Data Protection Information

The contents of the website is made available by thyssenkrupp AG, so that website visitors can read information about the product range of thyssenkrupp AG and our company. The handling of personal data of the site visitors follows the strict requirements of the GDPR.

We take the protection of your privacy when using our website very seriously as this is important to us. In the following we are pleased to inform you about the collection of personal data.

Name and Contact Data of the Controller

The Controller for the processing of personal data is

thyssenkrupp AG
thyssenkrupp Allee 1
45143 Essen
Germany
Phone: +49 201 844-0
Fax: +49 201 844-536000
Email: info@thyssenkrupp.com

Our Data Protection Officer can be reached at:

Data Protection Officer
thyssenkrupp AG
thyssenkrupp Allee 1
45143 Essen
Germany
Phone: +49 201 844-0
Fax: +49 201 844-536000
Email: datenschutzbeauftragter@thyssenkrupp.com

Collection and processing of personal data

In general, you can visit the website of thyssenkrupp AG on an anonymous basis, i.e. without informing us of who you are. When you visit our website, our web servers in Germany save as standard the IP address of your internet service provider via which you access our website, the site from which you access our website and the files you access from us, as well as the date of your visit and general information about your browser. These data are processed to ensure the security of the web server and to adapt the output of the information retrieved to your output medium (e.g. your phone, laptop or other device). These data are only analyzed in anonymized form for statistical purposes.

Personal data is stored and processed only if you provide us with this information, e.g. when completing a contact form or registering for personalized services. On the respective website you will be informed about the intended use and, if necessary, your consent to the storage and processing requested. Disclosure will only take place at thyssenkrupp companies and service providers affiliated with us, for example to send you the requested written information. Of course, all service providers are committed to data secrecy and confidentiality. A transfer to other third parties does not take place. Your data is always encrypted before transmission and processing to protect this data against unauthorized access.

Cookies

a) Description and scope of data processing

Cookies are text files that are stored on your computer or other end device. The use of cookies helps us to analyze your website usage, to improve services and products offered, to improve security and to prevent fraud. We differentiate between various cookies:

• Session cookies are temporary cookie files that are automatically deleted when you close your browser.

• Persistent cookies are cookie files that are stored until they are actively deleted or automatically removed after a certain amount of time.

• First-party cookies are cookies that are set directly by us.

• Third party cookies are cookies set by a third party.

On individual pages, personal data may be stored in cookies if you have previously expressly consented to such, e.g. to not have to re-enter access data. In principle, you can also access all information on our website if you have deactivated cookies in your Internet browser. If you do not accept cookies, this may result in functional limitations of our offers.

b) Legal basis for data processing

The legal basis for the processing of personal data using technically necessary cookies is Art. 6 para. 1 lit. f GDPR.

The legal basis for the processing of personal data using cookies for analysis purposes is Art. 6 para. 1 lit. a GDPR if the user has consented to this.

c) Purpose of data processing

Cookies can be used for different purposes.

• Functional cookies are used to provide you with standard services on our pages. Without the use of cookies, our website may work only very limited and possibly incorrect.

• Optimization cookies enable us to analyze the use of our website. If you have not consented to the use of your personal data for this purpose, this will be anonymous. The analysis helps us to improve our services and offered products and services.

• Personalization cookies allow us to determine your personal preferences, such as your preferred language. We use these cookies to improve usability and offer you a customized experience.

• Security-relevant cookies are cookies that are necessary to protect the website against attacks and to prevent fraud.

d) Duration of storage, option for objection and elimination

Cookies are stored on the user's computer and transmitted to our website. Therefore, you as a user also have full control over the use of cookies. You can deactivate or restrict the transmission of cookies by changing the settings in your Internet browser. Cookies that have already been saved can be deleted at any time. This can also be done automatically. If cookies are deactivated for our website, it may no longer be possible to use all functions of the website to their full extent.

Consent management / Cookies

To obtain and document your consents, we use the consent management platform of Usercentrics GmbH, Sendlinger Str. 7, 80331 Munich, Germany, acting as our processor (legal basis Section 25 (2) No. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG) and Art. 6 (1) sentence 1 lit. c GDPR to fulfil our obligation to demonstrate consent pursuant to Art. 7 (1) GDPR).

Details on all services used (purposes, legal bases, storage periods and transfers to third countries) as well as the option to change or withdraw your consent at any time can be found in the privacy settings.

Requests via Email

a) Description and scope of data processing

You can contact us via the e-mail address provided. In this case, the user's personal data transmitted by e-mail will be stored.

In this context, the data will not be passed on to third parties. The data is used exclusively for processing the conversation.

b) Legal basis for data processing

The legal basis for the processing of data in the case of the user's consent is Art. 6 para. 1 lit. a GDPR.

The legal basis for the processing of data transmitted in the course of sending an e-mail is Art. 6 para. 1 lit. f GDPR. If the e-mail contact is aimed at the conclusion of a contract, the additional legal basis for the processing is Art. 6 para. 1 lit. b GDPR.

c) Purpose of data processing

In the event of contact by e-mail, this also constitutes the necessary legitimate interest in the processing of the data.

d) Duration of storage, option for objection and elimination

The data will be deleted as soon as they are no longer necessary to achieve the purpose for which they were collected. For the personal data sent by e-mail, this is the case when the conversation with the user is finished. The conversation is terminated when the circumstances indicate that the matter in question has been finally clarified.

The user has the possibility to revoke his consent to the processing of personal data at any time. If the user contacts us by e-mail, he/she can object to the storage of his/her personal data at any time. In such a case, the conversation cannot be continued.

Contact Form

To respond to your request thyssenkrupp AG will process the following personal data if provided in the contact form:

• form of address

• first name, last name

• Email

• street

• zip code, town/city

• telephone number

• content of your request.

We will forward your personal data to recipients where this is necessary to meet your request. The legal basis for processing your personal data depends on your request and may take the form of a contract with you (Art.6 (1) (b) GDPR), your consent (Art. 6 (1) (a) GDPR) or our legitimate interests in providing you with a good service based on a balance of interests (Art. 6 (1) (f) GDPR). We are supported in the operation of our contact form by our IT service providers as order processors. We will process your data – where processing is based on your consent – until your consent is withdrawn or – where processing is based on a balance of interests – until you object to this or your request has been completed. Unless you provide the data required to contact you and to understand and process your request, we will not be able to process your request. All other information is optional. This service is only for persons over the age of 18.

If we process your personal data on the basis of your consent (Art. 6 (1) (a) GDPR), you can withdraw this consent at any time for the future. If we process your personal data on the basis of a balance of interests (Art. 6 (1) (f) GDPR), you can object to this at any time for the future.

In addition we process the referrer information in connection with use of the contact form (Art. 6 (1) (b) GDPR), which is erased after 4 weeks at the latest. It is technically not possible to use the contact form without collecting this information.

Job offer service by e-mail

If you register for our job offer service by e-mail, we will use your e-mail address to send you the job offers you have subscribed to. In order to ensure your proper registration for this service and to prevent unauthorised registrations on behalf of third parties, we will send you a confirmation email after initial registration using the double opt-in procedure, in which we ask you to confirm your registration. The legal basis for the processing of your personal data in the job offer service is your consent according to Art. 6 para. 1 sentence 1 lit. a GDPR.

Subscribing to the job offer service is voluntary and can be revoked at any time. For this purpose, you will be provided with a link in every job offer email, which you can use to unsubscribe from the service or revoke your consent.

Applications

Information on the processing of your personal data in the context of an application to a company of the thyssenkrupp Group can be found in the privacy information provided in the application form of the respective job posting.

Rights of the data subject

You have the right to request information about the data stored about you pursuant to Art. 15 GDPR. In addition, you may request the rectification or erasure of your data pursuant to Art. 16 and 17 GDPR. You may also have a right to restriction of the processing of your data pursuant to Art. 18 GDPR as well as a right to receive the data you have provided in a structured, commonly used and machine-readable format pursuant to Art. 20 GDPR, provided that this does not adversely affect the rights and freedoms of other persons. If you have given us your consent to data processing, you may withdraw it at any time without any formal requirements and without adverse consequences. Please note that the withdrawal does not affect the lawfulness of the data processing carried out prior to the withdrawal and that it does not extend to processing operations for which another legal basis exists and which may therefore also be carried out without your consent.

To exercise these rights, please contact the controller or the Data Protection Officer named above.

Pursuant to Art. 77 GDPR, you also have the option of lodging a complaint with the competent data protection supervisory authority. The right to lodge a complaint is without prejudice to any other administrative or judicial remedy.

Information about your right to object pursuant to Art. 21 of the General Data Protection Regulation (GDPR)

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Art. 6 (1) lit. f GDPR (data processing on the basis of a balance of interests); this also applies to any profiling within the meaning of Art. 4 No. 4 GDPR based on that provision.

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. The objection may be lodged without any formal requirements and should, where possible, be addressed to the controller or the Data Protection Officer named above in this privacy statement.

Scope and amendments to this privacy statement

This privacy statement applies exclusively to the use of our website. It does not apply to the websites of other service providers to which we provide a link. We accept no responsibility or liability for third-party statements and guidelines with no connection to our website.

We reserve the right to amend these data privacy rules from time to time in accordance with future changes relating to the collection and processing of personal data.