We take the protection of your personal data very seriously. Your privacy is very important to us, and we would thus like to inform you how we will process your data in our Company for the Annual General Meeting and how you can exercise your rights.

1. Who is responsible for data processing and how can you get in touch with our Data Privacy Officer?

The entity responsible for processing your personal data is RWE Aktiengesellschaft, RWE Platz 1, 45141 Essen, Germany. You can reach our Data Privacy Officer at the aforementioned address, via the phone at +49 201 5179 5311, via facsimile at +49 201 5179 5005 or via e-mail at datenschutz@rwe.com.

2. Which of your personal data will we process and why?

If you register for the Annual General Meeting, we will process such data as your name, surname, address, where applicable your e-mail address, and information concerning your shares (number and type of share ownership) as well as your participation ticket number and check number, in order to enable you to exercise your rights as shareholder in connection with the Annual General Meeting.

If you authorise another person to exercise your rights pertaining to the Annual General Meeting, we will process such data as their name, surname, address and, where applicable, their e-mail address in order to ensure the orderly conduct of the Annual General Meeting.

When we receive requests for supplements to the Agenda, countermotions or candidate nominations, we are obliged to publish some of your personal data to comply with German stock corporation law. Further personal information we receive from you may be processed in this context.

If you submit questions to the Executive Board and these questions are answered individually in the virtual Annual General Meeting, your name will only be disclosed in the context of the answer if you have expressly declared the consent to the disclosure.

If you submit a statement prior to the Annual General Meeting, with regard to a potential publication of your statement, your name will only be published on our website, if you have expressly declared the consent to the publication. In case of a publication on our website the data will be available worldwide.

If you have declared a separate consent to the processing of your data, you can revoke this consent at any time. The legitimacy of the processing of your data until the revocation remains unaffected by the revocation.

Shareholders and their agents who are represented at the Annual General Meeting by the voting proxies nominated by the Company are included in the participants register mandated by law. 

3. What sources does the data come from?

We will process personal data that we receive from you or via intermediaries. If you are acting as an authorised representative of a shareholder, we will receive the personal data from the shareholder. As a rule, shareholders are obligated to provide the data required to conduct the Annual General Meeting.

4. What is the legal basis for processing the data?

RWE Aktiengesellschaft will process your personal data only for the following purposes:

• exercise of your shareholder rights before and during the Annual General Meeting,
• fulfilment of requirements under German stock corporation law (e.g. compilation of the participants register) and
• fulfilment of further statutory obligations, e.g. monitoring regulations and archiving obligations.

The legal basis for this data processing can be found in Article 6, Paragraph 1, Sentence 1(c) of the General Data Protection Regulation (‘GDPR’) in conjunction with the provisions of the German Stock Corporation Act and the German Act Concerning Measures Under the Law of Companies, Cooperative Societies, Associations, Foundations and Commonhold Property to Combat the Effects of the COVID-19 pandemic (‘COVID-19-Act’).

Furthermore, we may process your personal data in accordance with Article 6, Paragraph 1, Sentence 1 (f) GDPR to safeguard justified interests such as

• organisation and orderly conduct of the Annual General Meeting,
• defence in litigation and
• statistics (e.g. shareholder development and an overview of the major shareholders).

Any publication of your statement on our website will be made, if you consent hereto, on the basis of Article 6, Paragraph 1, Sentence 1 (a) GDPR.

5. Who will receive your personal data?

In connection with the conduct of the Annual General Meeting, RWE Aktiengesellschaft commissions various external service providers and advisors which process your personal data on behalf of RWE Aktiengesellschaft solely within the EU (’Contracted Data Processing Entities’). These Contracted Data Processing Entities act solely upon instructions from RWE Aktiengesellschaft and will only receive the personal data required for them to meet their contractual obligations vis-à-vis RWE Aktiengesellschaft.

In certain cases, personal data will also be made available to public authorities and publication media on the basis of statutory provisions and to shareholders and shareholder representatives via the participants register in accordance with section 129 of the German Stock Corporation Act.

Upon request, every shareholder has the right to inspect the participants register for up to two years after the Annual General Meeting.

You may request further information and copies of the relevant agreements at any time. You can reach us and the Data Privacy Officer via the contact information provided in Item 1.

6. How long is your personal data stored?

Personal data regarding the Annual General Meeting is generally stored for up to three years and is usually deleted thereafter.

Moreover, personal data is stored, if so required, to meet legal obligations to discharge the company's burden of proof and archive the data. Such obligations arise under, inter alia, the German Commercial Code, the German Fiscal Code or the German Money Laundering Act. In certain cases,  the Company might have a justified interest in prolonging the storage period, for instance in connection with litigation and out-of-court disputes concerning the Annual General Meeting. 

7. What data privacy rights do you have?

You can exercise the following rights in compliance with the following statutory regulations:

• Article 15 GDPR: right to information as well as right to receive a copy of the data processed;
• Article 16 GDPR: right to request corrections to erroneous data;
• Article 17 GDPR: right to request deletion of your data if there are no legal grounds for its continued storage;
• Article 18 GDPR: right to request a limitation of processing 
• Article 20 GDPR: right to transmission of all data provided to us by you. This means that we provide them to you in a structured, customary and machine-readable format, and