Madaus Capital Partners GmbH, with its registered office at Triftstraße 13, 80538 Munich, Germany (hereinafter referred to as "Madaus" or "we") is the data controller within the meaning of Article 4 (7) of the General Data Protection Regulation ("GDPR"). Unless otherwise specified, we are responsible for the processing of personal data collected through the use of our website www.madaus-investment.de. We respect your privacy by processing and protecting the personal data you provide to us in accordance with applicable data protection laws. In this Privacy Policy, we explain what personal data we collect, use and for what purpose. We recommend that you read it carefully.

• Madaus Capital Partners Ltd.
• Triftstraße 13, 80538 Munich
• Phone number: 089 374 26 79 0
• E-mail address: backoffice@madaus.com

2.1 When visiting the website

2.1.1 When you access our website www.madaus-investment.de and portal.madauscp.de, the browser used on your terminal device automatically sends information to the server of our website. This information is temporarily stored in a so-called log file. The following information is collected without your intervention and stored until automated deletion:

• IP address of the requesting computer,
• Date and time of the request,
• Time zone difference from Greenwich Mean Time (GMT),
• Content of the request (concrete page),
• Access status/http status code,
• Amount of data transferred in each case,
• Website from which the request is made (referrer URL),
• The browser used and, if applicable, the operating system of your computer as well as the name of your access provider,
• Language and version of the browser software.

2.1.2 The aforementioned data will be processed by us for the following purposes:

• Ensuring a smooth connection of the website,
• Ensuring user-friendly use of our website,
• For the exploitation of network and information security,
• Evaluation of system security and stability, and
• for other administrative purposes.

2.1.3 The legal basis for data processing is Art. 6 para. 1 p. 1 lit. f DSGVO. Our legitimate interest follows from the purposes for data collection listed above. In no case do we use the collected data for the purpose of drawing conclusions about your person. In addition, we use cookies and analysis services when you visit our website. You can find more detailed explanations of this under point 5 of this data protection declaration.

2.2 When registering for our newsletter

If you register for our newsletter, we collect the following personal data from you:

• First and last name
• E-mail address
• Address.

The collection of this data is based on your consent according to Art. 6 para. 1, p. 1 lit. a DSGVO. You can revoke your consent at any time with effect for the future. To do so, use the above e-mail address from us or unsubscribe from the newsletter, e.g. via a link at the end of each newsletter. The revocation has the consequence that Madaus will no longer continue the data processing based on this consent for the future and will delete the data, unless there is another legal basis or there are legal retention obligations.

2.3 Contact form or other means of contact

If you use the contact form offered on the website or contact us in any other way, we collect the following data from you:

• First and last name
• E-mail address
• Your request
• Phone number

All other information is provided voluntarily and is not required for processing the request. The collection of this data is based on your consent according to Art. 6 para. 1 p. 1 lit. a DSGVO. You can revoke your consent at any time with effect for the future. To do so, use the above-mentioned e-mail address from us. The revocation has the consequence that Madaus will no longer continue the data processing based on this consent for the future and will delete the data, unless there is another legal basis or there are legal retention obligations

3.1 In order to carry out our business operations and provide this website, we may grant access to your personal data to our appointed order processors and other service providers. These are service providers that we require for the operation of our website and the processing of data stored or transmitted by the systems (e.g. data center performance, payment processing, IT security). The legal basis for the transfer is Art. 6 para. 1 p. lit. b or lit. f DSGVO. In addition, we may transfer your personal data to government bodies or authorities, insofar as this is necessary to fulfill a legal obligation. This is done on the basis of Art. 6 para. 1 lit. c DSGVO. A transfer also takes place to our appointed persons (e.g. employees, business customers). This is done on the basis of your consent according to Art. 6 para. 1 lit. a DSGVO or for the fulfillment of contract law according to Art. 6 para. 1 lit. b DSGVO.

3.2 If we process personal data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)) or if this is done in the context of using third-party services or disclosing or transferring data to third parties, this is only done if it is done in order to fulfill our (pre-)contractual obligations, on the basis of your consent, due to a legal obligation or on the basis of our legitimate interests. If there are no legal permissions, we only allow data to be processed in a third country if the special requirements of Art. 44 ff. DSGVO are met.

Your personal data will be deleted or blocked as soon as the purpose or legal basis for the storage ceases to apply.

However, storage may take place beyond the specified time in the event of a (threatened) legal dispute with you or other legal proceedings or if storage is provided for by legal regulations to which we are subject as the responsible party. If the storage period prescribed by the legal regulations expires, the personal data will be blocked or deleted, unless further storage by us is necessary and there is a legal basis for this.

We use only necessary cookies on our website. These are the following cookies:

You can assert your rights as a data subject regarding your processed personal data at any time by contacting us using the contact details provided at the beginning of section 1. As a data subject, you have the right:

• to request information about your personal data processed by us in accordance with Art. 15 DSGVO. In particular, you can request information about the processing purposes, the category of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned storage period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right of complaint, the origin of your data if it has not been collected by us, as well as the existence of automated decision-making, including profiling, and, if applicable, meaningful information about its details;

• demand the correction of incorrect or incomplete personal data stored by us without delay in accordance with Art. 16 DSGVO;

• pursuant to Art. 17 DSGVO to request the erasure of your personal data stored by us, unless the processing is necessary for the exercise of the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the assertion, exercise or defence of legal claims;

• to request the restriction of the processing of your personal data in accordance with Art. 18 DSGVO, insofar as the accuracy of the data is disputed by you, the processing is unlawful, but you object to its erasure and we no longer require the data, but you need it for the assertion, exercise or defence of legal claims or you have objected to the processing in accordance with Art. 21 DSGVO;

• pursuant to Art. 20 DSGVO to receive your personal data that you have provided to us in a structured, common and machine-readable format or to request the transfer to another controller;

• object to the processing pursuant to Art.21-DSGVO, provided that the processing is based on Art. 6 (1) lit. e or f DSGVO. This is particularly the case if the processing is not necessary for the performance of a contract with you. Unless it is an objection to direct marketing, when exercising such a right of objection, we ask you to explain the reasons why we should not process your data as we have done. In the event of your justified objection, we will review the situation and either discontinue or adjust the data processing or show you our compelling legitimate grounds on the basis of which we will continue the processing;

• in accordance with Art. 7 (3) DSGVO, to revoke your consent once given - i.e. your voluntary will, made understandable in an informed manner and unambiguously by means of a statement or other unambiguous confirming action, that you agree to the processing of the personal data in question for one or more specific purposes - at any time vis-à-vis us, if you have given such consent. This has the consequence that we may no longer continue the data processing based on this consent for the future and

• complain to a data protection supervisory authority about the processing of your personal data in our company in accordance with Art. 77 DSGVO, such as the data protection supervisory authority responsible for us: Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 189, 1522 Ansbach, poststelle@lda.bayern.de, https://www.lda.bayern.de.

Within the website visit, we use the widespread SSL protocol (Secure Socket Layer) in connection with the highest encryption level supported by your browser. As a rule, this is a 256-bit encryption. If your browser does not support 256-bit encryption, we use 128-bit v3 technology instead. You can tell whether an individual page of our website is encrypted by the closed key or lock symbol in the lower status bar of your browser. We also use appropriate technical and organizational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction or against unauthorized access by third parties. Our security measures are continuously improved in line with technological developments.

This privacy policy is currently valid as of April 2023.

Due to the further development of our website and offers on it or due to changed legal or official requirements, it may become necessary to change this data protection declaration.