Compliance – Reporting System

SEEBURGER regards information security as a key corporate objective and takes it into account in all company processes. Protecting the information of customers, partners and employees is just as important to us as protecting our own know-how.

It is therefore the task of company management to set targets at regular intervals in order to achieve a high standard of information security.

In this way, we ensure that the organizational and operational structure with regard to information security is clearly regulated, that it is integrated into all relevant business processes, that responsibilities are regulated and that the reliable implementation of processes and procedures is guaranteed.

Our Global Head of Governance, Risk, and Compliance is responsible for the worldwide SEEBURGER information security management system and for the creation of information security guidelines. She reports directly to the Co-CEO Michael Kleeberg.

As part of our ISMS, supplier management is of great importance to us, as it has a direct impact on the security of our organization's data and systems. To ensure efficient supplier management, we follow the following practices:

• Comprehensive procedure for selecting providers
• Clear and detailed contracts
• Regular performance monitoring
• Open communication channels

The topic-specific guidelines are defined, approved by the management, published, forwarded to the relevant employees and interested parties, and confirmed by them.

Our guidelines are reviewed regularly, at least once a year or in the event of important changes. In this way, we ensure the suitability, appropriateness, and effectiveness of the management guidelines and confirm that they continue to comply with business, legal, statutory, regulatory, and contractual requirements.

Inquiries from authorities or regulatory bodies are forwarded immediately to the Global Chief Compliance Officer (CCO) Dr. Zsófia Körmendy and the responsible Co-CEO Michael Kleeberg. These are formally and centrally documented to ensure that all relevant information is recorded and stored in one place. The legal assessment is carried out by the qualified employees of SEEBURGER's legal and compliance department. If necessary, external legal advisors are consulted.

Careful consideration is given to whether the requested data is classified as confidential or particularly worthy of protection.

We rely on transparent and cooperative collaboration with the authorities to ensure that misunderstandings are avoided. If a request is unlawful or inappropriate, SEEBURGER will formally object to the request and, if necessary, take legal action to protect the rights of customers and employees.

SEEBURGER shall inform the affected (cloud) customer(s) immediately and, where possible, obtain their consent to disclose the data, after receiving a request for information from a government authority. An exception exists if the applicable legal basis on which the state authority relies prohibits this or there are clear indications that an illegal act has been committed in connection with the use of the cloud service.

Conditions for access to or disclosure of data in the context of investigations:

Access to or disclosure of data of (cloud) customers or employees in the context of investigation requests from government authorities will only take place if the legal examination shows that there is an applicable and valid legal basis and the investigation request must be granted on this basis.

Restrictions on access to or disclosure of data in the context of investigations:

With respect to the procedures for establishing access to or disclosure of data in response to investigative requests from government authorities, only the data necessary to fulfill the requirements of the request will be disclosed. This is to ensure that the intrusion into the privacy of our customers and employees is kept to the absolute minimum necessary. Where possible, the requested data is anonymized or pseudonymized in order to protect the identity of the data subjects.

Every request for information and the subsequent disclosure of data are documented and recorded in detail to ensure transparency and traceability.

Training courses:

All relevant employees receive regular training to ensure that they are familiar with the procedures for handling investigation requests and implement them correctly.