1. Responsible person within the meaning of the GDPR

NEXX Capital GmbH
Westend Tower
Grüneburgweg 58–62
60322 Frankfurt am Main
Germany
Phone +49 (69) 66 77 417-0
E-Mail: info@nexx-capital.com
Webseite: www.nexx-capital.com
Represented by the Managing Directors: Florian Wiemken, Dominik Schwarz, Hans J. Moock

2. Data Protection Officer

NEXX Capital GmbH has appointed an external data protection officer who can be contacted at the following address:

Mr. Arnd Harnischmacher
Phone +49 (6172) 68 43 291
E-Mail: datenschutz@nexx-capital.com

3. General information on data processing

Legal basis for processing:

– Art. 6 para. 1 lit. b GDPR: Performance of a contract or pre-contractual measures

– Art. 6 para. 1 lit. c GDPR: Compliance with legal obligations

– Art. 6 para. 1 lit. f GDPR: Legitimate interest (e.g., security, internal administration)

– Art. 6 para. 1 lit. a GDPR: Consent (only if expressly given)

Personal data is only collected if you provide it to us voluntarily, for example when applying for a job (Article 88 GDPR), contacting us, or for the purpose of executing a contract (Article 6(b) GDPR). The following data is collected in this context

• Your name,

• Your company,

• The country

• Your phone number

• Your email address

• Subject and reason for contacting us

If you send us documents when contacting us, we will also collect the data that is transmitted in addition to the above-mentioned data. Your data will be processed within the Federal Republic of Germany or in a country with an adequate level of data protection (Article 45(1)). If it is necessary to transfer personal data to a third country, this will generally be done in accordance with an adequacy decision pursuant to Article 45 GDPR or the provision of appropriate safeguards pursuant to Article 46 GDPR.

The personal data collected on the websites will only be processed or used without your consent for the purposes of establishing contact, initiating business within the meaning of Article 6(b) GDPR, applying for a job within the meaning of Article 88 GDPR and associated national legislation and any resulting contracts, as well as for processing your inquiries (Article 6(b) GDPR) . If it is necessary to transfer the data to third parties for this purpose, your data will be transferred to these third parties or this data will already have been collected by the third parties on the website.

For the purposes of advertising and market research, as well as for the needs-based design of electronic services (Article 6(f) GDPR), we will only process or use data that we have collected and stored about you beyond the purposes already described if you have given your prior consent (Article 6(a) GDPR).

Personal data will only be transferred to third parties as described in the preceding paragraphs. Otherwise, no transfer to third parties will take place. If processing is to be carried out for other purposes, your express consent is required for each individual case.

You can, of course, revoke your consent at any time with future effect. To do so, simply send a message to the address below.

4. Server-Log-Files

When you visit our website, technical data is automatically collected and stored in log files. This data serves to ensure the stability and security of the website.

The following data is collected:

– IP-Adresse (abbreviated, anonymized)

– Date and time of access

– Name and URL of the file accessed

– Referrer-URL

– Browser type und -version as well as operating system

Legal basis: Art. 6 (1) (f) GDPR

5. Communication by email

If you contact us by email, your details will be used exclusively for processing your inquiry.

Legal basis: Art. 6 (1) (b) or (f) GDPR.

Your data will be deleted after your inquiry has been processed, provided that there are no legal retention obligations.

6. Applications

When you apply for a position with us, we process your data exclusively for the purpose of conducting the application process (Art. 6 (1) (b) GDPR, Art. 88 GDPR).

Data collected:

– Name, address, contact details

– Resume, references, application documents

Resume, references, application documents.

7. Hosting

Our website is hosted exclusively on servers in Germany . Hosting is carried out on behalf of NEXX Capital GmbH on the basis of a contract for order processing in accordance with Art. 28 GDPR.

8. Your rights as a data subject

You have the following rights under the GDPR:

– Access (Art. 15 GDPR)

– Rectification (Art. 16 GDPR)

– Erasure (Art. 17 GDPR)

– Restriction of processing (Art. 18 GDPR)

– Data portability (Art. 20 GDPR)

– Objection (Art. 21 GDPR)

– Withdrawal of consent (Art. 7(3) GDPR)

To exercise your rights, please contact: datenschutz@nexx-capital.com

9. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority in accordance with Art. 77 GDPR.

Competent supervisory authority:

The Hessian Commissioner for Data Protection and Freedom of Information (HBDI)
P.O. Box 3163
65021 Wiesbaden
Phone: +49 611 1408–0
Web: www.datenschutz.hessen.de

10. Data security

We use technical and organizational measures to protect your data against manipulation, loss, destruction, or unauthorized access. Your data is always transmitted in encrypted form (SSL/TLS).

11. Currency and amendment of this privacy policy

This privacy policy is effective as of October 2025.

We reserve the right to update them in the event of changes to legal or technical conditions.

The current version is available at www.nexx-capital.com/datenschutz.

As of: October 2025