Hamburger Hafen und Logistik : Data protection information whistleblower system

Data protection information

Information on data protection within the scope of HHLA's whistleblower system

Hamburger Hafen und Logistik AG (hereinafter referred to as "HHLA", "we", "us") ensures compliance with legal standards and internal company guidelines by means of an appropriate compliance management system. This includes, among other things, the implementation and operation of a whistleblower system by HHLA. HHLA ensures that whistleblowers who provide information about occurrences in good faith will not suffer any disadvantages from this. In this context, there is a special contact option for information on potential compliance violations. All communications will be treated confidentially and can also be made anonymously.

In accordance with Articles 13 and 14 of the General Data Protection Regulation (GDPR), we would like to inform you about the collection, processing and use of personal data within the scope of our whistleblowing system if you submit notifications and hints via our HHLA whistleblower portal (BKMS® System), the Compliance Hotline, by e-mail, letter or personal appearance in the Compliance department. We process personal data as part of our whistleblower system only in accordance with the applicable data protection regulations, which result in particular from the GDPR and the German Federal Data Protection Act (BDSG).

1. Data Controller

Hamburger Hafen und Logistik Aktiengesellschaft

Bei St. Annen 1

20457 Hamburg compliance@hhla.de

You can reach our data protection officer at the above address or at datenschutz@hhla.de.

2. Purpose of our whistleblower system and related data processing and legal basis

In order to ensure legal compliance with applicable laws and guidelines in our business operations, HHLA has implemented a whistleblower system as one of the measures. The use of our whistleblower system is on a voluntary basis, whereby our employees are obliged under our Compliance Guideline to inform their respective superior or the Compliance Officer without undue delay if they become aware of any events that constitute a breach of the Code of Conduct and/or applicable law or that are likely to cause economic or reputational damage to the HHLA Group.

Seite 1 / 3

Data protection information

When you submit a report, we collect the following personal data and information:

• Your name, if you do not wish to make your report anonymously
• Your contact information, if you provide it to us
• The information that you have submitted a report via the whistleblower system
• Information on whether you are submitting a report as an external person (e.g. as an employee of a business partner) or as an employee of ours and, if so, in which area/department you are employed by us
• Information you provide to us in your report (e.g. names of persons as well as other personal data you mention in your report)

In the context of further clarification measures, we may process further data or data categories about you (e.g. information on relevant facts, operational documents), depending on the need for clarification of the underlying facts.

You will receive separate data protection information on the collection, processing and use of personal data in the context of our HHLA whistleblower portal (BKMS® System) when you access the whistleblower portal and submit a report.

We process your data only insofar as this is permitted by a relevant legal basis (in particular the provisions of the GDPR and the BDSG).

3. Confidential treatment of information and disclosure to third parties

The information is generally received by HHLA's Compliance department (RV4). Data will only be passed on if it is intended to be passed on, if you have expressly consented to this in advance or if we are obliged or authorised to do so by law. Information via the HHLA whistleblower portal (BKMS® System) is received by a narrow circle of expressly authorised and specially trained employees of the HHLA compliance organisation and is always treated confidentially. Further information about the HHLA whistleblower portal (BKMS® System) can be found by accessing the HHLA whistleblower portal and submitting a report.

4. Data storage

Personal data will be stored as long as it is required for clarification and final assessment, there is a legitimate interest of the company or it is required by law. If the underlying purposes cease to apply or any statutory retention and documentation obligations no longer conflict, this data will be deleted in accordance with the statutory provisions. The duration of storage may also depend in particular on the severity of the suspicion, the nature of the reported possible compliance violation and the complexity of the facts.

Seite 2 / 3

Data protection information

5. Your data protection rights

As a data subject, you have the right to obtain information about the personal data concerning you, as well as the right to have inaccurate data corrected or to have it deleted, provided that one of the reasons stated in Art. 17 of the GDPR applies, e.g. if the data is no longer required for the purposes pursued. You have also the right to restriction of processing if one of the conditions mentioned in Art. 18 GDPR exists and in the cases of Art. 20 GDPR the right to data portability or revoke granted consent pursuant to Art. 7 (3) GDPR or object the data processing pursuant to Art. 21 DSGVO.

Every data subject has the right to lodge a complaint with a supervisory authority if he or she believes that the processing of data relating to him or her violates data protection provisions. The right to lodge a complaint may in particular be asserted before a supervisory authority in the Member State of the data subject's place of residence or place of work or the place of the alleged infringement. The competent supervisory authority in Hamburg is:

The Hamburg Commissioner for Data Protection and Freedom of Information of the Free and Hanseatic City of Hamburg, Ludwig-Erhard-Str 22, 20459 Hamburg, e-mail: mailbox@datenschutz.hamburg.de.

Contact details of the data protection officer:

You also have the right to contact the data protection officer at any time (datenschutz@hhla.de).

Seite 3 / 3