We are committed to complying with and monitoring our human rights and environmental due diligence obligations in accordance with Section 6 (2) of the German Supply Chain Due Diligence Act (LkSG)

In implementing our human rights and environmental strategy, we align our business activities primarily with the globally recognised United Nations Guiding Principles on Business and Human Rights (UNGP) and the OECD Guidelines for Multinational Enterprises. We therefore also implement the requirements of the National Action Plan for Business and Human Rights. These standards help companies to determine and continuously improve their approach to human rights. They emphasise the importance of a due diligence process that proactively identifies, assesses and avoids or at least minimises potential human rights or environmental abuses in order to protect rights holders.

In addition, our understanding and processes for respecting human rights and the environment are based on the following international reference instruments:

• the United Nations Universal Declaration of Human Rights,
• the principles of the United Nations Global Compact (UNGC),
• the Organisation for Economic Co-operation and Development (OECD) Guidelines for Multinational Enterprises,
• the core labour standards of the International Labour Organisation (ILO) on labour and social standards,
• the Charter of Fundamental Rights of the European Union,
• the Diversity Charter,
• the UN Convention on the Rights of the Child,
• the European Convention for the Protection of Human Rights and Fundamental Freedoms,
• the REACH Regulation, RoHS Directive and POP Regulation, and
• the Stockholm Convention on Persistent Organic Pollutants (POPs Convention).

Respect for human rights, labour and social standards and environmental protection are a key component of responsible and sustainable corporate governance at q.beyond.

We respect internationally recognised human rights and work to ensure that these are observed in our business activities, including the value chains, in particular

• the ban on child labour and forced labour,
• the prohibition of all forms of slavery and discrimination,
• the strengthening of freedom of association,
• mutual respect, regardless of age, disability, religion, social background, ethnic or cultural diversity, gender or sexual orientation and identity,
• compliance with occupational health and safety regulations,
• the payment of appropriate wages,
• compliance with data protection and privacy,
• the prohibition of corruption and bribery, and
• the ban on environmental pollution.

We are aware that every activity along our value chain can have a positive or negative impact on the environment and society. With this in mind, we focus our sustainability management on areas of activity in which our business model is particularly effective and efficient in generating additional environmental and social benefits. As an IT service provider, we support our customers in achieving sustainability goals in addition to their digitalisation goals. Our solutions are therefore the contemporary answer to current economic, ecological and social challenges.

At the heart of the sustainability process is the materiality analysis of sustainability issues, taking into account the perspective of relevant stakeholders, which we describe in detail in our sustainability reporting. In the materiality process, sustainability aspects are assessed according to the strength of their positive or (potentially) negative economic, environmental and social impact in the context of our business activities (impact materiality) and set in relation to the associated opportunities or risks for the company's business performance and financial position (financial materiality).

In section 2.1 "Environmental, social and societal challenges" of our declaration of principles, we have described the material human rights and environmental risks and opportunities within our own business operations and in relation to our supply chains that were identified as part of our materiality analysis.

• Declaration of principle

We expect our employees to comply with applicable laws and regulations and to take into account the principles and legal positions set out in the international standards mentioned in our declaration of principles in their daily work. Under the title "Strong principles and a fair culture", our Code of Conduct therefore summarises all rules of conduct, guidelines and compliance principles for the business activities of q.beyond AG and offers our employees guidance in their daily decisions. We have also established these principles in our corporate guidelines and in our management systems, which anchor sustainable management and behaviour in our corporate processes. These include, for example, the following:

• Quality management system (in accordance with ISO 9001) and management systems for data protection and information security (in accordance with ISO 27001),
• Emergency management (in accordance with the principles of standard 100-4 of the German Federal Office for Information Security and ISO standard 22301:2012) and our service-related internal control system to prevent damage to our customers (in accordance with ISAE 3402),
• Energy efficiency management (in accordance with EDI-G and DIN EN 16247-1), TÜV-certified data centres (high availability level 3 and energy efficiency class A, Trusted Site Infrastructure TSI V4.3 Level 3 [extended]),
• Systems for compliance, process management, IT service management, risk and occupational safety management and personnel development, as well as
• Purchasing guidelines.

We also expect our business partners who are directly or indirectly involved in our value creation processes for the provision of our services to commit to complying with the principles we consider important and to implement appropriate processes to respect human rights and protect the environment.

We have summarised our requirements on the subject of "human rights" and "environmental protection" in our Supplier Code of Conduct and made it part of our general purchasing processes. We also expect our business partners to pass on our requirements and expectations to subcontractors involved in the provision of their services. We reserve the right to review implementation in individual cases.

• Code Of Conduct
• Code of Conduct for Business Partners

In our risk management process, which has been established for many years, we also continuously identify, analyse and evaluate all risks relating to respect for human rights and the environment within our own business area and with our business partners:

Abstract risk analysis:
When analysing risks within the q.beyond Group's own business division, gross and net risks are assessed. In contrast to gross risks, net risks already take into account the effects of all established controls and measures implemented to deal with the identified risk. The assessment of net risks is based in particular on the factors of probability of occurrence and extent of damage.

We use a risk analysis tool to analyse risks relating to suppliers. This tool automatically assesses the country/location and industry-specific risk of suppliers.

In addition to this abstract risk analysis, the fulfilment of internally defined requirements/criteria such as the signing of the Supplier Code of Conduct and compliance with the Minimum Wage Act (MiLoG) are also included in the risk assessment. Taking into account the risk values of the individual suppliers, a decision is made on any preventive measures to be taken.

Ad hoc risk assessments:
Independently of this, we also carry out ad hoc risk assessments at suppliers.

We respond to risks that have become known by introducing suitable and appropriate measures to prevent and/or counteract the risks. In the coming years, we will continue to expand our risk management in order to continuously improve our understanding of specific human rights and environmental risks in our business area and our supply chains.

In section 2.1 "Environmental, social and societal challenges" of our policy statement, we have described the risks and opportunities that we have identified as significant within our own business division and in relation to our supply chains as part of our risk analyses.

• Declaration of principle

The risk analysis forms the basis for identifying appropriate preventive and corrective measures. We incorporate the results of our risk analyses into relevant business processes and our supplier assessment process. We recognise that comprehensive protection of human rights can only be guaranteed if human rights risks of any kind are not only tracked, but also avoided before they arise through preventative measures.

We have already implemented the following measures in particular, depending on the risks: In addition to the publication of the declaration of principles and the compliance principles (Code of Conduct), which are mandatory for all employees, other company guidelines accompany our actions and provide our employees with process reliability and guidance in their day-to-day work. These include guidelines on the topics of "Information security and data protection", "Purchasing" and "Hospitality". In-depth knowledge transfer and sensitisation of our workforce, particularly on the topics of human rights, climate and environmental protection, information security and data protection, occupational safety and unconscious bias, is carried out through training courses, among other things.

Furthermore, our company has a works council and involves this body in all personnel and co-determination matters at an early stage. In addition, the youth and trainee representatives, the representatives for severely disabled employees and the employee representatives on the Supervisory Board ensure that employee interests are protected.

Before entering into a supplier relationship, our direct suppliers undergo an evaluation process that includes an initial assessment of risks relating to human rights and the environment.

If a specific risk situation requires it, preventive measures are introduced on a case-by-case basis. Such preventive measures include, in particular, the agreement of appropriate contractual control mechanisms and the contractual assurance of a direct supplier that it will obtain the human rights and environmental expectations demanded by the company's management and address them appropriately along the supply chain.

If there is a reasonable suspicion or an actual or imminent violation that our business activities are causing or contributing to human rights and/or environmental violations, we will review the complaints made and take appropriate remedial action to prevent, end or minimise the extent of the violation.

If there is reasonable suspicion or a concrete indication within the q.beyond Group, we will take immediate action to prevent further abuses and put a lasting end to them.

We expect our direct suppliers to cooperate fully in clarifying, ending or minimising possible human rights and environmental due diligence violations. It is our principle to enter into a dialogue with the supplier as a first step in order to achieve an effective solution to the problem. If the dialogue with our supplier does not lead to a result, we strive to cooperate with other affected companies, industry associations and sector and multi-stakeholder initiatives in order to develop and initiate suitable remedial measures. However, we reserve the right to terminate the business relationship if the remedial measures agreed with the supplier are not implemented (in a timely manner) or if milder measures have not led to the termination or minimisation of the breach of due diligence.