Privacy Notice for business and communication partners

Information for business and communication partners of Porsche Automobil Holding SE in Europe on the processing of their personal data

Porsche Automobil Holding SE ("Porsche SE" or the "Company" – hereinafter also referred to as "we" or "us") is committed to protecting the privacy of its business and communication partners¹ when processing personal data. 

The purpose of this information is to inform current and future business partners and communication partners in Europe about the processing of their personal data by Porsche SE. Porsche SE is obliged to provide such information under the EU General Data Protection Regulation ("GDPR") and the German Federal Data Protection Act ("BDSG").

"Business Partner" or "Communication Partner", as the case may be, refers to any natural person with whom Porsche SE maintains a business relationship or with whom Porsche SE is in a communication relationship (in particular by email, via any email or other message distribution service or by post), e.g. representatives and employees of service providers, media representatives or capital market participants.

I. Responsibilities and contact information

The controller of your personal data is:

Porsche Automobil Holding SE
Porscheplatz 1
70435 Stuttgart
Telephone: +49 711 911 24420
Telefax: +49 711 911 11819

Email: investorrelations@porsche-se.com

You may contact our Data Protection Officer by email at datenschutzbeauftragter@porsche-se.com or by post by adding "Attn.: Data Protection Officer" to the address.

II. Processing of personal data within the scope of the business relationship

1. Categories of personal data

We process personal data that we receive directly from you or from third parties (e.g. your co-workers, superiors or other individuals through whom we have established contact with you) as well as from publicly accessible sources, such as homepages or published print media. Such personal data includes, without limitation,

• data relating to you, e. g. your first and last name, home and/or business address, telephone number, email address, professional qualities and/or description of your function, employer, native language, date of birth, gender, photos, if applicable, etc.;
• contractual information, e. g. information contained in contracts, agreements and other business documents as well as bank details, tax ID, etc.;
• information regarding your legal relationships with third parties;
• communication data such as information typically shared in business correspondence using communication channels (post, email, Twitter etc.).

2. How we use your personal data

Your personal data is processed to the extent that this is necessary for the purposes of the legitimate interests of Porsche SE (Art. 6 para. 1 sentence 1 lit. f GDPR), for example,

• to initiate or perform contracts and other business relationships (including the processing of purchase orders, deliveries or payments) or to prepare or reply to quotation requests and to determine the conditions of the contractual relationship with, among others, our service providers or competitors for whom you act as representative or employee, as the case may be;
• to transmit your personal data within the Company for internal administrative purposes (e.g. for accounting purposes);
• to publish ad hoc announcements and press releases;
• for communication with representatives of the press, including the preparation of press articles or the clarification of facts;
• for advertising our own services (e.g. invitations to events, company information, greeting cards);
• to use service providers, in particular, internal and external IT service providers, who support our business processes;
• to conduct compliance investigations;
• to ensure building and plant security (including video surveillance to the extent required for the protection of our premises).

Moreover, personal data is processed for the purpose of initiating and performing contracts with individuals (natural persons) with whom we maintain business relationships, e.g. for the purpose of processing purchase orders, deliveries or payments or to prepare or reply to individual quotation requests as well as other inquiries and to determine the conditions of the contractual relationship (Art. 6 para. 1 sentence 1 lit. b GDPR).

Porsche SE is also subject to various legal obligations (Art. 6 para. 1 sentence 1 lit. c GDPR) that may require the processing of your personal data. Such legal obligations may follow, for example, from taxation laws, foreign trade laws or sanctions laws.

III. Processing of personal data in the case of participation in events of Porsche SE (in particular at the Annual Press and Analyst Conference)

1. General Information

We process your personal data in accordance with Art. 6 para. 1 sentence 1 lit. b GDRP, insofar as this is necessary for the processing of the registration and for the performance and handling of events of Porsche SE, in particular for correspondence, the transmission of event documents and for invoicing. This includes in particular first name, surname, job, a valid e-mail address and a phone number (landline and/or mobile).

Your personal data will only be passed on to third parties if this is necessary for the implementation and processing of your participation (Art. 6 para. 1 sentence 1 lit. b GDRP), for example to the respective event hotel or if you are interested in or have registered for other offers at the event.

2. Special information regarding virtual events

In the case of a virtual event via an online webcast, we also process your personal data in particular for the purpose of:

• the video and audio transmission,
• the participation of the virtual event by means of electronic connection with the indication of first and last name as well as employer.

For the registration for the online webcast and its implementation, we use external service providers who are bound by our instructions, who have been obligated in accordance with data protection regulations and are not permitted to process the data for any other purpose.

a. Server log files

When you register for the online webcast and use it as part of the Annual Press and Analyst Conference, we process the following information which your browser automatically transmits to us for technical reasons:

• Date and time of access, volume of data transmitted, message indicating whether access was successful, IP address, type of web browser, the website previously visited.

This is necessary in order to retrieve website content and display it correctly on your device. The data requests from your browser are automatically stored in so-called "server log files". The data processing described is absolutely necessary to ensure the retrievability and correct display of our websites on your device (Art. 6 para. 1 sentence 1 lit. b GDPR).

b. Cookies

Furthermore, it is necessary both for the registration and the operation of the online webcast that cookies are stored on your device. We only use cookies that are necessary for the registration and use of the online webcast. You can prevent the setting of a cookie by setting your browser so that it does not allow cookies to be stored. However, blocking all cookies may prevent you from using the online webcast. The legal basis for this data processing is § 25 para. 2 No. 2 TDDDG. In detail, these are the following cookies:

• For registration via VIP Connect:
  • JSESSIONID: It is a cookie that allows websites to store data about the user's current browsing session. It is activated at the access to the web page to communicate the status data through a temporary cookie and is removed when you leave the site.

• For participation in the online webcast:
  • User’s registration data: This cookie is stored in the browser so users do not need to register again if they have to refresh the page, or if they join the event too early and want to come back later. This is only stored for events with pre-registration or registration enabled.
  • languagePreference: This cookie is used to keep track of the language in which a page is displayed (whether the language is set by default or in which language is chosen from the selection menu). It is necessary to show errors related to the forms in the right language. It only records a language code. It is stored for 137 days.
  • waitingAlertShown: This cookie is used to tracking whether or not the user has seen the buffering alert in the last 24 hours (if they have, it will not be shown again). This is stored only if the user receives a buffering alert. This is stored for one day.

  • pickupPoint: This cookie is used to create a timestamp of when users closed the window for archive playback. This is used in case users want to resume where they left off if they come to the page in the future. It is stored for seven days.

     

3. Note on the Recording and Publishing of image and sound recordings as well as transcripts of the event

During our event, image and sound recordings may be made and stored and transcripts of the event may be created. These image and sound recordings as well as excerpts from the transcripts created may in particular be published on our website www.porsche-se.com and on our company website at LinkedIn for the purpose of reporting and advertising our services.

We would like to point out that information on the Internet is accessible worldwide, can be found with search engines and linked to other information, from which personality profiles can possibly be created. Information posted on the Internet, including photographs, can be easily copied and distributed, and there are specialised archiving services whose aim is to permanently document the state of certain websites on certain dates. As a result, information published on the Internet may still be found elsewhere even after it has been deleted on the original website.

Legal basis:

We have a legitimate interest in the creation and storage of the image and sound recordings and transcripts in accordance with Art. 6 para. 1 sentence 1 lit. f GDPR.

By participating, you consent to the publication of image and sound recordings of the event on which you are also pictured, as well as the publication of transcripts of the event, which contain statements by you with your name mentioned.

If you do not agree, please inform the photographer or one of our employees. You have the right to withdraw your consent at any time. However, even if you withdraw your consent, the recordings may still be published and displayed for reporting purposes in accordance with § 23 para. 1 No. 3 of the German Art Copyright Act if the event itself is clearly in the foreground of the recordings.

IV. Recipient(s) of your personal data

Within the Company, only authorised staff of Porsche SE with relevant competencies will have access to your personal data.

We are authorised to mandate third parties to provide certain services, such as IT services. Furthermore, we engage, inter alia, legal advisors, management consultants and auditors. These third parties perform services on our behalf and under our supervision as well as in accordance with our instructions and may have access to personal data to the extent that this is required for them to render their services.

In addition, we can – to the extent legally permissible – transmit your personal data to authorities (such as social security institutions, tax authorities or law enforcement agencies) and domestic and foreign courts to comply with statutory duties or to act in the interests of Porsche SE.

V. Your rights

Subject to the statutory requirements you have the right to access information (Art. 15 GDPR) about your processed personal data, to require rectification (Art. 16 GDPR) or erasure (Art. 17 GDPR) of your personal data or the restriction of the processing (Art. 18 GDPR) and to receive your personal data in a structured, commonly used and machine-readable format (data portability, Art. 20 GDPR).

Right to object (Art. 21 GDPR): If we process your data for the purposes of the legitimate interests pursued by us (Art. 6 para. 1 sentence 1 lit. f GDPR), you may object to such processing at any time with effect for the future on grounds relating to your particular situation that oppose such data processing. Please submit your objection to the contact address indicated above.

We would also like to draw your attention to your right of appeal to a supervisory authority. The supervisory authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart. 

VI. Confidentiality / Security

Each of our employees as well as all staff of third party service providers who have access to and/or process personal data are obliged to treat such data confidentially.

Porsche SE also uses suitable technical and organisational security measures in order to protect personal data stored against manipulation, partial or total loss, as well as against unauthorised access by third parties. The security measures taken by Porsche SE are continuously improved in line with developments in technology.

VII. Obligation to delete personal data

All personal data will be stored in accordance with applicable statutory regulations.

Our general policy is to delete personal data once it does no longer need to be stored in order to fulfil our contractual obligations or to safeguard the legitimate interests outlined in this information letter or if they are no longer needed for any court or administrative proceedings and if no statutory retention obligations apply. We restrict the processing of such data in the event that statutory retention obligations apply.

VIII. Contact us

If you have any questions, comments or suggestions about this information or our personal data protection policies, please contact investorrelations@porsche-se.com or Porsche SE's Data Protection Officer at datenschutzbeauftragter@porsche-se.com.

IX. Up-to-date information

This information was last updated in April 2025.

In the event our business activities and/or our services change or as a result of amended legal and/or administrative requirements, it may become necessary to amend this information. The most recent version of this information can be accessed, saved and printed at any time via the link in our email signature.