| salary, citizenship, job title, any Shares or directorships held in the Company, and details of all awards, canceled, vested, or outstanding in the Grantee’s favor, which the Company receives from the Grantee. If the Company offers the Grantee the opportunity to participate in the Plan, then the Company will collect the Grantee’s personal data for purposes of allocating Shares and implementing, administering and managing the Plan. The Company’s legal basis for the processing of the Grantee’s personal data would be the Grantee’s consent. Stock Plan Administration Service Providers. The Company may transfer personal data to a designated broker, an independent service provider, to assist the Company with the implementation, administration and management of the Plan. In the future, the Company may select a different service provider and share the Grantee’s personal data with another company that serves in similar capacities. The Company’s service providers may open an account for the Grantee. The Grantee may be asked to agree on separate terms and data processing practices with the applicable service providers, which, as it relates to Plan administration service provider, is a condition to the Grantee’s ability to participate in the Plan. The Grantee should note that his or her country may have enacted data privacy laws that are different from the service provider. The Company’s legal basis for the transfer of the Grantee’s personal data would be the Grantee’s consent. Data Retention. The Company will use the Grantee’s personal data only as long as is necessary to implement, administer and manage the Grantee’s participation in the Plan or as required to comply with legal or regulatory obligations, including under tax and security laws. When the Company no longer needs the Grantee’s personal data, the Company will remove it from it from its systems. Voluntariness and Consequences of Consent Denial or Withdrawal. The Grantee’s participation in the Plan and the Grantee’s grant of consent is purely voluntary. The Grantee may deny or withdraw his or her consent at any time. If the Grantee does not consent, or if the Grantee withdraws his or her consent, the Grantee cannot participate in the Plan. This would not affect the Grantee’s base compensation as a director; the Grantee would merely forfeit the opportunities associated with the Plan. Data Subject Rights. The Grantee has a number of rights under data privacy laws in his or her country. Depending on where the Grantee is based, his or her rights may include the right to (i) request access or copies of personal data the Company processes, (ii) rectification of incorrect data, (iii) deletion of data, (iv) restrictions on processing, (v) portability of data, (vi) to lodge complaints with competent authorities in the Grantee’s country, and/or (vii) a list with the names and addresses of any potential recipients of the Grantee’s personal data. To receive clarification regarding the Grantee’s rights or to exercise the rights, the Grantee should please contact the Company at Attn: Share Plan Administrator, Einsteinring 9, 85609 Aschheim/Munich, Germany. The Grantee also understands that the Company may rely on a different legal basis for the processing or transfer of data in the future and/or request the Grantee to provide another data privacy consent. If applicable and upon |