Thank you for your interest in our company. Protecting your privacy when you use our website (www.porsche.al) or during our business activities is of particular importance to us. For this reason, below we provide you with detailed information on how we process your personal data, in accordance with Law No. 124/2024 "On the Protection of Personal Data" (the "Data Protection Law" or "DPL")

Porsche Albania sh.p.k. is, in general, the controller responsible for the processing of the data described below. In certain cases, joint responsibility may exist with the relevant group company, when the latter is involved in the specific processing activity; where such joint responsibility exists, this is clearly stated in the description of the relevant processing activity.

This privacy policy applies to www.porsche.al, its sub-pages, and related processing activities. It does not apply to websites controlled and operated by third parties.

1. Data integrity

Controllers have taken appropriate technical and organizational measures to protect your data, including safeguards against loss, manipulation, and unauthorized access. These measures are reviewed regularly and adapted to technological developments. If a breach of the security of your personal data occurs that may result in a high risk to your rights and freedoms, we will notify you without undue delay, and we will also notify the Commissioner for the Right to Information and Protection of Personal Data (the "Commissioner"), in accordance with the notification obligations under the Data Protection Law.

2. Use by minors

Our online services and data processing activities are directed at persons who have reached the age of 16. Under the Data Protection Law (Article 8, paragraph 6, DPL), the processing of a minor's personal data, based on consent, in relation to information society services, is lawful only if the minor has reached the age of 16; below that age, consent must be given or authorized by the holder of parental responsibility. If we become aware that we have processed the data of a minor without the required parental authorization, we will stop this processing and delete the data without undue delay

3. Collection and processing of personal data

Information you provide to us

If you contact us or provide data through our website or during interaction with us, the data you provide will be processed for the purposes described in this policy.

Information we collect

When you visit our website, some personal data is automatically collected through cookies and similar technologies. For more information on the cookies we use, please see our Cookie Policy.

4. Transmission of data

Porsche Albania does not carry out every processing activity itself and relies on carefully selected professional partners. These partners are contractually obligated to process your personal data in accordance with the Data Protection Law and to guarantee your rights through appropriate technical and organizational measures. Our partners are not entitled to use your personal data for their own or advertising purposes, or to pass it on to third parties. We do not pass your data on to third parties, such as companies that trade in addresses or direct marketing companies.

When recipients are located outside the territory of the Republic of Albania — including group companies located in the European Union, such as in Austria — we ensure an adequate level of protection through appropriate measures, such as an adequacy decision recognized under Albanian legislation, standard contractual clauses, or other appropriate measures approved by the Commissioner, in accordance with the provisions of the Data Protection Law on international data transfers (Articles 40–42).

5. Processing of data on the website

General contact form

Description: When you send a form or message, we process the information provided in order to handle your request.

Categories of data: Contact and identification data, as well as free-text fields.

Purpose: Responding to the request and managing communication.

Legal basis

• Performance of pre-contractual measures (Article 7, paragraph 1, "b" DPL) — to process and respond to your individual request.

• Legitimate interest (Article 7, paragraph 1, "dh" DPL) — our legitimate interest consists of the reliable and individual processing of your requests.

Recipients of the data: Employees of relevant departments; group companies.

6. Processing of data in business activity

6.1 Supplier Portal

Description: Potential and existing suppliers may provide their company's data during negotiations and interactions, with the aim of being considered as business partners and taking part in tenders or providing services and products. During the registration process, basic company data, contact data, and documentation verifying the legal form and fulfillment of compliance requirements are collected. Suppliers must accept the applicable procurement terms and the Code of Conduct for Business Partners.

Categories of data: Professional contact and organizational data, contractual data, creditworthiness, and bank data.

Purpose: Implementation of tenders and contract award processes.

Legal basis

• Performance of the contract / pre-contractual measures (Article 7, paragraph 1, "b" DPL) — for carrying out registration and initiating and administering contracts with suppliers.

• Legitimate interest (Article 7, paragraph 1, "dh" DPL) — to efficiently manage procurement processes, verify supplier suitability, and maintain a stable relationship with suppliers.

Recipients of the data: Group companies; IT service providers.

Retention period: Registration data: for the entire duration of the relationship with the supplier. Contract and compliance data: 10 years.

7. Processing of data in the compliance context

Gifts and benefits

Description: In accordance with anti-corruption legislation and our internal compliance policies, benefits (invitations, gifts, etc.) offered or received are recorded in our compliance database and are subject to an approval process. All gifts to and from third parties with business relationships are documented transparently.

Categories of data: Contact and identification data of business partners and employees.

Purpose: Compliance.

Legal basis: Legitimate interest (Article 7, paragraph 1, "dh" DPL) — exchange of data within the group for internal administrative purposes and fraud prevention.

Recipients of the data: Group companies; the internal compliance department; external service providers (e.g., for operating the database); authorities, when required by law.

Whistleblowing system

Description: Employees and external business partners may use our whistleblowing system to report suspected violations of the law, internal policies, or compliance requirements, including anonymously where the system allows. Reports are reviewed and processed by the responsible compliance function and, where applicable, by group compliance.

Categories of data: Contact and identification data; special categories of personal data, when related to the report; data relating to criminal offenses or administrative violations, when related to the report.

Purpose: Compliance with the law and prevention of fraud and other unlawful acts.

Legal basis

• Compliance with a legal obligation (Article 7, paragraph 1, "c" DPL) — including obligations under applicable legislation on the protection of whistleblowers.

• Legitimate interest (Article 6, paragraph 1, letter "dh" DPL) — the detection and prevention of violations and the protection of the company and its employees.

• Special categories of data and data on criminal offenses or administrative violations — processed only when necessary to clarify a matter of significant public interest and when permitted by applicable legislation.

Recipients of the data: Group compliance; authorities and courts, when required by law; external reviewers or lawyers, when necessary. 8. Business Partner Due Diligence (BPDD)

Description: In-depth due diligence of the group's business partners is carried out through a dedicated cloud-based tool. Business partner data is collected for a risk assessment (comparison against internal integrity lists and external databases) and, when necessary, supplemented with additional information. The compliance department prepares a report based on this assessment; business partners who do not meet the requirements may be included on the group's integrity list and excluded from cooperation.

Categories of data: Organizational data, contractual data, IT usage data, financial and creditworthiness data, data on personal or professional circumstances, special categories of personal data, and data relating to criminal offenses or administrative violations, where applicable.

Purpose: Compliance and fraud prevention.

Legal basis

• Compliance with a legal obligation (Article 7, paragraph 1, "a"/"c" DPL) — e.g., anti-money-laundering, anti-corruption, and international sanctions requirements applicable in Albania and within the group.

• Legitimate interest (Article 7, paragraph 1, "dh" DPL) — preventing corruption and financial crime and ensuring a legally sustainable supply chain within the group.

• Special categories of personal data — processed only to the extent necessary to protect a significant public interest, on a specific legal basis.

• Data on criminal offenses or administrative violations — processed only when necessary to assess the integrity of business partners and when permitted by applicable legislation.

Joint responsibility: When the in-depth due diligence process is carried out together with the wider group, the relevant companies jointly determine the purposes and means of processing, while responsibilities are divided between the local group company (initial registration and risk assessment) and Porsche Albania / the group compliance function (in-depth assessment, reporting, and approval decisions).

Recipients of the data: Group companies; external service providers engaged to carry out the due diligence; IT service providers; authorities and regulators, when required by law.

Background checks

Description: As part of the application process for management and senior-level positions, we may carry out a background check based on publicly accessible sources and approved databases (e.g., commercial register, sanctions lists). Profiling and private social media searches are excluded. The report is sent to the HR representative who requested the check and, where applicable, to the group's senior HR management; the full report is kept separately from the personnel file, which records only the fact that a check was carried out.

Categories of data: Personal, professional, and financial data; data on criminal charges, when relevant. Special categories of personal data are not processed, except in exceptional cases required by law.

Purpose: Compliance, integrity verification, and fraud prevention.

Legal basis: Legitimate interest (Article 7, paragraph 1, letter "dh" DPL) — ensuring compliance and integrity, e.g., verifying previous employment, qualifications, or creditworthiness, when relevant for the position.

9. Processing of data in the application process

Application and selection process

Description: As part of the application process, we process personal data to review documents, communicate with candidates, organize and carry out selection procedures (including online interviews), carry out further selection steps (e.g., assessment centers or knowledge tests for interns), share applications with HR and the relevant hiring department, provide feedback after the selection process is completed, and, with your express consent, keep your application beyond the current process in order to contact you about future job openings.

Categories of data: Private contact and identification data, professional contact and organizational data, IT usage data, special categories of personal data when relevant (e.g., health data, trade union membership), as well as compensation and time-management data.

Purpose: Recruitment.

Legal basis

• Pre-contractual measures (Article 7, paragraph 1, "b" DPL) — e.g., reviewing applications, conducting interviews, organizing selection procedures.

• Legitimate interest (Article 7, paragraph 1, "f" DPL) — efficient handling of applications and internal exchange of documents within the group for administrative purposes.

• Consent (Article 7, paragraph 1, "a" DPL) — keeping applications for future job vacancies.

• Special categories of data — processed only when necessary to exercise rights or fulfill obligations under labor law (e.g., declaration of a disability).

• Data on criminal offenses — processed only when permitted by applicable legislation and when necessary for the position.

Joint responsibility: Joint responsibility exists between the HR department of Porsche Albania and the relevant specialist departments of group companies: HR operates the application portal, prepares vacancy documentation, carries out initial selection, and administers contracts; the specialist departments decide on the final selection of candidates and hiring.

Recipients of the data: Group companies; IT service providers (e.g., video-conferencing software); consultants and external service providers (e.g., assessment centers); authorities, only when required by law (e.g., verification of judicial status).

Digital recruitment via messaging applications

Description: We offer the possibility of completing part of the application process through a messaging application, using a dedicated integration with the relevant provider's business messaging API. The API functions solely as a technical intermediary channel and does not process additional data; the messaging provider receives only candidates' phone numbers and has no access to other personal data or to the content of conversations.

Categories of data: Contact and identification data; data on personal or professional circumstances.

Purpose: Simplifying and speeding up communication during the application process.

Legal basis: Legitimate interest (Article 7, paragraph 1, "dh" DPL) — increasing efficiency, speeding up communication, and improving accessibility for candidates.

Recipients of the data: Group companies; the IT service provider for the technical implementation of the recruitment platform; the messaging provider, solely as a technical intermediary channel, with limited access to phone numbers.

Onboarding of new employees

Description: Once an offer has been accepted, we collect and process personal data to prepare the employment relationship efficiently and in compliance with the law. This includes collecting data through a personal data form, obtaining a criminal record certificate when required by law, drafting the employment contract, organizing administrative and technical measures for starting work (e.g., IT access, workplace, time-recording systems), and carrying out the required reporting to social security authorities and institutions.

Categories of data: Private contact and identification data; special categories of personal data or data on criminal convictions, when relevant; credit and bank data; contractual data.

Purpose: Recruitment and commencement of the employment relationship.

Legal basis

• Pre-contractual measures (Article 7, paragraph 1, "b" DPL) — preparation and execution of the employment contract.

• Compliance with a legal obligation (Article 7, paragraph 1, "c" DPL) — e.g., tax, social security, or reporting obligations.

• Legitimate interest (Article 7, paragraph 1, "dh" DPL) — structured and timely preparation of the employment relationship (e.g., early access to systems).

• Special categories of data — processed only to the extent required under labor law (e.g., severe disability status).

• Data on criminal convictions — processed only when required and permitted under applicable legislation.

Recipients of the data: Group companies; IT service providers (e.g., HR systems and integration); authorities and public bodies (e.g., social security, tax authorities); banks, for salary payments.

10. Cookies, social plug-ins, and other tracking tools

Our website uses cookies and similar technologies. Some of them are technically necessary for the website to function and are used on the basis of our legitimate interest (Article 7, paragraph 1, "dh" DPL). Others are used for statistical purposes or to display personalized content and advertising, and are used only with your consent (Article 7, paragraph 1, "dh" DPL). Detailed information on the cookies we use, their purpose, retention period, and your options for managing them can be found in our Cookie Policy.

11. Social media

Our website uses social media features and plug-ins to provide content and enable you to interact with social networks. This may result in the transmission of personal data to the operators of the relevant platforms, currently: Facebook, Instagram, TikTok, LinkedIn, and YouTube.

Responsibility

Joint responsibility: For our social media pages (e.g., Facebook pages, Instagram profiles, TikTok accounts), we are jointly responsible together with the relevant platform operator for the processing of personal data related to user interactions, posts, comments, messages, and anonymized usage statistics ("insights").

Sole responsibility of platform operators: Platform operators are solely responsible for processing carried out independently by them, such as the use of cookies, tracking technologies, or personalized advertising, which are outside our control. Please refer to each platform's privacy policy for more information.

Interactions and communication

Description: When you interact with us on social media — by following our pages, liking, commenting on, or sharing posts, posting on our pages, or sending us messages — we process your personal data.

Categories of data: Contact and identification data.

Purpose: Responding to your requests and analyzing and optimizing our pages.

Legal basis: Legitimate interest (Article 7, paragraph 1, "dh" DPL) — reliable response to individual requests and optimization of our social media presence.

Retention period: We regularly review the need to retain data on these platforms and take appropriate deletion steps, although we cannot guarantee deletion by the platform operator.

Contests

Description: We may organize contests on our social media pages. Participation requires us to process your personal data for the administration of the contest.

Categories of data: Contact and identification data.

Purpose: Running and administering the contest.

Legal basis: Performance of the contract / pre-contractual measures (Article 7, paragraph 1, "b" DPL) — fulfilling obligations toward participants, e.g., notifying and rewarding winners.

Retention period: Participants' data is deleted after the winner has been announced. The winner's data is processed until the prize has been delivered.

12. Data retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including compliance with any legal, accounting, regulatory, or reporting requirement. Where no specific statutory retention period applies, we will retain personal data for the time necessary to achieve the purpose for which it was processed, after which it will be securely deleted or anonymized.

Without prejudice to the general principle above, the following specific retention periods apply:

Accounting and Financial Data Personal data included in accounting documents, invoices, financial data, and other supporting documentation required under applicable accounting legislation will be retained for a period of ten (10) years from the end of the financial year to which the relevant documentation relates, in accordance with Law No. 25/2018 On Accounting and Financial Statements.

Anti-Money Laundering (AML) Data

Personal data collected and processed for customer due diligence, identity verification, transaction monitoring, and any other information required to be retained under applicable anti-money-laundering and counter-terrorist-financing legislation will be retained for a period of fifteen (15) years from the date of termination of the business relationship or the date of the occasional transaction, as applicable, in accordance with the requirements of Law No. 9917/2008 On the Prevention of Money Laundering and Financing of Terrorism

At the end of the applicable retention period, personal data will be securely deleted, destroyed, or anonymized, in a manner that prevents its reconstruction or further processing, unless a longer retention period is required or permitted by law, or is necessary for the establishment, exercise, or defense of legal claims.

13. Your rights

Under the Data Protection Law, you have the following rights regarding your personal data:

• The right to information / access — to receive confirmation as to whether and to what extent we process data about you.

• The right to rectification — to request the correction or completion of incomplete or inaccurate data.

• The right to erasure — to request the deletion of your data where the purpose of processing has ceased to exist, the processing was unlawful, the processing disproportionately infringes your protected interests, or you have withdrawn the consent on which the processing was based — except where there are legal retention obligations, ongoing judicial proceedings, or a need to establish, exercise, or defend legal rights.

• The right to restriction of processing — where you contest the accuracy of the data, the processing is unlawful but you object to erasure, we no longer need the data but you need it for legal claims, or you have objected to processing while our grounds are being verified.

• The right to data portability — to receive the data you have provided to us in a structured, commonly used, and machine-readable format, or to have it transmitted directly to another controller, where processing is based on consent or a contract and is carried out by automated means.

• The right to object — to object to processing carried out for a public interest, in the exercise of public authority, or based on our legitimate interest, where there are reasons relating to your particular situation.

• The right to withdraw consent — at any time and without giving reasons, with effect only for the future; withdrawal has no negative consequences for your employment relationship with us.

• The right to lodge a complaint — with the Commissioner for the Right to Information and Protection of Personal Data (www.idp.al), if you believe your data protection rights have been violated.

14. Contact details

Contact for privacy requests Porsche Albania SHPK Tiranë-Durrës Highway, km 3, Mëzez, Tirana E-mail: [email protected] Tel.: +355 (04) 240 74 30

Supervisory authority: Commissioner for the Right to Information and Protection of Personal Data, www.idp.al