Data Protection Notice for the investor relations information service

Thank you for your interest in our Group.

In the following Data Protection Notice, Klöckner & Co SE (also referred to in the following as “Klöckner”, “we”, “us” or “our”) provides you with various information about the processing of your personal data in the use of our investor relations information service. Personal data is all information relating to an identified or identifiable natural person (such as your first name and last name, your mailing address, your phone number or your e-mail address).

In the following, we would like to inform you in particular about which personal data we process, for what purpose in each case as well as your rights in this regard.

The controller for the purposes of data protection law is:

Klöckner & Co SE
Am Silberpalais 1
D-47057 Duisburg
Phone: +49 (0)203-307-0
E-mail: info@kloeckner.com

You can contact our Data Protection Officer using the following contact details:

Klöckner & Co SE Data Protection Officer
Am Silberpalais 1
D-47057 Duisburg
E-mail: datenschutzbeauftragter@kloeckner.com

a) Data categories affected:
When you use our investor relations information service, we process the following:

• Your contact information (such as your given name, surname, position, phone number, e-mail address, postal address and country of origin);
• If applicable, details of your company (such as name, sector, etc.);
• If applicable, information on your position in the company;
• If applicable, information on your or your company’s investment class and shareholding;
• History of information sent to you;
• Information on participation in joint meetings;
• Information on your professional background.

b) Purposes of processing, legal basis and any legitimate interests:
We process this data for the purpose of sending press releases and ad-hoc announcements, company news, invitations to analyst and investor conferences as well as other capital market-related events (such as our Capital Markets Day), and making related phone calls, on the basis of Article 6(1)(f) of the GDPR. In doing so, we pursue the interest of providing you with information on capital market-related situations with regard to Klöckner.

c) Duration of data storage:
We erase the data when you unsubscribe from our information service and object to the use of your data unless we need it for a longer period due to legal requirements. In the latter instance, we erase the data as soon as the purpose no longer applies.

d) Data source:
We collect the data from you directly, such as through receiving a business card from you, or obtain it from the provider Ipreo LLC’s BD Corporate database.

Internal recipients: Access to your personal data is restricted to the extent needed and to those persons at Klöckner who require such access in order to fulfill the purposes mentioned above.

External recipients: We pass on your personal data to external recipients outside of Klöckner only if it is necessary to do so for service provision, it is allowed by law or you have given us your consent to do so.

External recipients may be the following:

a) Processors
Klöckner Group companies or external service providers that we use for the provision of services, such as in connection with technical infrastructure and maintenance.

b) Public bodies
Public authorities and government institutions, such as prosecutors, courts or tax authorities to which we are under a binding obligation to disclose personal data by law.

c) Private entities and individuals
Distributors, independent branches, cooperation partners or helpers in cases where this is necessary for performance of contract, you have consented or this is allowed by law.
We also transfer personal data that we process in connection with the procedures described above to a processor who processes it in the USA. The European Commission has not issued an adequacy decision for the USA. For this recipient, we therefore ensure the adequate protection of your personal data by providing “appropriate safeguards” (Article 46 of the GDPR) through the use of standard contract clauses. You can request a copy of the safeguards from us (see heading I for contact details).

Your rights as a data subject under the General Data Protection Regulation (GDPR) – subject to the applicable legal requirements being met – are as follows:

Access: You have the right of access to personal data concerning you that we process.

Rectification: You have the right to obtain rectification of your personal data. You also have the right to have incomplete personal data completed.

Erasure: In certain instances, you have the right to obtain erasure of your personal data.

Restriction of processing: In certain instances, you have the right to have us restrict the processing of your personal data.

Data portability: If you have provided us with data on the basis of a contract or consent, you have the right to receive the data you have provided in a structured, commonly used and machine-readable format or to have us transmit it to another controller.

Right to object  
You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Article 6(1)(f) of the GDPR. We will then no longer process the personal data for the stated purposes unless we can demonstrate compelling legitimate grounds for processing that override your interests, rights and freedoms, or the processing is for the purpose of establishing, exercising or defending legal claims.

Exercising your rights: To exercise any or all of your rights as described above, please contact Klöckner & Co, Investor Relations, ir@kloeckner.com or by postal mail at the address under heading I. above. Please make sure that we can clearly identify you.

Right to lodge a complaint with a supervisory authority: You have the right to lodge a complaint with a supervisory authority – in particular, in the Member State of your habitual residence, place of work or place of the alleged infringement – if you consider that the processing of personal data concerning you is unlawful.

There is no automated individual decision-making, including profiling, within the meaning of Article 22 of the GDPR, in connection with the use of our investor relations information service.

As of July 2018