Information of Data Protection eRFX – Magna Supplier Portal

The protection of your privacy is of particular concern to MAGNA STEYR Fahrzeugtechnik GmbH & Co KG (hereinafter referred to as "Magna") and is a high priority in our corporate policy. Our declared aim is to take all the necessary technical and organizational measures to ensure the security of data processing and to process your personal data in such a way that they are protected against access by unauthorized third parties. We therefore process your personal data exclusively on the basis of the statutory provisions. In this privacy policy, we inform you about the most important aspects of data processing in eRFX.

1. Categories of data and legal basis of processing

Personal data are all data that make you directly or indirectly identifiable and thus allow an inference to your person.

Magna processes your personal data in eRFX based on the registration form and due to legitimate interest. We process the following personal data from you:

• name, company
• job title/ area of responsibility
• email address, phone number
• accesses and user activities (socalled server log files)

Personal data is processed to establish supplier relationships with MAGNA. The supplier portal serves as a communication platform for the administration of supplier information for the purpose of further use in inquiries and tenders as well as the further initiation of contracts.

When visiting the supplier portal, data on accesses and user activities (so-called server log files) are also collected. This technical access information is used exclusively to improve the usability of our offer and, if necessary, to detect and rectify technical problems at an early stage.

Magna respects your privacy and is committed to complying with applicable data protection laws in the countries where Magna does business. In order to comply with these obligations, Magna confirms that the collection, processing and use of your personal data will be primarily in electronic form and that your personal data will be used only for the purposes set out above.

2. Storage period

The data is stored for a further eleven years after termination of the business relationship. Records supporting the quotation and approval processes for direct and indirect orders are deleted after eight years.

3. Access to your personal data (recipients) and data transfer to third countries

In order to process your information in connection with your use of eRFX, your personal information may be shared with and accessed by authorized personnel within Magna and its affiliates ("MAGNA Group)". Internal use within the Magna Group of eRFX is intended to be worldwide. Therefore, your personal data will also be transferred in third countries. Magna ensures an adequate level of data protection when transferring data to third countries by concluding standard contractual clauses.

Magna also engages a third-party service provider as an authorized data processor ("Data Processor") to provide administrative services to eRFX for the System. The current service provider is QAD Europe GmbH.

Furthermore, Magna also engages third-party providers for the purpose of extended supplier master data processing. In the course of this activity, it may be necessary to have personal data processed by the third-party provider, whereby Magna will check in advance whether this transfer is necessary.

Magna has entered contractual obligations with the data processor to ensure that your personal data is adequately protected and to ensure that the data processor only processes your personal data in accordance with applicable data protection laws and only in accordance with Magna's instructions. In addition, the data processor is required to (i) ensure that its personnel who access your personal data maintain data secrecy and the confidentiality of your personal data, and (ii) take appropriate technical and organizational measures to protect your personal data.

Except for reasonable business use in connection with eRFX, your personal information will be kept strictly confidential and will not be disclosed to any third party other than the data processor without your consent (written or electronic), unless otherwise required or permitted by law.

4. Your rights

As an affected person, you have the following towards us:

• Right of access by the data subject (Article 15 GDPR),
• Right to rectification (Article 16 GDPR) or erasure (Article 17 GDPR),
• Right to restriction of processing (Article 18 GDPR),
• Right to data portability (Article 20 GDPR) and
• Right to object (Article 21 GDPR)

If you wish to exercise any of the above rights or have any questions regarding Magna's processing of your personal data under eRFX, please contact Magna at the following email address erfx-support@magna.com.

In addition, you have a right of appeal to the competent data protection authority.