Data protection information - Application Process

We are delighted that you would like to apply or have applied for a position in our company. This data protection information describes how the Vossloh Group processes your personal data during your application process in compliance with the applicable European data protection regulations.

This data protection information applies to the processing of personal data of applicants (data subjects of the data processing, „you“, „your“) when using the online recruiting platform of the Vossloh Group and in the case of applications by e-mail or post. Please note further information on the processing of your personal data in the individual job advertisements.

I. Controller for the processing of your personal data, Contact Information of the Data Protection Officer

1. Controllers

The controllers within the meaning of data protection law for the processing of personal data in the context of the application process are the Vossloh Group companies, which are named in the job advertisement as the advertising entities. If Vossloh AG itself advertises a position, the controller is Vossloh AG, Vosslohstraße 4, D-58791 Werdohl.

You will find further information on our Group companies, details of the authorized representatives and other contact options at https://www.vossloh.com/en/imprint/ and at https://www.vossloh.com/en/company/vossloh-worldwide/ .

2. Data protection officer

If you have any questions about the processing of your personal data by us or about data protection in general, please contact the competent data protection officer.

The Data Protection Officer of Vossloh Aktiengesellschaft and the Group companies listed below is Dr. Stefan Drewes, Vosslohstraße 4, 58791 Werdohl (Germany), datenschutzbeauftragter@vossloh.com . If desired, please make sure to mark your contact request as "personal/confidential".

• Vossloh Fastening Systems GmbH
• Vossloh Laeis GmbH
• Vossloh RailWatch GmbH

The Data Protection Officer of Vossloh Rail Services GmbH and the following subsidiaries can be contacted at Vossloh Rail Services GmbH, c/o Datenschutzbeauftragter, Hannoversche Straße 10, D-21079 Hamburg, datenschutz.lifecyclesolutions@vossloh.com . If desired, please make sure to mark your contact request as "personal/confidential".

• Vossloh Rail Services Deutschland GmbH
• Vossloh Rail Services International GmbH
• Vossloh Rail Inspection GmbH

The Data Protection Officer of Vossloh Cogifer SA ist Eric Barbry, 23 rue is François Jacob, FR-92565 Rueil-Malmaison, ebarbry@racine.eu . If desired, please make sure to mark your contact request as "personal/confidential".

II. Purposes of processing, legal basis, categories of personal data

1. Review of the application

a. General purposes of processing and categories of data processed

We process the data that you have provided to us in connection with your application in order to review your suitability for the position and to carry out the application process. This also applies to information added in the course of the application process, for example from follow-up queries and subsequently submitted documents. In addition, we process the information provided in the application process, e.g. in telephone interviews, personal interviews or during a visit to a job fair. In individual cases, we may organize and conduct assessment centers (tests and selection interviews) in order to specifically check your suitability for the advertised position, about which we will inform you separately.

We generally process the following categories of data as part of the application process:

• Basic data (surname, first name, date of birth);
• Contact details (address, telephone number, e-mail address, etc.);
• Application data such as CV, cover letter, photo, certificates, letters of recommendation and other information and data that you provide to us in addition and share with us in job interviews
• Nationality, work permit, data on health suitability;
• If you wish to make use of special rights for severely disabled persons in the application process, you can indicate your severe disability.

Upon receipt of your application, your application data will be reviewed by the HR department of the hiring company. Suitable applications will then be made available internally to the department managers responsible for the respective vacant position in order to assess the extent to which you are suitable for the position concerned.

Your application data will only be passed on to companies other than the Group company issuing the advertisement if this is absolutely necessary to review your application and in the event of recruitment, about which we will inform you separately, or if you have consented to the transfer, see section 7.

In addition, if applicable, the works council and the representative for severely disabled employees may also be involved in filling vacancies. Access is limited to the extent required by law.

b. Legal basis

The legal basis for the processing of personal data during the application process is primarily Art. 6 para. 1 sentence 1 lit. b of the General Data Protection Regulation (GDPR). This permits the processing of data required in connection with the decision to establish an employment relationship

In addition, personal data may be processed on the basis of Art. 6 para. 1 sentence 1 lit. f GDPR, insofar as this is necessary to pursue legitimate interests. As a rule, our legitimate interests consist in being able to design and optimize the application process more efficiently or to obtain additional information about applicants that is relevant to the position. Furthermore, we process your personal data due to legal obligations on the basis of Art. 6 para. 1 sentence 1 lit. c GDPR in conjunction with the relevant legal obligation. Further information in this regard is provided below.

Insofar as special categories of personal data are processed in accordance with Art. 9 para. 1 GDPR, this serves the exercise of rights or the fulfillment of legal obligations under labor law, social security law and social protection (e.g. informing the representative for severely disabled persons SGB IX § 81) as part of the application process. This is based on Art. 6 para. 1 sentence 1 lit. b; Art. 9 para. 2 lit. b, Art. 88 GDPR i.V.m. § Section 26 para. 3 of the Federal Data Protection Act (BDSG)

A medical examination is required to fill some positions. In this context, we only receive and process the information as to whether you are suitable or unsuitable. The legal basis for the processing is Art. 6 para. 1 sentence 1 lit. b; Art. 9 para. 2 lit. b, Art. 88 GDPR i.V.m. § Section 26 para. 3 BDSG.

2. Management of applications, Registration and use of the recruiting platform

We manage incoming applications using the Workday software, which is also used to operate the online recruiting platform. Applications that do not reach us via the online recruiting platform are entered into the software immediately after receipt by the responsible recruiters from the HR department of the Group company posting the vacancy. The legal basis for this is Art. 6 para. 1 sentence 1 lit. f GDPR based on our legitimate interest in making the application process efficient by speeding up processs.

The provider of the software Workday Limited (Ireland) processes personal data only on our behalf. If Workday Limited uses affiliated companies as sub-processors in third countries, Binding Corporate Rules (Art. 47 GDPR), Standard Contractual Clauses EU/2021/914 (Art. 46 GDPR) and, if the companies are located in the USA, certifications of Workday's US companies under the Data Privacy Framework (based on Adequacy Decision EU/2023/1795, Art. 45 GDPR) ensure that a level of data protection corresponding to EU standards is maintained.

a. Use of the online recruiting platform

We provide you with an online recruiting platform via our website, which you can use to apply to us. The online recruiting platform is used to request information that is required for your application. The fields provided for this purpose are marked with a red asterisk as "mandatory". You can also provide further information on a voluntary basis.

You can create a user account in our online recruiting platform to submit and manage your application and carry out the application process, including communication, via the online recruiting platform and to receive suggestions for suitable vacancies. To register, you must enter an e-mail address and a password, which will be stored in encrypted form by our service provider. If you have created a user account and logged into it, some data from your profile can be used if you wish to apply for other positions. While logged in, you can also view the status of your application, add to the information you have already provided and withdraw individual applications. You also have the option of deleting all data, including your applications. When you delete your data, you also withdraw your current applications. The legal basis for creating a user account is Art. 6 para. 1 sentence 1 lit. b GDPR. It is not necessary to create a user account to participate in the application process.

b. Technical provision of the online recruiting platform

When you access our recruiting platform, technical information is exchanged between the servers on which our recruiting platform is operated and your end device (computer, tablet, cell phone). The following data is transmitted by your browser and processed by our servers:

• Date and time of the request
• IP address
• Request details and address of the target file
• Name of the retrieved file
• Volume of data transferred and access status (file transfer, file not found, etc.)
• Message as to whether the access / retrieval was successful
• Previously visited website (referrer)
• Browser used, specific browser settings operating system used

Each time a file is accessed or retrieved, data about this process is also temporarily stored in a log file. The log file is kept for for a period of 30 days and then automatically deleted. The legal basis for the storage of this information is Art. 6 para. 1 sentence 1 lit. f GDPR (legitimate interests: Ensuring IT security and related legal defense and enforcement).

All personal data transmitted via the online recruiting platform is transferred using standard transport encryption mechanisms (SSL/TLS, recognizable by "https" in the address bar of your browser).

Cookies are used when using the online recruiting platform. These are small text files that are stored on the memory of your end device and can be read from there. The cookies used are absolutely necessary in order to make the recruiting platform available to you.

3. Pre-Employment Screening (“PES” or background checks)

In certain cases, or if the position for which you are applying involves the performance of highly confidential tasks or personal and/or financial responsibility, it may be necessary to collect and process your data more extensively for the purposes of fraud prevention, the protection of reputation and know-how and the fulfillment of international compliance requirements.

In order to ensure data protection, such additional data processing is based only at the end of the application process. Should the position for which you are applying or your application be affected by such additional data processing, you will be informed separately by us before the start of the PES. You can refuse data processing in the context of PES or object to it at any time. In such a case, however, we may not be able to consider you for the position for which you have applied.

4. Terror and sanctions lists check

The names and dates of birth of applicants are checked against relevant sanctions lists, such as anti-corruption lists, watch lists, terror lists and embargo lists. The processing is based on legitimate interests to protect property and business secrets. On the other hand, it may be necessary to carry out a check to fulfill legal obligations, Art. 6 para. 1 sentence 1 lit. c GDPR in conjunction with EU Regulations 881/2002 and 2580/2001.

5. Reimbursement of travel expenses

If travel expenses to be reimbursed by Vossloh are incurred, the data processing associated with the settlement is based on Art. 6 para. 1 sentence 1 lit. b, lit. c GDPR in conjunction with the applicable national regulations (in Germany § 670 of the German Civil Code).

6. Legal defense and prosecution

Data of applicants that we do not hire will be deleted on the basis of our legitimate interests (defense and enforcement of legal claims) regularly 6 months after the end of the application process, unless you have consented to a longer storage period. If you withdraw your application, your application documents will be deleted immediately. For a period of 6 months from the end of the application process, we will store your notification that you have withdrawn your application on the basis of our legitimate interests (defense against legal claims). We may also transfer your personal data to external consultants such as tax advisors, lawyers or certified public accountants for the aforementioned purposes. The legal basis is Art. 6 para. 1 sentence 1 lit. f GDPR (legitimate interests: defense and enforcement of legal claims).

7. Talent pool

With your consent, we will add your application data to our talent pool so that we can consider your application in the event of future vacancies. People who are responsible for filling other positions will also have access. In addition to the Group company to which you have applied, the HR departments of other Group companies may access your application data for the purposes described above at, provided that this is covered by your consent. Data stored in the talent pool will be deleted if you withdraw your consent, but at the latest after three years. The legal basis is your consent, which can be withdrawn at any time with effect for the future, Art. 6 para. 1 sentence 1 lit. a GDPR. If you consent to the transfer to Group companies established in third countries, the legal basis for the transfer is Art. 49 para. 1 lit. a GDPR. We would also like to point out that these companies have undertaken to maintain a European level of data protection by means of standard contractual clauses, Art. 46 GDPR in conjunction with EU 2021/914.

8. Processing in the event of a job offer

If an employment relationship is to be established, the data you provide to us as part of the application process and, if applicable, the PES report will be transferred to your personnel file and processed for the purpose of implementing the employment relationship. You may also be asked to provide further documents via the online recruiting platform. We will inform you separately about any further processing of your data when collecting data as part of the hiring process. The legal basis is Art. 6 para. 1 sentence 1 lit. b GDPR.

9. Reporting

In order to be able to advertise vacancies at Vossloh more efficiently, we collect data on a voluntary basis during the application process on how you became aware of our vacancies. The legal basis for this is your consent, which can be revoked with effect for the future, Art. 6 para. 1 sentence 1 lit. a GDPR.

We process application receipt times linked to the title of the advertised position in order to determine the number of applications per position and the time it takes to fill vacant positions. Reports created for this purpose only contain aggregated data that is not personally identifiable. The legal basis is Art. 6 para. 1 sentence 1 lit. f GDPR (legitimate interest: Improvement of recruiting processes in an efficient manner).

III. Recipients of data, third country transfers

Recipients of your personal data may be

• Other Group companies, provided you have consented to the transfer or the advertised position has Group-wide dimensions. We will inform you of this separately.
• Providers of HR management software (see section II, 2), authorities, chambers of trade and industry and commerce, translation service providers, recruitment agencies and service providers for the performance of PES.
• Transfers to third countries do not take place unless we point this out to you.

Vossloh AG may be engaged by the Group company advertising the vacancy as a processor, in particular for the provision of the online recruiting platform. In this respect, Vossloh AG processes your personal data on the instructions of the Group company publishing the job advertisement.

In addition, we may transfer your personal data to other recipients if you have consented to the transfer or due to a legal obligation, a court order or to support public prosecutor's investigations or other proceedings to investigating authorities, provided that we are legally obliged to do so. The legal basis is Art. 6 para. 1 sentence 1 lit. c GDPR in conjunction with the legal obligation or authorization basis applicable in the individual case.

We may also transfer your personal data to external consultants such as tax advisors, lawyers or certified public accountants for the purposes and on the legal basis specified in Section I, 6.

IV. Origin of the data

As a rule, we obtain your personal data directly from you. To fill vacancies, we also actively search online in professional networks and other freely accessible sources with a clear professional reference for suitable candidates. In this context, we only use data that is publicly accessible from the aforementioned sources and that is absolutely necessary for checking and making contact. We may also receive application data from recruitment consultants or recruitment agencies. The legal basis is Art. 6 para. 1 sentence 1 lit. f GDPR. Our legitimate interest is to fill vacant positions quickly with suitable applicants.

V. No obligation to provide personal data; no automated decision-making

The provision of personal data is neither legally nor contractually required. However, the provision of personal data is necessary for the application process. This means that if you do not provide us with personal data when applying, we will not be able to carry out the application process and will not be able to consider you in the future.

Automated decision-making - including profiling - within the meaning of Art. 22 GDPR does not take place.

VI. Your rights as a "data subject"

Every data subject has the following rights:

• Right to access (Art. 15 GDPR)
• Right to rectification of incorrect data (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing of personal data (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).

Every data subject has a general right to object (see Art. 21 para. 1 GDPR). In this case, the objection to data processing must be justified. Please note that we may not be able to continue the application process if you object to processing.

If the data processing is based on consent, your consent can be withdrawn at any time with effect for the future. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

To exercise your rights as a data subject, please contact the HR department.

Werdohl, April 2025