General Information on Data Protection PONS Intelligence GmbH protects and respects your personal data and privacy with the highest priority. In our privacy policy, we want to transparently inform you about the data processing that takes place in connection with our company and the rights you have in connection with your data. Your personal data will always be collected and processed in accordance with the General Data Protection Regulation (GDPR) and any other data protection-relevant provisions. We treat your data with strict confidentiality and place great importance on protecting your personal information. If you have any questions or concerns about this statement or the processing of your data, we are of course at your disposal.

Name and address of the controller PONS Intelligence GmbH

Rotebühlstr. 77

70178 Stuttgart

E-Mail: info@pons-i.com

Tel.: +49 (0) 711 89 462 – 100

Name and address of the data protection officer Name and address

Data Protection Team for General Data Protection Inquiries Email address and website

For questions regarding the processing of your personal data, for the assertion of your rights as a data subject (such as the right to information, correction, blocking or deletion of data), as well as for the revocation of granted consent, please contact our data protection officer directly.

With PONS Translate Enterprise, translate We want to explain to you transparently how we handle your data when you use our services to translate your texts:

What happens to the text you enter? As soon as you enter your texts into our service, they will be transferred to our servers. This step is necessary so that we can translate or improve your texts for you. Without this transfer, our service would not be usable.

What do we use your texts for? We only store the texts you enter and the uploaded documents for the duration and purpose of processing, i.e., for translation or improvement of the texts. After this processing, the texts and uploaded documents will be deleted. We do NOT store this data to train our translation models or improve our service.

How do we handle your glossary and translation memory data? If you use our glossary function or translation memory function to save specific terms, term pairs, or text segments, we store this data on our servers exclusively for your access, so you can use your glossaries and translation memories across devices and use them in the translation process for a customized translation.

How do we handle your documents? Translated documents are stored in your account for later retrieval.

Deletion or blocking of personal data We store your personal data only for the period necessary to fulfill the specified purpose. Upon the purpose being eliminated and upon the expiration of any applicable retention periods, your data will be deleted immediately. If deletion is not possible, the data will be blocked instead.

Rights of affected individuals The EU General Data Protection Regulation (GDPR) provides extensive rights for data subjects in Chapter III, which we will explain to you below regarding the processing of your personal data:

1. Right to information

This provision concerns, in particular, information on the following details of data processing: • Purposes of processing • Categories of data • Receiver or categories of receivers, as applicable • If applicable, the planned storage duration or the criteria for determining this duration • Note on the respective right to correction, deletion, restriction or objection • Exercise of the right to lodge a complaint with a supervisory authority • If applicable, origin of the data (if not collected from you) • The existence of automated decision-making, including profiling, including meaningful information about the logic involved, the scope, and the expected impact. • Transmission (planned) to a third country or international organization, if applicable.

2. Right to rectification We will promptly correct any erroneous data, provided you inform us accordingly. 3. Right to erasure (right to be forgotten) If processing is no longer necessary and one of the following conditions is met: • Loss of the purpose of processing • Withdrawal of their consent and lack of any other legal basis for processing • Objection to processing without a compelling reason • Unlawful Processing • Required to fulfill a legal obligation • Data collection was conducted in accordance with Article 8, Paragraph 1 of the GDPR. We may forward your request for deletion to the third parties to whom your data was previously transmitted.

4. Right to restriction of processing If one of the following conditions is met:

You dispute the accuracy of your data (restriction can be made on our site for the duration of the check) In case of unlawful processing and if the data is not to be deleted, a restriction of processing takes place in place of deletion If the processing purposes cease to exist, you also need your data to assert, exercise or defend legal claims After you have objected in accordance with Art. 21 para. 1 DS-GVO and for the duration of the examination, whether our legitimate reasons outweigh yours. Right to data portability If it is technically possible and does not affect the rights and freedoms of other persons, we will - at your request - transfer your data to another recipient (responsible person). Right to object If we collect or have collected personal data from you (on the basis of Art. 6 para. 1 e or f or Art. 9 para. 2 a DSGVO) and process it, you have the right to object at any time (with effect for the future) to data processing (incl. profiling). In exceptional cases, the objection may be ineffective, e.g. if we can prove compelling legitimate interests for processing that outweigh your interests or processing serves the assertion, exercise or defense of legal claims. If we process your personal data to operate direct mail, you have the right to object to this processing at any time. This also applies to profiling insofar as it is related to such direct mail.

You also have the right to object to the processing of your data, which takes place for scientific or historical research purposes or for statistical purposes in accordance with Art. 89 para. 1 DS-GVO, unless such processing is necessary to fulfill a task in the public interest. Automated decisions in individual cases including profiling If we collect or have collected personal data from you and process it, you have the right not to be subject to a decision based solely on automated processing - including profiling - that has legal effect or affects you in a similar way.

Exceptions to this requirement apply if the decision is necessary for the conclusion or performance of a contract between you and us or you have expressly consented to the processing. In any case, we take appropriate measures to protect your rights and freedoms as well as your legitimate interests, which include at least the right to obtain the intervention of a person on our part, to state your own position and to challenge the decision. Right to revoke a data protection consent You have the right to revoke a consent to the processing of personal data at any time. Right to complain to a supervisory authority A list of the supervisory authorities responsible in Germany can be found on the website of the Federal Commissioner for Data Protection or at the following link: https://www.bfdi.bund.de/DE/Service/Kontakt/Kontaktfinder/kontaktfinder_node.html.

Legal Basis of Processing We process personal data in accordance with the requirements of the GDPR, as follows, depending on the type and purpose of the processing: Legal basis and GDPR provision Informed consent: Article 6 (1) a Performance of a contract: Article 6 (1) b Implementation of pre-contractual measures: Article 6 (1) b Compliance with legal obligations: Article 6 (1) c Protection of vital interests: Article 6 (1) d Safeguarding our legitimate interest: Article 6 (1) f

Our legitimate interest Our legitimate interest, as defined in Article 6 (1) f GDPR, is based on the performance of our business activities to maintain our operational capability and secure the employment of our employees. Existence of automated decision-making We do not use automated decision-making processes and do not use profiling techniques.

General Information on Data Processing on Our Websites The following information applies to data processing on our website in general. Unless exceptions or deviations from this information are made, Additions to this are detailed in the respective sections.

Information on data security

We secure your personal data processed by or through us with appropriate technical and organizational measures against loss, destruction, access, alteration, or distribution of your data by unauthorized persons. Despite regular checks, it is not possible to provide complete protection against all risks.

General Time Limits for Data Deletion

Upon the removal of the storage purpose, the retention periods are generally at least six or ten years. Data deletion is generally performed in accordance with our deletion concept, usually without delay, unless there is a retention obligation, necessity for contract fulfillment, or a legitimate interest.

Recording of general data and information

As soon as you visit our website, some general data and technical information are collected by our web server - as shown in the following table:

Collected data and purpose of collection

Browser types and versions used: Correct display of page content Operating system used, visitor origin (referrer, e.g., Google), clicked subpages: Optimization of our website content

Date and time of access to the website, as well as the visitor's IP address and internet service provider: Ensuring the long-term functionality of our IT systems (for website operation) and preventing misuse Other data and information for danger prevention in the event of attacks Provision of relevant information to law enforcement authorities in the event of a cyberattack Under certain circumstances (e.g., due to legal or contractual regulations), you are obligated to provide us with your personal data. Examples: Type or purpose of processing and necessity for the conclusion of a purchase contract (e.g., your address): Fulfillment of contractual obligations (e.g., delivery of goods to your address) In the context of employment (e.g., transmission of data to the tax office): Fulfillment of legal requirements (e.g., tax regulations)

Contact Form and Contacting Purpose of processing: Processing for the purpose of responding to the request of the form sender. Legal basis (in accordance with Art. 6/9 GDPR): Implementation of pre-contractual measures (Art. 6 (1) b) Duration of data storage: See "General deadlines for data deletion" Obligation/necessity: There is no obligation. Consequences of non-provision: none Possible origin of data (if not collected directly from the data subject): The data comes from the data subject themselves. Possible categories of personal data (if not collected directly from the data subject): Data and categories requested in the respective form. Possible change of purpose: none

User Login Purpose of processing: User login Username, Password data type Purpose of collection Access for the user Legal basis (according to Art. 6 / 9 GDPR): • Preservation of legitimate interests (Art. 6 para. 1 f) • Performance of a contract (Art. 6 (1) b) • Conducting pre-contractual measures (Art. 6 para. 1 b) Recipient (if forwarded): none If applicable, intention of forwarding to a third country or international organization (including information about the Commission's adequacy decision or suitable guarantees): Data transfer to a third country does not take place and is not planned. If known - Duration of data storage: See General time limits for data deletion Obligation to provide personal data (e.g. due to statutory or contractual regulations) / Necessity: Without the data, the user account cannot be created. Consequences of non-compliance (in case of non-provision of the required data): Without the data, the user account cannot be created. Possibility of automated decision-making: In this context, we waive automated decision-making. Possibility of origin of data (if not collected directly from the data subject): The data comes from the data subject himself. Possibility of change of purpose: None

Cookies On this website, we use cookies, which are small text files that are stored on your computer via your internet browser (e.g., Google Chrome, Safari, Firefox, Edge). These cookies are used for various purposes: Many cookies are technically necessary to provide you with certain website functions (e.g., shopping cart functions, saving your login information), others are used for the security of your data or the website, and some can be used to analyze your user behavior. The latter cookies may contain a so-called cookie ID, a unique identifier consisting of a string that enables the association of websites and servers with the storing browser. Cookies that are necessary for transmitting a message over a public telecommunications network and cookies that are absolutely necessary to provide you with a specifically desired function are referred to as technically necessary cookies and may be set without your explicit consent (§ 25 (2) TDDDG). All other cookies require consent (§ 25 (1) TDDDG); as applicable, regulated by our consent management platform. We use cookies, some only for the duration of the stay on the website, some for a predefined period, and some permanently. You can manually or automatically delete all these cookies at any time through your web browser. Using our offerings is possible (even if not in full functionality) without cookies. Most browsers are set to automatically accept cookies. You can disable the storage of cookies or set your browser to notify you as soon as cookies are sent.

Applications and Application Process Purpose of processing: Applicant data are collected, processed, and used for the purpose of selecting potential employees. Legal basis (according to Art. 6 / 9 GDPR): Implementation of pre-contractual measures (Art. 6 para. 1 b) Recipient (in case of forwarding): JOIN Solutions AG Eichenstrasse 2 8808 Pfäffikon SZ (Schwyz) Switzerland If applicable, intention of forwarding to a third country or international organization (incl. information about the adequacy decision of the Commission or suitable guarantees): No forwarding takes place and is not planned. If known: Duration of data storage: The personal data of applicants who we do not hire will be stored for possible legal claims (e.g. according to the General Equal Treatment Act (AGG)) for the required period (maximum 6 months) and then immediately destroyed or deleted Obligation to provide personal data (e.g. due to legal or contractual regulations) / Necessity For a smooth application process, it is necessary that you provide us with the required information truthfully. Consequences of non-compliance (in case of non-provision of the required data) Non-compliance (i.e. non-provision of the required data) would possibly result for you in the fact that an employment contract cannot be concluded with you. Possibly existence of automated decision-making In this context, we waive automated decision-making. Possibly origin of the data (if not directly collected from the data subject) As a rule, the data come from the data subject himself; however, they may also come from third parties. Possibly categories of personal data (if not collected directly from the data subject). Master data, contact data, application data Possibly change of purpose If we take you into a employment relationship after the application process is completed, the purpose of processing the data in question changes: in this case, they will be used in the future to implement and maintain the employment relationship.

PONS Translate Enterprise Purpose of processing, data type, and purpose of collection • Text content & documents: Translation of entered texts & documents • Store original text and translation: Quality assurance • Translation of the legal domain, German source text to English (United States): Legal Basis: (pursuant to Art. 6 / 9 GDPR): • Performance of a contract: (Art. 6 (1) b) • Preservation of legitimate interests (Art. 6 para. 1 f) If applicable, intent to forward to a third country or international organization (including information about the Commission's adequacy decision or suitable guarantees): No data transfer to a third country is taking place and is not planned. If known: Duration of data storage See General deadlines for data deletion Obligation to provide personal data (e.g. due to legal or contractual regulations) / Necessity There is no obligation. Consequences of non-compliance (in case of non-provision of the required data) no If applicable, existence of automated decision-making In this context, we refrain from automated decision-making. If applicable, origin of the data (if not collected directly from the data subject) The data comes from the data subject themselves. If applicable, change of purpose: no OneTrust Purpose of processing: Providing a data protection management platform Legal basis: Legitimate interest (Article 6 (1) f) If applicable, recipient (in case of forwarding) OneTrust, LLC, Beavis Morgan and BM2020, 82, St. John Street, Farringdon, London Borough of Islington, London, Islington, Greater London, England, EC1M 4JN, United Kingdom If applicable, intention of forwarding to a third country or international organization (including information about the Commission's adequacy decision or appropriate guarantees) not known: Duration of data storage See General deadlines for data deletion Obligation to provide personal data (e.g. due to legal or contractual regulations) / Necessity no consequences in case of non-compliance (in case of non-provision of the required data) no If applicable, existence of automated decision-making In this context, we waive automated decision-making. If applicable, origin of the data (if not collected directly from the data subject) As a rule, the data comes from the data subject himself. If applicable, categories of pb data (if not collected directly from the data subject) which pages and functions were called up or clicked on during the website visit (click behavior), IP address assigned by the Internet Service Provider (ISP) in anonymized form, previously visited website (referrer), visited subpages, time spent on the website, frequency of visits, date, access location, time of visit, user agent If applicable, change of purpose no Opt-out Installation of the browser plugin: https://tools.google.com/dlpage/gaoptout, see also under Cookies Data protection officer of the provider https://support.google.com/policies/contact/general_privacy_form Data protection declaration of the provider https://policies.google.com/technologies/cookies?hl=en

YouTube Purpose of processing Video player service (viewing, rating, sharing, commenting, uploading videos) Legal basis Informed consent (Art. 6 (1) a) Recipient Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland Third country transfer if applicable USA; EU-U.S. Data Privacy Framework (Certification) Duration see "General Data Deletion Deadlines" Obligation no consequences no automated decision-making no origin usually affected, if applicable Third categories device information, IP address, referrer URL, viewed videos Purpose change no OptOut: https://safety.google/privacy/privacy-controls/ Data protection officer: https://support.google.com/policies/contact/general_privacy_form Privacy policy: https://policies.google.com/privacy?hl=en Here, specific data processing is informed on the page https://ai.langenscheidt.com/:

Amazon Web Services Purpose of processing: Cloud computing, website hosting Legal basis: Legitimate interest (Art. 6 (1) f) Recipient: Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg Contract processing: AV contract concluded Third country transfer: if applicable USA; Standard contractual clauses; DPF certification Duration see "General deadlines for data deletion" Obligation no consequences no automated decision-making no origin usually affected, if applicable Third categories: extensive usage/device/cookie/clickstream/IP/location/interaction data (see original text) Langenscheidt Language Coach (Web) Field Content Purpose of processing Central product of the website Legal basis Performance of a contract (Art. 6 (1) lit. b) Recipient Titanom Technologies GmbH, Gabriele-Münter-Straße 3, 82110 Germering Third country transfer if applicable. USA; AV-contract in accordance with Art. 28 GDPR Duration see "General time limits for data deletion" Obligation no consequences no automated decision-making no origin generally Affected categories User data, text content

Sentry Field Content Purpose of processing Error tracking & performance monitoring Legal basis Legitimate interest (Art. 6 (1) lit. f) Recipient Functional Software Inc. dba Sentry, 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA; security@sentry.io ; https://sentry.io/privacy/ Auftragsverarbeitung AV-Vertrag geschlossen Drittlandübermittlung ggf. USA; Standard Contractual Clauses; DPF Certification Duration Deletion as soon as no longer required; see "General Time Limits for Data Deletion" Obligation No Consequences No Automated Decision-Making No Origin Usually Affected, if applicable Third categories User-Agent, usage data, device information, IP address, error data Purpose change no AVV/DPA: https://sentry.io/legal/dpa/3.0.0/ Privacy policy: https://sentry.io/privacy/ OneTrust Purpose of processing Provide a data protection management platform Legal basis Legitimate interest (Article 6 (1) f) If applicable, recipient (in case of forwarding) OneTrust, LLC, Beavis Morgan and BM2020, 82, St. John Street, Farringdon, London Borough of Islington, London, Islington, Greater London, England, EC1M 4JN, United Kingdom If applicable, intention of forwarding to a third country or international organization (including information about the Commission's adequacy decision or appropriate guarantees) not known: Duration of data storage See General deadlines for data deletion Obligation to provide personal data (e.g. due to legal or contractual regulations) / Necessity no consequences in case of non-compliance (in case of non-provision of the required data) no If applicable, existence of automated decision-making In this context, we waive automated decision-making. If applicable, origin of the data (if not collected directly from the data subject) As a rule, the data comes from the data subject himself. If applicable, categories of pb data (if not collected directly from the data subject) which pages and functions were called up or clicked on during the website visit (click behavior), IP address assigned by the Internet Service Provider (ISP) in anonymized form, previously visited website (referrer), visited subpages, time spent on the website, frequency of visits, date, access location, time of visit, user agent If applicable, change of purpose no Opt-out Installation of the browser plugin: https://tools.google.com/dlpage/gaoptout, see also under Cookies Data protection officer of the provider https://support.google.com/policies/contact/general_privacy_form Data protection declaration of the provider https://policies.google.com/technologies/cookies?hl=en Specific data processing within the PONS Translate Enterprise Interface (https://pro.pons.com/

Account Management

Purpose of processing Registration of customers, invitation to product Data type First and last name, email address Legal basis Fulfillment of a contract (Art. 6 para. 1 b); Implementation of pre-contractual measures (Art. 6 para. 1 b) Recipient no / not planned Duration see "General deadlines for data deletion" Obligation Without the data, the user account cannot be created. Consequences Without the data, the user account cannot be created. Automated decision-making no Origin Affected Purpose change no PONS Translate Enterprise (Interface) Purpose of processing Data type Purpose of collection Translation Text content Translation of entered texts Quality Saving of original text and translation Quality assurance Documents Documents Translation of uploaded documents & storage in account for recall Legal basis: Fulfillment of a contract (Art. 6 para. 1 b) Recipient: no third country transfer: no / not planned Duration: see "General deadlines for data deletion" Obligation / Consequences: no Automated decision-making: no Origin: Affected Purpose change: no Amplitude Field Content Purpose of processing Web analysis tool (interpretation of user behavior) Legal basis Informed consent (Art. 6 para. 1 a) Recipient Amplitude, San Francisco, California Third country transfer USA Duration see "General deadlines for data deletion" Obligation no Consequences no Automated decision-making no Origin usually Affected, if necessary third parties Purpose change no Specific information on data processing on social media channels Operation of our LinkedIn page For the operation of our LinkedIn website, we may collect personal data. The collection and processing of your data is generally done in a pseudonymized form, meaning we cannot directly associate your data with your name or email address. In this case, the processing is done through a profile based on an ID or a cookie. You have the ability to significantly influence the processing of your data by clicking on the Settings menu item in your LinkedIn profile. LinkedIn Analytics LinkedIn provides us with statistical data about the visitors to our LinkedIn website through the "LinkedIn analytics" function. We are not able to establish a personal connection. This information is purely functional and helps us better analyze our page and adapt it to your needs and interests. More information: https://www.linkedin.com/help/linkedin/answer/83597 Interaction with the LinkedIn page As soon as you use a LinkedIn plugin on our website or rate or subscribe to posts on our LinkedIn page, a corresponding personal connection can be established. We can also see which LinkedIn profile is commenting on our LinkedIn page. Service provider for LinkedIn marketing If we use service providers for the data processing of our LinkedIn page, we conclude corresponding contracts for order processing (AVV) with them. We regulate the scope and security conditions of the processing and determine the necessary authority according to Art. 28 GDPR. Joint responsibility (Art. 26 GDPR) LinkedIn Ireland Unlimited Company Wilton Place Dublin 2 Ireland For the operation of our LinkedIn page, we are jointly responsible with LinkedIn for the processing of your personal data. LinkedIn Data Protection Officer

The LinkedIn privacy policy can be found here: https://www.linkedin.com/legal/privacy-policy. To contact LinkedIn's data protection officer, you can fill out a contact form at the following link: https://www.linkedin.com/help/linkedin/ask/TSO-DPO

Comment function on our LinkedIn page

We regularly post news on our LinkedIn page. To engage in an active exchange with you, we have activated the comment function. We reserve the right to remove inappropriate posts (e.g., with racist, illegal, or similar content) immediately. For this purpose, comments are checked for inappropriate content. In doing so, we have access to • the content of the comment • the time of creation • the user ID • the LinkedIn username

As a rule, the data is not disclosed to third parties; in exceptional cases, a legal provision or a court order may require us to disclose it. Contact LinkedIn You can contact us through various channels on our LinkedIn page. Personal data is only collected if you voluntarily provide it to us as part of your contact. We use the data you provide without your separate consent solely for the fulfillment and processing of your contact request. Disclosure to third parties does not occur.