Cookie Policy of Druck Styria GmbH & Co KG

(Status 9.12.2020)

0. General information

This Cookie Policy contains information for users (hereinafter referred to in brief as "user" or also "you") regarding the use of cookies and similar technologies on printgroupstyria.com and any other websites (hereinafter referred to collectively in brief as "our websites") of Druck Styria GmbH & Co KG, Styriastraße 20, 8042 Graz (hereinafter referred to in brief as "Druck Styria, Druck Carinthia, Tiskara Zagreb", "we" or also "provider").

So-called cookies, device identifiers and similar technologies (hereinafter referred to collectively in brief as "cookies") are used on our websites; with their help, the digital products and services of Druck Styria (hereinafter referred to collectively in brief as "our online offerings") can be used more easily and efficiently and the usage habits of the users can be analysed with the aim of constantly improving our online offerings.

This Cookie Policy can be adapted by Druck Styria to the respectively current circumstances at any time. The respectively current version of this Cookie Policy can be viewed or called up by the users during their usage of our websites.

Cookies are set either by Druck Styria itself or by certain technical service providers (hereinafter also referred to in brief as "third-party providers" which are used by Druck Styria (further information in this regard under point 3. of this Cookie Policy).

Under point 1. of this Cookie Policy, you will find more detailed information about cookies and how you can agree to them or revoke consent that has already been given, and about how you can object to processing of data collected on the basis of your consent to cookies that is based on a legitimate interest. Under point 2. and point 3. of this Cookie Policy we inform you in detail about the purposes for which cookies are set and how you can control cookies on our websites. Under point 4. of this Cookie Policy, we provide you with information about how you can manage and delete cookies, depending on which browser and which terminal you are using. And finally under point 5. of this Cookie Policy you can find out about the usage of services

Page 1 of 14 of external providers that you may be able to reach via our websites.

Note: Some of the information below contains links to third-party websites. We record that we do not identify with the content of the websites which are linked to in the following and that we rule out any liability in this regard. The calling up of the linked websites is therefore done at your own risk.

1. What are cookies and when are they set?

1.1. Cookies are text files that are saved on the user's computer or smartphone. They typically contain information about websites visited by the user which the browser saves during the user's surfing on the Internet. Cookies make it possible to recognise the user again when he or she visits the website again and can therefore be used, e.g. to ensure that a user does not have to register again any more on a website after he or she has registered once. In addition, cookies are suitable for saving and transmitting information about the user's surfing behaviour.

1.2. Cookies are used both to improve the service quality, including the saving of user settings, and for recommendations of content and search results, as well as for the tracking of user trends, such as which content users like to access. This enables the usage of digital platforms to be analysed and valuable insights into the users' requirements to be gained. These insights contribute to improving the quality of digital platforms further.

1.3. As a general rule, cookies may only be set on the basis of prior, active consent from the user (regarding the exceptions please see under point 1.8. and 1.9. of this Cookie Policy). If you wish to use our online offerings, we therefore first obtain your consent (hereinafter referred to as "consent") to set cookies. To this end, a window (hereinafter referred to in brief as "cookie banner") appears when our websites are called up, with information about for which purposes we and third-party providers (hereinafter also referred to collectively in brief as "providers") wish to use cookies. You can generally consent to the use of cookies for the purposes listed in the cookie banner by clicking on the button "Accept all" in the cookie banner.

1.4. Via the button "Manage settings" in the cookie banner, you can make your choice for each of the purposes listed there or for each of the providers listed there as to whether you wish to permit cookies or not. For this purpose, you must click on the button "Save and close" in the cookie banner

Page 2 of 14 after you have made your choice. Via the button "Reject all", you can generally reject the setting of cookies (regarding the exceptions, see under point 1.8. and point 1.9. of this Cookie Policy).

1.5. If you consent to all or individual purposes listed in the cookie banner, this consent applies for all providers listed in the cookie banner who are requesting your consent for this purpose. However, you can also only grant your consent to one provider or individual providers listed in the cookie banner. In this case, your consent covers all purposes for which the provider or the providers has/have requested your consent.

1.6. Your consent towards us only applies for our online offerings (service-related). The range of your consent towards the third-party providers is based on the privacy policy of the respective third-party provider (service-related, per group of companies, or worldwide). The privacy policies of the individual third-party providers can be found in the cookie banner by selecting any third-party provider from the list with all third-party providers and clicking on "Display data privacy notice". You can access the list with all third-party providers by first clicking on the button "Manage settings" and then clicking on "Providers" in the top right-hand corner.

1.7. Consent once give or a selection with regard to cookies can be revoked by the user at any time via the data privacy symbol at the bottom of the screen of the website or with regard to the cookies set, and also modified again separately depending on the purpose or provider. In addition, the user can also deactivate cookies universally via the browser by selecting corresponding browser settings. Please note that you may not be able to use our online offerings, or only to a limited extent, if you do not permit certain cookies.

1.8. According to the valid legal situation (Section 96 Para. 3 of the Telecommunications Act [TKG]), certain cookies may also be set without your prior consent. This exception applies for cookies that are technically necessary for the provision of our online offerings. These cookies are designated in the cookie banner as "Strictly necessary cookies" and described in more detail there under point 2.1. and point 3.1. of this Cookie Policy.

1.9. In some cases, providers base their activities on a legitimate interest instead of your consent for the (further) processing of data collected by means of cookies. However, this necessitates that you have previously agreed to the purpose "Save and/or retrieve information on a device" (see in detail under point 2.2. of this policy) in the cookie banner. This means that there will be no data processing based on a legitimate interest without you consenting to the saving of information on your terminal and/or to retrieve information already saved on your terminal.

Page 3 of 14 You can object at any time to a (further) processing of data collected on the basis of your consent to cookies based on a legitimate interest by setting the slide bar for "Legitimate interest" from green to red in the cookie banner under "Manage privacy settings depending on purpose" or "Manage privacy settings depending on provider" and then clicking on the "Save and close" button. In this case, your data will no longer be processed for the respective purpose or by the respective provider, unless the provider's grounds for the processing that are worthy of protection outweigh. The grounds of the provider for data processing that are worthy of protection based on a legitimate interest outweigh in particular in the case of processing for the "Special purposes" described in the cookie banner and under point 2.6. of this Cookie Policy.

You can access "Manage privacy settings depending on purpose" by first clicking on "Manage settings" in the cookie banner and then selecting one of the purposes displayed there. You can access "Manage privacy settings depending on provider" by first clicking in the cookie banner on "Manage settings" and then, after selecting one of the purposes displayed there, selecting a provider that bases its activities on a legitimate interest. Alternatively, you can call up the list of providers by first clicking in the cookie banner on "Manage settings" and then in the top right-hand corner on "Providers". By clicking on any provider from the list, you can determine for each provider for which purposes this provider is basing its activities on a legitimate interest, and if necessary object to the processing.

1.10. When obtaining your consent to cookies and the (further) processing of data collected on the basis of your consent to cookies based on a legitimate interest, we abide by the so-called "Transparency and Consent Framework" of the Interactive Advertising Bureau Europe (hereinafter referred to in brief as "IAB Europe"). This is a voluntary self-commitment by the international advertising industry with the goal of ensuring that the decision taken by a user with regard to cookies (full consent to cookies – consent only for certain purposes and/or providers – no consent to cookies) is also consistently adhered to across various digital platforms. Further information on the Transparency and Consent Framework can be found on the website of IAB Europe under: https://iabeurope.eu/transparency-consent-framework/.

1.11. Under point 2. of this Cookie Policy, the purposes for which we and third-party providers wish to use cookies are described in more detail, in addition to the depiction in the cookie banner.

2. For what purposes are cookies set? 2.1. Strictly necessary cookies

These cookies are technically necessary so that you as the user can use our online offerings and their central functionalities. This can relate e.g. to the saving of your language settings. As a general rule, strictly necessary cookies cannot be deactivated. However, certain browsers may block these cookies or suggest this to the user. Please note that the blocking of these cookies may impair our online offerings or occasionally make them impossible.

If you click on "Manage settings" in the cookie banner, you will find these cookies under the purpose "Strictly necessary cookies". There you can see in detail which providers set this type of cookies.

2.2. Save/Retrieve information on terminals

Data processing for the purposes listed in points 2.3. to 2.6. below and in the cookie banner are usually based on it being possible to save cookies, device identifiers or other information on your terminal or it being possible to retrieve cookies, device identifiers or other information already stored on your terminal. This requires your prior consent.

If you click on "Manage settings" in the cookie banner, you will find this purpose defined as "Save and/or retrieve information on a terminal". There you can see in detail which providers are requesting your consent for this purpose.

2.3. Functional cookies

These cookies facilitate an improved user experience through an enhanced scope of functions such as the possibility of selecting personal settings or using certain additional services. If these cookies are deactivated, some or all of these functions may be impaired.

If you click on "Manage settings" in the cookie banner, you will find these Cookies under the purpose "Functional". There you can see in detail which providers are requesting your consent for this purpose and which providers, if applicable, are basing their request on a legitimate interest for the processing of your data for this purpose. You can object to the processing of your data based on a legitimate interest (for further details on this see above under point 1.9.).

2.4. Performance or web analysis cookies

These cookies are used in order to measure and analyse the range and performance of our websites. Via these cookies, we receive information about the number of users of our websites or the number of page views. In

Page 5 of 14 addition, these cookies collect information about the usage habits of the users. Such information can e.g. be at what time there are most accesses or which (sub-)pages are visited most frequently. This information is summarised and analysed by means of performance and/or web analysis tools, with the purpose of being able to gain insights about the usage, functionality and user-friendliness of our websites and to develop them further on a continuous basis. Currently, no advertising is displayed on our websites. If we should publish web content on our websites in future, performance and web analysis cookies also provide information about the interaction of the users with this advertising content.

As a fundamental rule, performance and web analysis cookies are thus used to improve the quality of our websites. No connection to the individual user during this process is desired or intended.

If you click in the cookie banner on "Manage settings", you will find these cookies under the purposes listed below and described in more detail in the following:

• Measure ad performance

The performance and efficacy of ads that you see or with which you interact can be measured. In order to measure the ad performance, providers can: o measure whether and how ads have been displayed to a user and how the latter interacted with them; o provide reports on ads, including their efficacy and performance; o provide reports on the interaction of users with ads and do so based on data that have been measured in the course of the user's interaction with this ad; o provide reports for service providers about the ads that have been displayed on their services; o measure whether an ad is displayed in an unsuitable editorial environment (in a brand-unsafe manner); o determine the percentage at which the ad could have been perceived, including the duration (opportunity for advertising perception).

• Measure content performance

The performance and efficacy of content that the user sees or with which the user interacts can be measured. In order to measure the content performance, providers can: o measure and report on how content was delivered to users and how the latter interacted with it;

Page 6 of 14 o provide reports on directly measurable or already known information of users who have interacted with the content.

• Use market research to gain insights about target groups

Market research can be used to find out more about the target groups who use the services or applications and view ads. When using market research to gain insights about target groups, providers can: o provide aggregated reports for advertisers or their representatives about the target groups who are reached by their ads and who have been gained on the basis of survey panels or similar procedures; o provide aggregated reports for service providers about the target groups who have been reached by content and/or ads on their services or have interacted with the latter and who have been determined via survey panels or similar procedures; o assign offline data to an online user for the purpose of market research in order to gain insights about target groups if providers have declared that they wish to compare and merge offline data sources.

The above and other descriptions for the said purposes can also be found in the cookie banner directly next to the respective purpose under "Further information".

By clicking on one of the said purposes in the cookie banner, you can see in detail which providers are requesting your consent for the respective purpose and which providers are basing their activities, if applicable, on a legitimate interest for the processing of your data for the respective purpose. You can object to the processing of your data based on a legitimate interest (more details above under point 1.9. of this Cookie Policy).

2.5. Product development

Data collected using cookies can also occasionally be used by us to improve our existing online offerings and/or to develop new online offerings. For example, we can improve the user-friendliness of our online offerings by carrying out texts as to how certain functionalities are used by the users, or where content should be placed so that they are found more easily by the users. For this, we use products of third-party providers in places, such as feedback tools that use cookies.

Page 7 of 14

If you click on "Manage settings" in the cookie banner, you will find these Cookies under the purpose listed below and described in more detail in the following:

• Develop and improve products

Your data may be used to improve existing systems and software and to develop new products. In order to develop and improve products, providers may: o Use information in order to improve their existing products with new functions and to develop new products; o Create new computational models and algorithms with the aid of machine learning.

The aforementioned descriptions and other descriptions for the said purpose can also be found in the cookie banner directly next to the said purpose under "Further information".

By clicking on the said purpose in the cookie banner, you can see in detail which providers are requesting your consent for this purpose and which providers may be using a legitimate interest as the basis for the processing of your data for this purpose. You can object to the processing of your data based on a legitimate interest (more details above under point 1.9. of this Cookie Policy).

2.6. Special purposes

For the purposes listed in the cookie banner and below (hereinafter referred to in brief as "special purposes"), we and the third-party providers can process your data on the basis of a legitimate interest. For this processing, we and the third-party providers put forward reasons that must be protected as a mandatory measure, which is why you may not object to this processing in the cookie banner. However, the processing of your data for a special purpose based on a legitimate interests necessitates that you have previously agreed to the purpose "Save and/or retrieve information on a device"

(see in detail under point 2.2. of this Cookie Policy) in the cookie banner. This means that there will be no data processing based on a legitimate interest without you consenting to the saving of information on your terminal and/or to retrieve information already saved on your terminal.

Special purposes are the following:

• Guarantee security, prevent fraud, eliminate faults

Your data (e.g. device characteristics, location data, etc. that are sent automatically) can be used to identify and prevent fraudulent activities and in order to ensure that systems and processes

Page 8 of 14 work properly and securely. To guarantee security, prevent fraud and eliminate errors, providers can: o ensure that data are transmitted securely; o locate and prevent harmful, fraudulent, invalid or illegal activities; o safeguard the correct and efficient operation of systems and processes - including the monitoring and improvement of system and process performance - within the framework of the permitted purposes of processing.

• Provide ads or content from a technical perspective

The user's terminal can receive and send information that is necessary so that the user can see and use content and ads. To provide information data and respond to technical enquiries, providers can: o use the IP address of a user in order to display an ad via the Internet; o respond to the interaction by a user with an ad by forwarding the user to

a target page; o use the IP address of a user to provide content via the Internet; o respond to the interaction by a user with content by forwarding the user to a target page; o use information on the device type and its possibilities to depict ads or content, e.g. in order to provide advertising media or video files in the correct size and in a format supported by the device.

2.7. Functions / Special functions

The processing of your data collected by means of cookies can incorporate certain functions that serve the purposes named above. These functions will only be used if your data may be processed for the purpose that these functions serve, i.e. you have given your consent or there is a legitimate interest (cf. in this regard in detail under point 1.3. and point 1.9. of this Cookie Policy). Consequently, a separate consent for these functions according to the Transparency and Consent Framework of the IAB Europe is not envisaged unless it involves special functions (cf. in this regard immediately below).

The following functions do not require separate consent:

• Merge with offline data sources:

Page 9 of 14 Data from your online activities can be merged with data from offline data sources. In the process, providers can: o merge data that have been collected offline with data that have been collected online in order to additionally use them for one or more processing purposes (including special purposes);

• Link various devices

For use for one or more processing purposes, it can be determined whether different devices belong to you or your household. In the process, providers can: o determine that two or more devices clearly belong to the same user or household ("deterministic identification"); o determine that two or more devices with a certain degree of probability belong to the same user or household

("probabilistic identification"); o actively poll device characteristics for probabilistic identification, provided that the user gives his/her consent to the active polling of device characteristics (see immediately below).

• Receive and use device characteristics that have been automatically sent for the identification

Your terminal can be differentiated from other terminals based on information that it sends automatically, e.g. IP address or browser type. In the process, providers can: o create an identifier using automatically transmitted device characteristics such as IP address or browser identifier; o use such an identifier in order to attempt to recognise a terminal again;

Special functions that require the separate consent from the user are:

• Use precise location data

Your precise location data can be used for one or more processing purposes ("precise location data" means that there are no restrictions with regard to the precision of the location; this can be accurate down to the last few metres). In the process, providers can: o process precise location data in order to use them for one or more processing purposes.

• Actively poll device characteristics for identification

Your terminal can be recognised via a polling of its specific features. In the process, providers can:

Page 10 of 14 o create an identifier from data that have been gained from the active polling of certain characteristics of a device (e.g. the installed fonts or the screen resolution) o use such an identifier to identify a terminal again.

These special functions are only used by us and/or third-party providers if you have given your consent to this by means of the cookie banner.

3. Which cookies are used by Druck Styria on the digital platforms and how can they be controlled?

3.1. Strictly necessary cookies

The "strictly necessary cookies" listed below are used in our online offerings. Pursuant to the valid legal situation, this is done without your consent. If you wish to reject these cookies, we recommend that you do so universally via the browser. Please note that in this case our online offerings will not be available to you, or only to a limited extent.

A cookie for the language will only be set if it is not "German".

3.2. Other categories of cookies

On our websites, all cookies described under point 2.2. to point 2.6. of this Cookie Policy can be used or data collected by cookies can be processed for all purposes explained under point 2.2. to point 2.6. if i.) you have given us your consent via the cookie banner to the use of cookies for the respective purpose, and/or ii.) the (further) processing of data collected by cookies is based on a legitimate interest and you have not objected to the processing, or the grounds for the data processing that are worthy of protection and are based on a legitimate interest outweigh (applies in particular to processing that is done for "special purposes", as described in the cookie banner and under point 2.6. of this Cookie Policy). However, the (further) processing of your data collected by cookies based on a legitimate interest requires that you have previously consented to the purpose "Save and/or retrieve information on a device" in the cookie banner. This means that there will be no data processing based on a legitimate interest without you consenting to the saving of information on your terminal and/or to the retrieval of information already saved on your terminal.

Page 11 of 14 For the placement of the cookies described under point 2.2. to point 2.6. or for the processing of the data collected by cookies for the purposes explained under point 2.2. to point 2.6., we occasionally use technical service providers ("third-party providers"). Third-party providers who set cookies on our digital platforms are specified by name in our cookie banner and can be called up individually there with just a few clicks. In the cookie banner under "Manage settings", the third-party providers are assigned to the following purposes (also specified above under 2.2. to 2.6.) in this order:

• Save and/or retrieve information on a device

• Measure ad performance

• Measure content performance

• Use market research to gain insights about target groups

• Develop and improve products

• Functional

• Guarantee security, prevent fraud, eliminate faults

• Provide ads or content from a technical perspective

The allocation to the said purposes is based on the type of cookies set by us or the third-party providers or of the group which the respective cookie belongs to. In the process, a third-party provider can belong either to only one or also several of the said purposes. An overview of the individual third-party providers and their allocation to the individual purposes can be found in the cookie banner in the tab "Providers". In the respective privacy policy of the third-party providers listed there which can be called up in the cookie banner for the respective third-party provider, you will also find information how cookies of this third-party provider can be deactivated.

3.3. Functions / Special functions

If you click in the cookie banner on "Manage settings" and scroll down the list of purposes, you can see under "Functions" for each of the functions and special functions listed under point 2.7. of this Cookie Policy which providers use the respective function or are requesting your consent for the respective special function. If a certain function or special function is not displayed, this means that the function is not used by any provider or that no provider is requesting your consent to the special function.

3.5. Information on the revocation of your consent and other control options with regard to cookies

Page 12 of 14 You can revoke consent that you have given to cookies via the data privacy symbol at the bottom on the screen of the website at any time with effect for the future.

You may change the choice you have made with regard to cookies at any time in the same form and manner (see in detail above under point 1.4., point 1.5. and point 1.7. of this Cookie Policy).

Below you will find further information on how you can control cookies, depending on which browser or operating system you use.

4. Further information on how you can control cookies

4.1. How do I manage and delete cookies in my browser?

Apart from the possibilities depicted in detail above under point 1. to 3. of revoking the consent that you have given via the cookie banner, of objecting to the (further) processing of data collected by means of cookies based on a legitimate interest or of adapting your settings with regard to the use of cookies individually, cookies can generally also be rejected or deleted by corresponding browser settings. In this case, however, it is possible that all functions of the respective digital platform can no longer be used in full.

Here you will find instructions on how you can manage and delete cookies in your browser:

Delete, activate and manage cookies in Chrome Cookie settings in Firefox Manage and delete cookies in Internet Explorer Manage cookies and other website data in Safari Manage cookies in Opera (only available in English)

4.2. How do I manage and delete cookies on Android devices?

Android standard browser (browser, Internet) Open the standard browser. Press on the menu or function key (depending on the device e.g. left-hand soft key) and click on "Settings". There you can navigate through to the "Data privacy and security" section, where you can revoke the acceptance of cookies by deactivating the corresponding checkbox. You can also delete all cookie data by clicking on the button named accordingly.

Page 13 of 14

Chrome If you use a Chrome browser on your Android smartphone, open it and click on the menu or function key (depending on the device e.g. left-hand soft key). Enter the "Settings" section there and continue to "Data privacy". Click on the button "Delete browser data" there and tick "Cookies" and "Website data".

Other browser or device models Depending on the device model or Android version, the management and the deletion of cookies may deviate slightly from the description above. Further information on this can be found here:

Manage cookies in Google Chrome for Android Manage cookies in Firefox for Android

4.3. How do I manage and delete cookies on iPhone and iPad?

In order to block the cookies permanently on your Apple iPhone or iPad, go to Settings and then to Safari. After opening this page, scroll downwards until you reach the chapter "Data privacy & security". There you have the possibility to block cookies permanently by selecting "Block cookies" > "Block cookies always".

In order to delete the cookies, click on this page on "History" and then "Delete website data".

Other browsers:

Manage cookies in Chrome for iOS (scroll downwards for iOS instructions) Manage cookies in Firefox for iOS

Further links:

www.youronlinechoices.com www.allaboutcookies.org www.meine-cookies.org

Further information, in particular on the duration of retention and your rights, can be found in our Druck Styria data privacy notice [https://printgroupstyria.com/skin/pdf/Datenschutzinformation-DruckStyria.pdf].

Page 14 of 14