Annual General Meeting
of flatexDEGIRO SE on 02 June 2026

Information on data processing and data protection for shareholders and their representatives

For flatexDEGIRO SE, data protection for shareholders listed in the share register and their representatives in connection with the general meetings is of utmost importance.

The following information provides details about the processing of your personal data and, where applicable, that of your authorized representatives by flatexDEGIRO SE in connection with the flatexDEGIRO SE Annual General Meeting and your rights under data protection law.

Who is responsible for processing my data and who can I contact if I have questions regarding data protection?

The Controller within the meaning of the EU General Data Protection Regulation is:
flatexDEGIRO SE
Omniturm, Große Gallusstraße 16-18
60312 Frankfurt am Main
Phone: +49 (0) 69 450001 0
Email: kundeninfo@flatexdegiro.com
Website: www.flatexdegiro.com

Our Data Protection Officer can be contacted at:
flatexDEGIRO SE
Data Protection Officer
Omniturm, Große Gallusstraße 16-18
60312 Frankfurt am Main
Telefon: +49 (0) 69 450001 0
Email: privacy@flatexdegiro.com

Where do we receive your data from?

If you become a shareholder of flatexDEGIRO SE, we will process your personal data for the purpose of maintaining the share register. The shares of flatexDEGIRO SE are registered shares with no par value. In the case of such registered shares, Section 67 of the German Stock Corporation Act (AktG) stipulates that they must be entered in the company's share register, stating the shareholder's surname, first name, date of birth, address, and email address, as well as the number of shares. As a shareholder, you are generally obliged to provide flatexDEGIRO SE with this information. The credit institutions involved in the purchase, custody, or sale of your flatexDEGIRO shares regularly forward this information and other details relevant to the maintenance of the share register (e.g., nationality and submitting bank) to the share register. This is done via Clearstream Europe AG, which, as a central securities depository, handles the technical processing of securities transactions and the custody of shares for credit institutions.

If you register for the Annual General Meeting as a shareholder or exercise shareholder rights, for example by using the online service for shareholders of flatexDEGIRO SE, we process your personal data. In the event of a power of attorney or legal representation, we also process the personal data of your representatives.

We also process your personal data if you agree or have agreed to receive the invitation to the Annual General Meeting by email.

Finally, when you contact us and make inquiries, we process the personal data that you have provided us with in the context of your inquiry and that is necessary to respond to your inquiry.

What personal data do we collect from you in connection with the Annual General Meeting?

Personal data is any information that relates to you or can be associated with you. This includes, among other things, your name, address, date of birth, and IP address. By “processing,” we mean the collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

In particular, we process the following categories of personal data of shareholders or their representatives in the context of the Annual General Meeting of flatexDEGIRO SE:

• Title, surname, first name, contact details (e.g., address, email address, and telephone number, if provided),
• Date of birth,
• custodian bank,
• share-related data (e.g., number of shares, share class, type of share ownership, voting rights),
• general meeting-related data (e.g., shareholder number for registration, information on the exercise of voting rights),
• the content of a statement, speech, or motion.

Speeches are part of the Annual General Meeting and are broadcast, for example, via livestream in the online service, which is accessible via the company's website at www.flatexdegiro.com/agm-service.

When you log in to the online service, we also process the following data about you, which is automatically transmitted to us via your browser:

• the name of the file accessed,
• the date and time of your visit,
• a notification as to whether the retrieval was successful,
• the web browser you are using,
• the website you visited on our site,
• the website from which you visited us, and
• the IP address of the device you are using to access our Online Service.

For what purposes do we process your data and on what legal basis?

flatexDEGIRO SE processes your personal data in accordance with the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), the Regulation on the European Company (SE-VO), the German Stock Corporation Act (AktG) and all other relevant legal provisions.

flatexDEGIRO SE initially uses your personal data for the purposes specified in the German Stock Corporation Act. These include, in particular,

• maintaining the share register,
• preparing, conducting, and following up on general meetings, including enabling the exercise of shareholder rights before and during the general meeting, such as the right to submit comments before the general meeting and the right to speak live and submit motions at the general meeting, and
• communicating with you as a shareholder.

The legal basis for the processing of your personal data in these cases is the provisions of the Regulation on the European Company and the German Stock Corporation Act in conjunction with Art. 6 (1) subpara. 1 lit. (c) and (4) GDPR and, if you register to receive the invitation to general meetings by email, your consent in accordance with Art. 6 (1) subpara. 1 lit. a) GDPR.

In addition, flatexDEGIRO SE also processes your data on the basis of a legitimate interest, for example to compile statistical evaluations or in connection with the live broadcast of the Annual General Meeting in the Online Service for shareholders. During the live broadcast of the Annual General Meeting, the audience or individual persons may be filmed. This also applies to verbal contributions. This processing serves the legitimate interest of flatexDEGIRO SE in enabling shareholders to follow the Annual General Meeting via the Internet in accordance with the express permission granted in the German Stock Corporation Act and the company's Articles of Association. The legal basis for the processing of your personal data in these cases is Art. 6 (1) subpara. 1 lit. (f) GDPR.

If you send us personal data with an inquiry, the legal basis for processing it for the purpose of responding is also Art. 6 (1) subpara. 1 lit. (f) GDPR.

Finally, your personal data may also be processed to fulfill other legal obligations, such as regulatory requirements and corporate, commercial, and tax law retention obligations. For example, when authorizing the proxy appointed by the company for the Annual General Meeting, it is mandatory to record the data serving as proof of authorization in a verifiable manner and to store it in an access-protected manner for three years (Section 134 (3) sentence 5 AktG). In this case, the legal basis for processing is the respective legal obligations in conjunction with Art. 6 (1) subpara. 1 lit. (c) GDPR.

If we intend to process your personal data for another purpose, we will inform you in advance in accordance with the statutory provisions and provide you with the relevant legal basis for the processing.

Who will receive my data?

Within flatexDEGIRO SE, all persons who need your data to fulfill the aforementioned purposes have access to it.

ADEUS Aktienregister-Service-GmbH, Munich, is mandated to maintain the share register of flatexDEGIRO SE. flatexDEGIRO SE uses other external service providers for the technical handling of the Annual General Meeting. flatexDEGIRO SE only provides external service providers with the personal data necessary to execute their mandate, and they process this data exclusively on the basis of flatexDEGIRO SE’s instructions.

In addition to the company and any service providers and guests appointed by the company to conduct the virtual Annual General Meeting, access to the livestream of the Annual General Meeting is only permitted to shareholders and representatives who have access to the company's Online Service. A list of participants containing the personal data of the participants will be created during the Annual General Meeting of flatexDEGIRO SE. In accordance with Section 129 (4) of the German Stock Corporation Act (AktG), the list must be made available to all participants before the first vote, and in the case of a virtual Annual General Meeting, to all shareholders and representatives of shareholders who are connected to the meeting electronically. Upon request, each shareholder shall be granted access to the list of participants for up to two years after the Annual General Meeting.

In addition, personal data will be disclosed in accordance with legal requirements when exercising shareholder rights. This is particularly the case in connection with the announcement of requests to supplement the agenda (Art. 56 SE-VO in conjunction with Section 124 (1) AktG) as well as counter-motions and election proposals from shareholders (Art. 53 SE-VO in conjunction with Sections 126, 127 AktG). If shareholders are given the opportunity to ask questions by electronic means during the virtual Annual General Meeting, this will be announced and processed on the basis of Art. 53 SE-VO in conjunction with Section 131 (1) and (1) f) AktG. The company may disclose the names and, if applicable, the registered offices/addresses of shareholders or their representatives who submit questions or comments or make speeches. The speeches will be made available to shareholders and shareholder representatives in image and sound during the Annual General Meeting. The company reserves the right to name questioners when answering questions.

In addition, it may be necessary by law to transfer your personal data to other recipients, in particular such as authorities, in order to fulfill certain requirements (e.g., when legally prescribed voting thresholds are exceeded, to tax authorities or law enforcement agencies).

How long do we store your data?

We delete your personal data in accordance with legal regulations, in particular if your personal data is no longer necessary for the original purposes of collection or processing, if the data is no longer required for any disputes regarding the formation or effectiveness of resolutions of the Annual General Meeting in connection with any administrative or court proceedings, and if there are no legal retention obligations.

For data collected in connection with general meetings, the retention period is generally up to 10 years. The data stored in the share register is generally retained for 10 years after the sale of the shares.

In addition, flatexDEGIRO SE only retains personal data if this is necessary in connection with claims asserted against the company (statutory limitation period of up to 30 years). In principle, your personal data will be deleted or anonymized as soon as it is no longer required for the above-mentioned purposes and we are not obliged to store it further due to statutory documentation and retention obligations.

 

Details on the right to object

If we process your data to protect legitimate interests, you can object to this processing if there are reasons arising from your particular situation that prevent this data processing. Please send your objection to the above address of the Data Protection Officer at flatexDEGIRO SE.

In addition, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data is unlawful. The competent authority for flatexDEGIRO SE is:
Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
Gustav-Stresemann-Ring 1
65189 Wiesbaden.

 

Use of AI systems at the Annual General Meeting

Support systems based on artificial intelligence (AI) may be used in the course of the Annual General Meeting. These systems are used exclusively for organizational support, in particular to provide information, to assist in answering questions, to optimize technical processes, and, as the case may be, to automatically generate subtitles for the transmission of speeches during the Annual General Meeting. Audio data from the speeches can be processed in real time and displayed in text form.

Personal data is processed only to the extent necessary. In particular, identification data (name, shareholder number), access data for participation, and interaction data (e.g., questions asked, voting information) are processed. If AI-supported subtitling is used, audio data from the speeches is also processed.

The legal basis for processing is Art. 6 (1) subpara. 1 lit. (c) GDPR for the fulfillment of legal obligations and Art. 6 (1) subpara. 1 lit. (f) GDPR based on the legitimate interest in the efficient organization of the Annual General Meeting.

The data will be used exclusively for the purpose of conducting the Annual General Meeting. It will only be passed on to third parties if there is a legal obligation to do so. Appropriate technical and organizational measures are implemented in accordance with Art. 32 GDPR to protect the data.

There is no automated decision-making or profiling within the meaning of Art. 22 GDPR. The AI systems used do not make any legally binding decisions, but serve exclusively to support organizational processes.

Reservation of changes

We reserve the right to amend this data protection notice for shareholders and their representatives in connection with the flatexDEGIRO SE Annual General Meeting at any time in accordance with applicable laws.

Last Update: February 2026