Privacy Policy of GEZE Schweiz AG, as of September 2023

As part of using various services on GEZE websites, you have the option to consent to receive advertising from us. If you have given such consent, GEZE uses the information you provide to send you advertising by post or any other communication method you desire (electronic mail, phone, scheduled personal appointments). You can revoke your consent at any time with future effect. If you wish to unsubscribe from one or more of these services, you can do so at any time at abmeldung@geze.com. If you receive a mailing from us, you can also unsubscribe from this service at any time by clicking "Unsubscribe" at the bottom of the mailing. The following services are available to you (as of May 2024):

On GEZE websites, you can sign up for our monthly newsletter or other messages in the form of electronic mail and subscribe to them. For this purpose, we collect your name and email address and use this data to send you the newsletter or the respective messages you have subscribed to by email. We verify your consent to receive our newsletter or other messages by email using the so-called double opt-in procedure. This means that we first request active confirmation of your consent to receive the newsletter or other message by email to the address you provided during subscription before we start sending it. We use the information about the confirmation to document and possibly prove your consent. You can revoke your consent to receive the newsletter or other messages and the related use of your personal data at any time with future effect.

On our websites, you can indicate whether you are interested in event invitations from GEZE. If we have received your consent for this (see double opt-in procedure in the previous point), we will send you invitations to events such as trade fair dates or architect events, etc., by post or electronic mail. You can revoke your consent to receive event invitations or other messages and the related use of your personal data at any time with future effect.

On GEZE websites, we offer discount promotions, customer actions, and/or contests from time to time. Details of the respective actions will be announced on the company's websites in good time, communicated in our social media channels, and/or sent by email as part of the monthly newsletter. If you wish to participate, we will request your name and contact information (e.g., name, address, email address, etc.) as well as other information necessary for participation in the contest, such as answers to contest questions, photos of you or others, purchase receipts, etc. GEZE uses this information exclusively for the execution of the respective action; thereafter, your data will be rendered unusable. Further details can be found in the participation conditions for the respective action. If you have consented to the use of your data for other purposes as part of participation, such as signing up for the monthly newsletter, we will use the information optionally for the purposes stated in the consent declaration. If a violation of the terms of use or other manipulative interventions by a user leads to the acquisition of a prize, GEZE can revoke the prize retrospectively. If the prize has already been handed over, the winner is obliged to return it in the delivered condition. Winners are generally notified by email by GEZE Schweiz AG. GEZE reserves the right to create and publish further information about prizes and winners in word, image, and sound as part of their communication, provided the respective winners have given their consent to this publication. Cash payment of prizes is generally not possible. The decision is final. GEZE also reserves the right to change already announced or ongoing actions, prizes, and content at short notice. In such cases, appropriate information will be provided to users. The availability of prizes is explicitly mentioned in the respective action (e.g., while stocks last).

On our website, we provide you with a form through which you can contact us to ask us questions about the product advertised on the websites or request (product) information. We use the data you provide (e.g., name, address, phone number, email address, etc.) exclusively to process and answer your questions.

GEZE GmbH and various subsidiaries are represented in various social media channels and occasionally offer different actions such as contests there. The participation conditions of the respective action apply. The user will be contacted via their username and notified of the win in the respective social media channels in case of a win, with a request to provide their personal data to GEZE GmbH or GEZE Schweiz AG exclusively for the handover of the prize. The data received via the social media channels will be used exclusively in this context and will not be passed on to third parties. GEZE GmbH is currently represented in the social media channels Facebook ("@GEZE.Group"), X (formerly Twitter) ("GEZE_GmbH" and "GEZE_Int"), LinkedIn ("GEZE GmbH", "GEZE Benelux", "GEZE South Africa", "GEZE France", "GEZE Italy", "GEZE Scandinavia"), and Xing ("GEZE GmbH"). For the protection of your privacy, your data, and your settings, you are solely responsible.

Facebook Facebook Plugins (Like & Share Button) On our pages, plugins of the social network Facebook, provider Facebook Inc., 1 Hacker Way, Menlo Park, California 94025, USA, are integrated. You can recognize the Facebook plugins by the Facebook logo or the "Like Button" ("Like") on our site. An overview of the Facebook plugins can be found here: developers.facebook.com/docs/plugins/. We use these plugins based on our legitimate interests (i.e., interest in analyzing, optimizing, and operating our online platforms economically in the sense of Art. 6 (1) lit. f GDPR). When you visit our pages, a direct connection between your browser and the Facebook server is established via the plugin. Facebook thereby receives the information that you have visited our site with your IP address. If you click the Facebook "Like Button" while you are logged into your Facebook account, you can link the contents of our pages to your Facebook profile. This allows Facebook to assign your visit to our pages to your user account. We point out that we, as the provider of the pages, have no knowledge of the content of the transmitted data and their use by Facebook. For more information, please refer to Facebook's privacy policy: facebook.com/policy.php. If you do not want Facebook to assign your visit to our pages to your Facebook user account, please log out of your Facebook user account. Additional settings and objections to the use of data for advertising purposes are possible within the Facebook profile settings: www.facebook.com/settings or via the US website www.aboutads.info/choices/ or the EU website www.youronlinechoices.com. The settings are platform-independent, i.e., they apply to all devices, such as desktop computers or mobile devices. Facebook Pixel On this website, due to our legitimate interests in analyzing, optimizing, and economically operating our online offering, the so-called "Facebook Pixel" of the social network Facebook is used, which is operated by Facebook Inc., 1 Hacker Way, Menlo Park, CA 94025, USA, or if you are in the EU, by Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland ("Facebook").

With the help of the Facebook Pixel, Facebook is on the one hand able to determine the visitors to our websites as a target group for the presentation of advertisements (so-called "Facebook Ads"). Accordingly, we use the Facebook Pixel to show the Facebook Ads we place only to those Facebook users who have also shown an interest in our online offering or who have certain characteristics (e.g., interests in certain topics or products that are determined based on the websites visited) that we transmit to Facebook (so-called "Custom Audiences"). With the help of the Facebook Pixel, we also want to ensure that our Facebook Ads correspond to the potential interest of the users and do not have a harassing effect. With the help of the Facebook Pixel, we can also understand the effectiveness of Facebook advertisements for statistical and market research purposes by seeing whether users were redirected to our website after clicking on a Facebook advertisement (so-called "conversion"). The data processing by Facebook is carried out within the framework of Facebook's data usage policy. Accordingly, general notes on the presentation of Facebook ads can be found in Facebook's data usage policy: www.facebook.com/policy. Specific information and details on the Facebook Pixel and its functionality can be found in Facebook's help section: www.facebook.com/business/help/651294705016616. You can object to the collection by the Facebook Pixel and the use of your data for the presentation of Facebook ads. To set what types of ads you see within Facebook, you can go to the page set up by Facebook and follow the instructions on the settings for usage-based advertising: www.facebook.com/settings. The settings are platform-independent, i.e., they apply to all devices, such as desktop computers or mobile devices. You can object to the use of cookies for reach measurement and advertising purposes via the deactivation page of the Network Advertising Initiative (https://optout.networkadvertising.org/) and additionally the US website (https://www.aboutads.info/choices) or the European website (https://www.youronlinechoices.com/uk/your-ad-choices/).

Twitter To communicate with us, we operate a social media profile on X under GEZE GmbH by X Inc. ("X"), 1355 Market Street, Suite 900, San Francisco, CA 94103, USA. You can contact us through this profile. We have also placed social media buttons of X on our website to easily link you to our respective profile. This is not a plugin, but only an icon with an embedded link. X does not process personal data from you on our website. X processes the personal data according to their data protection principles and declarations: https://twitter.com/en/privacy Personal Data If you contact us or click on the Instagram button, the following information will be collected from you:

• User behavior

• IP address

• Connection data

• Device and browser information or app information

• Data about the accessed content

• Possibly username or first and last name

• Possibly payment and account data

• Possibly biometric information during registration

By clicking on the social media button, you will be redirected to the provider's website. We have no influence on the processing of personal data on third-party websites. Purpose The social media button from X serves to structure our website and is used to place other web content on our website. If you contact us via X, we process the data to answer your request. Legal Basis The data processing through clicking on the social media buttons takes place with your express consent according to Art. 31 (1) FDPA or Art. 6 (1) lit. a GDPR, which you have given via the cookie banner. If you contact us via our Instagram profile, we process your data to fulfill the contract or take pre-contractual measures according to Art. 31 (2) lit. a FDPA or Art. 6 (1) lit. b GDPR and based on our legitimate interest according to Art. 31 (1) FDPA or Art. 6 (1) lit. f GDPR to provide a communication option. Necessity The mentioned data are not necessary for the functionality of the website. Data Transfer to Third Countries Your personal data may be transferred to the USA according to X Corp.'s privacy policy. X Corp. is a participant in the EU-U.S. Data Privacy Framework. The Swiss-U.S. Data Privacy Framework has not yet come into force. Therefore, your data may be subject to a level of data protection that is not comparable to that in Switzerland when transferred to the USA. Therefore, we have taken technical and organizational measures. By your consent via the cookie banner, you also consent to the transfer of your personal data to unsafe third countries according to Art. 16 FDPA or Art. 49 (1) lit. a GDPR. The privacy policy of X can be found here: twitter.com/privacy Storage Duration Data processed in connection with your contact will be deleted after 1 year unless we are subject to a 5 or 10-year retention obligation for communication. X stores the data not related to accounts for a maximum of 18 months.

LinkedIn To communicate with us, we operate a social media profile on LinkedIn under GEZE GmbH by LinkedIn Ireland Unlimited Company ("LinkedIn"), Wilton Plaza, Gardner House, Dublin 2, Ireland. You can contact us through this profile. We have also placed social media buttons of LinkedIn on our website to easily link you to our profile. This is not a plugin, but only an icon with an embedded link. LinkedIn does not process personal data from you on our website. LinkedIn processes personal data according to their privacy principles and declarations: https://www.linkedin.com/legal/privacy-policy?trk=homepage-basic_footer-privacy-policy Personal Data If you contact us via our social media profile or click on a social media button, the following information will be collected from you:

• User behavior

• IP address

• Connection data

• Device and browser information

• Data about the accessed content when clicking on the social media button

• Username or first and last name

• Possibly image data you provide us with in the context of contacting us

By clicking on the social media button, you will be redirected to the provider's website. We have no influence on the processing of personal data on third-party websites. Purpose The social media buttons serve to structure our website and are used to place other web content on our website. If you contact us via LinkedIn, we process the data to answer your request. Legal Basis If you contact us via one of our social media profiles, we process your data to fulfill the contract or take pre-contractual measures according to Art. 31 (2) lit. a FDPA or Art. 6 (1) lit. b GDPR and based on our overriding private interest according to Art. 31 (1) FDPA or Art. 6 (1) lit. f GDPR to provide a communication option. Necessity This processing activity is not necessary for the functionality of the website. Data Transfer to Third Countries Your personal data will generally be processed in Ireland by LinkedIn Ireland Unlimited. However, personal data may also be transferred to the US parent company LinkedIn Corporation (USA). LinkedIn Corporation is a participant in the EU-U.S. Data Privacy Framework. The Swiss-U.S. Data Privacy Framework has not yet come into force. Therefore, your data may be subject to a level of data protection that is not comparable to that in Switzerland when transferred to the USA. By your consent via the cookie banner, you also consent to the transfer of your personal data to unsafe third countries according to Art. 16 FDPA or Art. 49 (1) lit. a GDPR. The privacy policy of LinkedIn can be found here: https://www.linkedin.com/legal/privacy-policy Storage Duration Data processed in connection with your contact will be deleted after 1 year unless we are subject to a 5 or 10-year retention obligation for communication.

Xing To communicate with us, we operate a social media profile on XING under GEZE GmbH by XING SE ("XING"), Dammtorstraße 30, 20354 Hamburg, Germany. You can contact us through this profile. We have also placed social media buttons of XING on our website to easily link you to our profile. This is not a plugin, but only an icon with an embedded link. XING does not process personal data from you on our website. XING processes personal data according to their privacy principles and declarations: privacy.xing.com/en/privacy-policy Personal Data If you contact us via our social media profile or click on a social media button, the following information will be collected from you:

• User behavior

• IP address

• Connection data

• Device and browser information

• Data about the accessed content when clicking on the social media button

• Username or first and last name

• Possibly image data you provide us with in the context of contacting us

By clicking on the social media button, you will be redirected to the provider's website. We have no influence on the processing of personal data on third-party websites. Purpose The social media buttons serve to structure our website and are used to place other web content on our website. If you contact us via XING, we process the data to answer your request. Legal Basis If you contact us via one of our social media profiles, we process your data to fulfill the contract or take pre-contractual measures according to Art. 31 (2) lit. a FDPA or Art. 6 (1) lit. b GDPR and based on our overriding private interest according to Art. 31 (1) FDPA or Art. 6 (1) lit. f GDPR to provide a communication option. Necessity This processing activity is not necessary for the functionality of the website. Data Transfer to Third Countries Your personal data will generally be processed in Germany by XING SE. However, personal data may also be transferred to other companies within the New Work SE group that are located outside the EU. XING SE ensures that all data transfers comply with EU data protection regulations. More information can be found in XING's privacy policy: privacy.xing.com/en/privacy-policy Storage Duration Data processed in connection with your contact will be deleted after 1 year unless we are subject to a 5 or 10-year retention obligation for communication.

Google Tag Manager Google Tag Manager is a solution that allows us to manage so-called website tags via an interface (and thus, e.g., to integrate Google Analytics and other Google marketing services into our online offering). The Tag Manager itself (which implements the tags) does not process personal data of the users. Regarding the processing of personal data of the users, reference is made to the following information on the Google services. Usage guidelines: www.google.com/intl/en/tagmanager/use-policy.html.

YouTube In addition, GEZE GmbH operates its own channel ("GEZE GmbH", hereinafter "Channel") on the video platform YouTube. GEZE GmbH is solely responsible for the produced, uploaded, and own video content of the GEZE GmbH Channel. GEZE GmbH assumes no liability for GEZE products depicted and/or installed in other videos not produced by us. The respective YouTube user who has uploaded these videos to their channel is solely responsible for these videos. GEZE GmbH reserves the right to delete comments and/or images with inappropriate content such as glorification of violence or spam, etc. To communicate with us, we operate a social media profile on YouTube under GEZE GmbH by Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland. You can contact us through this profile. This is not a plugin, but only an icon with an embedded link. Google (YouTube) does not process personal data from you on our website. When you click on the link or the embedded video, you will be redirected to the website of Google (YouTube). We have no influence on the processing of personal data on third-party websites. Google (YouTube) processes personal data according to their privacy principles and declarations: https://policies.google.com/privacy Personal Data If you contact us via YouTube, the following information will be collected from you:

• User behavior

• IP address

• Connection data

• Device and browser information

• Data about the accessed content when clicking on social media buttons

• Username or first and last name

• Possibly image data you provide us with in the context of contacting us

By clicking on the social media button, you will be redirected to the provider's website. We have no influence on the processing of personal data on third-party websites. Purpose The embedded videos serve to structure our website and are used to place other web content on our website. Legal Basis If you contact us via one of our YouTube profiles, we process your data to fulfill the contract or take pre-contractual measures according to Art. 31 (2) lit. a FDPA or Art. 6 (1) lit. b GDPR and based on our overriding private interest according to Art. 31 (1) FDPA or Art. 6 (1) lit. f GDPR to provide a communication option. Necessity This processing activity is not necessary for the functionality of the website. Data Transfer to Third Countries Your personal data will generally be processed in Ireland by Google Ireland Limited. However, personal data may also be transferred to the US parent company Google LLC. Google LLC is a participant in the EU-U.S. Data Privacy Framework. The Swiss-U.S. Data Privacy Framework has not yet come into force. Therefore, your data may be subject to a level of data protection that is not comparable to that in Switzerland when transferred to the USA. Therefore, we have concluded standard contractual clauses with Google and taken technical and organizational measures. By your consent via the cookie banner, you also consent to the transfer of your personal data to unsafe third countries according to Art. 16 FDPA or Art. 49 (1) lit. a GDPR. The privacy policy of Google can be found here: https://policies.google.com/privacy?hl=en Storage Duration Google (YouTube) stores your personal data according to their privacy principles and declarations: https://policies.google.com/privacy Data processed in connection with your contact will be deleted after 1 year unless we are subject to a 5 or 10-year retention obligation for communication. GEZE GmbH has the possibility to evaluate personal data through the Facebook Insights data. These Insights are regularly evaluated for the efficiency and optimization of our Facebook page. Together with Facebook, we ("responsible parties") are responsible for processing the Facebook Insights data. GEZE GmbH does not pass on these Insights to third parties except to service providers with whom we cooperate in the area of social media. Regarding Facebook Ireland Limited ("Facebook Ireland"), Facebook Ireland is solely responsible for processing the Insights data; we assume no liability for this. Read Facebook's Page Insights Supplement Agreement here: www.facebook.com/legal/terms/page_controller_addendum

Personal data is used in various ways by GEZE Schweiz AG. Depending on the action, e.g., the wording of the contact form may vary and/or be presented for specific purposes. You alone determine the purpose for which you give us your consent. Unsubscribing from any services is possible at any time. Through the GEZE career page, you have the opportunity to submit applications for open positions to us by email or using our online applicant portal. We process the data you send us in connection with your application to check your suitability for the advertised position (or possibly other open positions at GEZE) and to conduct the application process. Your applicant data will be reviewed by the HR department and the department managers within our company after receiving your application. Within the company, only those persons who need access to your data for the application process have access to it. Storage of any additional information you voluntarily provide is carried out based on Art. 6 (1) lit. f) GDPR, as we have a legitimate interest in processing the additional information you voluntarily provide for the purpose of conducting the application process.

To Process Job Placements Within the Application Process:

• Name

• Surname

• Email address

• Information provided by you in the application documents and during the further process about your person

To Facilitate Use (if the application is submitted online), "session cookies" are set: GEZE GmbH uses only "first-party" cookies, which are necessary for the function and security of the application and to facilitate your user guidance. No personal data is collected or stored. The cookies are deleted once you log out or close the browser. You cannot use the application generator if you do not accept cookies. You would then need to resort to email or postal mail.

To Avoid Duplicate Applications, "log files" are created: GEZE GmbH stores internet protocol addresses (IP addresses) for a limited time in the log files to the extent necessary for tracking purposes (to avoid duplicate applications). We match personal data (name, date of birth, place of birth, nationality, and voluntarily provided data) of such applicants whom we intend to employ concretely in the course of the application process with names on sanction lists, such as the EU terror list according to the EU anti-terror regulations. This serves to prepare the conclusion of an employment contract with such applicants and to fulfill a legal obligation (Art. 6 (1) lit. c) GDPR) as legal provisions prohibit providing financial services, including paying wages, to individuals listed on such sanction lists. Finally, this comparison with the sanction lists is also carried out based on our legitimate interests in maintaining our AEO certification in the sense of Art. 6 (1) lit. f) GDPR. If you agree to the further storage of your personal data in our applicant pool after the application process is unsuccessful, the legal basis for the associated further processing is your consent according to Art. 6 (1) lit. a) GDPR. You can revoke your consent at any time with future effect without giving reasons in writing. Please address this to GEZE GmbH, HR Department; Reinhold-Vöster-Str. 21-29 in 71229 Leonberg; or by email to datenschutz@geze.com. Personal data of applicants will be regularly deleted by us after four months, but no later than six months, in case of rejection. If you have agreed to the further processing of your personal data in our applicant pool, the data will be deleted when it is no longer necessary for the purposes for which it was collected and processed, typically after a period of 2 years after inclusion in the applicant pool. Should you be selected for a position as part of the application process, your data will be transferred to our personnel management system and processed there as far as it is necessary for establishing and conducting the employment relationship. Further information on the selection process or reimbursement of travel expenses can be found separately on the GEZE career page. The data used in this context is exclusively for the application and/or travel expense reimbursement, if requested by you.

Further processing and use of your personal data generally occur only if a legal regulation allows this or if you have consented to the data processing or use. As explicitly described above, GEZE does not pass on your personal data to third parties. Passing on to instructed service providers/data processors is reserved. In general, GEZE GmbH deletes or anonymizes your personal data as soon as it is no longer necessary for the purposes for which we have processed or used it as described above. Legal requirements for longer storage and deletion of personal data as described above remain unaffected.

1. As a data subject whose data we process, you have the following rights:

• Right to information according to Art. 15 GDPR

• Right to rectification according to Art. 16 GDPR

• Right to deletion ("right to be forgotten") according to Art. 17 GDPR

• Right to restriction of processing according to Art. 18 GDPR

• Right to data portability in a structured, commonly used, and machine-readable format according to Art. 20 GDPR

• Right to complain to the supervisory authority according to Art. 77 GDPR

Please address your claims or declarations to the following address: GEZE Schweiz AG Zelglimatte 1A CH-6260 Reiden or by email to: schweiz.ch@geze.com

If you believe that the processing of your personal data by GEZE GmbH or GEZE Schweiz AG violates legal regulations, we would be grateful for a note by email to schweiz.ch@geze.com. You also have the right to complain to a competent data protection supervisory authority (Art. 77 GDPR). In Switzerland, there is no formal right of complaint to the data protection supervisory authority; however, you can report what you consider to be unlawful data processing there.

If we process your personal data based on our legitimate interest, you have the right to object to this processing. You also have the right to object to any data processing for direct marketing purposes. If you wish to exercise your right to object, a notification in text form is sufficient. You can contact us in writing, send a fax, or email us. Our contact details can be found under point 14.2 of this data protection notice.

If we process your personal data for certain purposes based on your consent, you have the right to revoke your consent at any time according to Art. 7 (3) GDPR. After receiving your revocation, we and GEZE GmbH will stop processing the data for the purposes for which you have given us consent. The legality of the processing before receiving your revocation remains unaffected.