We, MHP Management- und IT-Beratung GmbH (hereinafter referred to as "we" or "MHP"), appreciate your interest in our online offering (hereinafter referred to as the "Online Offering"). We take the protection of your personal data very seriously. Your personal data is processed exclusively in accordance with the statutory provisions of data protection law, in particular the General Data Protection Regulation (hereinafter referred to as "GDPR"). With this data protection declaration, we inform you about the processing of your personal data and about your data protection rights in the context of personnel marketing and applications at MHP. For information on the processing of personal data in other areas, please refer to the respective specific privacy policy.

If we refer to this privacy policy from external social media profiles, the following explanations only apply insofar as the processing takes place in our area of responsibility and insofar as no more specific and therefore overriding information on data protection is provided in the context of such social media profiles.

1. Data controller and data protection officer

The responsible party within the meaning of the General Data Protection Regulation is:

MHP Management- und IT-Beratung GmbH
Film- und Medienzentrum
Königsallee 49
71638 Ludwigsburg
Tel: +49 (0)7141 7856-0
eMail: info(at)mhp.com

If you have any questions about data protection, please contact our data protection officer dataprivacy(at)mhp.com.

2. Subject of data protection

The subject of data protection is personal data. This is all information that relates to an identified or identifiable natural person (so-called data subject). This includes information such as name, postal address, e-mail address or telephone number, but also other information that arises during the application process, such as information about your qualifications, education or professional background.

3. Purpose and legal basis of data processing, categories of recipients

You will have an overview of the purposes and legal bases of data processing in the context of personnel marketing and the application process at MHP here below. In any case, we process personal data in accordance with the legal requirements, even if a legal basis other than that stated below is relevant in individual cases.

If an employment relationship is established with you, further data processing is governed by the privacy policy for the employment relationship.

The provision of personal data by you may be required by law or contract or may be necessary for the conclusion of a contract. We will inform you separately if you are obliged to provide personal data and the possible consequences of not providing it (e.g. a loss of claims or our notification that we cannot provide the requested service without providing certain information).

The use of the online offer is generally possible without registration. The use of individual services and functions may require prior registration. Even if you use our online services without registering, personal data may still be processed.

3.1 Fulfillment of contractual and pre-contractual obligations

We process your personal data if this is necessary to carry out the application process and, if applicable, to prepare an employment relationship with you. Data processing is carried out on the basis of Article 6(1)(b) GDPR.

We process personal data insofar as this is necessary to carry out the application process and, if applicable, to prepare an employment relationship with you. The purposes include in particular:

• Recording and reviewing the application
• Application management and implementation of the selection process (forwarding to the responsible internal functions, organization and implementation of job interviews, management and administration of filling the position)
• For internal applicants for internal programs: Application management and implementation of the selection process

Data processing is carried out on the basis of Section 26 (1) sentence 1 BDSG. In this respect, we process the personal data that is required to carry out the application process and, where applicable, to prepare for an employment relationship.

If an employment relationship is not established, your data will be anonymized by us after four months, unless another legal basis applies. If the latter is the case, we will anonymize the data once the other legal basis no longer applies. It will then no longer be possible to draw conclusions about your person. Data processing after anonymization only takes place for statistical evaluation purposes.

3.2 Fact check

We carry out a review of your personal data to ensure that potential employees perform their tasks without conflicts of interest and in compliance with high ethical standards and are committed to the company's principles.

The verification of personal data includes your personal data (surname, first name, date of birth, address) and the presentation of your original identity card or a comparable document proving your identity, the presentation of your original certificates (in particular the last certificate of the highest level of education) or an officially certified copy thereof in paper form.

In addition, we will check whether you have already been employed by MHP and - limited to this case and in compliance with data protection regulations - whether you have been subject to written disciplinary measures in the last three calendar years. For this purpose, personal data in the existing personnel file for the past three calendar years will be queried.

Furthermore, a comparison is made with publicly accessible EU sanctions lists in accordance with Regulations (EC) No. 2580/2001 and 881/2002 as well as the amendments issued and issued by the European Commission.

Only if necessary will you be asked to present the original of your residence permit, severely disabled person's pass or certificate of good conduct (background check).

The fact check is carried out by the relevant HR department as part of the onboarding process. Only a limited number of people are authorized to access your data internally. In the event of conspicuous findings during the fact check, the results are discussed in a committee (specialist department, HR department, works council). The result of the consultation is documented and filed in the personnel file.

For new hires at the Director, Senior Sales Director, Associated Partner, Executive Director and Partner levels, the completed checklist for the fact check and the completed self-disclosure form are stored in the personnel file and remain there in accordance with the deletion period for relevant personnel documents and data. No other data storage or processing takes place. The checklist for the fact check and the self-disclosure will be deleted from the personnel file after four months for external candidates who are not hired and after three years for all other cases.

The processing of your personal data for the purpose of establishing an employment relationship is necessary within the meaning of Section 26 (1) sentence 1 BDSG, as we have a legitimate interest in hiring people who have integrity and act in accordance with applicable law. The contents of the fact check are also regulated in a general works agreement.

The provision of the data is necessary for the conclusion of a contract.

3.3 Job subscription

To subscribe to the "Job Abo" newsletter, all you need to do is enter your email address and state how often you would like to receive the "Job Abo" newsletter. Newsletters are only sent after you have registered, i.e. with your consent on the basis of Article 6(1)(a) GDPR.

If the contents of the "Job Abo" newsletter are specifically described in the context of a registration, these are decisive for the scope of the consent. In addition, the "Job Abo" newsletter contains information about your career opportunities at MHP and other Group companies.

Registration takes place by means of the so-called double opt-in procedure, i.e. after your registration you will receive an e-mail in which you will be asked to confirm your registration in order to prevent misuse of your e-mail address.

The registrations are logged by us in order to be able to prove the registration process and the consent contained therein in accordance with the legal requirements. The logging of the registration and the necessary processing of the data entered by you during registration is therefore carried out on the basis of legitimate interests in accordance with Article 6(1)(f) GDPR.

You can revoke your consent to receive the "Job Abo" newsletter at any time, e.g. by unsubscribing from the newsletter. You will find an unsubscribe link to exercise this right at the end of each newsletter.

3.4 Application account

The purpose of the application account is to enable you to send and manage your application to us or other Group companies via the electronic application system or to monitor job offers. We recommend that you use the application account, as the internal processes and implementation of the application procedure at MHP as well as at the other Group companies are coordinated accordingly.

Even if you send us your application by other means, the application will be scanned as part of our internal processes and the information will be processed electronically (see section 3). You will then receive your paper documents back by post.

If you would like to set up an application account, registration is required. Your registration details (user name and password) will be collected and processed when you register and log in.

As part of the application account, you have the option of setting up an applicant profile. You can use an online questionnaire to enter or upload your personal data (e.g. form of address, title, surname, first name, date of birth, place of birth, country of birth, nationality, address, telephone number, e-mail address), your qualifications (e.g. educational background, professional experience if applicable, language skills, IT skills), your application documents (e.g. letter of motivation, application documents) and other application information (e.g. desired salary if applicable, availability if applicable). Corresponding mandatory fields are marked in the online questionnaire.

This data is processed on the basis of Section 26 (1) sentence 1 BDSG in order to create your application account with your applicant profile to carry out the respective application procedure and - if you have given your consent - as part of the review of your application in the Porsche Group or the Talent Pool on the basis of Article 6 (1) (a) GDPR.

If you delete your application account, your user profile will also be deleted. Regarding the deletion of the data of specific applications at MHP, the regulations under section 3 apply. Regarding the deletion of the data of specific applications at other Group companies, the regulations of the corresponding data protection notices apply (see section 1).

3.5 Fulfillment of legal obligations

We also process your personal data in order to comply with legal obligations to which we are subject. These obligations may arise, for example, from commercial, tax, money laundering or financial law. Measures in the area of health management and aptitude tests may also result from legal obligations.

The purposes of the processing result from the respective legal obligation; the processing usually serves the purpose of complying with state control and information obligations.

Data processing is carried out on the basis of Article 6(1)(c) GDPR. In this respect, we process those personal data that are necessary for the fulfillment of the legal obligation.

We delete the data after the legal obligation ceases to apply and if no other legal basis applies. If the latter is the case, we delete the data after the other legal basis no longer applies.

3.6 Pursuing legitimate interests

We also process your personal data to pursue our legitimate interests or those of third parties, unless your interests, which require the protection of your personal data, take precedence. Data processing is carried out based on Article 6(1)(f) GDPR.

Processing to safeguard legitimate interests is carried out for the following purposes or to safeguard the following interests.

• Operational reporting
• Implementation and optimization of personnel marketing and the recruitment process (implementation of personnel marketing consulting, applicant surveys and statistical evaluations)

When you access the online offer, data relating to your end device and your use of the online offer is processed and stored in a so-called log file. This relates to technical data such as the date and time of access, duration of the visit, type of end device, operating system used, functions used, amount of data sent, IP address and referrer URL.

We process this data to ensure technical operation and to identify and rectify faults. In doing so, we pursue the interest of ensuring technical functionality in the long term. We do not use this data for the purpose of drawing conclusions about your person.

3.7 Consent

We process your personal data based on your consent. Data processing is carried out based on Article 6(1)(a) GDPR. If you give your consent, this is always for a specific purpose; the purposes of the processing are determined by the content of your declaration of consent. You can withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

If you have given your consent for specific purposes, for example for the review of your application in other Group companies, for inclusion in a talent pool or to receive the "Job Abo" newsletter, the purposes are determined by the respective content of this consent.

We use the so-called "double opt-in procedure" for sending the newsletter to prevent misuse.

You can withdraw your consent at any time without giving reasons, without affecting the lawfulness of processing based on consent before its withdrawal.

We will erase the data if you have withdrawn your consent and there is no other legal basis. If the latter is the case, we will delete the data once the other legal basis no longer applies.

3.8 Change of purpose

If we process your personal data for a purpose other than the one for which the data was collected, beyond a corresponding consent or a compelling legal basis, we take into account the compatibility of the original and the now pursued purpose, the type of personal data, the possible consequences of further processing for you and the guarantees for the protection of personal data in accordance with Article 6 (4) GDPR.

3.9 Automated decision making and Profiling

We do not carry out automated decision-making or profiling in accordance with Article 22 GDPR. Profiling is only carried out to pursue our legitimate interests as described above.

4. Access authorizations in the device

Some functions of our online offering require you to grant authorization to access your device (e.g. access to location data). The granting of authorizations is voluntary. However, if you wish to use the corresponding functions, it is necessary to grant the corresponding authorizations, as otherwise you will not be able to use these functions. The authorizations remain active as long as you have not reset them in your end device by deactivating the respective setting.

5. Cookies and comparable technologies

As part of our online offering, we use cookies and similar technologies that are used to communicate with your device and exchange stored information (hereinafter collectively referred to as "cookies"). These cookies are primarily used to make the functions of the online offer usable.

General examples in which the use of cookies is technically necessary in this sense are the storage of a language selection, login data or a shopping or watch list. Accordingly, we may use technically necessary cookies to enable the processing described in section 3.1 and to ensure the proper and secure operation of the online offering. The data processing is then carried out based on Article 6(1)(b) and (f) GDPR, as it is necessary to implement the functions you have selected or to safeguard our legitimate interest in the functionality of the online offering.

If we also use cookies in order to analyze the use of the online offer and to be able to target it to your interests and, if necessary, to be able to provide you with interest-based content and advertisements, this is done exclusively on the basis of your voluntary consent in accordance with Article 6 (1) (a) GDPR.

You then have the option of making the corresponding settings via the consent management within the online offer. You can revoke your consent at any time with effect for the future.

Further information on cookies and their function in detail as well as on setting and revocation options can be found directly in the corresponding areas of consent management. Please note that we only provide consent management as part of the online offer if cookies are to be used based on consent in addition to the technically required cookies mentioned above.

If you do not wish cookies to be used in general, you can also prevent them from being stored by making the appropriate settings on your end device. You can delete stored cookies at any time in the system settings of your end device. Please note that blocking certain types of cookies may result in impaired use of our online services.

6. Integrated third-party services

If we integrate services from other providers as part of our online offers to provide you certain content or functions (e.g. playing videos or route planning) and we process personal data in the process, this is done based on Article 6(1)(b) and (f) GDPR. This is because data processing is then necessary to implement the functions you have selected or to protect our legitimate interest in an optimal range of functions of the online offer.

Insofar as cookies may be used in the context of these third-party services, the explanations under point 5 apply. Please also refer to the privacy policy of the respective provider regarding the third-party services.

Services of other providers that we integrate or to which we refer are provided by the respective third parties. Third-party services also include offers from other Porsche AG Group companies and Porsche Centers.

We have no influence on the content and function of the third-party services and are not responsible for the processing of your personal data by their providers, unless the third-party services are designed entirely on our behalf and then integrated by us under our own responsibility.

Insofar as the integration of a third-party service leads to us establishing joint processes with its provider, we will define with this provider an agreement on joint responsibility in accordance with Article 26 GDPR how the respective tasks and responsibilities in the processing of personal data are structured and who fulfills which data protection obligations.

If cookies are also to be set based on your consent, you will also receive further information on the responsibility for setting these cookies or any associated third-party services in the corresponding areas of consent management.

Unless otherwise stated, profiles on social media are only integrated into our online offering as a link to the corresponding third-party services. After clicking on the integrated text/image link, you will be redirected to the offer of the respective social media provider.

After forwarding, personal data may be collected directly by the third-party provider. If you are logged into your user account with the respective social media provider during this time, the provider may be able to assign the information collected from the specific visit to your personal user account.

If you interact via a "Share" button of the respective social media provider, this information can be stored in the personal user account and published if necessary. If you wish to prevent the information collected from being directly assigned to your user account, you must log out before clicking on the integrated text or image link.

7. Recipients of personal data

Within our company, only those people who need it for the purposes stated in each case have access to your personal data. Your personal data will only be passed on to external recipients if we have legal permission to do so or if we have your consent. Below you will find an overview of the relevant recipients:

• Processors: Group companies or external service providers, in particular milch & zucker Talent Acquisition & Talent Management Company AG (provision, operation and support of the electronic application system) and PI Company GmbH or Kienbaum Consultants International GmbH (applicant, personnel and skills assessment). These processors are carefully selected and regularly checked by us to ensure that your privacy is protected. The service providers may only use the data for the purposes specified by us.
• Public authorities: Authorities and state institutions, such as tax authorities, public prosecutors or courts, to which we (must) transfer personal data, e.g. to fulfill legal obligations or to pursue legitimate interests.
• Private bodies: Group companies, Porsche dealers and service companies, cooperation partners, service providers (not bound by instructions) or commissioned persons such as Porsche Centers and Porsche Service Centers, financing banks, credit agencies or transport service providers.

8. Data processing in Third countries

If data is transferred to bodies whose registered office or place of data processing is not located in a member state of the European Union, another signatory state to the Agreement on the European Economic Area or a state for which an adequate level of data protection has been established by a decision of the European Commission, we ensure before the transfer that the data transfer is either covered by a legal permission, guarantees for an adequate level of data protection exist in relation to the data transfer (e.g. by agreeing contractual guarantees, officially recognized regulations or binding internal data protection regulations at the recipient) or you have given your consent to the data transfer.

If the data transfer is based on Article 46, 47 or 49 (1) subparagraph 2 GDPR, you can obtain a copy of the guarantees for the existence of an adequate level of data protection in relation to the data transfer from us. For this purpose please find the information in section 1.

9. Storage period, deletion

If we have legal permission to do so, we will only store your personal data for as long as necessary to achieve the purposes pursued or as long as you have not withdrawn your consent. In the event of an objection to processing, we will delete your personal data unless further processing is still permitted under the statutory provisions. We will also erase your personal data if we are obliged to do so for other legal reasons.

Applying these general principles, we usually delete your personal data immediately

• after the legal basis ceases to apply and provided that no other legal basis (e.g. retention periods under commercial and tax law) applies. If the latter applies, we will delete the data after the other legal basis no longer applies;
• if your personal data is no longer required for the purposes pursued by us and no other legal basis (e.g. retention periods under commercial and tax law) applies. If the latter applies, we will delete the data after the other legal basis no longer applies.

10. Rights of the data subjects

Right to information and access: You have the right to receive information about the personal data we have stored about you.

Right to rectification and erasure: You can demand that we rectify incorrect data and - insofar as the legal requirements are met - erase your data.

Restriction of processing: You can demand that we restrict the processing of your data if the legal requirements are met.

Data portability: If you have provided us with data on the basis of a contract or consent, you can request that you receive the data you have provided in a structured, commonly used and machine-readable format or that we transfer it to another controller, provided that the legal requirements are met.

Objection: You have the right to object to data processing by us at any time for reasons arising from your particular situation, insofar as this is based on the protection of legitimate interests. If you exercise your right to object, we will cease processing unless we can demonstrate compelling legitimate grounds for further processing which override your rights and interests.

Objection to direct advertising: If we process your personal data for the purpose of direct advertising, you have the right to object to data processing by us for this purpose at any time. If you exercise your right to object, we will stop processing your data for this purpose.

Withdrawal of consent: If you have given us your consent to process your personal data, you can withdraw this consent at any time with effect for the future. This does not affect the lawfulness of the processing of your data until you withdraw your consent.

Right to lodge a complaint with the supervisory authority: You can also lodge a complaint with the competent supervisory authority if you are of the opinion that the processing of your data violates applicable law. To do so, you can contact the supervisory authority responsible for your place of residence or country or the supervisory authority responsible for us.

Contact us to exercise your rights: You can also contact us free of charge if you have any questions about the processing of your personal data and your rights as a data subject. Please contact us at dataprivacy(at)mhp.com or by post at the address given in section 1 above. Please ensure that we are able to clearly identify you. If you wish to withdraw your consent, you can alternatively use the contact method you used when you gave your consent.

11. Status

The current version of this privacy policy applies. Status as of 2025-10-20.