II. Data processing on our website

In principle, you can visit our website without revealing your identity. If you use certain functions/areas of our website, it may be necessary to provide or collect personal data, depending on the circumstances. In the following, we go into the details of the respective data processing operations

1. Hosting the website/ Logging of website visits

In order to be able to provide our website securely and efficiently, we use the services of the web hosting provider STRATO AG (Otto-Ostrowski-Straße 7, 10249 Berlin; hereinafter “STRATO”), from whose servers the website is accessed. For these purposes, we may use infrastructure and platform services, computing capacity, storage and database services, as well as security and technical maintenance services from STRATO. STRATO provides us with order processing in accordance with Art. 28 GDPR. The servers are located in Germany.

When you visit our website, we or STRATO collect data about every access to the server (so-called server log files). The data collected includes:

• IP address
• date and time of your visit
• The browser you are using, including version
• The operating system you are using, including version
• Which resources (e.g. subpage, contact form) you access on our website (is logged in the form of the so-called URL)

We process these server log files on the basis of our legitimate interest in accordance with Art. 6 para. 1 lit. f GDPR for the following purposes:

• Ensuring the security and stability of the website (e.g. avoiding server overloads due to abusive attacks, so-called DDoS attacks)
• Ensuring a smooth connection to the website
• Ensuring convenient use of the website
• Evaluation of system security and stability
• For further administrative purposes

We reserve the right to check these server log files retrospectively if we become aware of concrete evidence of illegal use. The server log files are deleted immediately when they are no longer required to achieve the purpose, but no later than 90 days after collection.

For the special features of the “Investor Relations” website area, reference is made to Chapter II.4 of this data protection information.

2. Use of cookies, web analysis & tracking

This website uses “cookies” and similar technologies. Cookies are text files that are stored on your device and which, for example, enable the website to be individualized/adapted to your preferences, automatic recognition the next time you visit, that the website functions correctly or an analysis of the use of the website.

The specific use of cookies on our website is determined by your voluntary selection in the cookie banner, which is shown to you in particular when you visit our website for the first time and/or by the appropriate settings in your browser.

Here, we differentiate between three categories of cookies:

1. Essential or necessary cookies

Essential cookies ensure that the website functions correctly. Without these cookies, malfunctions or error messages may occur.

2. Functional cookies

Functional cookies make it easier to visit the website and save settings, for example, so that you do not have to change them every time you visit the site. They also make it possible to use certain functions on our website.

3. Marketing cookies

Marketing cookies allow us to create evaluations of user behavior on our website and to measure the reach of our website. This gives us the opportunity to analyze the performance of the site and to continuously improve it.

2.1. Essential or necessary cookies

If you are in the cookie banner “Only necessary cookies” click or just “essential cookies” select or else do not make any selection, Only necessary cookies are used. This includes the use of cookies from our “Usercentric Consent Management Platform” cookie banner, which save your selection in the cookie banner so that you do not have to be asked to select again each time you visit a new subpage or when you visit the website later (promptly). These cookies are used for “selection or consent management” in accordance with Art. 6 para. 1 lit. c DSGVO to fulfill our data protection reporting and accountability obligations.

2.2. Functional cookies

If you use the cookie banner of “Functional cookies” select, additional cookies are set in addition to the “essential or necessary cookies” mentioned above. Currently, this only includes cookies that are related to Inclusion of YouTube videos available on our website. If you select these cookies, when playing YouTube videos embedded on our website, you will no longer be asked in advance for consent to the necessary data transmission to or data processing by YouTube/Google, including the activation of YouTube cookies. These functional cookies are used on the basis of your informed and voluntary consent in accordance with Art. 6 para. 1 lit. a DSGVO or § 25 para. 1 Telecommunications Telemedia Data Protection Act (TTDSG), that you give us through your express selection in the cookie banner.

Regardless of your selection in the cookie banner, these functional YouTube cookies are activated even if you play an integrated YouTube video on our website and give your consent to this by clicking on “Accept” in the notification window that appears in advance. For more information, see section 5.1.

You can withdraw your consent at any time with effect for the future by changing your cookie setting (via the cookie banner) accordingly or deleting the cookies on your device. You may need to restart your browser for these changes to take effect.

These YouTube cookies have different storage periods and are automatically deleted after 24 months at the latest, unless you have manually deleted them beforehand.

2.3. Marketing cookies/Google Analytics

If you use the cookie banner of “Marketing cookies” select or “Accept everything” click on, in addition to the above-mentioned necessary cookies and functional cookies, other cookies are set in particular to measure the reach of our website and to analyze usage behavior on our website. In particular, the following purposes are hereby pursued:

• Measuring the effectiveness of the website
• Analysis of user interactions with the website
• Optimizing the structure of the website
• Adapting the offer to the needs of users

This selection also includes “Google Analytics”, a web analysis service by Google Ireland Limited (Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland; hereinafter referred to as “Google”). Google uses various cookies/technologies that enable an analysis of your use of the website. The information generated by these cookies/technologies about your use of this website (including your abbreviated IP address) is also sent to servers by Google LLC (Parent company of Google Ireland Ltd: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) in the USA transmitted and processed there. Google will use this information to evaluate your use of the website on our behalf, to compile reports on website activity for us and to provide other services related to website activity and Internet usage. Google may also transfer this information to third parties if this is required by law or if third parties process this data on behalf of Google.

In order to enable the use of Google Analytics, the “Google Tag Manager” activated. With Google Tag Manager, so-called tags can be integrated centrally via a user interface. Google Tag Manager is used to generate so-called script codes from other tools (here Google Analytics) integrated. The Tag Manager makes it possible to control when a specific day is triggered (see also Section II.5.2).

Google stores cookies on your device for a period of up to two years since your last visit. These cookies contain a randomly generated user ID, which can be used to recognize you when you visit a website in the future. The recorded data is stored together with the randomly generated user ID, which makes it possible to evaluate pseudonymous user profiles. This user-related data is automatically deleted after 26 months, provided You do not visit our website again (using marketing cookies). Other (non-personal) data will be stored indefinitely in aggregate form.

The processing of your data by Google is generally carried out here anonymized, because your IP address is automatically abbreviated after collection by Google, making it impossible to identify your person based on this abbreviated IP address. However, it cannot be ruled out that Google may still draw conclusions about you based on further information collected through your use of other Google services (e.g. an Android smartphone, Google Chrome web browser). Detailed details about data processing by Google can be found in the Google Privacy Center at https://policies.google.com/privacy.

The use of these marketing cookies (including Google cookies) is based on your informed and voluntary consent in accordance with Art. 6 para. 1 lit. a DSGVO or § 25 para. 1 TTDSG, which you give us through your express selection in the cookie banner.

Additional note on data transfer to the USA: By selecting “marketing cookies”, you also expressly consent, in accordance with Article 49 (1) (a) GDPR, that your data collected by Google may also be transmitted to Google servers in the USA. The USA was classified by the European Court of Justice (ECJ) as a country with an insufficient level of data protection according to EU standards.

You can withdraw your consent at any time with effect for the future by changing your cookie setting (via the cookie banner) accordingly or deleting the cookies on your device. You may need to restart your browser for these changes to take effect.

You also have the option of fundamentally preventing Google Analytics from processing your data by installing the “Google Analytics Opt-out Browser Add-on”. You can download this add-on from Google on the following page: https://tools.google.com/dlpage/gaoptout?hl=de

2.4. Browser settings to limit cookie usage

You can prevent the use of cookies by setting your browser accordingly. This may mean that you are unable to use all functions on our website to their full extent.

If your browser's “Do-Not-Track” function is activated, we will of course take this into account and no marketing cookies (web analysis/tracking) will be set.

You may need to restart your browser for changes to your cookie selection or setting to take effect.

2.5. Overview of cookies used

You can find more information about the cookies used in the cookie banner, which is shown to you in particular when you visit the website for the first time, or but can be accessed at any time via the “fingerprint button” at the bottom of the website can be.

3. Contacts

When you contact us (e.g. via contact form, e-mail, telephone), the information or data you provide will be processed insofar as this is necessary to process or answer the contact request and any measures requested.

In particular, you can write to us using the contact forms provided in the “Contact” website area. The information marked as mandatory in the respective contact form (e.g. first name, last name, email address) must be provided. In addition, further data can be provided voluntarily. This also includes all data that you provide in the free text field of your message to us.

All messages received via the contact forms are forwarded to the relevant mailbox. Only a limited number of authorized persons within our company have access to these mailboxes. If necessary to process your request, your request may be forwarded to other offices within our company or to other companies in the Speer Group. In exceptional cases, these may also include affiliated companies outside the European Union (EU) or the European Economic Area (EEA). We ensure an appropriate level of data protection at Speer Group affiliated companies outside the EU/EEA in accordance with Art. 44 ff. GDPR. Transfer to persons or companies outside the Speer Group will not take place without your prior express consent.

The Investor Newsletter is also available at Section II.4.3 remanded.

Data processing for the purpose of contacting us takes place based on our legitimate interest in accordance with Article 6 (1) (f) GDPR, to process and respond to your request in an appropriate manner. This legitimate interest also includes any necessary forwarding of your request to affiliated companies of the Speer Group. If you make an enquiry as part of a If you have a contractual or pre-contractual relationship with us, this request will be processed on the basis of Art. 6 para. 1 lit. b GDPR to fulfill our contractual obligations or to answer (pre-) contractual inquiries.

Your contact request (including the submitted data) will usually be deleted 7 days after completion, unless there are any legal retention periods or other legitimate reasons for further storage (e.g. assertion, exercise or defense of legal claims). In the latter cases, your data will be deleted after expiry of the applicable legal retention period (e.g. under commercial or tax law) or after the other legitimate processing grounds cease to apply (the legal basis for continued storage for these legitimate reasons is usually Art. 6 para. 1 lit. f GDPR).

Special note about applications: Applications must only be submitted via our career page. All applications that we receive by other means will be deleted unprocessed.

4 Investment newsletter

4.1 Investment newsletter

In the “For Investors” website area, you also have the option to subscribe to our Dealflow newsletter (newsletter). This requires you to enter your email address in the appropriate field and click on the “Sign in” button. You will then receive a confirmation email to the specified email address to confirm your email address and subscribe to the Dealflow newsletter. The confirmation is made by clicking on the corresponding link in the confirmation email (so-called “double opt-in” procedure).

As part of signing up for and using the Dealflow newsletter, we process your email address exclusively for the purpose of sending emails with references to opportunities on a deal-by-deal basis, which are being pursued by the Speer Group or are being pursued with the participation of Speer Group companies. Your email address will not be passed on to third parties.

This data processing is carried out on the basis of your express double opt-in Consent in accordance with Art. 6 para. 1 lit. a GDPR.

You can unsubscribe from the newsletter at any time and withdraw your consent with effect for the future by unsubscribing at the following link: unsubscribe

Your email address will be automatically deleted after you unsubscribe.

4.2. Contact forms

You can contact us using the contact forms. The information marked as mandatory in the contact form (e.g. first name, last name, email address) must be provided. In addition, further data can be provided voluntarily. This also includes all data that you enter in the free text field of your message.

All messages received via this contact form are received and processed by Speer Group. Only a limited number of authorized persons have access to these messages at a time.

If necessary to process your request, your message/request may be forwarded to other places within our company (Speer Group) or to other companies in the Speer Group. In exceptional cases, these may also include affiliated companies outside the European Union (EU) or the European Economic Area (EEA). We ensure an appropriate level of data protection for the affiliated companies of the Speer Group outside the EU/EEA in accordance with Art. 44 ff. GDPR. Transfer to persons or companies outside the Speer Group will not take place without your prior express consent.

Data processing for the purpose of contacting us is carried out at basis of our legitimate interest in accordance with Art. 6 para. 1 lit. f DSGVO, to process and respond to your request in an appropriate manner. This legitimate interest also includes any necessary forwarding of your request to affiliated companies of the Speer Group. If you make an enquiry as part of a If you have a contractual or pre-contractual relationship with us, this request will be processed on the basis of Art. 6 para. 1 lit. b GDPR to fulfill our contractual obligations or to answer (pre-) contractual inquiries.

Your contact request (including the data provided to us) will be deleted after completion, unless there are any legal retention periods or other legitimate reasons for further storage (e.g. assertion, exercise or defense of legal claims). In the latter cases, your data will be deleted after expiry of the applicable legal retention period (e.g. under commercial or tax law) or after the other legitimate processing grounds cease to apply (the legal basis for continued storage for these legitimate reasons is usually Art. 6 para. 1 lit. f GDPR).

Special note about applications: Applications must be submitted exclusively via our separate application/career portal. All applications that we receive by other means will be deleted unprocessed.

5. Plug-ins and embedded functions and content

5.1. Inclusion of YouTube videos

We integrate functional and content elements from the YouTube video platform on our website to enable selected YouTube videos to be played directly on our website. This includes, among other things, the development of a Connect to YouTube servers and the use of YouTube cookies (see also Section II.2.2) required.

The YouTube service provider (https://www.youtube.com) is Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), whose parent company in turn is Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) with Based in the USA is. The provider's data protection information can be accessed via the following link: https://policies.google.com/privacy

The YouTube videos are in the so-called YouTube's extended privacy mode integrated. This mode ensures that the connection to YouTube is only established when the video is actively played. Before that, there is no connection to and therefore no data transfer to YouTube.

When you click on an embedded YouTube video, you will receive a separate notice window Shows which you are using your express consent in the data transfers and cookie requests required for playback (“ACCEPT” button). If you already The use of functional cookies beforehand in the cookie banner or all Cookies/Features If you have selected, this separate message window will no longer be displayed. A corresponding selection in the notice window or cookie banner will also be made for later Website visits saved. You can find more detailed information on the storage period in cookie banner on YouTube.

When the embedded YouTube video is played, a connection to YouTube is established, which, among other things, also transmits your IP address. In addition, there will also be YouTube cookies on your device , which can also be used to analyze your usage behavior for market research and marketing purposes by YouTube. If you are logged into your YouTube account at the same time, you may enable YouTube to associate your surfing behavior with your personal profile. You can prevent this, among other things, by logging out of your YouTube account. Details of the cookies used can be found in the cookie banner.

By playing the integrated YouTube video (after prior selection in the cookie banner or notification window), you give your express and voluntary consent to this data processing and use of cookies by YouTube in accordance with Art. 6 para. 1 lit. a DSGVO or § 25 para. 1 TTDSG. We have no influence on this data processing by YouTube.

Note on data transfers to the USA: Since YouTube is an offer from the US company Google, the transfer of your data to the USA cannot be ruled out. By playing the integrated YouTube video, you therefore also expressly consent in accordance with Article 49 (1) (a) GDPR that your data collected by YouTube or Google may also be processed by Google in the USA. The USA was classified by the European Court of Justice (ECJ) as a country with an insufficient level of data protection according to EU standards.

5.2. Google Tag Manager

This website also uses Google Tag Manager to enable the use of Google Analytics. However, this is only with your previous express selection in the cookie banner (Consent in accordance with Art. 6 para. 1 lit. a DSGVO or § 25 para. 1 TTDSG) You can find more information about this in Section II.2.3.

So-called website tags can be managed by Google Tag Manager. Google Tag Manager is operated by Google Ireland Limited (Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland). Google Tag Manager only implements tags, but does not collect any personal data itself. Google Tag Manager triggers other tags, which in turn may collect data (here: Google Analytics, see Section II.2.3).

5.3. Event streaming on microsites

You can access so-called microsites on our website via special links, which are communicated, for example, as part of Speer Online events. These microsites are quasi-hidden sub-pages that can only be reached via these separate links. In addition to the information explained in this data protection information, the following applies to these microsites Special features:

On these microsites, you will typically find streams/content that is integrated via a so-called inline frame (iFrame) (hereinafter referred to as “streams” for short). These streams are offered by our service provider Dubidot GmbH (P.O. Box 291, 9650 Nesslau, Switzerland) and operated/hosted on servers in Germany. (Note: According to the European Commission's adequacy decision, Switzerland is a country with an adequate level of data protection.)

When such a stream is called up, data about every access to the server (so-called server log files) is automatically collected by Dubidot. The data collected includes:

• IP address
• date and time of your visit
• Which resources (e.g. subpage, contact form) you access on this website area
• The browser you are using, including version
• The operating system you are using, including version

These server log files are based on our and Dubidot legitimate interest in accordance with Art. 6 para. 1 lit. f DSGVO processed for the following purposes:

• Ensuring the security and stability of the website/streams (e.g. avoiding server overloads due to abusive attacks, so-called DDoS attacks)
• ensuring a smooth connection between the website/streams,
• ensuring convenient use of the website/streams,
• Evaluation of system security and stability

The data will be deleted immediately when they are no longer required to achieve the purpose, but no later than 6 months after collection.

In addition to the general cookies on our website, which are activated in accordance with your selection in the cookie banner (see chapter II.2), other cookies from our service provider Dubidot are used when you visit a microsite. These are exclusively cookies that are necessary for the stream to function properly. These cookies are automatically deleted at the end of the session (i.e. after you close your browser). The mission These necessary cookies are based on our and Dubidot's legitimate interest (ensuring the functionality of the microsite and stream) in accordance with Art. 6 para. 1 lit. f GDPR.

6. Job advertisements and career pages

On our Career pages In addition to a wide range of information about career opportunities in the Speer Group, you will also find an overview of job offers and entry opportunities. There, you have the option, among other things, to apply for individual job offers. By clicking on the application button (“Apply online now! “/“Apply Only Now! “) of the respective job offer, you can access our separate Career and recruitment platform (independent website). For this independent website or platform Does the data protection information listed there apply, which you can also access here.

Applications are only accepted via our careers page!

7. General information on deleting your data

The data processed by us is generally deleted in accordance with legal requirements as soon as it is no longer required to achieve the processing purpose, the processing purpose has been fulfilled or no longer applies, or you withdraw any consent you may have given. We will also delete your data if you request a corresponding deletion in accordance with Article 17 GDPR or — in the case of processing based on legitimate interests under Article 6 (1) (f) GDPR — if you object to this processing in accordance with Article 21 GDPR (further information on your rights can be found in chapter IV of this data protection information).

However, the deletion of your data may be precluded by legal retention periods or other legitimate storage reasons on our part. Data that we are legally obliged to store will be deleted after these retention periods have expired. Data that we continue to store due to conflicting legitimate storage reasons (e.g. to assert, exercise or defend legal claims under Art. 17 para. 3 lit. e DSGVO or Art. 21 para. 1 GDPR) will be deleted after these legitimate storage reasons cease to exist.

Unless the data is deleted because it is necessary for other legally permitted purposes, its processing will be limited to these purposes.

More detailed information on the specific storage or deletion of your data can be found in the individual sections of Chapter II “Data processing on our website.”

8. Links

On our website there are links to Online- or Social media presences the Speer Group (see corresponding icons in the footer/lower section of the website):

Clicking on the respective icon or link takes you to the corresponding external online or social media platform. The data protection information stored there applies to the respective presence. We do not transfer data to the external operators of the platforms by clicking on the respective symbol/link.

The data protection information for our social media presences You can also find them here.