Information Sheet: Privacy policy AGM

Data processing information pursuant to Art. 13 GDPR

Annual general meeting

1. Scope and purpose

AGRANA Beteiligungs-AG processes personal data in a trustworthy and responsible manner.

This also applies to personal data of shareholders, especially those pursuant to § 10a II of the AktG (Austrian Stock Corporations Act), on the basis of the applicable data protection laws and the Austrian Stock Corporations Act, in order to enable the shareholders to exercise their rights at the Annual General Meeting.

This information sheet on the processing of shareholder data serves to inform the shareholders of AGRANA Beteiligungs-AG about the processing of their personal data and their rights in this regard in accordance with the EU General Data Protection Regulation (GDPR).

2. What information about shareholders does AGRANA Beteiligungs-AG process in the course of the General Meeting, and how are these data collected?

In the context of confirmation of shareholder status, AGRANA Beteiligungs-AG processes personal data of its shareholders.

In particular, these are the data generated or provided, respectively, by the shareholders themselves or by third parties.

In particular, the following shareholder data are processed:

• Personal data; in particular title, name, gender, birthday, place of residence, etc.
• (if applicable) title, name, place of residence of the authorized representative, etc.
• Credentials and authentication data; in particular ID copies, ID data, photo, number of the securities account, number of shares of the shareholder, if applicable share class, number of the voting card, etc.

If shareholders and/or their authorized representatives do not provide the data or do not provide it to the required extent, they will not be able to participate in the Annual General Meeting.

3. For what purpose will shareholder data be processed in the context of the General Meeting?

Shareholder data are processed by AGRANA Beteiligungs-AG in accordance with the applicable data protection laws for the purpose of fulfilling legal obligations.

In particular, shareholder data are processed for the following purposes:

1. Organization of General Meetings
2. Participation of shareholders and their representatives in General Meetings

1

1. For the exercise of the shareholders' rights during General Meetings
2. Determination of the voting activities
3. Creation of a registration list
4. Creation of a list of participants
5. Creation of a list of proxies
6. Creation of minutes of the General Meeting
7. Fulfilment of compliance obligations including documentation, information and reporting obligations

In the context of these purposes a-i, AGRANA Beteiligungs-AG processes shareholder data, as a matter of principle, in order to fulfill legal obligations (Art. 6 I lit. c of the GDPR or Art. 9 II lit. b of the GDPR, respectively). Within the scope of purpose i, shareholder data is also processed to safeguard the legitimate interests of the company or a third party (Art. 6 (1) lit. f DSGVO). The legitimate interest is to ensure a legally compliant and effective conduct of general meetings. In addition, processing of shareholder data may be required in individual cases in order to assert, exercise, or defend legal claims and/or rights in judicial, administrative, or extrajudicial proceedings (Art. 9 II lit. f of the GDPR).

4. Which functions are shareholder data transmitted to?

At AGRANA Beteiligungs-AG, only those functions or employees receive personal data that need the same in order to fulfill their duties in the context of contractual and legal obligations as well as legitimate interests. Beyond this, shareholder information will not be disclosed or transmitted within AGRANA Beteiligungs-AG.

In fulfillment of our legal obligations, AGRANA Beteiligungs-AG also discloses personal data of shareholders to public authorities (Commercial Register Court [Firmenbuchgericht], Vienna Stock Exchange, Austrian Financial Market Authority, Austrian Kontrollbank). Beyond our statutory obligations, such as at the General Meeting and in the Commercial Register, etc., no shareholder information is disclosed to public authorities.

In addition, service providers (in particular the notary public, IT and back-office service providers, service providers specialised in the organisation of the Annual General Meeting) commissioned by AGRANA Beteiligungs-AG will receive shareholder data if and insofar as they need these data to fulfill the purpose. All service providers are obliged to treat the transmitted data confidentially and to process them only in the context of service provision. Where necessary, data processing contracts have been concluded with the service providers.

If a shareholder requests that items be added to the agenda or if a shareholder proposes resolutions, personal data (such as name) will be published on the website https://www.agrana.com/en/ir/general-meeting - to the extent required by law.

No transfer of shareholder data to recipients in third countries - i.e. countries outside the EU or the EEA - takes place. If, in exceptional cases, such a transfer is nevertheless intended, the affected shareholders will be informed separately.

2

5. How long will the shareholder data remain stored?

With regard to the storage period the statutory limitation periods, in particular those under the Austrian General Civil Code (ABGB), which may in certain cases amount to up to 30 years (the general limitation period being 3 years), are to be considered.

For more information on the storage period of personal data at AGRANA Beteiligungs-AG, the Compliance Office is available to shareholders for information.

6. What rights do shareholders have with regard to their personal data?

In accordance with the provisions of Articles 15 to 22 of the GDPR and the conditions laid down therein, shareholders of AGRANA Beteiligungs-AG have the following rights:

• To obtain information about their personal data processed, and to receive a copy of the stored data ("right to be informed");
• to demand correction or completion, respectively, of incorrect or incomplete personal data ("right to rectification");
• to demand deletion of the personal data concerning them, if the processing infringes the GDPR, in particular because the shareholder revokes a consent or has legitimately objected ("right to erasure", aka. "right to be forgotten");
• to demand restriction of the processing of their data, and to object to certain forms of processing ("right to restriction of processing" and "right to object"); and
• to obtain their data in a structured, commonly used and machine-readable format, and to transfer those data to another processor ("right to data portability").

Shareholders are not subject to any decision-making based solely on automated processing, including profiling, which would have a legal effect on them or significantly affect them in any similar manner.

3

AGRANA Beteiligungs-AG is the data controller according to GDPR. In case of any questions or in order to assert these rights, please contact:

AGRANA Beteiligungs-AG Compliance Office Friedrich-Wilhelm-Raiffeisen-Platz 1 A-1020 Vienna (Wien)

[phone]

Email: [e-mail]

Furthermore, any shareholder may address his/her complaint to the Austrian Data Privacy Authority:

Austrian Data Protection Authority (Österreichische Datenschutzbehörde) Barichgasse 40-42

A-1030 Vienna Phone: [phone] Email: [e-mail]

In case of inquiries, AGRANA Beteiligungs-AG may request additional information for confirmation of your identity. This is to protect your rights and privacy.

Further information can be found at www.agrana.com/gdpr/en.

4