Local court Düsseldorf
Commercial register number: HRB 39401

Value added tax identification number (VAT No):
Rheinmetall AG: DE 119356818

Represented by the Executive Board

Armin Papperger (Chairman), Peter Sebastian Krause, Dagmar Steinert

Responsible for contents (§ 5 TMG and § 18 MStV)

Dr. Philipp von Brandenstein
Head of Corporate Communications
Rheinmetall AG
Rheinmetall Platz 1
40476 Düsseldorf
Germany
Phone: +49 211 473-01
Fax: +49 211 473-4158

Privacy policy

for the Rheinmetall AG website www.rheinmetall-defence.com

I. General Information

1. Introduction

With the following privacy policy, we would like to inform you about which categories of your personal data (hereinafter also referred to as "data") we process for what purposes and to what extent when you visit our website www.rheinmetall-defence.com.

2. Controller

The Controller pursuant to Art. 4 para. 7 of the General Data Protection Regulation (hereinafter referred to as “GDPR”) for the data processing on this website is:

Rheinmetall AG
Rheinmetall Platz 1
40476 Düsseldorf
Germany
Phone: +49 211 473-01
e-mail address: info@rheinmetall-defence.com

3. Data Protection Officer

The contact details of Rheinmetall AG's Data Protection Officer are:

Rheinmetall AG
Data Protection Ofiicer
Rheinmetall Platz 1
40476 Düsseldorf
Germany
e-mail address: DSB-RhAG@rheinmetall.com

II. Data processing activities on our website

In general, you can visit our website without disclosing your identity. However, if you use certain functions/areas of our website, depending on the circumstances, it may be necessary to provide or collect personal data. In the following, we will go into the details of the respective data processing activities on our website.

1. Hosting of the website / logging of website visits

In order to provide our website securely and efficiently, we use the services of the web hosting provider Arvato Systems GmbH (An der Autobahn 200, 33333 Gütersloh, Germany; hereinafter referred to as Arvato), from whose servers (or servers managed by them) the website is accessed. For these purposes, we may use infrastructure and platform services, computing capacity, storage space and database services as well as security and technical maintenance services from Arvato. Arvato carries out data processing on our behalf in accordance with Art. 28 GDPR.

When you visit our website, we or Arvato collect data on each access to the server (so-called server log files). The data collected includes:

• IP address
• Date and time of your visit
• The browser you are using (including its version)
• The operating system you are using (including its version)
• Which resources (e.g. subpage, contact form) you access on our website (this is logged in the form of a so-called URL)

We process these server log files on the basis of our legitimate interests in accordance with Art. 6 para. 1 lit. f GDPR for the following purposes:

• Ensuring the security and stability of the website (e.g. avoiding server overloads due to abusive attacks, so-called DDoS attacks)
• Ensuring a proper connection to the website,
• Ensuring a comfortable use of our website,
• Evaluation of system security and stability and
• for further administrative purposes.

We may analyze these server log files if we become aware of concrete indications of illegal use. The server log files will be deleted immediately after they are no longer required to achieve the aforementioned processing purposes, but no later than 90 days after their collection.

2. Use of cookies / web analysis

This website uses "cookies". Cookies are text files which are stored on your computer and which enable, for example, individualization/adjustment of the website to your preferences, automatic recognition on your next visit, proper functioning of the website and analysis of the use of the website.

The concrete use of cookies on our website is determined by your voluntary selection of the "privacy settings" on our cookie banner, which is displayed to you in particular when you visit our website for the first time, and/or by the corresponding settings of your browser.

We distinguish between three categories of cookies:

(1) Necessary cookies
Necessary cookies ensure the correct functioning of the website. Without these cookies, malfunctions or error messages may occur.

(2) Comfort cookies
Comfort cookies facilitate a comfortable use of the website and, for example, save settings so that you do not have to enter them again each time you visit the website.

(3) Statistics cookies
Statistics cookies allow us to evaluate user behavior on our website and measure the reach of our website. This gives us the opportunity to measure the performance of the site and to improve it continuously.

2.1. Necessary Cookies

If you select necessary cookies (setting "NECESSARY" in the cookie banner) or make no selection at all, only necessary cookies are used. This includes the use of a so-called "session cookie", which is used to control certain website functions. The session cookie contains a so-called session ID (session identifier), which is used to assign several requests from a visitor to a website to a specific single session. The session cookie is automatically deleted when your browser is closed. The use of these necessary cookies is based on our legitimate interest (ensuring the functionality of our website) in accordance with Art. 6 para. 1 lit. f GDPR.

2.2. Comfort cookies

If you select comfort cookies (setting "COMFORT" in the cookie banner), further cookies are placed in addition to the above-mentioned "necessary cookies". These comfort cookies save your “cookie selection” / “data privacy settings” so that you do not have to answer the cookie banner again each time you visit our website. The use of these comfort cookies is based on your informed and freely given consent pursuant to Art. 6 para. 1 lit. a GDPR, which you give by making the corresponding selection on the cookie banner.

You can withdraw your consent at any time with effect for the future by changing your cookie settings accordingly or by deleting the cookies from your computer.

These comfort cookies are automatically deleted no later than 7 days after you close your browser, unless you visit our website again in the meantime without changing your cookie settings.

2.3. Statistics cookies and web analysis

If you select statistics cookies (setting "STATISTICS" in the cookie banner), further cookies will be placed in addition to the above-mentioned necessary cookies and comfort cookies, particularly to measure the reach of our website and to evaluate the user behavior on our website. In detail, the following purposes are pursued:

• Measuring the effectiveness of the website,
• Analysis of user interactions with the website,
• Optimization of the structure of the website,
• Adaptation of the website to the requirements of the users.

By selecting “STATISTICS” on the cookie banner, "Google Analytics", a web analysis service of Google Ireland Limited (Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland; hereinafter referred to as "Google"), will also be activated. Google places various cookies that enable an analysis of your use of the website. The information generated by these cookies about your use of this website (including your shortened IP address) is also transferred to servers of Google LLC (parent company of Google Ireland Limited: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) in the USA and processed there. Google will use this information for the purpose of evaluating your use of the website on our behalf, compiling reports on website activity for us and providing other services relating to website activity and internet usage. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google's behalf.

Google Analytics stores cookies on your end device for a period of up to two years since your last visit (for more details see cookie overview in section III.2.5). These cookies contain a randomly generated user ID with which you can be recognized on future visits to the website. The recorded data is stored together with this randomly generated user ID, which enables the evaluation of pseudonymous user profiles. This user-related data is automatically deleted after 26 months unless you visit our website again (using statistics cookies). Other (non-personal) data remains stored in aggregated form for an unlimited period of time.

The processing of your data by Google takes place anonymously, because your IP address is automatically shortened after Google has collected it, making it impossible to identify you personally using this shortened IP address. However, it cannot be ruled out that Google may, in exceptional cases, draw conclusions about your identity on the basis of further information collected through your use of other Google services (e.g. an Android smartphone, Google Chrome web browser). Detailed information on data processing by Google can be found in the Google Data Protection Center at https://policies.google.com/privacy.

The use of these statistics cookies (including the cookies from Google) is based on your informed and freely given consent pursuant to Art. 6 para. 1 lit. a GDPR, which you give by making the corresponding selection on the cookie banner.

Additional note on data transfer to the USA: By selecting "statistics cookies", you also expressly consent pursuant to Art. 49 para. 1 sentence 1 lit. a GDPR that your data collected by Google can also be transferred to Google servers in the USA. The USA has been classified by the European Court of Justice (ECJ) as a country with an inadequate level of data protection according to EU standards.

You can withdraw your consent at any time with effect for the future by changing your cookie settings accordingly or by deleting the cookies on your computer.

You also have the option of preventing your data from being processed by Google Analytics by installing the "Google Analytics Opt-out Browser Add-on".

You can download this add-on from Google on the following page: https://tools.google.com/dlpage/gaoptout?hl=de .

2.4. Browser settings to limit the use of cookies

You can prevent the use of cookies by configuring your browser settings accordingly. This may result in certain websites/resources not working properly or to their full extent.

If the "Do Not Track" function of your browser is activated, we will of course take this into account and not set any statistics cookies.

2.5. Overview of cookies

In addition to the aforementioned cookies, cookies are also set when actively playing YouTube videos embedded on our website. You will find more detailed information on this in section 4.1. of this privacy policy.

A detailed overview of the cookies we use including their respective purpose and storage duration can be found at: https://www.rheinmetall.com/en/rheinmetall_ag/service/imprint/cookies/index.php

3. Communication

If you contact us (e.g. via our contact forms, e-mail, telephone), the information or data provided will be processed to the extent necessary to answer your contact request and/or to perform requested actions.

In particular, you can write us using the contact forms provided in the "Contact" section of the website. In doing so, the information marked as “required” in the respective contact form (e.g. first name, last name, e-mail address) must be provided. In addition, further data (e.g. telephone number, fax) can be provided voluntarily. This includes all data that you voluntarily provide in the free text field of your message to us.

All messages sent via the contact forms or via e-mail are forwarded to the respective mailbox. Only a limited number of authorized persons within our company have access to these mailboxes. If necessary for processing your request, your inquiry/message can be forwarded to other departments within our company or to other companies of the Rheinmetall Group. In exceptional cases, these may also be affiliated companies outside the European Union (EU) or the European Economic Area (EEA). We provide an appropriate level of data protection at the affiliated companies of the Rheinmetall Group outside the EU/EEA in accordance with Art. 44 et seq. GDPR. No data will be transferred to persons or companies outside the Rheinmetall Group without your prior express consent.

The data processing necessary to adequately answer your inquiry/message is based on our legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR. This legitimate interest also includes any necessary forwarding of your inquiry/message to affiliated companies of the Rheinmetall Group. If you submit an inquiry/message within the scope of a contractual or pre-contractual relationship with us, the necessary data processing is based on Art. 6 para. 1 lit. b GDPR for the purpose of fulfilling our contractual obligations or to answer (pre-)contractual inquiries.

Your inquiry/message (including the transmitted data) will be deleted no later than 7 days after completion/answering of your inquiry/message, provided that no statutory retention periods or other justified reasons for further storage (e.g. to assert, exercise or defend legal claims) apply. In the latter cases, your data will be deleted after expiry of the applicable statutory retention period (e.g. under commercial or tax law) or after expiry of the other justified reasons for processing (the legal basis for such further processing is generally Art. 6 para. 1 lit. f GDPR).

Special note on job applications: Applications must be submitted exclusively via our separate application/career portal. All applications received by other means will be deleted immediately.

4. Plugins and embedded functions / content

4.1. Embedded YouTube videos

We integrate functional and content elements of the video platform YouTube on our website to enable the playback of selected, embedded YouTube videos directly on our website. This requires, among other things, the establishment of a connection to the servers of YouTube.

YouTube (https://www.youtube.com) is operated and provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), whose parent company is in turn Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) with headquarters in the USA. The provider's privacy policy can be accessed via the following link: https://policies.google.com/privacy .

The YouTube videos on our website are embedded in the so-called “extended data protection mode” of YouTube. This mode ensures that a connection to YouTube is only established when you actively play a video. Prior to this, there is no connection to and therefore no data transfer to YouTube.

By clicking on and playing an embedded YouTube video, a connection to YouTube is established during which your IP address is automatically transmitted. In addition, cookies are then set by YouTube on your end device, which can also be used to analyze your usage behavior for market research and marketing purposes by YouTube. If you are at the same time logged into your YouTube account, you potentially enable YouTube to connect your surfing behavior to your personal profile. You can prevent this e.g. by logging out of your YouTube account. Further details on the cookies used can be found in the cookie overview (see section III.2.5). By clicking on and playing an embedded YouTube video, you give your express and free consent in accordance with Art. 6 para. 1 lit. a GDPR to this data processing and cookie use by YouTube. We have no influence on this data processing by YouTube.

Note on data transfers to the USA: Since YouTube is provided by the US-company Google, a transfer of your data to the USA cannot be excluded. By clicking on and playing an embedded YouTube video, you therefore also expressly consent pursuant to Art. 49 para. 1 sentence 1 lit. a GDPR that your data collected by YouTube or Google can also be processed by Google in the USA. The USA has been classified by the European Court of Justice (ECJ) as a country with an inadequate level of data protection according to EU standards.

4.2. Google Tag Manager

This website also uses the Google Tag Manager, which allows the management of so-called website tags via an interface. Google Tag Manager is provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. The Google Tag Manager only implements tags. This means: no cookies are used and no personal data is collected. The Google Tag Manager triggers other tags, which in turn may collect data. However, the Google Tag Manager does not access this data. If a deactivation has been made at domain or cookie level, it will remain in effect for all tracking tags as long as they are implemented with the Google Tag Manager.

4.3. Target practice calendar of Rheinmetall Waffe Munition ARES GmbH

On the subpage of our affiliate company Rheinmetall Waffe Munition ARGES GmbH you may find a link to an external Google-calendar, which contains the current scheduled target practices (“shooting plan”) of this company. By clicking on the calendar/link you will be redirected to the external website of Google. This website/calendar is operated by Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, hereinafter referred to as “Google”). Only Google is responsible for the data processing on the external website. No data will be transferred by us to Google by visiting this website or calendar.

The privacy policy of the calendar operator Google can be found here: https://www.google.com/policies/privacy/

5. Job advertisements and career portal

In our career section you will find plenty of information on career opportunities in the Rheinmetall Group as well as an overview of job vacancies and entry-level opportunities. All subpages/topics in this career section are linked to our central career-website on www.rheinmetall.com. By clicking on this subpages/topics (e. g. job vacancies and entry options, personnel development, benefits and remuneration, exhibitions and events) you will be redirected from www.rheinmetall-defence.com to the abovementioned independent website of Rheinmetall AG, which has its own privacy policy (only this privacy policy applies there).

On this career-website of www.rheinmetall.com, you have inter alia the option to apply for jobs. By clicking on the application button ("Apply Online Now!"/”Jetzt Online Bewerben!”) of the respective job offer you will be redirected to our separate career and recruitment platform (another different independent website), for which a separate privacy policy applies. No personal data is transferred to this separate website/platform. Job applications will only be accepted via our career and recruitment platform!

6. General information on the deletion of your data

In general, we will delete your data in accordance with the legal provisions as soon as it is no longer required for the respective processing purposes or if the processing purpose has been fulfilled or has expired or if you withdraw any consent you may have given. In addition, we will delete your data if you request such deletion pursuant to Art. 17 GDPR or - in the case of processing based on legitimate interests in accordance with Art. 6 para. 1 lit. f GDPR - if you object to such processing pursuant to Art. 21 GDPR (for further information on your rights, please refer to Chapter IV of this privacy policy).

However, the deletion of your data may be prevented or restricted by statutory retention periods or other justified reasons for retention on our part. Data that we are legally obliged to retain will be deleted after expiry of the respective statutory retention periods. Data that we continue to retain for opposing legitimate interests on our part (e.g. to assert, exercise or defend legal claims in accordance with Art. 17 para. 3 lit. e GDPR or Art. 21 para. 1 GDPR) will be deleted once these legitimate interests no longer apply.

In the event that your data is not deleted because of further legally permissible retention purposes, their processing will be limited to these purposes. This means that the data will be restricted and not processed for any purposes other than these legally permissible retention purposes (e.g. defence of legal claims).

More detailed information on the specific storage or deletion of your data can be found in the individual sections of Chapter II "Data processing on our website" of this privacy policy.

7. Links

Our website contains links to the following (external) online and social media presences of the Rheinmetall Group (see corresponding symbols in the footer/lower section of the website):

• YouTube
• Twitter
• Xing
• LinkedIn
• Kununu
• Instagram
• Glassdoor

By clicking on the respective icon or link, you can access the corresponding external online or social media platform, each of which has its own privacy policy. No data will be transferred by us to the external service providers of those platforms when clicking on the respective symbol/link.

III. Technical and organizational measures

We implement appropriate technical and organizational measures in accordance with the legal requirements, taking into account the state of the art, the implementation costs and the nature, scope, context and purposes of the processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, in order to ensure a level of security appropriate to the risk.

Such measures include, in particular, safeguarding the confidentiality, integrity and availability of data by controlling physical and electronic access to the data as well as the access, input, disclosure, availability and separation to and of the data. Furthermore, we have established procedures to ensure that data subjects' rights can be exercised, data can be deleted, and responses are made to any threats to the data. Additionally, we already consider privacy matters during the development or selection process of hardware, software and procedures in accordance with the principle of Privacy-by-Design and Privacy-by-Default.

SSL encryption (https): To properly protect your transmitted data, this website uses a so-called SSL encryption. You can recognize such encrypted connections by the prefix "https://" in the page link (URL) in the address line of your browser. Unencrypted pages are prefixed by "http://".

Thanks to this SSL encryption, no data which you transmit to this website – for example in case of inquiries – can be read by third parties without further significant efforts.

IV. Your rights

The GDPR grants various rights to data subjects, in particular:

Right to be informed and of access (Art. 15 GDPR): In accordance with the statutory provisions, you have the right to request information as to whether and to what extent we process your personal data.

Right to rectification (Art. 16 GDPR): In accordance with the statutory provisions, you have the right to request the rectification or completion of incorrect or incomplete data concerning yourself.

Right to erasure (Art. 17 GDPR): In accordance with the statutory provisions, you have the right to demand that your personal data be erased immediately. Note: An immediate deletion of your data may be opposed by statutory retention obligations or other justified reasons for further processing.

Right to restrict processing (Art. 18 GDPR): In accordance with the statutory provisions, you have the right to demand that the processing of your personal data be restricted.

Right to data portability (Art. 20 GDPR): In accordance with the statutory provisions, you have the right to receive your personal data in a structured, commonly used and machine-readable format and - as far as technically feasible - to demand that it be transferred to another controller.

Right to object (Art. 21 GDPR): In accordance with the statutory provisions, you have the right to object to the processing of your personal data at any time for reasons arising from your particular situation, provided that the data processing is carried out on the basis of legitimate interests (cf. Art. 6 para. 1 lit. e or lit. f GDPR).

If your personal data is processed for the purpose of direct marketing, you have the right to object at any time to such processing, including profiling, insofar as it is connected with such direct marketing.

Right to withdraw consent (Art. 7 para. 3 GDPR): You have the right to withdraw any consent you have given at any time with effect for the future without having to state reasons. Such withdrawal of consent does not affect the lawfulness of processing that has taken place on the basis of consent until the time of withdrawal.

To exercise your rights, please contact

Rheinmetall AG
Rheinmetall Platz 1
40476 Düsseldorf
Germany
e-mail address: info@rheinmetall-defence.com

Right to lodge a complaint with a supervisory authority (Art. 77 para. 1 GDPR): In accordance with the statutory provisions, you have the right to lodge a complaint with a data protection supervisory authority of your choice, in particular in the Member State of your habitual residence, place of work or place of alleged infringement, if you believe that the processing of your personal data violates the GDPR.

V. Miscellaneous

We reserve the right to adapt this privacy policy if changes of the legal situation or of our data processing make it necessary.

When visiting our website, only the latest privacy policy applies.

Where necessary and possible, we will inform you if any changes require your involvement (e.g. renewed consent) or individual notification.

Please note that addresses and contact information of other companies that we have provided in this privacy policy may change over time.

Status of this privacy policy: 19 January 2021

Data Protection Officers of Rheinmetall Group companies