EU General Data Protection Regulation (EU-GDPR)

Protecting your personal data is important to us. Transparency regarding the processing of personal data is a key principle of the EU General Data Protection Regulation (GDPR), which has been applicable since 25 May 2018. We process your personal data in connection with the administration of your current or future occupational pension entitlement in accordance with the GDPR and other applicable data protection laws. Processing includes, among other things, the collection, storage, use, modification and deletion of personal data.

Responsibility for your personal data rests with the respective Group company, Deutsche Post Pensionsfonds AG and VAP (Versorgungsanstalt der Deutschen Bundespost) from which you have received a pension commitment or from which you currently receive occupational pension benefits.

Deutsche Post AG, Renten Service branch office, acts as an internal service provider and is responsible for the administration and payment of your occupational pension benefits.

Please refer to the list entitled "Group Companies", column "Data Protection Officers", for the Group company from which you received your pension commitment and from which you currently receive occupational pension benefits.

The list is available on our website at www.rentenservice.de under the section "Voluntary Occupational Pension Provision".

You may contact the Data Protection Officer of VAP as follows:

Versorgungsanstalt der Deutschen Bundespost (VAP)
Data Protection Officer
Nauheimer Straße 98
70372 Stuttgart
Germany

E-mail: datenschutz@vap-stuttgart.de or datenschutzVAP@vap-stuttgart.de

Please refer to the list entitled "Group Companies", column "Supervisory Authority", for the Group company from which you received your pension commitment and from which you currently receive occupational pension benefits.

The list is available on our website at www.deutschepost.de/rentenservice under the section "Voluntary Occupational Pension Provision".

For VAP:

The Federal Commissioner for Data Protection and Freedom of Information
Graurheindorfer Straße 153
53117 Bonn
Germany

E-mail: poststelle@bfdi.bund.de

We may process the following categories of personal data:

• Master data (such as name, date of birth, nationality, place of birth, marital status, dependent children, pension number, personnel number, tax identification number, pension insurance number and, where applicable, information relating to pension equalisation and legal representatives)

• Contact details, such as your private address, e-mail address and, where applicable, telephone number
• Contractual data, including supplementary agreements
• Periods of employment
• Salary and pension data
• Data relating to the suspension of a current or former employment relationship (period and reasons)
• Bank account details
• Tax data
• Social security data

In order to administer your occupational pension entitlement following your employment, we require your master data and contact details, as well as any personal data that we are legally obliged to process and, where necessary, disclose to third parties.

You provide us with these data directly and inform us of any changes. In addition, data generated during your employment may affect your current or future occupational pension entitlement, such as employment periods and salary information.

In individual cases, we may also receive data concerning pension recipients from tax authorities, health insurance providers, courts or other public authorities.

Your personal data are used exclusively for purposes related to the administration of your current or future occupational pension entitlement arising from a former employment relationship with the respective Group company.

The purposes of processing include:

• Establishment, administration and termination of benefit payments

• Calculation and determination of benefit amounts, including benefit adjustments

• Taxation of benefits

• Reporting and payment of social security contributions (health and long-term care insurance)

• Corporate and HR reporting, including the calculation of pension provisions

• Information and certification services

• Advice and support regarding the matters listed above, including by telephone and online where applicable

Personal data are processed primarily for the performance of the contractual arrangements underlying your current or future occupational pension entitlement. In this context, we are required to comply with obligations under employment, social security and tax law and must process personal data for these purposes. Applicable data protection legislation also permits processing in certain cases based on legitimate interests. Where processing is based on legitimate interests, we will inform you accordingly and advise you of your right to object. Furthermore, we may process your personal data on the basis of your consent. In such cases, we will obtain your consent separately and inform you of your right to withdraw it at any time.

These legal bases arise from Section 26 of the German Federal Data Protection Act (BDSG) and Article 88 in conjunction with Article 6(1) of the General Data Protection Regulation (GDPR).

Your personal data are made available only to authorised employees. Group-wide processes, such as outsourced IT services and personnel administration, may require authorised employees of other Group companies to have access to your data where necessary.

Where permitted or required by law, we may disclose personal data to external parties, including social security institutions, public authorities, courts, banks, tax authorities, creditors, insolvency administrators and external service providers.

Where another Group company or an external service provider processes personal data on our behalf, appropriate agreements in accordance with Article 28(3) GDPR are in place. We do not transfer your personal data to third countries or international organisations.

We retain your personal data for as long as necessary to fulfil the processing purposes described above or for as long as we are legally required to do so. Under German law, records forming the basis of payments made to you, such as pensions or salaries, must generally be retained for ten years following the relevant payment.

We do not carry out automated decision-making based on your personal data. Nor do we conduct automated processing for the evaluation or prediction of personal aspects relating to you (profiling).

Subject to the applicable legal requirements, you have the right to:

• Obtain information about the personal data we hold about you

• Request the correction of inaccurate personal data

• Request the deletion of personal data that we are no longer permitted to store

• Request the restriction of processing of your personal data

• Be informed about and object to any automated decision-making that affects you

• Object to processing based on our legitimate interests

• Withdraw any consent you have provided

• Receive a copy of the personal data we hold about you, where applicable in electronic form

• Exercise your right to data portability

To exercise your rights, please contact the Data Protection Officer of the relevant Group company using the contact details provided above, or the Data Protection Officer of VAP.

In the case of a correction or deletion of data, we will also inform recipients of your personal data where required. The responsible Data Protection Officer will be happy to assist you with any further questions.

If you believe that your rights are not being adequately respected, you have the right to lodge a complaint with the competent supervisory authority.

If the content of this Privacy Notice changes, the updated version will be made available on our website at www.deutschepost.de/rentenservice under the section "Voluntary Occupational Pension Provision".