Data privacy for shareholders

Data privacy notice for shareholders of Porsche Automobil Holding SE

Since 25 May 2018, new rules for data privacy apply under the EU General Data Protection Regulation (GDPR). Compliance with the provisions of data protection law is very important to Porsche Automobil Holding SE ("Porsche SE" – hereinafter "we" or "us"). In the following, we would like to inform you about the processing of your personal data and about your rights under data protection law.

Additional information on data protection at Porsche SE can be found in our privacy notice: www.porsche-se.com/en/contact/data-privacy/.  

 

Controller

The controller of the processing of personal data is Porsche SE. You may reach Porsche SE at:

Porsche Automobil Holding SE
Porscheplatz 1
70435 Stuttgart
Telephone: +49 711 911 11021
Telefax: +49 711 911 11819
Email: investorrelations@porsche-se.com

You may address your questions or comments on the processing of personal data to the data protection officer of Porsche SE:

Porsche Automobil Holding SE
Der Datenschutzbeauftragte (The Data Protection Officer)
Porscheplatz 1
70435 Stuttgart
Telephone: +49 711 911 11021
Telefax: +49 711 911 11819
Email: datenschutzbeauftragter@porsche-se.com

 

Purposes and legal bases of the processing

We process your personal data in full compliance with the provisions of the GDPR, the German Federal Data Protection Act (Bundesdatenschutzgesetz), the German Stock Corporation Act (Aktiengesetz, "AktG")1 and all other applicable laws and regulations.

Generally, Porsche SE will receive the shareholders' personal data from the credit institution that the shareholders have entrusted with the safekeeping of their bearer shares (so-called depository bank) via the registration office. In some cases, Porsche SE may receive personal data directly from the shareholders.

We use your personal data (e.g. last name and first name, address, email address, number and class of shares, type of share ownership, postal votes/instructions and admission ticket number) as well as personal data of your shareholder representatives, if any, for the purposes provided for in the AktG and for organizing General Shareholders' Meetings. Processing of personal data for these purposes is a mandatory requirement under applicable law. The legal basis for the processing of your personal data is the AktG in conjunction with Art. 6 (1) sentence 1 lit. c) GDPR.

In addition, we use your personal data on the basis of Art. 6 (1) sentence 1 lit. c) and (4) GDPR for purposes that are compatible with the aforementioned purposes (in particular, for preparing statistics on, for instance, changes in the shareholder structure, the number of transactions or overviews of major shareholders).

We also process your personal data, where necessary, in order to comply with other legal obligations, e.g. regulatory requirements, record retention requirements under stock corporation, commercial and tax laws. Under provisions of the German stock corporation law, for instance, we are obligated to keep a verifiable record of the data provided as proof of the authorization of the company-named proxies for the General Shareholders' Meeting. In this case, the legal basis for the processing of personal data are the respective legal provisions and Art. 6 (1) sentence 1 lit. c) GDPR.

In certain individual cases, we also process your personal data as necessary for the purposes of the legitimate interests pursued by Porsche SE (Art. 6 (1) sentence 1 lit. f) GDPR). This occurs, inter alia, for statistical purposes, for the processing of contact and service requests, for the provision of financial reports, for photography and video recordings at our meetings and gatherings, or for participating in our General Shareholders' Meeting as a guest.

In the event that we intend to process your personal data for a purpose that was not previously mentioned, we will inform you in advance in accordance with the applicable statutory provisions.

 

Recipient(s) of your data

For the organization of the General Shareholders' Meeting (e. g. for printing and sending the invitation documents or for conducting the General Shareholders' Meeting), we commission, to some extent, third-party service providers as well as group-affiliated companies that will be granted access to your personal data in the context of the tasks assigned to them. In the context of commissioned data processing, our partners are carefully selected and are obligated pursuant to Art. 28 GDPR to observe the data protection standards of Porsche SE. The service providers and group-affiliated companies commissioned by us will process your personal data exclusively as instructed by us and only to the extent that this is necessary for the performance of the services commissioned. All employees of Porsche SE, the group of companies as well as all staff of commissioned service providers who have access to and/or process your personal data have committed to treat such data confidentially.

Furthermore, we may be obligated to transmit your personal data to further recipients such as, for instance, public authorities in order to comply with statutory reporting obligations.

If you participate in the General Shareholders' Meeting, other shareholders of Porsche SE may access, pursuant to Sec. 129 AktG, data relating to you that is contained in the list of participants, if any, for up to two years following the General Shareholders' Meeting. If you wish to submit a motion for including additional items in the agenda, counter-motions or nominations for election, we may, under certain conditions, be obligated to publish your name.

 

Transfer of data to third countries

In the event that we transfer personal data to service providers located outside the European Economic Area (EEA), the transfer will only take place to the extent that the EU Commission has confirmed that the third country offers an adequate level of data protection or that other adequate data protection safeguards exist (e. g. binding corporate rules on data protection or an agreement on the EU Commission's standard contractual clauses).

You may request detailed information in this regard as well as on the level of data protection offered by individual service providers located in third countries from our data protection officer at the above indicated contact information.

 

Storage period

We will anonymize or erase your personal data as soon as they are no longer required for the aforementioned purposes, the personal data is no longer required for any administrative or court proceedings, if any, and no other statutory obligations to furnish evidence or record retention requirements (e. g. under the AktG, the German Commercial Code (Handelsgesetzbuch) or the German Tax Code (Abgabenordnung)) apply or any reasons justifying the storage exist.

Beyond that, we will only retain personal data in individual cases to the extent that this is necessary, for instance, in order to manage claims, if any.

 

Rights of the data subjects

Subject to the statutory requirements, you have the right to access information (Art. 15 GDPR) about your processed personal data and to require rectification (Art. 16 GDPR) or erasure (Art. 17 GDPR) of your personal data or the restriction of processing (Art. 18 GDPR) using the contact information indicated above.

Furthermore, you may also contact the competent supervisory authority.

Right to object (Art. 21 GDPR): If we process your data for the purposes of the legitimate interests pursued by us (Art. 6 (1) sentence 1 lit. f) GDPR), you may object to such processing on grounds relating to your particular situation that oppose such data processing. Please submit your objection to the contact address indicated above.

If we process your personal data on the basis of your consent (Art. 6 (1) sentence 1 lit. a) GDPR), you may withdraw your consent at any time (Art. 7 (3) GDPR). Please submit your objection to the contact address indicated above.

If we process your personal data on the basis of your consent (Art. 6 (1) sentence 1 lit. a) GDPR), you are further entitled to receive the personal data relating to you in a structured, commonly used and machine-readable format (Art. 20 GDPR).

 

 

 

 

1 The provisions of the German Stock Corporation Act apply to the company pursuant to Art. 9 para. 1 lit. c) (ii) of Council Regulation (EC) No 2157/2001 of 8 October 2001 on the Statute for a European company (SE) (the "SE Regulation").