Privacy policy for webcasts and virtual events

The controller pursuant to Article 4(7) of the EU General Data Protection Regulation (GDPR) is
Salzgitter AG
Eisenhüttenstraße 99
38239 Salzgitter, Germany
Phone: +49 5341 / 21-01

You can contact our Data Protection Officer at the address and phone number listed above, or by email at:

datenschutz.holding@salzgitter-ag.de

Personal data is processed for the following purposes:

• To technically facilitate online broadcasts
• To enable participation in events requiring registration
• To verify identities and access permissions
• To ensure the security and stability of the systems

Legal basis:

• Art. 6(1)(b) GDPR: Conducting events requiring registration
• Art. 6(1)(f) GDPR: Technically necessary data processing for the provision of broadcasts

3.1 For publicly accessible livestreams that do not require registration

• IP address
• Time and duration of access
• Device and browser information
• Technical log data

3.2 For events requiring registration

• First name
• Last name
• Email address
• Company

3.3 Interactive formats (e.g., Q&A sessions)

• Audio contributions
• Video contributions, if applicable
• Chat content

Non-public Q&A sessions are not recorded; recordings are made exclusively for the respective public portion of the event, if applicable.

We use various service providers and platforms for technical implementation: 

4.1 Neumann & Müller GmbH & Co. KG
Provision and execution of live streams and online events requiring registration.

Neumann & Müller uses the video platform provided by 3Q GmbH for the technical implementation of streaming content.

In connection with the execution of these services, personal data is also processed on our behalf by the following service providers:

• 3Q GmbH (Germany)
  Provision of the video streaming infrastructure (3Q SDN video platform). When video content is accessed, personal data is processed (e.g., IP address, technical access data such as browser type, operating system, referrer URL, and time of access).
• Cloudflare, Inc. (USA)
  Content delivery and security services (e.g., CDN, DDoS protection)

Data transfers to third countries (e.g., the USA) cannot be ruled out, particularly in connection with the use of Cloudflare. These transfers are based on appropriate safeguards in accordance with Art. 44 et seq. of the GDPR (e.g., EU Standard Contractual Clauses).

For the conduct of individual webcasts, we sometimes use separate event websites. Supplementary, event-specific privacy notices apply here, which you can view at the following link: https://szag-ak.de/de/datenschutz

There you will find, in particular, information regarding the processing of your personal data in connection with registration and participation in the respective event.
These notices apply in addition to our Privacy Policy.

4.2 Microsoft Teams
Provider: Microsoft Ireland Operations Ltd., Ireland
Used for webinars and analyst conferences. 

Microsoft Teams is a service provided by Microsoft Corporation. For more information on data processing, please visit:
https://www.microsoft.com/en-us/privacy/privacystatement

4.3 Company Webcast B.V.
Provider: Company Webcast B.V. (part of Euronext Corporate Services BV)
Used for selected conference calls in connection with quarterly reports.

Further privacy information from Company Webcast B.V. can be found here:
https://info.companywebcast.com/hubfs/4788601/5. Company Webcast/Terms and Conditions/Privacy Policy/Company Webcast Privacy Statement Website 2025.pdf

4.4 meetyoo conferencing GmbH
To host webcasts, virtual events, and conference calls, we use, among other platforms, the platform provided by meetyoo conferencing GmbH, Friedrichstraße 153a, 10117 Berlin, Germany (“MEETYOO”).
MEETYOO acts as a data processor pursuant to Art. 28 GDPR on the basis of a corresponding data processing agreement.

Personal data is processed in connection with participation in webcasts. This includes, in particular:

• Registration data (e.g., name, email address, company if applicable)
• Communication data (e.g., chat messages, questions submitted via Q&A functions)
• Technical data (e.g., IP address, device and log data)
• Usage data (e.g., times of participation, interactions)

The processing is carried out for the purpose of conducting and technically facilitating the event, as well as to ensure stable and secure operation.
Content provided by you (e.g. chat messages or questions submitted via Q&A functions) will be processed during the event and may – depending on the configuration of the event – be visible to other participants.
MEETYOO uses Amazon Web Services EMEA SARL (“AWS”) as a sub-processor for hosting services. According to MEETYOO, data processing takes place within the European Union, in particular in AWS data centres located in Frankfurt am Main, with backups stored in Paris. The use of sub-processors is carried out in compliance with applicable data protection requirements.

The legal basis for the processing is Art. 6(1)(b) GDPR (conducting the event) and Art. 6(1)(f) GDPR (legitimate interest in the secure and efficient execution of webcasts).
To the extent that additional features (e.g., recordings or further analyses) are used, this is based on your consent pursuant to Art. 6(1)(a) GDPR.

MEETYOO is engaged as a data processor based on a corresponding contract pursuant to Art. 28 GDPR.

Further information on data processing in connection with webcasts via MEETYOO as well as general data protection information of the provider can be found at the following links:
https://www.meetyoo.com/en/privacy-policy-meetyoo-pro-show-organizer
https://www.meetyoo.com/en/legal/general-privacy-policy
 

Registration data will be deleted as soon as it is no longer required for the purpose of the event and there are no legal retention periods in effect.

Technical log data is stored only for as long as is necessary for system operation, security, and troubleshooting.

As a data subject, you have the following rights:

• Access to information about the data processed
• Correction of inaccurate data
• Erasure or restriction of processing
• Objection to processing
• Data portability

to the extent permitted by law. These data subject rights are set forth in Articles 15–22 of the GDPR.

We update these guidelines as needed, for example, when new formats are introduced or technical processes are changed.

Below, we provide information about the rights you are entitled to under data protection law, which you may exercise at any time, free of charge, by contacting the data controller and the respective data protection officer.

You can find out how to contact the data protection officer and the data controller in Section 1.

Every data subject has the right of access under Art. 15 GDPR, the right to rectification under Art. 16 GDPR, the right to erasure under Art. 17 GDPR, the right to restriction of processing under Art. 18 GDPR, the right to object under Art. 21 GDPR (see section 10 below), as well as the right to data portability under Article 20 of the GDPR. The restrictions under Sections 34 and 35 of the BDSG apply to the right of access and the right to erasure. In addition, you have the right to lodge a complaint with the competent data protection supervisory authority (Article 77 of the GDPR in conjunction with Section 19 of the BDSG).

You may revoke any consent you have given to the processing of personal data at any time by contacting the controller. Please note that the revocation takes effect only for the future. Processing that took place prior to the revocation is not affected.

As part of our business relationship, you are required to provide the personal data necessary for establishing and conducting a business relationship and fulfilling the associated contractual obligations, or which we are legally required to collect.