Data Privacy Notice for Civil-Law Notaries

This is to inform you, supplementarily to the data privacy information provided by Simmons & Simmons LLP ("Simmons & Simmons") (https://simmons-simmons.com/en/legal-and-regulatory-information/data-privacy), of the way that the civil-law notaries (German Notare, hereinafter "notaries") working with Simmons & Simmons, at present

• Boris Strauch-Rötting, Friedrich-Ebert-Anlage 49, 60308 Frankfurt am Main, Germany

process personal data in the performance of their official duties (e.g. issuing certifications and safekeeping) and of the rights that you have in this context.

If you are looking for information about the processing of your personal data

• as a user of the website https://simmons-simmons.com,
• as a client of Simmons & Simmons,
• as an applicant for a position with Simmons & Simmons,
• as a business partner to Simmons & Simmons,

please see Simmons & Simmons' Privacy Notice at https://simmons-simmons.com/en/legal-and-regulatory-information/data-privacy.

The notaries will process your data in accordance with the data privacy provisions of the Hessian Data Protection and Freedom of Information Act ("HDSIG"), Regulation (EU) 2016/679 (General Data Protection Regulation - "GDPR") and the Federal Data Protection Act ("BDSG").

Should you have any questions or concerns after reading this privacy information, please feel free to contact the notaries' data protection officer as follows:

Simmons & Simmons LLP
Data Protection Officer -- Confidential
Jan Zücker
Königsallee 2a, Kö-Bogen
40212 Düsseldorf, Germany
E-mail: datenschutzbeauftragter@Simmons-Simmons.com

1) Who is the controller in terms of the processing of my personal data?

It is the notary that processes personal data in the performance of his or her official duties that is the controller within the meaning of Art. 4(7) GDPR.

2) What types of data are processed by the notary as part of the issuing of certifications and safekeeping?

Depending on the elements of the official duties performed by the notaries, the following types of personal data are processed:

2.1 contact information, in particular last name, first name, address, e-mail address, phone number,

2.2 contract and other data included in the documents to be certified or provided for safekeeping,

2.3 other personal data provided to the notary for the purpose of certification, safekeeping or any other official business, and

2.4 information to be included in the notarial record concerning the parties' identities, their statements, the relationships between the parties and, as the case may be, their legal capacity to perform a legal act, which may include information on serious illnesses and disabilities.

2.5 In general, the notary collects such data from you directly. In individual cases, the notary will obtain personal data concerning you from third parties, in particular from the company and/or the authority or other entity that you are employed with or that you are a member of, or from another person involved in the relevant action.

3) For what purpose and on what legal basis is the personal data processed?

3.1 The notary will process the personal data referred to in 2.1 to 2.3 where this is necessary to perform the public duties vested in the notary by law. The legal basis for such processing is Art. 6(1)(e) GDPR in conjunction with section 3(1) HDSIG of the Berlin Data Protection Act ("BlnDSG") in conjunction with the provisions of the German Notarization Act ("BeurkG"), the German Code on Notaries ("BNotO") and the Official Regulations Applicable to Notaries (in Hesse, implemented by the circular order of the Hessian Ministry of Justice dated December 2021) ("DONot").

3.2 The notary processes the personal data referred to in 2.4 in order to meet legal requirements. The legal basis for such processing is Art. 6(1)(c) GDPR or, in the case of sensitive data, especially data concerning health, Art. 9(1)(g) GDPR in conjunction with sections 8 to 17, 22 to 28, 36 to 38 BeurkG.

4) For how long will my personal data be stored?

The above-mentioned types of data will be stored for as long as this is necessary to achieve the purposes stated and will be erased or anonymized thereafter unless the notary is obligated to retain them. The notarial duties to retain records provide for a retention period of up to one hundred years. The legal basis for such retention is Art. 6(1)(c) GDPR or, in the case of sensitive data, Art. 9(2)(g) GDPR in conjunction with section 5(4) DNotO.

5) Will my personal data be disclosed to third parties?

5.1 For certain technical processes of data processing, the notary uses the support of external service providers that will be given access to your personal data in order to provide such services. Such service providers are carefully selected and meet high standards of data protection and data security. They are sworn to strict secrecy and process data only as commissioned and instructed by the notary.

5.2 Except in the cases illustrated in this privacy notice, the notary will only disclose your data to third parties without your express consent if he or she is bound to do so under law or by an authority's or court order.

6) What rights do I have in respect of my personal data?

6.1 Provided that the legal requirements are met, you will have the right to obtain access to the personal data concerning you that the notary stores.

6.2 Should any personal data concerning you be inaccurate or incomplete, you will have the right to obtain rectification of such data or, as the case may be, have it completed -- including by means of providing a supplementary statement.

6.3 Provided that the legal requirements are met, you will also have the right to obtain the erasure or, as the case may be, the restriction of processing of your personal data, and to receive the data you have provided in a structured, commonly used and machine-readable format. You will have the right to transmit such data to another controller. Where technically feasible, you may also have such data transmitted directly from the notary to the other controller.

6.4 You will also have the right to lodge a complaint with a supervisory authority. For the German state of Hesse, this is

The Hessian Commissioner for Data Protection and Freedom of Information
P.O. box 3163
65021 Wiesbaden, Germany
poststelle@datenschutz.hessen.de