Heinz Hermann Thiele“- Employee Share Plan

The protection of personal data is important to us. That is why Knorr-Bremse processes your data in accordance with the provisions of the European General Data Protection Regulation (GDPR) and other applicable legislation on data protection and data security.

This data protection notice contains information on how we process your personal data as part of the “Heinz Hermann Thiele” - employee share plan, what measures we have taken to protect your data, and what rights you have in relation to your personal data.

1. The controller for the processing of your personal data is:

Knorr-Bremse AG
Moosacher Str. 80
D-80809 München
Tel.: +49 89 3547-0
By email: info@knorr-bremse.com

The contact details of the data protection officer are:

Knorr-Bremse Group Data Protection Officer
Moosacher Str. 80
D-80809 München
By email: datenschutzbeauftragter@knorr-bremse.com

2. Purpose and legal basis of data processing

Pre-registration for participation in the employee share plan

In order to register on our website for participation in the employee share plan, we ask you to provide the following information

- First name, last name, date of birth (for identification purposes), company, country
- Optional information: Person ID, business or private email address

The legal basis for the processing of your personal data is your consent in accordance with Art. 6 para. 1 lit. a) GDPR.

Eligibility and access data for the employee share plan

Once you have registered, Knorr-Bremse processes the following data in order to check your eligibility and send you the access data for the employee share plan:
- Master data: First name/last name, personnel number, date of birth, citizenship), tax number if applicable (Germany only).
- Contact data: First name/last name, address (private), e-mail address (business or private), telephone number (business)
- Employment data: Position, organizational unit, department, country, employment status, cost center

If applicable, we receive the data from the Knorr-Bremse company with which you have your employment relationship.

The legal basis for the processing of your personal data is your consent in accordance with Art. 6 para. 1 lit. a) GDPR.

Participation in the employee share plan

The following additional data will be processed if you decide to participate in the employee share plan:

- Account/portfolio number, information on the use of the employee share plan, extent of participation, stock holdings (number and value of stocks, plan-related dates, transaction data (e.g., stock sales, transfers.)
- If necessary, additional tax-relevant information for the determination of final withholding tax, solidarity surcharge and church tax; if required, information on the tax-relevant place of residence, if this differs from the aforementioned place of residence
- Optional information: different postal address, private e-mail address, private telephone number
- Information on the use of the platform, login information

The legal basis for processing of your personal data within the framework of participation in the employee share plan is Art. 6 para. 1 lit. b) GDPR (contract with subject).

3. Transfer and disclosure of your personal data

Knorr-Bremse will transfer your data to credit institutions in compliance with data protection regulations insofar as this is necessary for the fulfilment of the contract. Apart from this, we will not pass on your data to other third parties without your consent, unless we are obliged to do so by law.

Knorr-Bremse commissions service providers (processors) to process your personal data for IT support and administrative handling of the employee share plan. These processors are contractually obliged to comply with data protection regulations.

The recipients of your personal data may be based in countries outside the European Union where the applicable law does not guarantee the same level of data protection as in your home country. In such cases, we ensure that an appropriate level of protection is guaranteed for your data by means of contractual agreements based on EU standard contractual clauses together, if necessary, with additional technical and organizational measures. Further information and a copy of the measures implemented are available upon request.

4. Storage time limits

If you decide not to participate in the employee share plan and have not registered on the service provider's platform, your data will be deleted 2 weeks after the end of the subscription period. Otherwise, your personal data will be deleted when it is no longer required to fulfil the above-mentioned purposes, and statutory retention obligations (e.g. tax or commercial law retention obligations) do not prevent deletion.

5. Your rights

Inasmuch as the legal requirements have been met, you have the right

- to request confirmation as to whether we are processing personal data about you
- and to receive information about the personal data that we have processed,
- to request the correction or completion of incorrect or incomplete data,
- to request the deletion of your personal data,
- to request the restriction of the processing of your personal data,
- to request the transfer of your personal data within the scope of the legal requirements.

- Inasmuch as we process your personal data on the basis of your consent, you can withdraw this consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

6. Right of objection

If the processing of your data is required to protect a legitimate interest of Knorr-Bremse, you may object to the processing at any time on grounds relating to your particular situation. Knorr-Bremse will then no longer process your data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing is required to assert, exercise or defend legal claims.

7. Contact person

Please direct any questions about the employee share plan to info-esp@knorr-bremse.com

If you have any questions about data protection or wish to exercise your rights, please contact the Knorr-Bremse data protection organization at privacy@knorr-bremse.com

We take your requests very seriously and are committed to address any of your concerns. Nonetheless, you have the right to file a complaint with a competent data protection authority at any time. In Bavaria, the competent supervisory authority is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.

Update: February 26, 2026