The Home Connect GmbH, with its registered office at Carl-Wery-Strasse 34, 81739 Munich, Germany (hereinafter "Home Connect" or "we") is responsible for the collection, processing and use of your personal data associated with the Synced Home Appliance Account (hereinafter "Synced Home Appliance Account").

We collect, process and use your personal data, which is either entered by you or otherwise created and processed in the course of using the Synced Home Appliance Account, the associated household appliances or services offered by Home Connect in accordance with the applicable data privacy laws. We have taken organisational and technical security measures to protect all of our websites and apps against the potential risks present in processing personal data. Our affiliated Group Companies and external partners who support us in the provision of the services must also comply with these provisions.

There are different laws that regulate Data Protection depending on the country in which you are located. In this instance, the European General Data Protection Regulation (“GDPR”) sets out the basic principles guidelines, on how we process and protect your personal data when providing our websites and services:

a. Lawfulness

We only use personal data if such use is lawful, which is the case only if and to the extent that at least one of the following applies:

• You have given your consent.

• The use of personal data is necessary the performance of a contract to which you are party.

• The use of personal data is necessary for compliance with a legal obligation, e.g. in cases of product safety actions, where we are obliged to inform all our customers.

• The use of personal data is necessary in order to protect the vital interests of the person.

• The use of personal data is based on a legitimate interest in using personal data and our usage does not adversely affect your data protection rights.

For all processing of personal data, we describe herein, we will also provide the legal reason the processing is based on.

b. Fairness and Transparency

We will inform you about the personal data we collect and why we collect it in a fair and transparent manner. This information is contained within the Data Protection Information which we provide to you directly or via a link when you register and/or at any touchpoint where you interact with us.

Users below the age of 16 should only transmit personal data to us with the consent of their parent or legal guardian. The data protection law that applies in your country may result in different age limits in this regard.

c. Purpose limitation and data minimisation, deletion

We only use personal data that we really need and for the purpose that you provided the personal data to us. If we can achieve the purpose with less personal data, we will only use the minimum data required. Nevertheless, at any time, you are free to provide additional personal data, if this would enhance your experience with the services provided.

We also will delete your personal data (also automatically), if the data is not needed anymore, the legal retention period is reached or you send us a notice to delete the personal data fully or in parts.

The following information explains how we treat such data based on the Terms of Use or on another legal basis.

1. Types of personal data

In terms of

• The use of the Synced Home Appliance Account;

• The use of touchpoints where the Synced Home Appliance Account is connected to;

• the associated household appliances or services and functions offered by Home Connect (hereinafter "Services")

Home Connect collects, processes and uses the following categories of personal data for itself as well as on behalf of the BSH Group Companies you are interacting with (hereinafter “Home Connect Family“).

a. User master data and contractual data

Below we describe how we collect and use our personal data when setting up a user account (registration via SingleKey ID) as well as when setting up the Synced Home Appliance Account. This data is stored into your account and this account is personal and non-transferable.

• When registering with the SingleKey ID:

– Access data, i.e. identification data that serves to control access to the SingleKey ID user account and consists of the user ID (e.g. email address or mobile phone number of the user). Responsible for providing this registration service is Bosch.IO GmbH, , Ullsteinstrasse 128, 12109 Berlin, Germany ("BIO").

• Additional details that you provide during the setting up of the Synced Home Appliance Account (as long as they are not transmitted via the SingleKey ID), such as:

– “User Master Data” as

 first and last name,

 salutation

 email address (which is used as the user ID),

– language setting,

– the country in which you operate your Synced Home Appliance Account,

– consent to and recognition of the terms of use,

– acknowledgement of the data protection information,

– information within existing MyAccounts (e.g. your master data, existing orders or service assignments), if those are migrated by you to the Synced Home Appliance Account.

The details requested as part of the registration process may differ from country to country.

• Information which we collect, synchronize and store while your use of the Synced Home Appliance Account:

– additional “User Master Data” if and as provided via Home Connect Family touchpoints (e.g. delivery address, phone number),

– “Contractual Data” if and as provided via Home Connect Family touchpoints (e.g. purchase order(s), date of purchase, warranty extensions), as well as service history (e.g. service orders, service technician assignment) of your household appliances as well as related orders of the user (e.g. consumables).

b. Appliance Master Data

The data we collect and use if you directly buy an Appliance via a Home Connect Family entitiy, register it or otherwise include your household appliance and the user account are as follows:

• brand of the household appliance (e.g. Bosch or Siemens),

• serial number and, if applicable, manufacture date of the appliance (so-called E number (full model) and FD (production) number – you can also find these details on the appliance label),

• additional programs (if you have purchased additional programs for your connected home appliance),

• home appliance specific services you have registered for or opted in for (e.g. proactive maintenance),

• data you provide during purchase/registration of your home appliance,

• pairing-status of a Home Connect enabled home appliance.

c. Touchpoint data

The data we collect and use in relation to your usage of Home Connect Family touchpoints are as follows:

• personal information and other content you provide via contact forms or within a service call,

• information about gift/cashback/warranty processes and similar product related information,

• customer satisfaction data, if you participate in a survey,

• website related information, e.g. information of your shopping cart (if you accepted the specific cookie on the relevant website), content you provided via website forms or similar interactions with our website(s),

• anonymised data provided by you via Home Connect Family touchpoints, for statistical use.

d. Permissions and permission related data

The data we collect and use in relation to your permissions given to us and/or a Home Connect Family entity are as follows, whereby your profile information will not be used for marketing purposes without your permission:

• data regarding a (separate) marketing permission given by you (e.g. identifier for the marketing permission, usually your e-mail address, timestamp and touchpoint of your given permission, scope of your permission);

• if you revoke your marketing permission given, we will store the data necessary to process and prove the execution of your revocation by the relevant Home Connect Family entity (e.g. identifier, timestamp and touchpoint of your revocation),

• Home Connect Family brand and communication preferences set in your preference centre,

• aggregation of your Home Connect Family touchpoint interactions to better understand your interests (as part a given marketing permission given),

• (personal) data provided via such marketing tools, you opted-in to allow them sending data (e.g. Thunderhead Marketing)

• to the extent permitted by a separately collected, specific permission, we may also combine the information you provide with other data collected online or offline and use or share it for the (marketing) purposes described herein.

2. Purpose of use

We use the above-mentioned categories of data

• to provide the login-functionality via SingleKey ID,

• to provide Synced Home Appliance Account features itself as well as the services offered via the Synced Home Appliance Account and or Home Connect Family touchpoints (1.a.-c.),

• for contractual purposes, insofar you use your Synced Home Appliance Account for e.g. the purchase of products, service arrangements and similar contractual interactions (1.a. to c.),

• to improve the Synced Home Appliance Account's user friendliness and for specific or general troubleshooting of the Synced Home Appliance Account and the digital services offered through it (1.a. and c.),

• to improve our range of products and services (including those of Home Connect Family entities), especially with regard to the usage of the features of the Synced Home Appliance Account and your registered household appliance(s), if any (1.b. and c.),

• for marketing and market research purposes including in-Synced Home Appliance Account/email messages (1.a. to d.) as far as a corresponding consent is given,

• for notification purposes in case of specific safety instructions and/or recall information in the context of product monitoring (1.a. and b.),

• for general Safety Action purposes your Name, contact details and appliance master data (including customer service transaction data) in a separate "Safety Action" database, e.g. to perform product recalls (1.a. and b.); and

• in anonymized form for statistics on the use of the Synced Home Appliance Account including connected home appliance(s) for use by HomeConnect and its affiliates for internal purposes and in the context of general communications, including social media (1.b and c anonymized).

The legal bases for the purposes of processing within the scope of the GDPR are described in section 10.a) of this information.

Regarding other data transfers within the Bosch Group associated with the central SingleKey ID, we refer to the BIO data protection information at https://singlekey-id.com/en/data-protection-notice/.

3. General retention periods

Provided there are no statutory provisions to the contrary, the following general retention periods shall apply:

a. SingleKey ID: Deletion with deletion of the SingleKey ID user account.

b. User Master Data: Deletion of the User Master Data (including additional User Master Data you provided, if any) as soon as the Synced Home Appliance Account is deleted.

c. Contractual Data: in case of the deletion of the Synced Home Appliance Account or in case of an individual deletion of such data, contractual data will be deleted automatically, if no binding retention period will apply to such contractual data. If there is a binding retention period, as e.g. for tax reasons, the contractual data will be kept for such reasons, but not actively used otherwise and will also not be visible via the Synced Home Appliance Account (e.g. in case you did not ask for deletion of the whole account including all data).

d. Appliance Master Data: Removal of link to you as the user and the Synced Home Appliance Account upon removing the household appliance from the Synced Home Appliance Account.

e. Touchpoint Data: in case of the deletion of the Synced Home Appliance Account or in case of an individual deletion of such data, contractual data will automatically be deleted, if no binding retention period will apply to such contractual data. If there is a binding retention period, as e.g. for tax reasons, the contractual data will be kept for such reasons, but not actively used otherwise and will also not be visible via the Synced Home Appliance Account (e.g. in case you did not ask for deletion of the whole account including all data).

f. Permissions and permission related data: Storage until revocation of the relevant permission, for such data, connected to that permission covered by your revocation.

g. Name, contact details and Appliance master data (including customer service transaction data): Stored in personal form for a period of 30 years in a separate "Safety Action" database, held solely for these purposes, e.g., to conduct product recalls.

If you sell the home appliance, please note that you must reset your home appliance to its factory settings before deleting the SingleKey ID or the Synced Home Appliance Account. If you have allowed the use of a home appliance together with another Synced Home Appliance Account user who does not use his own account, the deletion of your account also triggers the deletion of the other user. If you have allowed the use of a home appliance together with another Synced Home Appliance Account user who uses his own account, please note that the deletion of your account does not trigger the deletion of the additional user at the same time. If you do not want the other user to be able to continue using the home appliance via the Synced Home Appliance Account, please also arrange for the deletion of the other user. If such deletion does not take place, the previously collected appliance master data and appliance usage data will remain available for the additional user.

4. Account management

You can manage your user accounts via the Synced Home Appliance Account and e.g. delete Synced Home Appliance Account data as follows:

• If you use the SingleKey ID, the SingleKey ID account will be deleted via the SingleKey ID functions, whereby in addition to the SingleKey ID itself, individual linked applications can also be deleted. If the SingleKey ID is the only access mechanism to the Synced Home Appliance Account/to the central BSH user account, the deletion of the SingleKey ID may make access to the linked services impossible. Therefore, before deleting the SingleKey ID, please check if you still have linked applications/user accounts.

• You can delete your Synced Home Appliance Account via a deletion request via the SingleKey ID management page.

• You can delete your user account also directly within your Synced Home Appliance Account.

• You can delete your registered home appliances – choosing this will lead you to the MyProducts page where you can delete products without deleting the whole account.

• You can manage your personal information, edit your address, and customize your communication preferences via the Synced Home Appliance Account .

• You can opt-out from communication fully or in part via the Synced Home Appliance Account. Choosing this function will lead you to the communication preferences where you can manage your communication preferences.

Based on specific action you choose from the above, you will receive an e-mail communication to confirm your choice(s) and/or deletion request.

5. Transmission or disclosure of your data e.g. to third parties

We work together with our Home Connect Family entities as well as various external service providers to create and run the Synced Home Appliance Account and provide the respective services. We secure the data processing within the Home Connect Family entities by an intra group data protection agreement. To the extent that we have bound these external service providers to process data in line with strict instructions in their capacity as data processors on our behalf, any data processing activities undertaken by such providers do not require your consent.

The service providers we have commissioned to create and run the Synced Home Appliance Account are:

• Service providers for hosting services

• Service providers for programming services

• Service providers for hotline services (also if performed via a chat-function or similar communication channels) and other Synced Home Appliance Account services

We only transmit your data to other recipients where necessary to fulfil a contract with you or between you and the third party, where we or the recipient has a legitimate interest in the disclosure of your data, or where you have given your consent to that transmission. These recipients include service providers and other companies within our corporate group. Furthermore, data may be transmitted to other recipients in the event that we are obliged to do so due to legal provisions or enforceable administrative or court orders.

Other recipients of your data are especially such service providers whose offers and services (third-party services) can be used in connection with the Synced Home Appliance Account or where the Synced Home Appliance Account enables access to such services.

6. Data security

We deploy technical and organisational measures to protect your data, for example, from manipulation, loss and unauthorised third-party access. These measures include the use of encryption technologies, certificates, firewalls on the Home Connect servers and password protection in the Synced Home Appliance Account. We are reviewing and improving our security measures in accordance with technological advancement.

7. Scope of application of the data protection information

This data protection information shall apply for the functions and services offered by Home Connect via the Synced Home Appliance Account. Insofar as additional functions or services are offered within the Synced Home Appliance Account by Home Connect or a BSH Group company, special information on data protection is provided, insofar as their use is subject to special data protection regulations or information.

However this data protection information shall not apply for third-party services, even if Home Connect facilitates the use of and/or access to such third-party services in the Synced Home Appliance Account (please see the terms of use with regard to third-party services). The use of such third-party services is governed by the prevailing data protection provisions put in place by the third-party service provider and, if applicable, additional data protection information on our part which outline the distinctive features of these third-party services and shall only be relevant in this regard.

If you are referred to another service provider, Home Connect shall make reasonable and appropriate efforts to elucidate such referral (e.g. by embedding the service provider's content within the Synced Home Appliance Account using inline frames) if such referral is not clear. If you click on a link in the Synced Home Appliance Account which calls up a Synced Home Appliance Account or website of another service provider, this is considered to be a clear referral.

If you, the user, are located within the scope of application of the GDPR , please note that the use of third-party services may result in your personal data being processed in countries outside the scope of application of the GDPR. Please then refer to the data protection information of the respective third-party service providers.

8. Changes to the data protection information

As the Synced Home Appliance Account and the services provided via the Synced Home Appliance Account continues to undergo development – among other things, through the implementation of new technologies or the introduction of new services – this data protection information may need to be adjusted accordingly. Home Connect shall reserve the right to amend or supplement this information as required. Home Connect will always update the data protection information for the Synced Home Appliance Account; you can therefore familiarise yourself with the latest version at any time.

9. Rights and contact information

If, despite our efforts to only store data which is correct and up-to-date, your personal details are stored incorrectly, we shall correct such information upon your request. In case you gave us your consent for the collection, processing and use of your personal data, you may withdraw such consent at any time with effect for the future. Consent may generally be withdrawn by termination of the Synced Home Appliance Account itself or individually through the contact information referred to in the Synced Home Appliance Account.

Your personal data will be deleted if you withdraw your consent to your data being stored, if your personal data is no longer needed to serve the purpose pursued by such storage or if such storage is inadmissible for other legal reasons. Please bear in mind that, for technical or organisational reasons, there may be an overlap between you withdrawing your consent and your data being used, e.g. in the case of a newsletter which has already been sent out. Data required for billing and accountancy purposes or which are subject to the legal duty to preserve records are not affected by this.

Should you have any questions on the topic of data protection or should you wish to exercise your rights to withdraw consent or your rights to information, rectification, deletion or suspension, please contact us using the contact information provided in the Synced Home Appliance Account.

10. Additional information pursuant to the GDPR

a. Legal bases for intended data uses

We base the following data uses on

• the performance of a contract according article 6(1b) GDPR:

– Provision of the access to the Synced Home Appliance Account via SingleKey ID in using the data category listed in item 1.a).

– Provision of Synced Home Appliance Account itself and its features as well as the data based or other services offered via the Synced Home Appliance Account by processing the data categories listed in the items 1.a.-c.

– Transfer of data categories listed in the items 1.a.-d. to Home Connect Family entities and/or service providers of third-party services, which are processed in connection with the Synced Home Appliance Account.

– Processing of Contractual Data within the Synced Home Appliance Account to provided synced information on all touchpoints (items 1.a – d.).

• legitimate interests according article 6(1f) GDPR:

– The improvement of Synced Home Appliance Account user friendliness by processing the data categories listed in the item 1.c. based on statistical data.

• your consent according article 6(1a) GDPR:

– Direct marketing purposes by processing the data categories listed in the items 1.a.-d.

• a legal permission according to Art. 6 (1 c and d) GDPR:

– Storage of data categories 1.a. and b in the "Safety Action" database in the scope described above

– Notification in case of safety instructions and/or recall information in the context of product monitoring by processing data categories 1.a.-c in the scope described above.

b. Your rights

Your additional rights are outlined below. To exercise your rights, please use the contact information provided at the end of this data protection information.

• Your right to information about your data: We will provide you with information about the data we hold about you on request.

• Your right to correct and complete your data: We will correct inaccurate information about you if you notify us accordingly. We will complete incomplete data if you notify us accordingly, provided this data is necessary for the intended purpose of processing your data.

• Your right to delete your data: We will delete the information we hold about you on request. However, some data will only be deleted subject to a defined period of retention, for example because we are required to retain the data by law in some cases, or because we require the data to fulfil our contractual obligations to you.

• Your right to have your data blocked: In certain legally determined cases, we will block your data if you would like us to do so. Blocked data is only further processed to a very limited extent.

• Your right to withdraw consent: You can withdraw consent given for your data to be processed with effect for the future at any time. The legality of processing your data remains unaffected by this up to the point at which your consent is withdrawn.

• Your right to object to the processing of your data: You can object to the processing of your data with effect for the future at any time, if we are processing your data on the basis of one of the legal justifications set out in article 6(1e or 1f) GDPR. In the event that you object we will cease processing your data, provided that there are no compelling and legitimate grounds for further processing. The processing of your data for the purposes of direct marketing never constitutes compelling and legitimate grounds for us.

• Your right to data portability: At your request, we can make certain information available to you in a structured, commonly used and machine-readable format.

• Your right to appeal to a regulatory authority: You can lodge an appeal pertaining to data protection with a data protection authority. To do so, contact the data protection authority responsible for your place of residence or the data protection authority under whose jurisdiction we fall (named below).

Bavarian Data Protection Authority (BayLDA), www.baylda.de.

c. Transmission to recipients outside the EEA

If necessary, for the provision of Synced Home Appliance Account features as well as the services offered via the Synced Home Appliance Account, we also transmit personal data to recipients based outside of the EEA, in so-called third countries. In this case, we ensure ‒ before any data is shared ‒ that either an appropriate level of data protection is maintained by the recipient (e.g. on the basis of an adequacy decision made by the EU Commission for the respective country or the agreement of standard EU contractual clauses between the European Union and the recipient) or that you have given your consent to said sharing.

We are happy to provide you with an overview of the recipients in third countries and a copy of the specific provisions agreed to ensure an appropriate level of data protection. To request this, please use the contact information provided at the end of this data protection information.

Please see item 5 for transmission of personal data by usage of third-party services.

d. Contact details of the data protection officer

If you have any questions relating to data protection or exercising your rights, you can use the following contact information to get in touch with our data protection officer directly:

i. As far as you are resident in an EU state (except the United Kingdom):

BSH Hausgeräte GmbH

Data Protection Officer

Carl-Wery-Str. 34

81739 Munich, Germany

Data-Protection-de@bshg.com

ii. As far as you are resident in the United Kingdom:

BSH Home Appliances Limited

Data Protection Officer

Grand Union House, Old Wolverton Road

Wolverton, Milton Keynes, MK12 5PT

Data-Protection-GB@bshg.com

iii. Representative in the United Kingdom (Art 27 UK GDPR)

BSH Home Appliances Limited

UK GDPR Representative Home Connect

Grand Union House, Old Wolverton Road

Wolverton, Milton Keynes, MK12 5PT

Date of issue: November 2022