Transparency and information obligations for visitors of MEKRA Lang GmbH & Co. KG*

in accordance with the EU General Data Protection Regulation (EU-GDPR)

With this document, we inform you about the processing of your personal data by MEKRA Lang GmbH & Co. KG upon your registration as a visitor and your rights under the German Data Protection Act.

Responsible entity / data protection

Address:

MEKRA Lang GmbH & Co. KG
Buchheimer Str. 4
91465 Ergersheim

Phone : +49 9847 989-0
email: info@mekra.de
Privacy Policy Contact: datenschutz@mekra.de

Categories / origin of the data

Your personal data is either collected directly from you upon reception or previously recorded by in our administrative system by your contact person. We may also collect personal data through video surveillance in certain buildings.

For business customers:

• Contact details (visitor‘s name, company name and visitor‘s address
  (employer))
• License plate number
• Contact person and associated department within MEKRA Lang GmbH & Co. KG
• Arrival and departure time

For private customers:

• Basic data (title, first name, last name, name suffixes)
• Contact details (e.g. name and private address (if applicable, federal state), mobile and landline telephone number, email address, fax number)
• Different delivery/billing address (e.g. name and address (if applicable, federal state), telephone number and email address if applicable)
• License plate number

Purposes and legal bases of data processing

When processing your personal data, we always adhere to the provisions of the EU GDPR, the new Federal Data Protection Act (BDSG)
and other relevant legal regulations.

Your data is recorded to facilitate your visit to our business premises, which includes making an entry in our visitor list and issuing a visitor
badge.  For security reasons, your identity details will be checked by inspecting and comparing your ID document before the visitor pass is handed out.

Your personal data is collected to safeguard our property rights and our legitimate interests (Art. 6 para. 1 lit. f EU GDPR) in maintaining
necessary security standards. This includes, for instance, preparations for evacuation and identification of unauthorized parking.

For the detection of criminal offenses, your personal data will only be processed under the conditions of Art. 10 EU GDPR.

Data storage period

We delete your personal data as soon as it is no longer required for the aforementioned purposes, but no longer than two months.

Data recipients / categories of recipients

Within our company, we ensure that only those departments and individuals who require your data to fulfill our contractual and legal
obligations receive it.

In certain cases, service providers support our specialist departments in fulfilling their tasks. The necessary data protection contracts have been
concluded with all service providers. These may include, for example, IT service providers, shipping or visitor management systems.

In specific cases, we are legally obligated to provide information to public authorities, such as Tax authorities, law enforcement authorities
and customs authorities.

Transfer to a third country / intention to transfer to a third country

Data is not transferred to third countries (outside the European Union or the European Economic Area).

Rights of the data subjects

Your rights as a data subject are standardized in Articles 15-22 of the EU-GDPR. These include:

• The right of access (Art. 15 EU GDPR)
• The right to rectification (Art. 16 EU GDPR)
• The right to erasure (Art. 17 EU GDPR)
• The right to restriction of processing (Art. 18 EU GDPR)
• The right to object to processing (Art. 21 EU GDPR)
• The right to data portability (Art. 20 EU GDPR)

To assert these rights, please contact: datenschutz@mekra.de. The same applies if you have any questions about data processing in
our company or wish to withdraw your consent. Additionally, you can file a complaint with a data protection supervisory authority if necessary.

If we process your data to protect legitimate interests, you can object to this processing at any time on grounds relating to your particular situation. We will then cease to process your personal data unless we can demonstrate compelling legitimate grounds for the processing
which override your interests, rights and freedoms, or if the processing serves establishment, exercise, or defense of legal claims.

Obligation to provide the data

In order to process your visit, you are obliged to provide certain personal data. This is necessary to comply with security standards and the resulting legal obligations. Otherwise, access to our premises cannot be granted.

Automated case-by-case decisions

We do not use purely automated processing to make decisions.

Additional note

For further details related to data processing by MEKRA Lang GmbH & Co. KG, we invite you to refer to our extensive data protection information
available at our website: https://www.mekra.de/en/impressum/datenschutz.

*All the provisions listed also apply to the affiliated companies of MEKRA Lang GmbH & Co. KG. These include Lang Technics GmbH & Co. KG, MEKRAtronics GmbH, MEKRA Global Mirrors Holding GmbH and Frieda Lang Haus für Kinder gGmbH.and Frieda Lang Haus für Kinder gGmbH.