Data Privacy Statement for Social Media

Your right to data protection is our obligation. The protection of your privacy when processing your data is a matter of importance to Covestro (herein after referred to as “we” or “us”) and it is taken into consideration in all of our business processes. Therefore, we would like to take this opportunity to explain the basic principles we apply in handling your personal data on social media platforms. Please keep in mind that the use of our social media platforms leads to further processing of your personal data by the respective social media provider, not necessarily limited to your interaction with us or our social media presence.

Please note that we may update this statement from time to time. Any changes become effective when we publish them on our social media channels.

Responsibilities

Responsible for the data processing for the purposes described in this data privacy statement is:

Covestro AG, Kaiser-Wilhelm-Allee 60, 51373 Leverkusen, Germany

If not indicated otherwise in the following sections, Art. 6 (1), f) of the General Data Protection Regulation (GDPR) forms the legal basis for the handling of your data. Our legitimate interest is to be able to respond to your messages or inquiries and to analyze the reach and usage of our social media channels in order to continuously optimize our presence.

When we link to other websites from our social media channels, the data privacy statements of those websites apply respectively.

Please keep in mind that your use of social media platforms leads to further processing of your personal data by the respective social media platform providers. This data is not limited to your interactions with Covestro.

The Covestro social media sites are operated by the following social media platform providers:

Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, D2 Dublin, Ireland, for “Facebook” and “Instagram”

X Corp., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA, for “X”

LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland, for “LinkedIn”

Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, for “YouTube”

New Work SE, Am Strandkai 1, 20457 Hamburg, Germany, for “Xing”

Covestro does not have any influence or control over the data processing activities of the platform providers. You can limit the processing of your personal data by changing your privacy settings and your own social media activities. To learn more about the processing of your personal data via the social media platform providers please read the respective data privacy statements.

• Facebook: https://www.facebook.com/policy.php
• Instagram: https://help.instagram.com/155833707900388
• LinkedIn: https://www.linkedin.com/legal/privacy-policy
• X: https://X Privacy Policy (twitter.com)
• YouTube: https://policies.google.com/privacy
• Xing: https://privacy.xing.com/privacy-policy

Covestro and the platform providers might be regarded as joint controllers in the context of the GDPR. For more information please read the joint controller agreements:

• LinkedIn Joint Controller Addendum: https://legal.linkedin.com/pages-joint-controlleraddendum
• Facebook Joint Controller Addendum: https://www.facebook.com/legal/terms/page_controller_addendum

If you have any questions or suggestions related to data privacy, please contact the Covestro AG Group Data Privacy Office

Kaiser-Wilhelm-Allee 60
51373 Leverkusen, Germany
Phone: +49 214 6009 2000

E-Mail: data.privacy@covestro.com

Which personal data will be processed and why

Processing your personal data is necessary to interact with you on social media platforms. Our intention is to provide you with multimedia services, respond to your requests, and exchange ideas on topics that are relevant for you and for Covestro.

The social media platforms provide us with anonymized information via the Insights and Analytics services. These services include statistical data that does not enable conclusions on individual users. Please note that you use the social media platforms and their functions on your own responsibility. This applies in particular to the use of the interactive functions (e.g. commenting, sharing and rating).

When you visit our social media sites, the social media provider collects your IP address and other information that is available on your device in the form of cookies and Social Plugins. This information is used to provide us, as the operator of the social media sites, with statistical information about the use of the site. More detailed information is provided by the data privacy statements of the social media platforms (please see links further above).

In the following sections you can learn which personal data we collect, how we process it, and how you can object to our use of your personal data. We process personal data that you publish in your social media profiles. This includes your username and any personal data that you have made publicly available on your profile. We use this data for the purposes described below.

Connecting with Covestro

If you follow or “like” our social media accounts you send information to the platform provider, who provides us with your username as well as with statistical information about our communities. This information includes the average age structure, place of residence, gender, language, and any other information that you publish on your social media profile.

Communicating with Covestro

When you reach out to us via social media posts, comments, messages, or chats, we will process your name, your username, and any further data you provide. Your personal data will be exclusively used to find the required information and respond to your request, unless stated otherwise in our exchange. We will delete your personal data within two years after our response. Please note that the platform providers can store this information for a longer time.

Community features

When you publicly talk about Covestro on social media or interact with our content via the community features such as reactions, likes, shares or retweets, and comments, you send information to the platform providers and it can be seen by others, including Covestro. We can see who interacted with us and our content via community features and we process the anonymized interpretation of this data in the form of statistical analysis. This helps us evaluate the performance of our activities and make them more attractive and valuable to you over time. We also use this data to react to your content in the form of likes, shares, retweets, replies and comments. Please keep in mind that we cannot control or prevent how other users process this information.

Social media listening

We conduct real-time research on social media platforms by collecting publicly accessible data from relevant channels and on relevant topics such as our brand, our products and services, and other topics related to our business. This approach is called social media listening. The processed data may include personal data that you have made publicly available in your content and in your social media profile. We use this data to derive insights in order to improve our own communication, align our activities with the public discussion, and contribute to relevant public conversations.

Content curation

We share selected content from our social media listening endeavors with our online communities and via displays on selected locations or at Covestro sites. Our intention is to create value for our communities and at the same time support great content providers by increasing the reach for their content. This process is called content curation. We display the curated content on Covestro websites as well as via digital signage displays in Covestro facilities and trade shows. We only curate publicly accessible content. The data may contain personal information. It is limited to the display name of the author and any other data that is included in the content that the author made publicly available on his or her social media profile.

How we transfer your personal data

Covestro provides personal data only to persons and bodies that require it to fulfil the purposes described in this statement.

For the administration of our social media channels we carefully select external service providers who might have access to personal data of the users contacting us via social media channels. We regularly examine them in order to make sure that your privacy is safeguarded. Based on data processor agreements they will only process personal data for the purpose determined by us and strictly in accordance with our directives.

Personal data might further be disclosed to criminal prosecution authorities, supervisory authorities, courts or law offices if necessary and if legally permitted to exercise, assert or defend legal rights.

How long we store your personal data

We delete or anonymize your personal data as soon as it’s no longer needed for the purposes described in this data privacy statement, unless explicitly stated otherwise in advance or in cases where the deletion would violate our legal obligations.

Processing of data outside the EU / the EEA

In some cases, your data may be processed in countries outside the European Union (“EU”) or European Economic Area (“EEA”). Those areas may have a lower level of data protection than the EU. In such cases, we ensure that a sufficient level of protection for your data is guaranteed through, for example, contractual agreements with our contractors for ensuring they provide a sufficient level of protection for your data, or we ask you for your explicit consent.

Your rights

You have the right to:

• receive information on your personal data stored by us;
• request the rectification or erasure of your personal data or a restriction of the processing;
• object to a processing that serves our legitimate interest, a public interest, or profiling, unless we can demonstrate compelling legitimate grounds for this processing that outweigh your interests, rights, and freedoms, or the processing serves to assert, exercise, or defend legal claims;
• have your data transmitted to the extent regulated by law, such as in Art. 20 GDPR, and
• submit a complaint to a supervising authority if you believe the processing of your personal data violates the GDPR or any other law or regulation;

You can withdraw your consent to the collection, processing and use of your personal data at any time, with future effect. For more information, see the individual sections that describe data processing based on your consent.

Please use the contact details presented in this statement if you wish to exercise your rights.