Privacy Policy for the Concrete Customer Portal

Status: 29.11.2021

Joint data protection declaration of Dyckerhoff GmbH and its subsidiaries Dyckerhoff Beton GmbH
& Co. KG, Dyckerhoff Beton Rheinland-Pfalz GmbH & CO. KG, Dyckerhoff Transportbeton
Schmalkalden GmbH & Co. KG, Dyckerhoff Transportbeton Thüringen GmbH & Co. KG, TBG
Lieferbeton GmbH & Co. KG Odenwald, (hereinafter "we").

Contact details and further information on the aforementioned persons responsible for this website
can be found in the appendix to this privacy policy.

You can reach our data protection officer at the contact details below:

Dyckerhoff GmbH
Data Protection Officer
Biebricher Str. 68
65203 Wiesbaden
Phone: +49 611 6761647
E-mail: protection.data@dyckerhoff.com

1. Data processing when using the customer portal

Whenever you use the customer portal, all data that you collect there yourself or that we make
available to you from our data is stored at our external web application provider.

The processing of this data is carried out for the execution of the customer order in accordance with
Art. 6(1) sentence 1 letter b GDPR and for the protection of our legitimate interests in accordance
with Art. 6(1) sentence 1 letter f GDPR.

2. Cookies

Use of our customer portal is associated with the storage of cookies. These are small files that are
automatically created and stored on your end device (laptop, tablet, smartphone or similar) when you
access the customer portal.

In the cookie, information is stored that arises in each case in connection with the specific end device
used. However, this does not mean that we obtain knowledge about your usage behavior in the
customer portal or other Dyckerhoff websites or web applications beyond the use of the customer
portal. Cookies also do not cause any damage to your end device.

The purpose of the use of technical cookies by our service provider is to ensure the functionality of
the application. The cookies are automatically deleted after leaving our site ("maximum age: end of
session") or after 24 hours at the latest.

Most browsers accept cookies automatically. However, you can set your browser so that no cookies
are stored on your end device or a message always appears before a new cookie is created.
However, the complete deactivation of cookies may mean that you cannot use all the functions of
our customer portal.

3. Your rights

In accordance with Article 15 GDPR, you have the right to receive information about the data stored
about you, including any recipients and the planned storage period.

You have the right to withdraw your consent without affecting the lawfulness of the processing carried
out on the basis of the consent until the withdrawal.

If inaccurate personal data is processed, you have a right to rectification pursuant to Article 16 GDPR.

If the legal requirements are met, you have the right to erasure or restriction of the processing of the
data concerned (Article 17 and Article 18 GDPR).

Under the conditions of Article 20, you have a right to data portability.

Pursuant to Article 21 GDPR, you have the right to object at any time, on grounds relating to your
particular situation, to the processing of your personal data carried out on the basis of Article 6(1)
sentence 1 letter f GDPR. We will then no longer process the personal data unless we can
demonstrate compelling legitimate grounds for the processing which override your interests, rights
and freedoms, or the processing serves the purpose of asserting, exercising or defending legal
claims. The collection of data for the provision of the website and the storage of log files are
mandatory for the operation of the website.

Pursuant to Article 77(1) of the GDPR, you have the right to lodge a complaint with a data protection
supervisory authority if you consider that the processing of your data infringes applicable data
protection law.

We refrain from automated decision-making including profiling.

4. Third Party Services and Possible Third Country Transfer

For the operation of our customer portal, we have integrated the services of SAP Deutschland SE &
Co. KG, Hasso-Plattner-Ring 7, 69190 Walldorf, Baden (hereinafter "SAP Cloud Services").

We use the cloud services of SAP to protect our legitimate interests, Article 6(1) sentence 1 letter f
GDPR. In this way, we ensure the full functionality of the customer portal.

By using the cloud service provider listed, information about the use of this website, including your
IP address, may be transferred to the USA, although this does not mean that the third party
commissioned by us obtains knowledge of your identity. It cannot be ruled out that your personal
data will be stored and processed worldwide, including on servers in the USA. These could be
countries where the level of data protection is not as high as within the European Union. Due to the
possibly lower level of data protection in the third countries, you may not be able to assert your data
subject rights with these recipients or only partially. Furthermore, your data may be subject to access
by foreign authorities and remedies before courts and authorities abroad may be unsuccessful. There
is no adequacy decision by the EU Commission within the meaning of Article 45 of the GDPR for the
USA.

We have concluded an order data processing agreement with SAP Cloud Services. In this, the EU
standard contractual clauses constitute appropriate safeguards within the meaning of Article 46 of
the GDPR.