Volkswagen : Information on Data Protection

Information on data protection for shareholders and shareholder representatives

1. Controller
   We are delighted that you will be taking part in the Annual General Meeting of Volkswagen Aktiengesellschaft, Berliner Ring 2, 38440 Wolfsburg, Germany, registered in the commercial register of the Local Court of Braunschweig under the number HRB 100484 ("Volkswagen AG"). The Annual General Meeting will take place as a virtual event without the physical presence of shareholders or their proxies and will allow you to participate and exercise your rights as a shareholder or shareholder representative online via the shareholder portal.
   The shareholder portal, which we make available to you via our service provider Computershare Deutschland GmbH & Co. KG ("Computershare"), offers shareholders (or their representatives) the opportunity to follow the Annual General Meeting live in video and audio, to ask questions and/or motions by means of video communication, to exercise their voting rights, to grant proxies, to have objections to resolutions of the Annual General Meeting recorded or to submit a statement in advance in text form, to complain unanswered questions and to retrieve proof of the exercise of voting rights after the Annual General Meeting. Further information on your shareholder rights can be found in the invitation to the Annual General Meeting as well as in the information of your rights under www.volkswagen-group.com/agm.In addition, all shareholders (or their representatives) are listed in a list of participants and can be viewed in the shareholder portal.
   In the following, we would like to inform you about the processing of your personal data by Volkswagen AG in connection with your visit to our shareholder portal and the holding and follow-up of the Annual General Meeting.
   Our data protection officer is available to you for any matters relating to data protection:
   Volkswagen AG Data Protection Officer Berliner Ring 2
   38440 Wolfsburg, Germany Phone +49 5361 9-0
   Email: datenschutz@volkswagen.de
2. Processing of personal data
   I. Operation of our shareholder portal

If you visit our shareholder portal, we will process the following data about you:

• an anonymous cookie ID, which does not enable your IP address to be inferred;
• the operating system you are using, the web browser you are using, and the screen resolution you have set;
• the date and time of your visit;
• the website within our internet presence that you have visited;
• the website from which you are visiting us; and
• the IP address of your device with which you are accessing our shareholder portal.

The processing of this data is carried out in accordance with Art. 6 (1) (f) GDPR on the basis of our legitimate interest in being able to properly display the shareholder portal to you. The data will be deleted after 90 days.

If you make a contribution via a two-way video communication via the shareholder portal, we will also process the following data from you:

• the outgoing technical sound and video signals (access to microphone and webcam);
• your telephone number for callback in the event of technical malfunctions, and
• If necessary, on request, your e-mail address for contacting us in the event of technical malfunctions.

The processing of this data is carried out in accordance with Art. 6 (1) (f) GDPR on the basis of our legitimate interest in providing you with the shareholder portal, ensuring the smooth running of the Annual General Meeting, preventing misuse and eliminating disruptions.

II. Conducting the General Meeting

The processing before and during the connection is logged. The shareholder portal takes into account the latest security standard (256bit encryption). Your data is encrypted directly in transit, and all privacy-related information is stored in encrypted form in a protected database. The data is automatically transmitted to us via your browser or actively provided by you.

Volkswagen AG processes the following data in connection with holding the General Meeting:

• title, last name, first name;
• contact details (e.g., address, email address, telephone number);
• share-relateddata (e.g., number of shares, class of shares, type of ownership of shares, voting rights);

• data relating to the General Meeting (e.g., number of the registration confirmation [login data and access data], exercise of voting rights and other rights)

to enable the shareholders and their representatives to participate in the General Meeting and exercise their rights in accordance with the Aktiengesetz and the Articles of Association of Volkswagen AG. The processing is carried out in this context particularly

• to check the entitlement to take part in the General Meeting;
• to dispatch of registration confirmation (including the access data for the shareholder portal);
• to vote according to the agenda;
• to submit statements in text form;
• to prepare the list of attendees;
• to record proxies and instructions and their revocation.

Processing your personal data is necessary to meet our legal obligations (particularly under sections 67c (3), 118, 118a, 123 (2), 129 (1) sentence 2, 130 (6). 130a, 135 Aktiengesetz (German Stock Corporation Act). The legal basis for the processing is thus Art. 6 (1) c) GDPR.

Please note, to participate to the General Meeting a proper registration is obliged according to Aktiengesetz. A proper registration requires the processing of personal data.

We retain this data in accordance with statutory obligations, e.g., due to regulatory requirements and stock- corporation-law,commercial-law and tax-law retention obligations. For example, we are obliged by law, after the end of the General Meeting,

• to verifiably document proxy forms for proxy holders and retain these for three years in such a manner that they are protected from access (section 134 (3) sentence 5 of the Aktiengesetz);
• to retain a confirmation of whether and how votes were counted for each voter for four weeks (section 129
  (5) Aktiengesetz);
• to retain a list of attendees for two years (section 129 (4) Aktiengesetz).

The legal basis for fulfilling the legal retention obligations in this respect is Art. 6 (1) c) GDPR.

After the end of the storage periods, we will erase your data unless another legal basis for further storage exists.

C. Data sources

Volkswagen AG receives personal data in connection with holding the General Meeting directly through the shareholder or shareholder representative or via the registration agent through the custodian bank (the bank that the shareholder has entrusted with the safe custody of their shares).

D. Disclosure of your data

Volkswagen AG employs of the service provider Computershare to provide the shareholder portal and to hold and prepare the General Meeting and provide follow-up services after it. This service provider is only given the personal data necessary for carrying out the commissioned service from Volkswagen and only processes the data in accordance with the instructions of Volkswagen AG as a processor.

Otherwise, personal data is only shared in accordance with statutory requirements. This particularly concerns:

1. • the list of attendees, which records the circumstances of your electronic connection or that of your representative at the Annual General Meeting, stating your name, place of residence, number of shares held, type of ownership and class of shares, and which can be viewed by other shareholders (or their representatives) during the Annual General Meeting for two years after the holding of the Annual General Meeting (Section 129 (4) of the Aktiengesetz (German Stock Corporation Act));
   • the announcement of agenda items and nominations and counter-nominations on the website of the Group, specifying the submitting shareholder in accordance with the requirements of stock-corporation law (section 126 (1) Aktiengesetz);
   • sharing your data with additional recipients outside of the Group. This concerns, for example, publications of voting rights announcements in accordance with the requirements of the Wertpapierhandelsgesetz (WpHG
     - German Securities Trading Act) or disclosure to public bodies on the basis of legal requirements (e.g., tax and law-enforcement authorities).
2. Cookies

Volkswagen AG uses various cookies on its websites. Cookies are small files containing configuration information that are stored on your device. Cookies can basically be divided into three categories.

• So-calledfunctional cookies are essential for the functionality of the website. The processing of functional cookies is necessary to enable you to visit the website (cf. Art. 6 (1) (b) GDPR).
• The convenience of a website visit is increased by so-calledcomfort cookies, which e.g. save your language preferences. The legal basis for the convenience cookies is a legitimate interest (Art. 6 para. 1 lit. f GDPR). The legitimate interest lies in providing a certain comfort during your visits to the website. You can object to data processing at any time with effect for the future.
• In order to create a pseudonymized user profile, so-calledtracking cookies are used. Tracking cookies are only set if the website visitor has given their consent (Art. 6 (1) (a) GDPR). Consent is given via the so-called cookie banner, which must be actively clicked.

Different types of cookies are used within the categories described. Below are the most common types of cookies explained for your understanding:

• While you are active on a website, a session cookie is temporarily stored in the memory of your device, in which a session identifier is stored, e.g. to prevent you from having to log in again every time you change pages. Session cookies are deleted when you log out or expire once your session has automatically expired.
• A persistent or log cookie stores a file on your device for the period specified in the expiry date. These cookies allow websites to "remember" your information and preferences the next time you visit. This leads to faster and more convenient access, as you do not have to change your language setting for our portal again, for example. Once the expiry date has passed, the cookie is automatically deleted when you visit the website that generated it.
• Third-partycookies come from providers other than the operator of the website. For example, they can be used to collect information for advertising, custom content, and web statistics.
• Flash cookies are stored on your device as data elements of websites when they are operated with Adobe Flash. Flash cookies do not have a time limit.

Following cookies are used in the shareholder portal:

F. Rights with regard to your personal data

You can enforce the following rights against Volkswagen AG free of charge at any time.

Right of access:

You have the right to receive information on the processing of your personal data (Article 15 GDPR).

Right to rectification:

You have the right to obtain the rectification of inaccurate or incomplete personal data concerning you from us (Article 16 GDPR).

Right to erasure:

You have the right to obtain the erasure of your data where the conditions set out in Article 17 GDPR are met. You can then, for example, obtain the erasure of your data if it is no longer necessary for the purposes for which it was collected. In addition, you can obtain erasure if we are processing your data on the basis of your consent and you revoke this consent.

Right to restriction of processing:

You have the right to obtain restriction of processing of your data if the conditions of Article 18 GDPR are met. This is, for example, the case if you dispute the accuracy of your data. For the duration of the verification of the accuracy of the data, you can obtain restriction of processing.

Right to object:

If the processing takes place on grounds of the legitimate interests of Volkswagen AG or a third party or is in the public interest or in the exercise of an official authority, you have the right to object to the processing of your data on grounds relating to your particular situation. In the event of objection, we ask you to inform us of your reasons for objecting to the data processing. In addition, you have the right to object to data processing for direct marketing purposes (Article 21 GDPR). This also applies to profiling to the extent that it is related to the direct marketing.

Right to data portability:

If the data processing is carried out on the basis of consent or the performance of a contract and this is also done using automated processing, you have the right to receive your data in a structured, commonly used and machine-readable format and to transmit it to another data processor (Article 20 GDPR).

Right of revocation:

If the data processing is based on consent, you have the right to revoke the consent free of charge at any time with effect for the future (Article 7 (3) GDPR).

Right to lodge a complaint:

You also have the right to lodge a complaint with a supervisory authority (e.g., with the state data protection officer for Lower Saxony, Germany) regarding our processing of your data.

The data protection supervisory authority responsible for the Company is:

The State Commissioner for Data Protection of Lower Saxony Prinzenstrasse 5

30159 Hanover, Germany

Phone: +49 (0511) 120 45 00

Fax: +49 (0511) 120 45 99

E-mail: poststelle@lfd.niedersachsen.de

Further information on data protection is available at Volkswagen AG's website at https://datenschutz.volkswagen.de/?lang=en-gb.

Status: April 2024