Exhibit
III. Transfer of Personal Data
The Company may disclose personal data to an external service provider (“External Service Provider”), in particular to Solium Capital UK LTD. (“Shareworks”), commissioned or involved for the purposes of the administration, processing and/or execution of the RSUP in order to support the processing of personal data for the processing purpose set out in Section II above. If and to the extent permitted by law, the Company may also commission other third parties to provide certain services, such as IT-services and legal services, for the processing purpose set out in Section II above and may disclose personal data to such third parties. These recipients provide their assistance or services to the Company under its control and direction and may have access to personal data to the extent necessary to provide their assistance or services.
In addition, the Company may, to the extent required and permitted by law, transfer personal data to domestic and foreign authorities or courts in order to fulfil legal obligations.
IV. Storage and Deletion of Personal Data
The Company processes the personal data within the framework of the participation of the Data Subjects in the RSUP. The Company deletes the personal data if it no longer needs it for the fulfilment of its contractual obligations under the RSUP and if there are no legal storage obligations. In the event of a legal obligation to retain personal data, the Company shall restrict the processing of such personal data.
V. Rights of the Data Subjects
The Data Subjects may, at any time and free of charge, contact the Company or its Data Protection Officer directly with an informal notification in order to exercise their rights under the GDPR. The Data Subjects have the right, subject to the legal requirements, the fulfilment of which is to be examined on a case-by-case basis, to request information on their personal data, any rectification or deletion of their personal data, information regarding restrictions on the processing of their personal data and they have the right to receive their personal data in a structured, generally used and machine-readable format.
The Data Subjects also have the right to object to the processing of their personal data, subject to the legal requirements, the fulfilment of which must be examined on a case-by-case basis.
In addition, Data Subjects have the right to lodge a complaint with a supervisory authority.
Page 22/22