Legal Notes

Information on personal data processing

thyssenkrupp ("We") appreciates your interest in our company and our products. We make sure to comply with the requirements of the General Data Protection Law – Law n. 13,709/2018 (LGPD). Below is a detailed summary of how we handle your data and what your rights are.

1. Who is responsible for processing your data and how to contact the data protection officer?

Controller for data processing is

thyssenkrupp Brasil Ltda. - Regional Platform South America

Avenida Brigadeiro Faria Lima, 1461-1485 – 8th floor, São Paulo, SP. Brazil

Phone: (11) 5105-7555

Email: info.brasil@thyssenkrupp.com

You can contact the Data Protection Officer of thyssenkrupp Brasil Ltda. - Regional Platform South America at info.brasil@thyssenkrupp.com.

2. What categories of data do we handle and where does the data come from?

We process your data in compliance with the provisions of the General Data Protection Act (LGPD) and all other applicable laws.

In general, it is possible to visit thyssenkrupp websites anonymously, that is, without telling us who you are. When you visit our website, data is stored anonymously and for statistical purposes only. This includes the following categories of data:

• IP of the internet provider through which you are accessing our website;

• Website whose link redirected you to our website;

• Files from our website that you have accessed;

• The date you visited the website;

• General information about your browser.

In addition to this data, we use cookies to make your navigation on our websites easier. Personal data may be saved in cookies on individual pages if you have expressly consented to this in advance (eg. to avoid retyping data). In principle, it is possible to access all information on our websites even if cookies are disabled in your browser. However, if you disable cookies, some functions may be restricted.

Cookies are text files stored on your computer or other end device. The use of cookies helps us to analyze the use of your website, improve the services and products offered, improve security and prevent fraud. We differentiate several cookies:

• Session cookies are temporary cookie files that are automatically deleted when you close your browser;

• Persistent cookies are cookie files that are stored until they are actively deleted or automatically removed after a certain period of time;

• First-party cookies are cookies set directly by us;

• Third-party cookies are cookies set by third parties.

• On individual pages, personal data may be stored in cookies if you have previously expressly consented (eg. not to have to re-enter access data).

• Your consent applies to the following domains: www.thyssenkrupp.com.br

3. For what purposes and on what legal basis are the data processed?

We process your data in compliance with the provisions of the General Data Protection Act (LGPD) and all other applicable laws.

We only process personal data if you provide us with this information voluntarily, such as when filling in a contact form. You will be informed of the purpose of data collection on the respective websites and, if necessary, your consent to save and process the data will be requested (eg. cookies).

Finally, if your consent is required to support the processing of your data, it will be collected separately by thyssenkrupp, in accordance with the provisions of the LGPD.

4. Who receives your data?

Your data will be processed within thyssenkrupp in the data processing operation that concerns your relationship with thyssenkrupp. If you visit our job opportunities websites and use the services offered there or complete an online application, your data may also be sent to other thyssenkrupp companies.

The data will only be sent to service providers connected with us to, for example, send you the requested information in writing. All service providers are bound by contractual clauses and data processing agreements to comply with their data protection obligations, ensuring the same level of data protection that thyssenkrupp applies internally, in accordance with data processing laws ( Article 39 of the LGPD). The transfer to other third parties or service providers does not take place. Your data will be encrypted before being transferred and processed to protect it from unauthorized access.

5. How long will your data be stored?

We process your personal data for as long as necessary for the aforementioned purposes. Upon completion of your contact with thyssenkrupp, your data will be stored for as long as we are legally required to store it.

The data owner has the possibility to revoke his consent to the processing of personal data at any time. If you contact us by email, you can object to the storage of your personal data at any time. In that case, the conversation cannot continue.

Cookies are stored on the holder's computer and transmitted to our website. Therefore, you as a user have full control over the use of cookies. You can disable or restrict the transmission of cookies by changing your Internet browser settings. Cookies that have already been saved can be deleted at any time. This can also be done automatically. If cookies are deactivated for our website, it may no longer be possible to use all functions of the website to their fullest extent.

6. Are you required to provide your data?

There is no legal obligation to provide personal data.

7. Is your data transmitted to another country?

To the extent necessary for the above purposes, we also transmit data to group companies or service providers outside Brazil. Such transmission occurs in the following cases:

• Germany – thyssenkrupp AG

This is done in compliance with data protection requirements, in particular confirmation of an adequate level of data protection, which is provided by adequate assurance (e.g. in the form of a standard data protection clause in accordance with Article 33, item II, item 'b', of the LGPD, which is agreed with the respective addressee).

8. What are your rights as an owner of personal data?

The rights of holders of personal data, provided for in article 18 of the LGPD, are:

I. Confirmation of the existence of processing and access to data;

II. Correction of incomplete, inaccurate or outdated data;

III. Anonymization, blocking or deletion of unnecessary, excessive or processed data in violation of the provisions of the LGPD;

IV. Data portability to another service or product provider, upon express request, in accordance with the regulation of the national authority, observing commercial and industrial secrets;

V. Deletion of data processed based on the consent of the holder, unless there is another legal basis that justifies the continuity of the treatment;

SAW. Information about data sharing.

If you have given us consent to process your personal data, you can withdraw this consent at any time. Please note that the revocation has no effect on the lawfulness of the data processing carried out before the revocation and that it does not extend to the processing of personal data for which there is another legal basis for processing and which, therefore, may be continued without your consent.

To exercise your rights, contact the Data Protection Officer indicated in item 2.

You have the option to file a complaint with the Data Protection Officer mentioned in item 2 of this document or with the Brazilian national data protection authority:

National Data Protection Authority - ANPD

www.gov.br/anpd

As of April 14^th, 2022