Privacy notice for our website ("Privacy Notice")

Scope, Data Subject and controller

This Privacy Notice exclusively applies to the collection and processing of Personal Data of users of the Website with the domain hydac.com or affiliated Websites of HYDAC International GmbH.

The responsible data controller for any Personal Data collected and processed in connection with the use of the Website is HYDAC. Should another controller process Personal Data about how you use this Website, you will be provided with a separate privacy notice.

How to contact Us and Our Data Protection Officer

You can contact Us via mail at HYDAC International GmbH, Industriestraße, 66280 Sulzbach/Saar, Germany, or at the following email address: info@hydac.com.

You can contact Our data protection officer via mail at the following address: HYDAC Verwaltung GmbH, Data Protection Department, Industriestraße, 66280 Sulzbach/Saar, Germany or at the following e-mail address: privacy@hydac.com.

For details, please refer to 2.7.

Categories of Personal Data, purposes of processing and legal bases

Appendix 1 "Personal Data" to this Privacy Notice contains detailed information on (i) the categories of Personal Data We collect from you; (ii) the purposes for which We process these Personal Data; and (iii) the legal bases for the collection and processing of your Personal Data. If processing for another purpose takes place, We will provide you with additional information.

For details, please refer to 2.1.

Recipients and categories of recipients of the Personal Data

We share your Personal Data with other entities of the HYDAC Group. We use internal and third-party service providers to provide services and products on Our behalf and We will share your Personal Data with them for the provision of the services and products. Within HYDAC and such recipients any access to your Personal Data in relation to your use of the Website is restricted to those individuals who have a 'need to know' in order to fulfill their job responsibilities.

We share your Personal Data with governmental authorities, courts, external advisors.

For details, please refer to 2.2.

Data transfers outside the European Economic Area ("EEA")

Personal Data of Data Subjects residing in the EEA may be transferred to recipients of the Personal Data located outside the EEA (e.g., USA). By way of entering into appropriate data transfer agreements or by other adequate means, We have established that all such recipients located outside the EEA will provide an adequate level of protection for the Personal Data and that appropriate technical and organizational security measures are in place to protect Personal Data. Any onward transfer is subject to appropriate onward transfer requirements as required by applicable law.

For details, please refer to 2.3.

Scope and duration of storage

Your Personal Data are stored by HYDAC and/or Our service providers, strictly to the extent necessary for the performance of Our obligations to you respectively the performance of the service providers' obligations to Us and strictly for the time necessary to achieve the purposes for which the Personal Data are processed, in accordance with applicable data protection laws. When HYDAC and/or Our service providers no longer need to process your Personal Data, the Personal Data will be erased from the systems and/or records and/or steps will be taken to properly anonymize the Personal Data so that you can no longer be identified from the Personal Data unless We and/or Our service providers need to keep your information

• to comply with legal or regulatory obligations to which HYDAC and/or Our service providers are subject; and/or
• with regard to a judicial action; and/or
• are otherwise authorized to retain Personal Data.

Your rights

Under the conditions set out under applicable data protection law (e.g., the GDPR), you may have the following rights: (i) the right of access; (ii) the right to obtain a copy of your Personal Data undergoing processing; (iii) the right to rectification; (iv) the right to erasure ("right to be forgotten"); (v) the right to restriction of processing; (vi) the right to data portability; (vii) the right to object; (viii) the right to lodge a complaint with the competent data protection supervisory authority. If you have given your consent to the processing of Personal Data, you may withdraw such consent at any time. Such withdrawal will not affect the lawfulness of the processing that took place prior to the withdrawal of consent.

For details, please refer to 2.5.

Use of cookies and similar technologies on the Website

We use cookies and similar technologies on Our Website. You can find detailed information about this in Our Cookie Notice.

Personal Data required for the conclusion or fulfillment of the contract

You only have to provide the Personal Data that are marked as mandatory in the respective forms on Our Website. Without this Personal Data, the envisaged contract cannot be concluded or an existing contract can no longer be performed and may have to be terminated.

Personal Data that are not marked as mandatory in the corresponding forms on Our Website do not have to be provided.

For details, please refer to 2.6.

Changes to this Privacy Notice

This Privacy Notice may require an update from time to time. We reserve the right to change or supplement this Privacy Notice at any time.

For details, please refer to 2.8.

Categories of Personal Data, purposes of processing and legal bases

In Appendix 1 "Personal Data" to this Privacy Notice, you will find detailed information on:

• the categories of Personal Data We collect from you in addition to other Personal Data that you actively provide to Us (e.g., when you send an email to Us);
• the purposes for which We process those categories of Personal Data; and
• the legal bases for the collection and processing of your Personal Data

We also use cookies and similar technologies on Our Website. You can find detailed information on this in Our Cookie Policy.

Please note that We process your Personal Data for other purposes only if:

• We are obligated to do so on the basis of legal requirements (e.g., transfer to courts or criminal prosecution authorities);
• if you have consented to the respective processing; or
• if the processing is otherwise lawful under applicable law.

If processing for another purpose takes place, We will provide you with additional information.

Recipients and categories of recipients of the Personal Data

HYDAC transfers your Personal Data for the respective purposes and limited to the extent necessary to the recipients and categories of recipients listed below:

Within the HYDAC group

We share your personal information with other HYDAC Group companies for the following purposes:

• For the implementation of marketing measures. Such data transfers are based on Art. 6 (1)(a) or (f) GDPR.
• For the (pre-)contractual performance and fulfillment of your request to the establishment responsible for you on the basis of Art. 6 (1)(f) GDPR

(A list of these other HYDAC Group companies can be found here: https://www.hydac.com/en/locations.  )

Service providers (internal and external)

We use both external and internal service providers to provide services and products on Our behalf and share your Personal Data with them for this purpose. Our service providers are contractually obliged to process this Personal Data on HYDAC’s behalf under appropriate instructions to the extent necessary for the relevant processing purposes set out in Appendix 1, “Personal Data,” and to appropriately protect your Personal Data. Our service providers may not otherwise process or share your Personal Data except as permitted by law.

We share your Personal Data with the service providers listed in Appendix 2 "Service providers" to this Privacy Notice.

Governmental authorities, courts, outside counsel and similar third parties

to the extent required or permitted by applicable law in order to:

• ensure compliance with applicable laws;
• respond to governmental inquiries or requests;
• comply with applicable legal obligations;
• protect the rights, privacy, safety or property of HYDAC, website visitors, guests, employees or the public;
• enable Us to pursue potential legal remedies or prevent or limit potential bad debts or damage that We may suffer;
• enforce the Terms of Use of Our Websites https://netiquette.hydac.com/en.html; and
• respond to an emergency. Such data transfers are based on Art. 6 (1)(a), (c) or (f) GDPR.
• Within HYDAC and its service providers, access to your personal information in connection with your use of the Website is limited to those individuals who have a compelling need to know that information in order to perform their professional tasks.

Personal Data of Data Subjects residing in the EEA may be transferred to recipients of the Personal Data located outside the EEA (e.g., USA); data protection laws there may provide a different level of protection than the laws in your jurisdiction. We will take necessary measures under applicable data protection law to ensure that transfers from the EEA are adequately protected.

By way of entering into appropriate safeguards based on the Standard Contractual Clauses (2021/914/EU) as referred to in Art. 46 (2)(c) GDPR, or by other adequate means, which are accessible upon request under the contact details provided in Section 2.7 below, We have established that all recipients located outside the EEA will provide an adequate level of protection for the Personal Data and that appropriate technical and organizational security measures are in place to protect Personal Data against accidental or unlawful destruction, accidental loss or alteration, unauthorized disclosure or access, and against all other unlawful forms of processing. Any onward transfer (including to Our affiliates outside the EEA) is subject to appropriate onward transfer requirements as required by applicable law.

Scope and duration of storage

Your Personal Data are stored by HYDAC and/or Our service providers, strictly to the extent necessary for the performance of Our obligations to you respectively the performance of the service providers' obligations to Us and strictly for the time necessary to achieve the purposes for which the Personal Data are processed, in accordance with applicable data protection laws.

When HYDAC and/or Our service providers no longer need to process your Personal Data, the Personal Data will be erased from the systems and/or records and/or steps will be taken to properly anonymize the Personal Data so that you can no longer be identified from the Personal Data. However, We and/or Our service providers need to keep your information to comply with legal or regulatory obligations to which HYDAC and/or Our service providers are subject. Further, if a judicial action is initiated, the Personal Data will be stored until the end of such action, including any potential periods for appeal.

Insofar as a more detailed description is possible, you will find detailed information in Appendix 1 "Personal Data" to this Privacy Notice.

Your statutory rights

If you have declared your consent to any Personal Data processing activities, you can withdraw this consent at any time with future effect. Such a withdrawal will not affect the lawfulness of the processing prior to the consent withdrawal.

In accordance with applicable data protection laws (such as the GDPR), you may have the following rights which you may exercise by contacting Us as stated in in Section 2.7:

Right of access: You have the right to obtain confirmation from Us as to whether or not Personal Data concerning you is processed, and, where that is the case, to request access to the Personal Data. The access information includes – inter alia – the purposes of the processing, the categories of Personal Data concerned, and the recipients or categories of recipients to whom the Personal Data have been, or will be disclosed. However, this is not an absolute right and the interests of other individuals may restrict your right of access. You also have the right to obtain a copy of the Personal Data undergoing processing. For further copies requested by you, We may charge a reasonable fee based on administrative costs.

Right to rectification: You have the right to obtain rectification of inaccurate Personal Data concerning you from Us. Depending on the purposes of the processing, you have the right to have incomplete Personal Data completed, including by means of providing a supplementary statement.

Right to erasure ("right to be forgotten"): Under certain circumstances, you have the right to obtain the erasure of Personal Data concerning you from Us and We may be obliged to erase such Personal Data.

Right to restriction of processing: Under certain circumstances, you have the right to obtain the restriction of processing your Personal Data from Us. In this case, the respective data will be marked and may only be processed by Us for certain purposes.

Right to data portability:

Under certain circumstances, you have the right to receive the Personal Data concerning you, which you have provided to Us, in a structured, commonly used and machine-readable format, and you have the right to transmit those data to another entity without hindrance from Us.

Right to object: You have the right to object, on grounds relating to your particular situation, at any time to the processing of your Personal Data by Us and We can be required to no longer process your Personal Data. If you have a right to object and you exercise this right, your Personal Data will no longer be processed for such purposes by Us. Exercising this right will not incur any costs.

Such a right to object may not exist, in particular, if the processing of your Personal Data is necessary to take steps prior to entering into a contract or to perform a contract already concluded.

Right to file a complaint: In addition to the rights set out above, you also have the right to lodge a complaint with the competent data protection supervisory authority.

Unabhängiges Datenschutzzentrum Saarland

Landesbeauftragte für Datenschutz und Informationsfreiheit

Monika Grethel

Fritz-Dobisch-Straße 12

66111 Saarbrücken

Phone: 0681 94781-0

E-Mail: poststelle@datenschutz.saarland.de

Homepage: https://www.datenschutz.saarland.de

Personal Data required to enter into or perform the contract

You are only required to provide Personal Data that We need to establish and maintain a business relationship with you or that We are required to collect by law. Such Personal Data are marked as mandatory in the respective forms on Our Website. Without such Personal Data, We will not be able to enter into the requested contract or - should you remove such Personal Data at a later point in time - We will no longer be able to perform an existing contract and may have to terminate it.

Personal Data that are not marked as mandatory in the corresponding forms on Our Website do not have to be provided.

In the following cases, We can provide Our service and/or conclude a contract only if you provide Us with the relevant data records:

• Purchase/service orders: Company data (address, contact details, registration number or similar), contact person (salutation, surname, first name, telephone and extension, e-mail address, position, department, location);
• Newsletter subscriptions: Last name, first name; salutation; company data; company address; personal contact information (email address, phone number); country/region; language; consent status (opt-in for marketing); interests (industries, trends and topics).

For additional information regarding Our newsletter and purchase/service orders, please see Appendix 1 "Personal Data" to this Privacy Notice.

The controller within the meaning of Art. 4 No. 7 GDPR is:

HYDAC International GmbH

Industriestraße

66280 Sulzbach/Saar

Germany

Phone: +49 (0) 68 97 509-01

Mail: info(at)hydac.com

Website: https://www.hydac.com

Contact details of the data protection officer

We have appointed a joint data protection officer for our companies.

This person can be contacted at:

HYDAC Verwaltung GmbH

Data protection department

Industriestraße

66280 Sulzbach/Saar

Germany

Phone: +49 (0) 68 97 / 509 01

Mail: dataprivacy(at)hydac.com

So that you can reach us easily and also communicate with us in your national language, you will find the contact details of the data protection coordinators of the countries and companies below.

This privacy policy may be subject to change - e.g. due to the implementation of new technologies or the introduction of new services or functions. We reserve the right to amend or supplement this privacy policy at any time. We will publish the changes on https://www.hydac.com/privacy-policy.

Personal Data

We process the following personal data in connection with your use of the website, as follows:

Service Provider

Depending on the purpose of the processing for which we use the respective service provider, we share certain personal data (where necessary) with the following service providers:

1. maxcluster GmbH, Technologiepark 8, 33100 Paderborn, E-Mail: info (at) maxcluster.de als Hosting Provider.
2. KERN GmbH, In der Kölling 7, 66450 Bexbach as part of the dispatch of postal mailings
3. GuestOne GmbH, Hofaue 3942103 Wuppertal for guest management at events
4. LegalTegrity GmbH, Platz der Einheit 2, 60327 Frankfurt as the operator of the whistleblower system

Processing for video surveillance

We process the following personal data in connection with the monitoring of our work areas, properties or buildings, if marked accordingly on site