Privacy Notice

1 Data controller and data protection officer

Data controller:

Dunlop Tyre Europe GmbH

Berliner Straße 74-76, 63065 Offenbach am Main

Germany

Tel: +49-(0)69-247 5252-0

Contact Data Protection Officer:

E-mail: ds@falkentyre.com

2 Visiting our Website

We process technical data (IP address, browser settings) to provide the website. Functional cookies may also be set in this context (Art. 6 I f GDPR, § 25 II No. 2 TDDDG).

2.1 Consent with ConsentManager

We use ConsentManager to manage and document your consent settings in accordance with data protection regulations (Art. 6 I c GDPR). This stores your consent and, if applicable, its revocation. This information is stored until you delete the cookie or the purpose for data storage no longer applies. Mandatory legal retention obligations remain unaffected.

2.2 Cookies and tracking

We use cookies on our website for various purposes.

Essential functions serve to operate the website or certain functions thereof, such as to ensure security or to make an appointment with us. These providers are absolutely necessary and cannot be deselected (Art. 6 I f GDPR, § 25 II No. 2 TDDDG).

The integration of external content into our website serves to enable the use of certain functions (e.g. booking an appointment) or to improve the user experience (e.g. fonts and graphics) and is activated with your consent (Art. 6 I a GDPR, § 25 I TDDDG).

For reach measurement for marketing purposes, we use in particular "tracking" (tracking of registrations) and the measurement of the success of our advertisements. The associated reach measurement is the evaluation of visitor actions by analysing usage behaviour in relation to the determination of certain user actions and measuring the effectiveness of online advertising. The number of visitors who have accessed websites or apps by clicking on advertisements, for example, is measured. In addition, the rate of users who perform a specific action (e.g. registering for the newsletter) can be measured. These are activated with your consent (Art. 6 I a GDPR, § 25 I TDDDG).

You can adjust your cookie settings at any time in ConsentManager.

You can configure general settings for cookies in your browser, including the deletion of cookies.

2.2.1 Google Analytics

We use Google Analytics to evaluate the use of our website and to improve our content and marketing measures. The service provider is Google Ireland Limited ("Google"). Google Analytics is only used with your consent (§ 25 I TDDDG, Art. 6 I a GDPR).

The following data is collected: pages visited, IP address, browser and device information. No data such as name or contact details is transferred to Google.

Google anonymises your IP address using IP masking, so that we can no longer assign it to an individual. IP truncation takes place in the EU or EEA; only in exceptional cases is the full IP address transferred to Google's servers in the USA and truncated there. Data processing outside the EU legal framework cannot be ruled out.

Data transfer to the USA takes place within the framework of the EU-US Data Privacy Framework. In addition, standard data protection clauses (SCC) have been agreed.

You can prevent data collection by using the browser add-on to deactivate Google Analytics. http://tools.google.com/dlpage/gaoptout?hl=en

For more information about Google Analytics, please refer to Google's privacy policy https://policies.google.com/privacy?hl=en#europeanrequirements

2.3 Google Ads

We use Google Ads, an online advertising programme from Google Ireland Limited ("Google").

With Google Ads, we can display advertisements in the Google search engine or on third-party websites when search terms are entered into Google (keyword targeting). Furthermore, targeted advertisements can be displayed (target group targeting). As website operators, we can evaluate this data quantitatively, for example by analysing which search terms led to the display of our advertisements and how many advertisements led to corresponding clicks.

The use of this service is based on your consent (Art. 6 I a GDPR, § 25 I). Consent can be revoked at any time.

Data is transferred to the USA within the framework of the EU-US Data Privacy Framework. In addition, standard data protection clauses (SCC) have been agreed.

2.3.1 Google Tag Manager

We use Google Tag Manager from Google Ireland Limited to manage website tags, monitor the performance and stability of our website, and control and manage services. This also manages tracking by integrated tools such as Google Analytics.

Data is transferred to the USA within the framework of the EU-US Data Privacy Framework. In addition, standard data protection clauses (SCC) have been agreed.

2.4 Google reCAPTCHA

This website uses the Google reCAPTCHA captcha service from Google Ireland Limited (hereinafter: "Google") to distinguish between humans and machine programmes (bots). Google reCAPTCHA thus makes an important contribution to the security and stability of the website, as it can effectively prevent malicious attacks (e.g. DDos attacks). Google reCAPTCHA evaluates data such as your IP address, information about your operating system, mouse movements, keystrokes and the length of time you spend on the website.

For information on settings to protect your privacy, please refer to the information provided by Google at https://www.google.com/intl/en/policies/privacy/ .

Data processing is based on your consent (Art. 6 I a GDPR, § 25 I TDDDG).

Data is transferred to the USA within the framework of the EU-US Data Privacy Framework. In addition, standard data protection clauses (SCC) have been agreed.

2.5 Google Maps

This site uses the Google Maps map service provided by Google Ireland Limited ("Google") to make it easy to find the locations we specify on the website (Art. 6 para. I f GDPR).

When Google Maps is activated, Google may use Google Fonts for the purpose of uniform font display. When you access Google Maps, your browser loads the required web fonts into your browser cache to display text and fonts correctly.

The storage of cookies, including device fingerprinting, is based on consent (Art. 6 I a GDPR, § 25 I TDDDG).

Data is transferred to the USA within the framework of the EU-US Data Privacy Framework. In addition, standard data protection clauses (SCC) have been agreed.

For more information on the handling of user data, please refer to Google's privacy policy: https://policies.google.com/privacy?hl=en

2.6 Integration of content and functions

For better presentation and accessibility, external content and functions may be integrated, such as YouTube for embedding videos, Google Fonts for displaying fonts, and Google Translate for displaying content in different languages. Details are described in ConsentManager.

2.7 Integration of social networks

Our website uses buttons for social networks

• Facebook/ Instagram, Meta Platforms Ireland Limited, Irland

• Google/ YouTube, Google Ireland Limited, Irland

• Xing, New Work SE, Deutschland

• LinkedIn, LinkedIn Ireland Unlimited Company, Irland

The buttons are not social plug-ins, but buttons with stored links. As long as these buttons are not clicked, no data is transferred to the social networks.

Once clicked, the button acts as a so-called share plug-in. Information about the page you have visited is made available to the social network, which you can share with your contacts on your social network if you are logged in there. If you are not logged in, you will be taken to the login page of the social network you clicked on and you will no longer be on our site.

Furthermore, information is transmitted when you visit the corresponding page of our website, including, for example, your IP address, details of the browser used and language settings.

The respective provider is the data controller for activities on the respective networks within the meaning of the GDPR.

The data is transmitted regardless of whether you actually have an account with the provider or are logged in there. If you are logged in with the provider, your data will be directly assigned to your account.

We describe information about the processing of personal data on social media in the section "Online presence on social media".

If you do not want the social network to receive data about you, do not click on the button.

3 Sweepstakes and promotional campaigns (e.g. fuel voucher campaign)

If you participate in one of our sweepstakes or promotional campaigns (e.g. fuel voucher campaign), we will process the personal data required for participation in the respective campaign/promotion in accordance with the respective conditions of participation (Art. 6(1)(b) GDPR). We use the personal data collected in the participation form exclusively for the proper execution of the respective campaign/promotion. Where you provide information voluntarily and give your consent (Art. 6(1)(a) GDPR) to do so, we may use this information for statistical analysis. You may withdraw this consent at any time by e-mailing ds@dunloptyres.com , with effect for the future.

The personal data will be routinely deleted after the end of the campaign/promotion, but no later than 6 months after the prizes have been sent. The data is retained for the period after the prizes have been sent in order to process latecomers and complaints in connection with the campaign or promotion. The data will not be used for subsequent advertising purposes unless separate consent has been given for the newsletter to be dispatched. There is no automated decision-making or profiling.

Please address any enquiries regarding the dispatch of prizes or vouchers to the address specified in the respective campaign/promotion.

4 Newsletter

Our newsletter informs you about current offers and services, products and partners. If you would like to receive the newsletter, we need a valid e-mail address from you. The data entered in the input mask during registration is collected. In order to address you personally, we ask you to provide your title and name. This data will only be used to send you the newsletter on the basis of your consent (Art. 6 I a GDPR). We store the date of registration for verification purposes.

Each newsletter contains a link to unsubscribe.

5 Contact

5.1 E-mail, telephone, post

You can contact us by e-mail using the addresses provided, by telephone using the telephone numbers provided, or by post. When you contact us, we will process the personal data you provide (e-mail address, name and telephone number, if applicable) in order to respond to your enquiry. The exact purpose depends on the content of your enquiry (e.g. provision of product information, information on campaigns or events). In doing so, we process your personal data for contractual or pre-contractual measures (Art. 6 I b GDPR) or for legitimate interests such as public relations (Art. 6 I f GDPR). We delete the data once the respective purpose has been fulfilled and further storage is no longer necessary.

5.2 Contact form for tyre clearance/air pressure recommendation

On our website, we offer the option of having tyre clearance/air pressure recommendations validated via a contact form. We process the personal data you provide (name, contact details, tyre data) for the purpose of confirming the suitability/permissibility of tyre-rim combinations. We process your personal data on the basis of your consent (Art. I a GDPR). The data will be deleted after the purpose has been fulfilled or after the expiry of mandatory retention periods.

6 Business Partner Data

In the course of our business, we process the data of our business partners to fulfil our contractual obligations (Art. 6 I b GDPR). This includes customer master data, contact data, order data, transaction data.

To optimise our services to our customers, we may further process customer data such as: purchasing potential, relevant product types, preferences regarding events, campaigns, sales and promotion support. (Art. 6 I f GDPR).

7 Webshop

Existing business customers can place their tyre orders online via our B2B web shop. There, customers also have an overview of the status of their orders and their order history. The web shop is hosted by ZYRES GmbH.

In order to process orders and provide related information, customer master data and contact details from the web shop registration form, user account data (access data, account settings) and order data (orders, date, status, order history) are processed (Art. 6 I b GDPR).

When the account is deactivated, the data is restricted in processing and deleted in accordance with statutory retention periods.

8 Complaints

Our customers can submit technical complaints about tyres sold by us via PDF/paper forms or via the online portal (B2B web shop). The data entered in the form (dealer and dealer address, name of the dealer or employee, tyre data, vehicle data, type of complaint, date, damage if applicable) is processed by us for the purpose of reviewing and processing the complaint.

While the paper form is signed, the identity of the sender is determined in the online portal via the user ID. Processing is based on the fulfilment of warranty obligations within the framework of the contractual relationship (Art. 6 I b GDPR).

Personal data of other persons may be transmitted to us in the context of the complaint, e.g. if the dealer provides invoices or vehicle registration documents from tyre purchasers as evidence, from which the name, vehicle data and date of purchase are apparent. In these cases, the personal data is only stored by us in the document and is not used for any other purposes outside the processing of the complaint. The processing is carried out within the scope of fulfilling our statutory warranty obligation (Art. 6 I c GDPR).

9 Events

9.1 Organisation of events

In order to hold events for our customers (e.g. incentive trips, invitations to motorsport events, workshops, dealer conferences, etc.), we process the personal data of participants and guests required for booking and organisation, such as name, address, e-mail, telephone numbers, dates of birth, allergies and dietary preferences, if applicable. Processing is based on the consent given at the time of registration (Art. 6 I a GDPR or Art. 9 II a GDPR).

9.2 Image and sound recordings at events

At events (such as motorsport events at the Nürburgring, trade fairs, promotional events), image and sound recordings are made for use in advertising and promotional purposes as well as for public relations. The recordings may be published on the website and on social media, or used in printed materials (flyers, brochures, posters).

The recordings are always made in accordance with the guidelines for the respective event. The commissioned photographers and videographers are instructed to ensure that people are not recorded against their will, e.g. if they expressly signal that they do not want to be recorded by walking away. The legal basis is consent (Art. 6 I a GDPR), otherwise legitimate interest (Art. 6 I f GDPR).

Our legitimate interest in processing the recordings lies in documenting the events for public relations and advertising purposes. The recordings will be deleted once the purpose has been fulfilled or consent has been revoked.

10 Job applications

On our careers page, you have the opportunity to apply for advertised positions or submit a speculative application using the embedded form. The form is provided by HRworks GmbH.

We store your application data for the duration of the review of your application. If your application is not successful, your application data will be deleted no later than 6 months after the end of the selection process.

If you withdraw your application yourself, the documents will be deleted immediately.

The processing is carried out for the purpose of initiating possible employment (Art. 6 I b GDPR). Storage until deletion is necessary in order to be able to prove the fairness of the selection process.

You can make your application data available in the talent pool so that we can contact you if necessary. Your data will be stored there for a maximum of 2 years. However, you can withdraw your consent to storage in the talent pool at any time, whereupon your data will be deleted immediately.

If you do not provide us with the necessary personal data, this will not have any negative consequences for you. However, incomplete or incorrectly completed applications may not be considered. Without providing your personal data, the application cannot be submitted and will therefore be deleted.

11 Online presence on social media

We maintain several online presences on social networks and platforms in order to communicate with active users there and inform them about our service portfolio. In doing so, we use the technical platforms and services offered by the operators. If you do not want us to process your data, you can disconnect your user profile using the "Unlike" function.

The respective operators are data controllers for the processing of your personal data. You can find out what data they process and what settings are available to you in the respective data protection information of the individual platforms.

11.1 Facebook

Our online presence on Facebook serves to publish news, increase the visibility of the company and raise brand awareness.

• We may process personal data from users when we interact with users and respond to comments, questions and private messages.

• We use the Meta Insights tool for statistical purposes. For posts, we see account names, age, gender and location in anonymised form. We only see this information when there are reactions to a post (e.g. likes, comments, shares). Facebook (Meta) is the data controller for data collected and processed by Facebook. Meta privacy policy: https://www.facebook.com/privacy/policy/

11.2 Instagram

Our online presence on Instagram serves to publish news, increase the visibility of the company and raise brand awareness.

• We may process personal data from users when we interact with users and respond to comments, questions and private messages.

• We use the Meta Insights tool for statistical purposes. For posts, we see account names, age, gender and location in anonymised form. We only see this information when there are reactions to a post (e.g. likes, comments, shares). Instagram (Meta) is the data controller for data collected and processed by Instagram. Meta privacy policy: https://privacycenter.instagram.com/policy/

11.3 Xing

Our online presence on Xing serves to publish news, increase the visibility of the company and raise brand awareness. In this context, users' personal data may be processed.

The platform operator (New Work SE) is the data controller for data processing on the platform. Xing privacy policy: www.xing.com/privacy

11.4 LinkedIn

Our online presence on LinkedIn serves to publish company-related news. In this context, users' personal data may be processed:

• We may process users' personal data when we interact with users and respond to comments, questions and private messages.

• For statistical purposes, we process name, location, field of work, seniority, industry and company size. We see this when you visit or follow us. LinkedIn is the data controller for the collection and processing of this data. LinkedIn privacy policy: https://www.linkedin.com/legal/privacy-policy?

11.5 YouTube

Our online presence on YouTube serves to publish videos, increase the visibility of the company and raise brand awareness.

• We use Google Analytics on YouTube for statistical purposes. We receive data about how the video was found, as well as your gender, age and subscription status. This data is presented in anonymised and aggregated form.

• We may process personal data from users when we interact with comments. The statistical data on origin (how the video was found) and user characteristics (gender, age, subscription status) is only presented to us in aggregated and anonymised form.

YouTube is the data controller for the collection and processing of data by YouTube. Google privacy policy: https://support.google.com/youtube/answer/10364219#zippy=%2Chow-youtube-may-use-data-linked-to-your-account%2Chow-youtube-may-use-aggregated-data%2Cyoutube-does-not-sell-your-personal-information%2Chow-youtube-uses-your-location-data

12 General

12.1 Disclosure to third parties

We use service providers for numerous activities who process data on our behalf (e.g. IT service providers, consultants). We carefully select these service providers and regularly review them with regard to data protection requirements. A corresponding agreement is concluded for order processing, in which the respective obligations are clearly regulated (Art. 28 I GDPR).

We do not sell your data to third parties, nor do we market it in any other way.

12.2 Transfer to third countries

Personal data is only transferred to third countries to the extent described here and on the appropriate legal basis.

Data transfers to the USA are generally based on the adequacy decision of the Commission within the framework of the EU-US Data Privacy Framework. https://www.dataprivacyframework.gov/s/

In addition, standard data protection clauses (SCC) are agreed with data processors in the USA.

12.3 Deletion of data

Your personal data will be stored for as long as necessary to fulfil the respective purpose. Once the purpose no longer applies, the data is routinely deleted. If the processing is based on consent, the data will be deleted at the latest after the consent is revoked. Beyond this, storage only takes place if the data is subject to statutory retention obligations or if the retention of the data is necessary for the assertion of claims.

Data in automated backups will be deleted in accordance with backup deletion routines to conserve the integrity of the backups.

12.4 Other uses of data

In the event of further processing for purposes other than those for which the data was originally collected, we will inform you of these other purposes before further processing and provide you with further relevant information.

13 Rights regarding the processing of personal data

You can send enquiries regarding your rights to the contact address of our data protection officer.

13.1 Right to information

You have the right to obtain from us, upon request, information about the personal data we process concerning you at any time (Art. 15 GDPR).

13.2 Right to rectification of inaccurate data

You have the right to request that we immediately correct any personal data concerning you that is inaccurate (Art. 16 GDPR).

13.3 Right to erasure

You have the right to have personal data concerning you erased without delay ("right to be forgotten") if there are legal grounds for doing so (Art. 17 GDPR). These exist, for example, if the personal data is no longer necessary for the purposes for which it was originally processed, or if you have revoked your consent and there is no other legal basis for the processing, or if you have objected to the processing (and there are no overriding reasons for processing – this does not apply to objections to direct marketing).

13.4 Right to restriction of processing

You have the right to restriction of processing (Art. 18 GDPR). Restriction of processing may be necessary in particular if the processing is unlawful and the data subject refuses to have the personal data deleted and instead requests the restriction of the use of the personal data, or if the data subject has objected to the processing, as long as it is not yet clear whether our legitimate reasons outweigh theirs (Art. 21 I GDPR).

13.5 Right to data portability

You have the right to data portability (Art. 20 GDPR). This means you have the right to receive the data concerning you that you have provided to us in a commonly used, structured and machine-readable format and to transfer this data to another data controller, such as another service provider. The prerequisite for this is that the processing is based on consent or a contract and is carried out using automated procedures.

13.6 Right to object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of public interest or legitimate interest (Art. 6 I e or f GDPR) (Art. 21 GDPR). We will cease processing unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

13.7 Right to lodge a complaint with the supervisory authority

If you believe that our processing of your personal data is unlawful, you have the right to lodge a complaint with the supervisory authority responsible for us:

The Hessian Commissioner for Data Protection and Freedom of Information (Der Hessische Beauftragte für Datenschutz und Informationsfreiheit)

https://datenschutz.hessen.de/

E-mail: poststelle@datenschutz.hessen.de

---

Version August 2026