Privacy notice for event management with catering and content production

This privacy notice for events ("Privacy notice") applies to the B&R Group, i.e. B&R Industrial Automation GmbH, Austria and any company in which B&R Industrial Automation GmbH directly or indirectly holds a majority interest or owns or controls the majority of voting rights. B&R Industrial Automation GmbH is in turn part of the ABB Group (a 100% subsidiary of ABB Asea Brown Boveri Ltd.). The B&R company whose business premises you enter during your visit, or on which you are staying as a result of an invitation from B&R (event, contract negotiations, etc.) or for the purpose of providing a contractually agreed service (hereinafter referred to as "B&R"), is responsible for processing your personal data and controls its use in accordance with this privacy notice.

At B&R, protecting your personal data is a top priority. This privacy notice explains how we process your personal data and what rights you have in relation to your personal data.

B&R Industrial Automation GmbH and all B&R subsidiaries are responsible for your personal data. In accordance with applicable data protection laws, the person responsible for processing your personal data is the B&R subsidiary on whose premises you are located and which communicates with you. Furthermore, other B&R subsidiaries may receive and process your data, either as the data controller or the data processor. Accordingly, this privacy notice applies equally to them.

In your case, B&R Industrial Automation GmbH, B&R Strasse 1, 5142 Eggelsberg, Austria or the respective company affiliated with B&R Industrial Automation GmbH will decide, as the "responsible party" within the meaning of the General Data Protection Regulation ("GDPR") and the Austrian Data Protection Act or other applicable national data protection laws at the headquarters of the respective subsidiary, for what and how your personal data will be used in accordance with this privacy notice (hereinafter also referred to as "B&R", "we" or "us").

We collect and use the personal data that we receive from you in connection with the event and our content production.

We process the following categories of your personal data to the extent required for the purposes of processing in accordance with this privacy notice:

• The contact information you share with us to register and communicate in the course of the event, such as first name, last name, profession/position / title, business email address, postal address, telephone, cell phone and fax numbers, gender, date of birth.
• Additional information that you provide us for accommodation arrangements and invoicing, such as business address, passport number, nationality, place of birth, emergency contact name and number, credit card number.
• Media assets such as photographs, images, videos and recordings in the course of an event, interview, photoshoot or other appointments.

The below-mentioned types of personal data are only collected and processed, if at all, in accordance with applicable local laws in your country of residence and justified on a legal basis:

Special categories of personal data such as the information about your food preferences and allergies you share with us in the course of the event (e.g. dietary requirements).

If you wish to obtain information about a specific data processing activity, please send a request to www.abb.com/privacy.

We may use your personal data as described above for the following purposes:

• To register your attendance to events and forums
• To provide you with information and services associated with the event
• To provide a personal event experience
• To facilitate the event and provide you with an acceptable service (e.g. dietary requirements to organize catering)
• To make travel arrangements and reserve hotel accommodations where requested
• To conduct and facilitate event satisfaction surveys
• To create media assets (photographs, videos and recordings) to showcase event impressions and store those assets in our brand database
• To produce content for articles, publications, press releases and brochures
• To publish media assets, articles, publications, press releases and brochures on ABB channels, third party channels and social media channels

We only collect the personal data from you that we require for the purposes described above. For statistical purposes, to improve our services and to test our IT systems, we use anonymous data as much as reasonably possible. This means that you can no longer be directly or indirectly identified as an individual using this data.

We process your personal data for the purposes described above in accordance with the provisions of the GDPR and the Austrian Data Protection Act, especially in accordance with the following applicable legal bases:

• We will request your consent for the activities described in this privacy notice, for example to collect any information about dietary requirements as these types of data are classified as special categories of personal data and for the publication of your image on different channels; and
• Where required, we process your personal data within the scope of your specific visit to our offices and premises, or your stay on our premises, as well as the existing business relationship with you or your company, in order to safeguard legitimate interests (ours and that of third parties). Our legitimate interests to collect and use the personal data for this purpose are event management and interaction (e.g. registration, organizing accommodation, publishing media assets that focus on the event, etc.)

To obtain a copy of our assessment of our legitimate interest in processing your personal data, including documented balancing of interests, please send a request to www.abb.com/privacy.

As part of a global corporation, we have business relationships with companies in the B&R Group and external service providers, both within and outside the European Economic Area (EEA), which we may also use to process your personal data. We will only share your personal data with other B&R companies or third parties if this is required for the purposes listed in the table below.

In this regard, your personal data may also be made available to companies of the B&R Group in countries within and outside of the EEA for the aforementioned processing purposes. In addition, when processing your personal data for the aforementioned purposes, we may use external service providers as data processors (e.g. facility management or security companies). They are generally used with binding instructions within the framework of an existing contractual relationship and receive your personal data only to the extent and for the period of time required to provide the service.

In case of suspicion of criminal offenses, we may also pass on your personal data to law enforcement agencies. Otherwise, your personal data will only be transferred to third parties if there is a legal basis for this transfer. This can be the case especially if the police or other security authorities take action in the context of so-called emergency response and demand access to video surveillance data.

If we share your personal data with a B&R company or third party and it is transferred or becomes accessible outside of the European Union ("EU") and the European Economic Area ("EEA") or outside the country in which the B&R company controlling your information is located, we will protect your personal data with appropriate safeguards. Examples of such safeguards include a determination of suitability by the European Commission or Standard Contractual Clauses. We have taken additional measures to protect your personal data when it is transferred outside the EU, EEA or the country where the B&R company controlling your data is located. If you would like an overview of the safeguards applied, please send a request to www.abb.com/privacy.

In principle, we process and store your personal data only as long as is necessary for the processing purposes stated in this privacy notice, until you withdraw your consent granted under Art. 6 (1) a) of the GDPR or until you object to the use of your personal data if a legitimate interest is the legal basis for processing (Art. 6 (1), f) of the GDPR).

However, legal provisions require B&R to store certain personal data for minimum retention periods. In general, the personal data used for visitor management is stored for a period of 3 to 12 months and is only kept for a longer period if this is necessary due to local laws and official requirements or to defend legal claims.

At the same time, applicable data protection laws require that we store and process your personal data in a form that identifies you for no longer than is necessary for the purpose for which the personal data was collected and that we carry out regular checks in this regard. Through settings in IT systems and guidelines, we ensure that your personal data is deleted as soon as it is no longer needed.

If you have questions about data protection, complaints about how we are handling your personal data or wish to exercise the rights of data subjects listed below, you can contact us at . Under certain circumstances, we may have to restrict these rights of data subjects in order to safeguard the public interest (e.g. the prevention or detection of criminal offenses) or our business interests (e.g. maintaining legal privilege). Should you not be satisfied with our response or believe we are processing your personal data unlawfully, you may also contact the Data Protection Authority in your country of residence or work or in which you believe the data breach may have taken place in accordance with your right to lodge a complaint per Art. 77 of the GDPR. In addition to your right to lodge a complaint, you also have the following rights:

• Right to information: In accordance with Art. 15 of the GDPR, you have the right to receive information from us regarding your personal data that we process at any time upon request (in text form). This right is limited by the exceptions of Art. 4 (6) of the Austrian Data Protection Act, according to which the right of information is not applicable in particular if the provision of this information would endanger a business or trade secret of the data controller or of a third party.
• Right to rectification: In accordance with Art. 16 of the GDPR, you have the right to request that we rectify your personal data without delay if it is incorrect. This right is subject to the restrictions set out in Art. 4 (2) of the Austrian Data Protection Act, according to which, in the event that the correction of personal data processed with the aid of automation cannot be carried out immediately because it is only possible at certain times for economic or technical reasons, the processing of the personal data in question must be restricted with the effect of Art. 18 (2) of the GDPR until this point in time.
• Right to erasure: You have the right to request us to delete your personal data under the conditions set out in Art. 17 of the GDPR. These conditions are particularly met if a) the respective processing purpose has been achieved or otherwise ceases to apply, b) we have processed your data unlawfully, c) you have withdrawn your consent without the data processing being able to be continued on another legal basis, d) you successfully object to the data processing or e) in cases where there is an obligation to delete the data on the basis of EU law or the law of an EU member state to which we are subject. This right is subject to the restrictions set out in Art. 4 (2) of the Austrian Data Protection Act, according to which, in the event that the deletion of personal data processed with the aid of automation cannot be carried out immediately because it is only possible at certain times for economic or technical reasons, the processing of the personal data in question must be restricted with the effect of Art. 18 (2) of the GDPR until this point in time.
• Right to restrict processing: In accordance with Art. 18 of the GDPR, you can request that we only process your personal data to a limited extent. This right exists in particular under the conditions that a) the accuracy of the personal data is disputed, b) you request limited processing instead of deletion under the conditions of a justified request for deletion, c) the data is no longer necessary for the purposes we pursue, but you need the data to assert, exercise or defend legal claims, or d) the success of an objection is still disputed.
• Right to data portability: In accordance with Art. 20 of the GDPR, you have the right to receive your personal data that you provided us in a structured, common, machine-readable format, as well as the right to have us transfer this data to another data controller.
• Right to object: In accordance with Art. 21 of the GDPR, you have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data, either in the public interest or to safeguard our legitimate interests. Thereafter, we will stop processing your personal data unless we can prove compelling reasons for processing your personal data that are worthy of protection, which outweigh your interests, rights and freedoms or unless such processing serves to assert, exercise or defend legal claims. If you object to the processing of your personal data for marketing purposes, we will stop processing your data in any case.

This Privacy Notice may be updated from time to time as a result of required developments. In case of such updates, we will undertake necessary actions to inform you about them depending on the importance of changes done. If and where required by applicable laws we will also ask for your consent to any material Privacy Notice changes describing our up-to-date practices. Please check the "date of publication" to see when this Privacy Notice was updated.

Date of publication: May, 2022