GTC and software contracts

Introduction

The following notes provide an overview of what happens to your information when you use our "ema in axilaris Collaboration Hub" service. Two interests prevail in offering a high level of security:

1. Handling your personal information
2. Handling of your other data worth protecting when using the online service

With regard to the provision of the online service, imk automotive GmbH is responsible for the secure operation of the service and for maintaining a high level of security in the exchange and storage of information.

The processing of personal information within the scope of the use of the service is carried out exclusively on the instructions of the client and is regulated in an order processing addendum to the main contract. The subcontractor named in this contract, Axilaris GmbH in Chemnitz, is obliged to provide the Virtual Desktop Interface (VDI) and is contractually bound by imk automotive GmbH to at least the security level defined in the order processing addendum. The security level applies to both groups of information mentioned above.

Re 1. personal data

What personal data is collected and for what purpose?

A) On the one hand, your data is collected by you providing it to us.
This is data that is disclosed for the contractually agreed service in the contractual relationship and is necessary for the fulfilment of the service and billing:

• Invoice data
• Contact details of the contact persons
• Contact details of users in case of support

The contact details are limited to the surname, first name and title of the contact person and their professional address details such as, email address, telephone number, company address, position in the company and department in the company.

Support is provided directly by imk automotive GmbH. This information is not passed on to subcontractors.

B) Other personal data is automatically collected when using the IT systems and stored in log files.
This is data that is required for support services in the event of technical problems and data that forms the basis for invoices for the service used.

• Technical data of the user
  • Version and name of the Internet browser at login/logout
  • Time of login/logout
  • Time of the start and end of the use of the ema product family
  • IP address, host name, MAC address of the connecting client
  • User name

What rights do you have regarding the processing of your personal data?
The statutory provisions apply:

• Revocation of your consent to data processing
• Right of appeal to the competent supervisory authority
• Right to data portability
• Right to information, blocking, deletion and correction
• Right to restrict processing

A more detailed presentation of your rights can be found in the Privacy policy of imk automotive GmbH.

Do you have questions about data protection?
We have appointed a data protection officer for our company.

To the Data Protection Officer
Amselgrund 30
09128 Chemnitz
Phone: +49 (0)371 400 97-0
E-mail: data-privacy@imk-ic.com

Re 2. data in general

From the moment the desktop is registered for virtual use, the operating system, some applications and apps typical of the operating system and the application of the ema Software Suite of the booked online product are available to you. In order to be able to work on results in an ema product, it is necessary to upload the required data to the memory of the virtual system. Results and project files (ema Work Designer), as well as the productive database of the ema Plant Designer, are also stored in the axilaris Collaboration Hub.

As a customer, you decide yourself which information you can and may use here.

The information includes:

• 3D objects for products and resources
• Layout data for workplaces, halls, etc.
• and other information belonging to you

Together with our partner axilaris GmbH, we provide a high level of security to protect your information on the virtual environments. Our partner is certified according to ISO 27001:2013 and EN 50600 "Reliable Data Center" by TÜV Rheinland and is subject to the strict rules of the financial sector. You can find the certificates of our partner in the Flyer. imk automotive GmbH itself is certified according to TISAX, which gives you the security of being able to rely on audited processes outside the virtual environment of the axilaris Collaboration Hub. If you participate in the ENX TISAX process, you can view the status of imk automotive GmbH's TISAX auditing directly via the TISAX portal.

We have summarised the most important safety aspects for you:

• There will be no unauthorised access to your data, either by axilaris GmbH or imk automotive GmbH.
• Your data never leaves the axilaris Collaboration Hub.
• The data centres are certified for high availability and operational safety by an independent body (TÜV).
• axilaris GmbH operates an information security management system (ISMS) certified according to ISO 27001, imk automotive GmbH according to TISAX.
• A data backup is automatically performed daily and is kept for a period of 30 days.
• The transmission of your information is encrypted.
• The virtual desktop is protected by a multi-level firewall concept.
• Your data is strictly separated from that of other customers.
• The systems used are subject to axilaris GmbH's regular vulnerability and patch management process. This ensures that potential security gaps are closed within a reasonable period of time in accordance with the requirements of ISO 27001.
• Necessary data medium changes and data medium disposals are carried out according to a certified procedure.
• Upon expiry of your online contract, your customised information will be deleted upon expiry of the contract, backups will remain for 30 days.
• You can delete your saved data from the file storage yourself at any time. This does not affect the backup strategy.

Do you have specific questions about security issues? Then please feel free to contact us.

Additional Licensing Service ema Software Suite

In addition to the data required directly for the ema Software Suite, the ema Software Suite uses imk automotive GmbH's own licensing service. This service is also operated in the axilaris Collaboration Hub and manages and controls the licences of the ema Software Suite. Transfers take place exclusively between the ema software components and the service and are also encrypted. The same applies to the service's data storage; data is stored in encrypted form.

imk automotive GmbH has access to the usage data of this service.

Reports and log files are pseudonomised, i.e. IP addresses and user names can only be read in modified form.