Compliance at Dataflor

These compliance principles apply to all employees of DATAflor AG. This includes, in particular, managers, trainees, interns, and other individuals working on behalf of Dataflor.

We also expect our business partners to conduct themselves lawfully and with integrity. Where necessary, these principles are incorporated into legally binding agreements through appropriate contractual provisions.

All employees are required to

• comply with applicable laws and internal regulations,
• make business decisions objectively and independently,
• to refrain from corruption, bribery, and undue influence,
• disclose actual or potential conflicts of interest,
• to use company resources exclusively for lawful business purposes, and
• protect confidential information and personal data.

Managers bear a special responsibility. They must set an example through their conduct, establish clear lines of responsibility, and appropriately investigate reports of potential violations.

Gifts of money and benefits equivalent to money may neither be accepted nor offered or granted. These include, in particular, cash, gift certificates equivalent to cash, personal commissions, rebates, private loans, and other personal payments.

Other gifts or benefits must neither actually influence a business decision nor give the impression of such influence.

Occasional promotional and courtesy gifts with a gross value of up to 50 euros may be accepted or given if they

• are socially customary and appropriate,
• are given transparently,
• are not linked to any consideration,
• are not provided regularly by the same person or company, and
• are not related to an ongoing procurement, purchasing, or contractual decision.

The value limit is an internal approval threshold and not a general legal threshold of permissibility.

Gifts exceeding this threshold must be approved in advance by the responsible compliance office. Gifts that cannot be approved must be returned. If, in exceptional cases, immediate rejection is not possible, the gift must be reported without delay and kept in a secure place until a decision is made.

Appropriate business hospitality is permitted if there is a clear business reason. Invitations to recreational activities, trips, overnight stays, or events that are primarily for entertainment purposes must be approved in advance.

Gifts must never be solicited.

Particularly strict requirements apply when dealing with public officials, government agencies, public institutions, and employees of public contracting authorities.

Gifts, invitations, or other benefits may be provided in this context only if they are clearly permitted by law and have been approved in advance by the Compliance Office. Money and monetary benefits are prohibited without exception.

This also applies to indirect benefits, such as those provided through family members, associations, consultants, or other third parties.

A conflict of interest exists when personal, family, financial, or other private interests could influence a business decision.

Employees must immediately disclose any actual or potential conflict of interest to their supervisor or the compliance office. Until the matter is resolved, they may not participate in the decision in question.

This applies in particular to transactions involving

• relatives,
• life partners,
• close personal friends,
• their own companies, or
• companies over which the employee has significant influence.

Disclosure of a conflict of interest does not automatically result in a prohibition on the transaction. Dataflor establishes appropriate measures to ensure an independent and transparent decision.

Private business dealings with Dataflor’s customers, suppliers, or other business partners are generally permitted. However, employees may not accept special terms or benefits granted to them solely because of their employment with Dataflor.

Any personal investments in competitors or business partners must be disclosed if they could give rise to an actual or potential conflict of interest. Pure financial investments that do not confer any influence—in particular, broadly diversified funds or minor holdings in publicly traded companies—are generally not subject to this requirement.

Information regarding holdings of related parties need only be disclosed to the extent that the employee is aware of them and they could give rise to a specific conflict of interest.

Secondary employment must be reported before it begins if this is stipulated in the employment contract or if Dataflor’s legitimate interests may be affected.

This may be the case, in particular, if the secondary employment

• competes with Dataflor,
• may impair the performance required under the employment contract,
• violates statutory working hour requirements,
• involves company resources or confidential information, or
• leads to a conflict of interest.

A secondary employment may only be prohibited or subject to reasonable conditions for legitimate business or legal reasons.

No one may instruct, incite, or pressure employees to violate laws or these Compliance Principles.

Unlawful instructions do not have to be followed. Affected employees should immediately contact the Compliance Office or the internal reporting office.

Company funds may not be used for bribery, covert payments, personal gain, or other unlawful purposes. This applies regardless of whether the funds used are the employee’s own, Dataflor’s, or those of a third party.

Any potential personal liability is governed exclusively by the statutory provisions and the principles of labor law applicable to the specific case.

Dataflor encourages employees and others who become aware of potential violations in the course of their professional activities to report such incidents.

Reports may pertain in particular to the following matters:

• corruption or bribery,
• fraud, embezzlement, or theft,
• Violations of data protection or information security policies,
• antitrust or anti-competitive conduct,
• discrimination or significant harassment,
• Violations of occupational safety or environmental regulations, as well as
• other significant violations of laws or regulations.

The internal reporting office operates independently, impartially, and confidentially. Only knowledgeable and authorized individuals are entrusted with handling reports.

Receipt of a report is generally acknowledged within seven days. The whistleblower will receive feedback within the statutory time limits regarding planned or already implemented follow-up measures, provided that this does not interfere with internal investigations or the rights of the individuals concerned.

The identities of whistleblowers, affected individuals, and other persons named in a report are protected to the extent provided by law. Disclosure occurs only if it is permitted or required by law.

Whistleblowers may not be disadvantaged because of a report or disclosure that falls under the statutory protection provisions. This also applies to threats of or attempts at disadvantage.

A prerequisite for this protection is, in particular, that the whistleblower had sufficient reason to believe, at the time of the report, that the information reported was accurate. Intentionally false allegations will not be tolerated and may result in legal consequences.

Reports are reviewed objectively. In doing so, the principles of proportionality, confidentiality, data protection, and the presumption of innocence apply in particular. The legitimate interests of the persons affected by a report are also taken into account.

Further information on the processing of personal data can be found in the separate privacy policy for the whistleblower system:

Privacy Policy

Overall responsibility for compliance rests with the Executive Board of DATAflor AG.

Operational advice, the review of compliance issues, and the handling of reports are delegated to the designated compliance office or the internal reporting office. These offices must possess the necessary expertise and be able to perform their duties independently.

Employees are regularly informed about compliance principles, reporting channels, and measures to prevent corruption. Additional training and approval processes may be provided for areas of activity that are particularly at risk.

Violations of laws, obligations under an employment contract, or binding internal policies may result in appropriate consequences, taking into account the circumstances of each individual case.

These may include, in particular:

• organizational or procedural measures,
• measures under labor law,
• claims for damages,
• the termination of business relationships, and
• referral to the competent authorities.

Employment-related measures are taken in accordance with the statutory requirements and the principle of proportionality.

These compliance principles are reviewed on a regular basis and whenever there are significant legal or organizational changes, and are updated as needed.

Effective: July 2026