Information Requirements according to GDPR

Information duties according to Art. 13 and 14 GDPR

Transparency in the processing of personal data is an essential part of protecting the rights of data subjects. We hereby inform you about the processing of your personal data as well as about your rights under the General Data Protection Regulation (GDPR).

This information applies to customers, interested parties, suppliers, service providers, applicants, shareholders and other data subjects.

1. Name and address of person responsible

AIXTRON SE
Dornkaulstr. 2
52134 Herzogenrath
person responsible: Dr. Christian Danninger (Member of the Executive Board of AIXTRON SE)
E-Mail: info@aixtron.com

2. Name and contact details of the responsible data protection officer

NTEGRITY GmbH
Gesellschaft für Datenschutz, Informationssicherheit und Compliance
Bischof-Hemmerle-Weg 9
52076 Aachen
Germany
Website: https://www.dgc-integrity.de

Contact via
Katharina Klostermann
Data Protection Coordinator
Corporate Governance & Compliance
mobile +49 174 345 8125
e-mail k.klostermann@aixtron.com
e-Mail: datenschutz@aixtron.com

3. General information on data processing

We process personal data in accordance with the regulations of the GDPR and the German Federal Data Protection Act (FDPA).

The processing is carried out in particular on the basis of:

Art. 6 (1) (b) GDPR (performance of a contract or pre-contractual measures)
Art. 6 (1) (c) GDPR (legal obligation)
Art. 6 (1) (f) GDPR (legitimate interest, e.g. efficient organization of business processes)

4. Overview of data processing

Processing	Purposes	Data Types	Data subjects	Legal basis according to GDPR	Recipients	Transfer to third countries	Storage period
Customer data	Contract processing, customer communication, invoicing	Contact, contract and payment data	Customers	Art. 6 (1) (b) GDPR	Internal entities, hosting providers, payment service providers, affiliated companies	Transfer possible on the basis of standard contractual clauses (Art. 46 GDPR)	6-30 years (duration of the contractual relationship regarding the lifecycle of the customer's plant)
Supplier data	Contract execution, supplier management	Contact, contract and payment data	Suppliers	Art. 6 (1) (b) GDPR	Internal departments, IT Service Providers, Logistics Partners	Transfer possible in accordance with Art. 46 GDPR	6-30 years (depending on the duration of the contractual relationship)
Service providers	Examination of professional suitability, implementation of pre-contractual measures, compliance checks	Contact, contract and payment data; data on prof. skills	Service providers	Art. 6 (1) (b), (c), (f) GDPR	Internal departments, affiliated companies, IT service providers	Transfer possible on the basis of standard contractual clauses (Art. 46 GDPR)	6-30 years (duration of the selection process and statutory retention periods))
Applicant data	Implementation of application procedures	Application data	Applicants	Art. 6 (1) (b) GDPR, § 26 BDSG	Human Resources, Personnel Service Providers, internal departments	Transfer possible in accordance with Art. 46 GDPR	6 months (after completion of the application process)
Shareholder data	Legal obligations, communication	Contact and share data	Shareholders	Art. 6 Abs. 1 lit. c DSGVO, AktG	Share management service provider	None	According to the duration of the contract

5. Additional notes to the table

The table above provides an overview of the main processing activities.

The processing of personal data of service providers and business partners is carried out in particular for the purpose of conducting qualification checks, selecting suitable contractual partners and complying with legal and internal compliance requirements.

If data is transferred to third countries, this is done on the basis of appropriate safeguards in accordance with Art. 46 GDPR (e.g. standard contractual clauses). However, it cannot be excluded that there is no level of data protection in third countries comparable to the EU.

6. Your rights as a data subject

You have the following rights:

Right to information (Art. 15 GDPR)
Right to rectification (Art. 16 GDPR)
Right to erasure (Art. 17 GDPR)
Right to restriction of processing (Art. 18 GDPR)
Right to data portability (Art. 20 GDPR)
Right to object (Art. 21 GDPR)

Right to object:
Insofar as the processing is based on Art. 6 (1) (f) GDPR, you can object at any time.

Withdrawal of consent:
If processing is based on your consent, you can revoke it at any time with effect for the future.

To exercise your rights, please contact the Data Protection Coordination, pls see above.

7. Right to lodge a complaint with a supervisory authority

You have the right to complain to a data protection supervisory authority.

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Postfach 20 04 44
40102 Düsseldorf
Phone.: +49 0211 38424 0
E-Mail: poststelle@ldi.nrw.de

8. Obligation to provide data

The provision of personal data is sometimes required by law or contract. Without this data, it may not be possible to carry out contractual relationships or pre-contractual measures.