Common use of Categories of Personal Data Clause in Contracts

Categories of Personal Data. Within the scope of this contractual relationship, ATOSS generally processes the following categories of personal data of the Customer. Which categories of personal data are processed in the respective contractual relationship depends on which data the Customer specifically transfers to ATOSS for processing. Employee master data and time-management information • Master data, such as: o Personnel number o Salutation, Name, Forename o Date of birth o Card number(s) of the badge(s) o Employee category (e.g., assignment to settlement model) o Other contract-relevant data such as entry, exit, and regrouping data o Agreements regarding working hours as well as beginning and end of the time- management consideration o Contact details (such as address, email, phone numbers) o Employee photo o Other organizational aspects • Information regarding affiliation with specific regions / countries / languages • Information regarding work locations and travel times • Information about supervisor, employee, and proxy relationships • Other personal information stored by end users in freely definable fields • Information about qualifications and training measures • Information about time balances / time accounts • Information on individual contractual, collective and other remuneration, vacation and leisure time entitlements of employees: o General agreements o Actual values and balances • Information about planned and actual absences • Information about bookings / clockings, including time and place of booking / clocking • Information regarding actual attendance, (on-call) standby and working hours • Information about affiliation to organizational units, projects, orders, cost centers, workplaces, etc. and the time worked for them • Cafeteria bookings • Manual notes on master and transaction data • System-side warnings and error messages for deviations from specifications or rules Information from personnel deployment planning • Information about contractual and planning availability of employees • Information about planning requests of employees • Information about staff scheduling and actual hours worked • Information about plan changes • Information about shift change procedures of employees • Information about employee performance profiles Applications and task management • Requests for absences, including approval process and approval status • Applications for work-related or service-planning-related procedures, including approval process and approval status • Pending and completed tasks • Information about email and SMS notifications sent by the system Information on access management • Information about access rights for specific devices, zones and periods • Access IDs • PIN for input at the device • Identification features for biometric access protection (fingerprint procedure, etc.) • Information about actual or attempted entry or exit of zones, including time and place of booking System-related information • System access information • Information about rights for specific objects and interactions as users of the system • Last-used system settings and preferences • Registered system users • Login attempts • Logs of user interactions that change data in the system

Categories of Personal Data. Within the scope of this contractual relationship, ATOSS generally processes the following categories of personal data of the Customer. Which categories of personal data are processed in the respective contractual relationship depends on which data the Customer specifically transfers to ATOSS for processing. Employee master data and time-management information • Master data, such as: o Personnel number o Salutation, Name, Forename o Date of birth o Card number(s) of the badge(s) o Employee category (e.g., assignment to settlement model) o Other contract-relevant data such as entry, exit, and regrouping data o Agreements regarding working hours as well as beginning and end of the time- management consideration o Contact details (such as address, email, phone numbers) o Employee photo o Other organizational aspects • Information regarding affiliation with specific regions / countries / languages • Information regarding work locations and travel times • Information about supervisor, employee, and proxy relationships • Other personal information stored by end users in freely definable fields • Information about qualifications and training measures • Information about time balances / time accounts • Information on individual contractual, collective and other remuneration, vacation and leisure time entitlements of employees: o General agreements o Actual values and balances • Information about planned and actual absences • Information about bookings / clockings, including time and place of booking / clocking • Information regarding actual attendance, (on-call) standby and working hours • Information about affiliation to organizational units, projects, orders, cost centers, workplaces, etc. and the time worked for them • Cafeteria bookings • Manual notes on master and transaction data • System-side warnings and error messages for deviations from specifications or rules Information from personnel deployment planning • Information about contractual and planning availability of employees • Information about planning requests of employees • Information about staff scheduling and actual hours worked • Information about plan changes • Information about shift change procedures of employees • Information about employee performance profiles Applications and task management • Requests for absences, including approval process and approval status • Applications for work-related or service-planning-related procedures, including approval process and approval status • Pending and completed tasks • Information about email and SMS notifications sent by the system Information on access management • Information about access rights for specific devices, zones and periods • Access IDs • PIN for input at the device • Identification features for biometric access protection (fingerprint procedure, etc.) • Information about actual or attempted entry or exit of zones, including time and place of booking System-related information • System access information • Information about rights for specific objects and interactions as users of the system • Last-used system settings and preferences • Registered system users • Login attempts • Logs of user interactions that change data in the systemsystem (3) Categories of data subjects The categories of data subjects processed include:

Categories of Personal Data. Within the scope of this contractual relationship, ATOSS generally processes the following categories of personal data of the Customer. Which categories of personal data are processed in the respective contractual relationship depends on which data the Customer specifically transfers to ATOSS for processing. Employee master data and time-management information • Master data, such as: o Personnel number o Salutation, Name, Forename Xxxxxxxx o Date of birth o Card number(s) of the badge(s) o Employee category (e.g., assignment to settlement model) o Other contract-relevant data such as entry, exit, and regrouping data o Agreements regarding working hours as well as beginning and end of the time- management consideration o Contact details (such as address, email, phone numbers) o Employee photo o Other organizational aspects • Information regarding affiliation with specific regions / countries / languages • Information regarding work locations and travel times • Information about supervisor, employee, and proxy relationships • Other personal information stored by end users in freely definable fields • Information about qualifications and training measures • Information about time balances / time accounts • Information on individual contractual, collective and other remuneration, vacation and leisure time entitlements of employees: o General agreements o Actual values and balances • Information about planned and actual absences • Information about bookings / clockings, including time and place of booking / clocking • Information regarding actual attendance, (on-call) standby and working hours • Information about affiliation to organizational units, projects, orders, cost centers, workplaces, etc. and the time worked for them • Cafeteria bookings • Manual notes on master and transaction data • System-side warnings and error messages for deviations from specifications or rules Information from personnel deployment planning • Information about contractual and planning availability of employees • Information about planning requests of employees • Information about staff scheduling and actual hours worked • Information about plan changes • Information about shift change procedures of employees • Information about employee performance profiles Applications and task management • Requests for absences, including approval process and approval status • Applications for work-related or service-planning-related procedures, including approval process and approval status • Pending and completed tasks • Information about email and SMS notifications sent by the system Information on access management • Information about access rights for specific devices, zones and periods • Access IDs • PIN for input at the device • Identification features for biometric access protection (fingerprint procedure, etc.) • Information about actual or attempted entry or exit of zones, including time and place of booking System-related information • System access information • Information about rights for specific objects and interactions as users of the system • Last-used system settings and preferences • Registered system users • Login attempts • Logs of user interactions that change data in the system

Categories of Personal Data. Within the scope of this contractual relationship, ATOSS generally processes the following categories of personal data of the Customer. Which categories of personal data are processed in the respective contractual relationship depends on which data the Customer specifically transfers to ATOSS for processing. Employee master data and time-management information • Master data, such as: o Personnel number o Salutation, Name, Forename Xxxxxxxx o Date of birth o Card number(s) of the badge(s) o Employee category (e.g., assignment to settlement model) o Other contract-relevant data such as entry, exit, and regrouping data o Agreements regarding working hours as well as beginning and end of the time- management consideration o Contact details (such as address, email, phone numbers) o Employee photo o Other organizational aspects • Information regarding affiliation with specific regions / countries / languages • Information regarding work locations and travel times • Information about supervisor, employee, and proxy relationships • Other personal information stored by end users in freely definable fields • Information about qualifications and training measures • Information about time balances / time accounts • Information on individual contractual, collective and other remuneration, vacation and leisure time entitlements of employees: o General agreements o Actual values and balances • Information about planned and actual absences • Information about bookings / clockings, including time and place of booking / clocking • Information regarding actual attendance, (on-call) standby and working hours • Information about affiliation to organizational units, projects, orders, cost centers, workplaces, etc. and the time worked for them • Cafeteria bookings • Manual notes on master and transaction data • System-side warnings and error messages for deviations from specifications or rules Information from personnel deployment planning • Information about contractual and planning availability of employees • Information about planning requests of employees • Information about staff scheduling and actual hours worked • Information about plan changes • Information about shift change procedures of employees • Information about employee performance profiles Applications and task management • Requests for absences, including approval process and approval status • Applications for work-related or service-planning-related procedures, including approval process and approval status • Pending and completed tasks • Information about email and SMS notifications sent by the system Information on access management • Information about access rights for specific devices, zones and periods • Access IDs • PIN for input at the device • Identification features for biometric access protection (fingerprint procedure, etc.) • Information about actual or attempted entry or exit of zones, including time and place of booking System-related information • System access information • Information about rights for specific objects and interactions as users of the system • Last-used system settings and preferences • Registered system users • Login attempts • Logs of user interactions that change data in the systemsystem (3) Categories of data subjects The categories of data subjects processed include:

Categories of Personal Data. Within the scope of this contractual relationship, ATOSS generally processes the following categories of personal data of the Customer. Which categories of personal data are processed in the respective contractual relationship depends on which data the Customer specifically transfers to ATOSS for processing. Employee master data and time-management information • Master data, such as: o Personnel number o Salutation, Name, Forename Xxxxxxxx o Date of birth o Card number(s) of the badge(s) o Employee category (e.g., assignment to settlement model) o Other contract-relevant data such as entry, exit, and regrouping data o Agreements regarding working hours as well as beginning and end of the time- management consideration o Contact details (such as address, email, phone numbers) o Employee photo o Other organizational aspects • Information regarding affiliation with specific regions / countries / languages • Information regarding work locations and travel times • Information about supervisor, employee, and proxy relationships • Other personal information stored by end users in freely definable fields • Information about qualifications and training measures • Information about time balances / time accounts • Information on individual contractual, collective and other remuneration, vacation and leisure time entitlements of employees: o General agreements o Actual values and balances • Information about planned and actual absences • Information about bookings / clockings, including time and place of booking / clocking • Information regarding actual attendance, (on-call) standby and working hours • Information about affiliation to organizational units, projects, orders, cost centers, workplaces, etc. and the time worked for them • Cafeteria bookings • Manual notes on master and transaction data • System-side warnings and error messages for deviations from specifications or rules Information from personnel deployment planning • Information about contractual and planning availability of employees • Information about planning requests of employees • Information about staff scheduling and actual hours worked • Information about plan changes • Information about shift change procedures of employees • Information about employee performance profiles Applications and task management • Requests for absences, including approval process and approval status • Applications for work-related or service-planning-related procedures, including approval process and approval status • Pending and completed tasks • Information about email and SMS notifications sent by the system Information on access management • Information about access rights for specific devices, zones and periods • Access IDs • PIN for input at the device • Identification features for biometric access protection (fingerprint procedure, etc.) • Information about actual or attempted entry or exit of zones, including time and place of booking System-related information • System access information • Information about rights for specific objects and interactions as users of the system • Last-used system settings and preferences • Registered system users • Login attempts • Logs of user interactions that change data in the systemsystem (3) Categories of data subjects The categories of data subjects processed include: Employees

Categories of Personal Data. Within the scope of this contractual relationship, ATOSS generally processes the following categories of personal data of the Customer. Which categories of personal data are processed in the respective contractual relationship depends on which data the Customer specifically transfers to ATOSS for processing. Employee master data and time-management information • Master data, such as: o Personnel number o Salutation, Name, Forename o Date of birth o Card number(s) of the badge(s) o Employee category (e.g., assignment to settlement model) o Other contract-relevant data such as entry, exit, and regrouping data o Agreements regarding working hours as well as beginning and end of the time- management consideration o Contact details (such as address, email, phone numbers) o Employee photo o Other organizational aspects • Information regarding affiliation with specific regions / countries / languages • Information regarding work locations and travel times • Information about supervisor, employee, and proxy relationships • Other personal information stored by end users in freely definable fields • Information about qualifications and training measures • Information about time balances / time accounts • Information on individual contractual, collective and other remuneration, vacation and leisure time entitlements of employees: o General agreements o Actual values and balances • Information about planned and actual absences • Information about bookings / clockings, including time and place of booking / clocking • Information regarding actual attendance, (on-call) standby and working hours • Information about affiliation to organizational units, projects, orders, cost centers, workplaces, etc. and the time worked for them • Cafeteria bookings • Manual notes on master and transaction data • System-side warnings and error messages for deviations from specifications or rules Information from personnel deployment planning • Information about contractual and planning availability of employees • Information about planning requests of employees • Information about staff scheduling and actual hours worked • Information about plan changes • Information about shift change procedures of employees • Information about employee performance profiles Applications and task management • Requests for absences, including approval process and approval status • Applications for work-related or service-planning-related procedures, including approval process and approval status • Pending and completed tasks • Information about email and SMS notifications sent by the system Information on access management • Information about access rights for specific devices, zones and periods • Access IDs • PIN for input at the device • Identification features for biometric access protection (fingerprint procedure, etc.) • Information about actual or attempted entry or exit of zones, including time and place of booking System-related information • System access information • Information about rights for specific objects and interactions as users of the system • Last-used system settings and preferences • Registered system users • Login attempts • Logs of user interactions that change data in the systemsystem (3) Categories of data subjects The categories of data subjects processed include: Employees