Heidelberg Materials Nederland N.V. and all its subsidiaries ("we", "Company") and our Group (HeidelbergMaterials AG) take the protection of your personal data seriously. We undertake to process your personal data in our possession in accordance with applicable laws and regulations for the protection of personal data.

Personal data is any information about an identified or identifiable person, e.g. your name, address, phone number, e-mail address, online identifier.

This document describes (i) the types of information we collect about you; (ii) where we obtain the information; (iii) how we use the information we collect about you, (iv) how long we keep your information, (v) to whom we may disclose it; and (vi) your rights in relation to the processing of your personal data.

This privacy statement applies to all personal data we collect about you when you:

- are a customer, supplier, vendor, other business or professional stakeholder You buy goods or services from us; you provide services or goods to us (for example, if you are a sole trader, partnership or if you provide services or goods on behalf of your employer/contractor);

- receive our newsletters and other promotional or marketing information;

- apply for one of our vacancies;

- visit any of our sites or buildings;

- calling or being called by our customer service centre; - using any of our websites; or

- use one of our applications.

If you have any questions, comments or requests regarding this privacy statement, please contact us at DPC-Bene@heidelbergmaterials.com.

For the purposes of this privacy statement, the controller is Heidelberg Materials Nederland N.V. , located at Pettelaarpark 30 (5216 PD) 's-Hertogenbosch, registered in the Chamber of Commerce under number 16058288.

We process personal data on the contacts of our customers, suppliers, vendors, other business or professional stakeholders (e.g. architects, entrepreneurs).

Types of personal data collected

We collect the following information:

- Identification data: Name and surname, signature, marital status (for salutation) of contacts of our customers, suppliers, vendors, other business or professional stakeholders (e.g. architects, entrepreneurs);
- Contact details: Phone number, e-mail, (physical) address (if relevant) and language of these contacts;
- Financial data: Bank details, cost centre required for billing or payments, credit status;
- Other company details: Such as company title or professional role;
- Business area of interest: HeidelbergMaterials products and services previously purchased or within the person's area of interest; and
- Opinions: on our products and services (e.g. customer surveys) to improve our customers' services and relationships.

Sources of personal data collected

We collect your personal data when you, as an individual:

- buy goods or services from us;
- provide goods or services to us;
- have been designated by your employer as our contact person for proposal submission, managing customer orders, billing or (for companies providing services to us) for managing the service relationship and paying invoices;
- complete our registration form or other submission form, or request to be added to our mailing list; or
- otherwise provide us or any of our employees with your contact details or other personal data.

Personal data may also be obtained from published sources (e.g. Chamber of Commerce to confirm signatories' powers, social media) and from our affiliates, for example.

Purposes of personal data collected

We process this personal data to what is relevant for providing or informing you about our products or services or otherwise doing business with you (e.g. buying goods or services from our suppliers).

We process your personal data in order to:

- provide our customers with our products or services To complete and fulfill orders, purchases, process payments, deliver your orders, communicate about your purchases and provide you with related customer service;
- Inform customers, potential customers and business leads about our new products, services or events Such as updates, announcements about our new products, promotions, to send you invitations to our events;
- select our suppliers (tendering process), to instruct our suppliers and service providers and compensate them for their services
- correspond with our business or professional contacts (e.g. entrepreneurs, architects, professional federations)
- respond to the queries and meet requests from our customers, business or professional contacts For example, by sending newsletters, providing targeted information on our products or services
- send administrative information Such as, for example, regarding changes to our terms and conditions or policies
- to participate in our surveys, promotions, competitions and to manage these activities
- for other business purposes Such as, for example, analysing and managing our businesses, market research, audits, developing new products, improving our services and products, determining the effectiveness of our promotional campaigns, measuring customer satisfaction and providing customer service;
- as we deem necessary or appropriate: To comply with our legal obligations (e.g. to satisfy economic and trade sanctions), to check credit status, to respond to requests from public and governmental authorities, to enforce our terms and conditions, to protect our business or that of any of our affiliates, to protect our rights, privacy, security or property and/or that of our affiliates, you or others, and to enable us to pursue available remedies or mitigate any damages we may incur.

The above processing activities are necessary to (i) enter into a contract with you; (ii) perform a contract with you (to receive services or products from us or from you); (iii) serve our legitimate business interests (e.g. by providing you with more information about our services and products, measure customer satisfaction, improve our products and services); or (iv) comply with our legal obligations.

If you do not want to provide us with your personal data and it is necessary to (i) enter into a contract with you; (ii) perform a contract with you; (iii) provide you with more information about our services and products or otherwise do business with you; or (iv) comply with our legal obligations, then we will not be able to enter into a contract with you, provide you with the requested information, services or products, or receive from you the requested information, services or products, or do business with you.

How long do we keep your personal data?

We will retain your personal data for the period necessary to achieve the purposes listed above:

- as long as you remain a customer, service provider, company or professional stakeholder; or
- as long as the statutory limitation period to bring a claim or legal action; or
- for a longer retention period if required or permitted by law (e.g. health and safety legislation, in case of a dispute).

If you are a customer, a prospect or a business lead (e.g. architects, entrepreneurs), we use your personal data to provide you with a better customer experience or to keep you informed about our products and services.

Types of personal data collected

We collect the following types of information:

- Your basic identification and contact details: Your first and last name, your company name, role/function, phone number, e-mail address, professional address, language;

- Information about your customer relationship with us: We collect personal data when you purchase our products and services, such as your previous purchases, product preferences, information about our events you have participated in and feedback you have given us;

Sources of personal data collected

We collect the information directly from you when you use our services or buy our products, or when you register for one of our events.

Purposes of personal data collected

We use your personal data to provide you with information about our products and services, our promotions and events that we think may interest you. We will provide you with our newsletters and promotional or marketing information by post or e-mail.

If you are a customer, we consider you to have legitimate business interests in providing you with certain marketing information about our products and services, our promotions and events that we think may interest you.

If you are a prospect or a business lead, we will provide you with certain marketing information about our products and services, our promotions and events once we have obtained your consent (opt-in).

You can easily withdraw your consent or unsubscribe from our e-marketing messages by clicking the "unsubscribe" link at the bottom of each marketing e-mail.

You can also unsubscribe (opt-out) from our newsletters sent by post by contacting us at marketing@heidelbergmaterials.com.

How long do we keep your personal data?

We will retain your personal data to provide you with our newsletters and other promotional or marketing information for as long as you wish to receive this information from us. If you decide to unsubscribe or withdraw your consent to our newsletters and other promotional or marketing information, we will no longer use your personal data for this purpose. However, we may need to keep your personal data for another purpose (for example, to carry out our customer relationship).

Types of personal data collected

When you apply for one of our vacancies, we process some personal data about you that is necessary to process your application. This includes:

- Your name, address and contact details, including e-mail address and phone number;
- Details about your education or qualifications, (soft and hard) skills and personality, experience and employment history;
- Information about your current salary and any applicable benefit rights;
- Copy of driving licence for specific positions requiring such information (e.g. truck driver positions); and
- Information on your right to work in the Netherlands.

Sources of personal data collected

We may collect this information in various ways. The personal data we process is mainly provided to us directly by you through your application, CVs or resume, or collected through interviews or other forms of assessment.

In some cases, we may collect your personal data from other sources, such as references from previous employers, recruitment agencies, government agencies, schools, publicly available information sources such as the internet or public social media profiles.

Purposes of personal data collected

We process your personal data:

- To take action on your requests regarding your application, or to enter into a contract with you if you are a successful applicant;
- To meet our legal obligations, e.g. to verify a successful applicant's eligibility to work in the Netherlands, to comply with economic and trade sanctions legislation;
- To process it based on our legitimate business interests, for example, to assess and confirm a candidate's suitability for a job and to keep track of it; to decide to whom a job is offered or to respond to and defend against legal claims; to monitor recruitment statistics: for example, the effectiveness of our recruitment process; or
- Where we have obtained your consent, i.e. where we retain an application from an unsuccessful candidate who is nevertheless considered an interesting prospect for future vacancies, or where relevant to contact previous employers for reference checks.

If you do not provide us with your personal data to process your application, we cannot (i) process your application, (ii) contract for successful applicants, (iii) fulfil our legal obligations or (iv) serve our legitimate business interests.

How long do we keep your personal data?

If your application is not successful, we will keep your personal data for 3 months after the end of the recruitment process in order to defend ourselves against legal claims.

We will also ask you if you agree to us keeping your personal data on file for further employment opportunities. In such a case, we will keep your data for this purpose for a period of 12 months after the end of the recruitment process.

At the end of that period or if you withdraw your consent for other vacancies, your personal data will be deleted.

If your application is successful, personal data collected during the recruitment process will be transferred to your personnel file (electronic and hard copy) and kept during your employment. The periods during which your data will be kept will be provided to you in the internal privacy statement (for employees).

Types of personal data collected

CCTV and other image capture/recording devices

CCTV and other image capture/recording devices are used at our sites and locations. Therefore, your image may be captured when you visit any of our sites or buildings. The CCTV and other image capture/recording devices are indicated by an icon or symbol at various entrances to the sites and buildings.

Reception

At the reception desk in our premises, we collect first name, last name, company name, car number plate, time in and out, host name, signature and date of visit of our visitors.

Employees of companies or contractors who have access to our sites to carry out work

We also collect personal data from employees or contractors of the companies working on our sites: first name and surname, company he/she works for, role or function, phone number, department or site to access.

Purposes of personal data collected

Personal data is collected for the following purposes:

- To fulfil our contractual obligations with our service providers and contractors;
- To ensure compliance with our legal obligations (e.g. legal health and safety obligations) (e.g. intervene in the event of occupational or third-party accidents on sites or premises, manage and investigate such accidents, report such accidents to insurance companies and other relevant third parties) towards our employees, contractors, service providers and visitors who have access to our sites and premises;
- to serve our legitimate business interests to ensure the security of our sites and buildings and to control the production process on our machines.

Specific safety measures

Images captured on CCTV and other image capture/recording devices are safely secured against tampering and other forms of unlawful processing. Only a very limited number of people have access to those images.

How long do we keep your personal data?

We will retain your personal data for as long as necessary for the purposes set out above. In particular, images captured on CCTV and other image capture/recording devices are kept for up to 4 weeks after the visit, unless we need to keep them for a longer period (for example, if the recorded images show potential criminal activity or incidents).

Phone calls to and from our customer service centre (i.e. order intake and shipping service) are recorded in accordance with applicable laws to document commercial transactions (i.e. taking, monitoring and verifying your orders and deliveries, as well as orders we place with our suppliers and contractors for pump and truck-related services) and for training and improving the quality of our customer service centre.

Order Intake and Dispatch Service recorded phone lines and related emails are as follows.

Types of personal data collected

During the interviews, we collect the following information:

- about our customers: first and last name, mobile or fixed telephone number, office address, contact details of contact person, name of employer, VAT number, product choices, place and time of delivery;
- About our suppliers and contractors: first and last name, mobile or fixed telephone number, office address, contact details of the contact person, name of the employer, VAT number.

We do not record personal data that is not required to process and manage orders and deliveries from our customers or to process and manage orders placed with our suppliers or contractors for pump and truck-related services. We do not record sensitive personal data or critical personal data such as financial data.

Sources of personal data collected

Personal data relating to orders and deliveries are collected directly from you during conversations with our customer service centre.

Purposes of personal data collected

We record telephone calls from (outgoing calls) or to (incoming calls) our Order Intake & Dispatch Service in accordance with applicable law:

- To record our commercial transactions with our customers, suppliers and contractors; and

- for training our employees in our customer service centre and improving the quality of our customer service centre.

For incoming calls to our Order Intake & Dispatch Service, a specific beep and information message are played at the beginning of the call to inform call participants of the registration, its purposes and how to access this privacy statement. A customer, supplier or contractor may also contact our Order Intake & Dispatch Service via e-mail (see table above).

Specific safety measures

The call recordings are only accessible on a need-to-know basis for i) taking and processing orders and deliveries, as well as managing accounts with our customers, suppliers and contractors; and ii) for training our employees in our customer service centre and improving the quality of our customer service centre. The servers are located within the European Economic Area and access to the recordings is monitored via a security log.

How long do we keep your personal data?

For the purpose of recording commercial transactions, call recordings are kept for as long as commercial transactions can be challenged in court (i.e. 5 years for the liability established by the Civil Code), unless required or allowed to be kept longer (e.g. in case of a dispute, investigation).

Call recordings will not be used for training purposes 1 month after the recording is made.

When you visit any of our websites such as www.heidelbergmaterials-benelux.com ("Websites"), the personal information we collect falls into two categories: i) personal information you voluntarily provide to us; and ii) personal information collected through automated means such as cookies.

Personal information voluntarily provided by you when visiting one of our websites

We automatically collect and store information sent to us by your browser in server log files. This includes:

- browser type/version

- operating system used

- referring URL (the previously visited site)

- host name of the computer accessing the site (IP address)

- time of the server request

We cannot attribute this data to specific individuals. These data are not merged with other data sources. Moreover, the data will be deleted after statistical analysis. Additional personal data such as your name, address, telephone number or e-mail address will not be collected unless this data is voluntarily provided by you, for example in the context of a registration, survey, competition, performance of a contract or request for information.

Personal information collected through automated means such as cookies

Some web pages use so-called cookies. Their purpose is to make our internet presence more user-friendly, effective and secure. Cookies are small text files that are stored on your computer and saved by your browser. Most of the cookies we use are 'session cookies'. They are automatically deleted at the end of your visit. Cookies do not harm your computer and do not contain viruses. If you do not want cookies to be stored on your hard disk, you can adjust your browser settings accordingly.

Personal information collected by Google Analytics

This website uses Google Analytics, a web analytics service provided by Google, Inc ("Google"). Google Analytics uses "cookies", which are text files placed on your computer, to help the website analyse how users use the site. The information generated by the cookie about your use of the website (including your IP address) will be transmitted to and stored by Google on servers in the United States. If IP anonymisation is activated, Google will truncate/anonymise the last octet of the IP address for Member States of the European Union and for other parties to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be sent to and truncated by Google servers in the US. On behalf of the website provider, Google will use this information to evaluate your use of the website, compiling reports on website activity for website operators and providing other services relating to website activity and internet usage to the website provider. Google will not associate your IP address with any other data held by Google. You can refuse the use of cookies by selecting the appropriate settings in your browser. However, please note that if you do so, you may not be able to use the full functionality of this website. In addition, you can prevent Google from collecting and using data (cookies and IP address) by downloading and installing the browser plug-in available at https://tools.google.com/dlpage/gaoptout?hl=en-GB.

You can refuse the use of Google Analytics by using a switch. An opt-out cookie is placed on your computer, which prevents the future collection of your data when you visit this website.

(Click on the link below and go to the "Third-party cookies" section to change your current status)

https://heidelbergmaterials-benelux.com/nl/cookieverklaring

More information on terms of use and data protection can be found at http://www.google.com/analytics/terms/gb.html or at https:// www.google.de/intl/en_uk/policies/. Please note that on this website, the Google Analytics code is supplemented with "anonymizeIp" to ensure an anonymised collection of IP addresses (so-called IP masking).

etracker

Heidelberg Materials uses the services of etracker GmbH, Hamburg, Germany (www.etracker.com) to analyse usage data. We do not use cookies for web analysis by default, but for application of analysis and optimisation cookies we always ask for your express prior consent. If you consent, cookies are used to enable statistical analysis of the reach of this website and measurement of the success of our online marketing measures and testing procedures, for example to test and optimise different versions of our online offer or certain aspects of it. Cookies are small text files stored by the internet browser on the user's device. Etracker's cookies do not contain any information that identifies a user. The data generated by etracker on behalf of Heidelberg Materials are processed and stored by etracker exclusively in Germany on behalf of Heidelberg Materials and are therefore subject to strict German and European data protection laws and standards. In this regard, etracker has been independently audited, certified and awarded the ePrivacyseal-seal of approval for data protection.

The processing of personal data is based on Art. 6(1)(f) (legitimate interest) of the General Data Protection Regulation (GDPR). Our legitimate interest is the optimisation of our online offer and our website. As the privacy of our visitors is very important to us, any data that might allow reference to an individual person, such as IP addresses, registration or device IDs, is anonymised or pseudonymised as soon as possible. Etracker does not use the data for other purposes, does not combine it with other data and does not pass it on to third parties.

We collect personal information about you when you use our Track & Trace application.

The purpose of our Track &Trace application is to enable our customers to track their orders and deliveries.

Types of personal data collected

To use our Track &; Trace application, we need to collect the following personal data about you: your name and surname, mobile phone number, e-mail address and the company name you work for.

Sources of personal data collected

This information comes from you when you register for the application or from our customer service when you ask your account manager to create the registration for you.

Purposes of personal data collected

We collect this information for the following purposes:

- To create the account of the user who wishes to register for our Track &Trace application to track his/her orders and deliveries; and
- To verify the user's account as one of our customers.

How long do we keep your personal data?

Personal data is kept as long as the user is actively using the application. Customer data is updated when you communicate changes to your account manager or sales manager contact.

To the extent permitted by applicable law and in accordance with this privacy statement, we may disclose your personal data:

- within the HeidelbergMaterials Group or to other affiliated companies, for purposes consistent with this privacy statement. We take precautions to limit access to your personal data only to those personnel who have a legitimate business need to access it in accordance with the privacy statement;

- to our third-party service providers, such as payment or billing processing, IT services, website hosting, order fulfillment, infrastructure provision, security, audit services and other services, to enable them to provide their services;

- to an authorised law enforcement agency, regulatory, government agency, court or other third party, such as, but not limited to, police authorities, tax authorities, social security authorities, when such transfer is necessary (i) as a matter of applicable law or regulation, (ii) to exercise, establish or defend our legal rights, (iii) to protect your vital interests or those of another individual, or (iv) based on a court order;

- to our auditors, consultants, legal representatives and similar agents in connection with advisory services they provide to us for legitimate purposes and in accordance with the purposes described in this privacy statement;

- In the event that we, or part of our assets, are acquired, we may share all types of personal data with the acquiring company.

We take technical and organisational measures to adequately protect your personal data and maintain its quality. We continuously make improvements to this protection in line with technical progress. We use a range of physical, electronic and administrative measures to ensure that we keep your personal data safe.

We do not disclose your personal data to third parties outside the EEA (European Economic Area) other than within the HeidelbergMaterials Group or other affiliates (see the section on How may we disclose your personal data above), except in the following cases:

- You have expressly consented to the transfer;

- The transfer is necessary for the performance of a contract between you and us or the implementation of pre-contractual measures taken at your request;

- The transfer is necessary for the conclusion or performance of a contract concluded in your interest between us and another natural or legal person;

- The transfer is necessary for important public interest reasons;

- The transfer is necessary for the establishment, exercise or defence of legal claims;

- The transfer is necessary to protect your vital interests or those of other persons when the data subject is physically or legally incapable of giving consent;

- When using standard clauses of the EU model; or

- If authorised by the data protection authority.

You have a number of rights under applicable data protection legislation.

- You have the right to be informed about how we process your personal data. This is the purpose of this privacy statement.
- You have the right to access your personal data, view your personal data and ask to be corrected or updated.
- You have the right to ask us to delete your personal data, object to or restrict its processing, or request its portability.
- You have the right not to be subjected to a decision based solely on an automated process, including profiling, that has legal consequences for you or affects you significantly in a similar way.
- You have the right to withdraw your consent at any time where we rely on it to use your personal data (for example, to provide you (as a prospect or business lead) with certain marketing information about our services or goods).

The above rights may be subject to some legal conditions. To exercise any of your above rights, or if you have any questions about this privacy statement, please write to us at this email address: DPC-Bene@heidelbergmaterials.com.

We will take all reasonable steps to respond to your request in accordance with applicable data protection laws. When you exercise any of the above rights, we will ask you to provide us with a copy of a valid proof of identity (e.g. your ID card) to authenticate you.

You can also use the contact details above if you have any concerns or wish to make a complaint to us regarding the way we process your personal data.

You also have the right to lodge a complaint with your local data protection authority in your jurisdiction. In the Netherlands, this is the Personal Data Authority.

We may update this privacy statement from time to time. To let you know when we make changes to this privacy statement, we will change the revision date at the top of the page. The new amended or modified privacy statement will apply from the revision date. We therefore encourage you to review this privacy statement regularly to stay informed about how we are protecting your personal information.

Our websites may contain hyperlinks to websites owned and operated by other HeidelbergMaterials Group entities or third parties. They are not provided by us. Such websites, as well as other websites that may be linked to our websites, are not covered by this privacy statement. They have their own privacy statements. We therefore encourage visitors to read such privacy statements on each of these other websites before disclosing personal information. We do not accept any responsibility or liability for these other websites and the respective privacy practices of third-party websites and your use of such websites is at your own risk.

If you have any questions, comments or requests, please contact us at hDPC-Bene@heidelbergmaterials.com.