there are no overriding legitimate grounds; (4) the data was unlawfully processed; (5) the data must be erased to comply with a legal obligation; (6) the data was collected in relation to information society services as per Art. 8(1) GDPR. b) Notification to third parties If the controller has made the personal data public and is obliged to erase it, they shall take reasonable steps to inform other controllers that you have requested deletion of any links or copies. c) Exceptions The right to erasure does not apply where processing is necessary: (1) for exercising the right of freedom of expression and information; (2) for compliance with a legal obligation or public interest tasks; (3) for public health purposes; (4) for archiving, research, or statistical purposes where erasure seriously impairs these goals; (5) for legal claims. Right to Notification If you have exercised your right to rectification, erasure, or restriction of processing, the controller must notify all recipients to whom the data was disclosed, unless impossible or involving disproportionate effort. You have the right to be informed about these recipients. Right to Data Portability You have the right to receive personal data concerning you, which you have provided to a controller, in a structured, commonly used, machine-readable format. You also have the right to transmit that data to another controller without hindrance where: (1) processing is based on consent or contract under Art. 6(1)(a) or (b) GDPR; and (2) processing is carried out by automated means. You also have the right to have the data transmitted directly from one controller to another where technically feasible, provided it does not adversely affect others’ rights and freedoms. This right does not apply to processing for public interest tasks. Right to Object You have the right to object at any time, on grounds relating to your particular situation, to processing of your personal data based on Art. 6(1)(e) or (f) GDPR, including profiling. The controller shall no longer process the data unless they demonstrate compelling legitimate grounds overriding your interests, rights, and freedoms, or for legal claims. Where your data is processed for direct marketing, you have the right to object at any time to such processing, including profiling related to direct marketing. If you object, your data will no longer be used for this purpose. You may exercise your objection using automated means using technical specifications, regardless of Directive 2002/58/EC. Right to Withdraw Consent You have the right to withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal. Automated Individual Decision-Making, Including Profiling You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects you. This does not apply if the decision: (1) is necessary for entering into or performing a contract; (2) is authorized by Union or Member State law with safeguards; (3) is based on your explicit consent. Such decisions may not be based on special categories of data unless suitable safeguards are in place. The controller must implement measures to safeguard your rights and freedoms, including the right to human intervention, to express your point of view, and to contest the decision. Right to Lodge a Complaint with a Supervisory Authority You have the right to lodge a complaint with a supervisory authority, in particular in your habitual residence, place of work, or place of alleged infringement, if you believe the processing of your personal data violates the GDPR. The authority will inform you of the status and outcome of the complaint, including judicial remedy under Art. 78 GDPR.