Information for shareholders of Ahlers AG on data protection pursuant to Art. 13, 14 GDPR

The purpose of this data privacy statement is to inform you of the processing of your personal data by Ahlers AG in connection with your position as shareholder and your rights under data protection legislation. Personal data is all information that relates to an identified natural person or a natural person that is identifiable, directly or indirectly, by reference to an identifier such as a name or an identification number.

Who is responsible for data processing?

Responsibility for data processing lies with Ahlers AG, Elverdisser Str. 313, 32052 Herford, Germany, e-mail: ahlers-ag@ahlers-ag.com, phone: +49 5221 979-0

You can contact the Data Protection Officer of Ahlers AG at Ahlers AG, Datenschutzbeauftragter, Elverdisser Str. 313, 32052 Herford, Germany, e-mail: ariel.biskupek@ahlers-group.com.

For what purpose and on what legal basis are the data processed?

Ahlers AG processes your personal data in accordance with the new Federal Data Protection Act (Bundesdatenschutzgesetz - BDSG), the General Data Protection Regulation (GDPR), the German Stock Corporation Act (Aktiengesetz - AktG) as well as all other relevant legal provisions and regulations.

The shares of Ahlers AG are registered shares. Pursuant to Section 67 of the German Stock Corporation Act (AktG), these shares must be registered in the company’s share register stating the name, date of birth and address of the shareholder as well as the number of shares held by the latter. The shareholder is obliged to inform the company of these data. If you are not willing to make these data available, you cannot be registered in the share register and cannot exercise your rights as a shareholder. The financial institutions involved in the purchase, safekeeping or sale of your shares pass this information as well as other relevant information needed to maintain the share register (e.g. nationality, sex and custodian bank) on to the share register. This is done via Clearstream Banking AG, Frankfurt, which act as the central agent for the technical settlement of securities transactions and the safekeeping of shares for financial institutions.

In connection with the Annual Shareholders’ Meeting, Ahlers AG processes your personal data for the purpose of managing shareholders’ registration for and participation in the Annual Shareholders’ Meeting (e.g. review of the eligibility for participation) and of enabling shareholders to exercise their rights in the context of the Annual Shareholders’ Meeting (incl. granting, revoking and giving evidence of powers of attorney and instructions). Without making your personal data available, it will not be possible for you to attend the Annual Shareholders’ Meeting and to exercise your voting rights and other meeting-related rights. This comprises the following processing procedures:

- registration of a shareholder for the Annual Shareholders’ Meeting with the required data stored in the share register and the data provided by the shareholder or transferred by their custodian bank for this purpose (especially first and last name, domicile or address, number of shares, type of shares, admission ticket number and type of shareholding);
- for participation in the Annual Shareholders’ Meeting by a proxy: the personal data of the shareholder stated in the power of attorney as well as the first and last name, domicile or address of the proxy;
- in the case of a power of attorney and instructions given to a designated proxy of Ahlers AG: the instructions given as well as the power of attorney;
- for the list of participants pursuant to Section 129 of the German Stock Corporation Act (AktG): number of the admission ticket, first and last name as well as domicile of the attending or represented shareholder and, if applicable, their proxy, number of shares, type of shares, number of voting rights and type of shareholding;
- in the case of items added to the agenda at the request of the shareholder as well as for counter-motions and election proposals: announcement of the name of the shareholder as well as the agenda items and the counter-motions and election proposals on the website of Ahlers AG (Sections 122 para. 2, 126 para. 1, 127 AktG).

Furthermore, Ahlers AG also processes your personal data to comply with other legal obligations such as regulatory requirements as well as retention duties under stock corporation, commercial and tax laws.

The legal basis for the above-described data processing procedures is constituted by Art. 6 (1) c) GDPR, according to which processing is lawful if it is necessary for compliance with a legal obligation to which the controller is subject. The obligation to perform the above-described processing procedures arises from the Stock Corporation Act. Processing of the above-mentioned personal data is necessary to comply with the legal obligations of Ahlers AG.

In individual cases, the company may also process your data for the purposes of the legitimate interests pursued by the company or by a third party pursuant to Art. 6 (1) lit. f) GDPR. This is the case if and when Ahlers AG must exclude individual shareholders or groups of shareholders from subscription offers because of their nationality or their place of residence in order not to violate legal regulations of certain countries. For the purpose of a legitimate interest pursued by the company, data may be processed pursuant to Art. (1) lit. f) GDPR also to provide information about the company in accordance with Section 67 (1) sentences 4 and 5 of the German Stock Corporation Act (AktG); this includes shareholder letters containing information about the course of business and important events of the company. Besides the above, we use your personal data to produce internal statistics (e.g. for the presentation of changes in the shareholder structure, the number of transactions or for an overview of the largest shareholders).

Should we intend to process your personal data for a purpose other than those mentioned above, we will inform you in advance in accordance with applicable legal provisions.

To what categories of recipients may your data be passed on?

Below please find information on the categories of recipients to which your personal data are passed on:

External service providers: We use external service providers for the management and technical maintenance of the share register as well as for the organisation of the Annual Shareholders’ Meeting; these service providers have been instructed by us to process your personal data in accordance with Art. 28 GDPR. External service providers will obtain from the company only such personal data that are necessary to provide the requested service and will process the data exclusively as instructed by the company.

Shareholders / Third parties: In the context of the statutory right of shareholders to inspect the list of participants of the Annual Shareholders’ Meetings, shareholders may inspect their data recorded in the list of participants for a period of up to two years from the Annual Shareholders’ Meeting. In addition, the list of participants is made available to all participants at the Annual Shareholders’ Meeting. Your data will also be published in the context of reportable requests to add items to the agenda, counter-motions and/or election proposals.

Other recipients: In the context of legal provisions, we may be obliged to transfer your personal data to other recipients such as authorities and courts (e.g. for the publication of voting rights notifications pursuant to the German Securities Trading Act and for reporting to authorities to comply with statutory reporting obligations).

It is not intended to transfer personal data to a recipient in a third-party country. 

How long will your personal data be stored?

As a general rule, we will delete or anonymise your personal data as soon as and to the extent that they are no longer needed for the above purposes unless legal evidence and/or retention obligations (under the Stock Corporation Act, the Commercial Code, the Fiscal Code or other legal provisions) oblige us to keep them stored. Data relating to Annual Shareholders’ Meetings are regularly deleted or anonymised every three years. After shares have been sold, the data stored in the share register must be retained by us for ten years. Above and beyond this, we only retain personal data in individual cases if this is necessary in connection with claims brought forward against our company (statutory limitation period of up to 30 years).

What are your rights?

If we process your personal data, you have the following rights:

- right of access to your personal data stored by Ahlers AG (Art. 15 GDPR);
- right to rectification of inaccurate personal data (Art. 16 GDPR);
- right to erasure of your data, especially if the data are no longer necessary in relation to the purposes for which they were collected (Art. 17 GDPR);
- right to restriction of processing (blocking), especially if the processing is unlawful or the accuracy of your data is contested by you (Art. 18 GDPR);
- right to object to the processing of your data if the data is processed for the purposes of the legitimate interests of the company (Art. 21 DSGVO).

To exercise the above rights or file complaints regarding the processing of your personal data, you may contact our Data Protection Officer using the above contact details. Regardless of this, you have the right to lodge a complaint with the competent data protection authority.

This data protection information relates to data protection issues in connection with your status as a shareholder. The information in this document was last updated in June 2018.