EQS IR Services and Data Protection – What Website Operators Need to Know

If a website operator (in particular a publicly listed company) uses IR services from EQS, they typically integrate news widgets, IR website modules, or investor relations tools on their corporate website and thereby process access data and, where applicable, user account data of website visitors for the purpose of providing investor relations content and compliance documentation. This information is based on provider statements and publicly accessible sources.

A. Purpose and Function of EQS IR Services

EQS Group AG is a leading provider of software and services for publicly listed companies, in particular for:

• Investor Relations (IR)
• Corporate Compliance & Governance
• Data Privacy Management
• Whistleblowing systems (Integrity Line)

The EQS IR Services comprise several integration functions for corporate websites:

1. EQS News Widget / News Feed: Automatic display of press releases and regulatory news on the IR website
2. IR Website & Reports: Fully integrated IR website modules with embedded news, stock charts, investor profiles, contact forms
3. EQS Stock Chart: Automatic integration of share price data and corporate news in the chart
4. Contact forms and request management: Forms for investor enquiries

When integrating these modules, website access data and where applicable user data are collected and processed.

B. Mandatory Disclosures in the Privacy Policy on EQS IR Services

Under the GDPR, the operator must disclose the following information on EQS IR Services:

• Purpose (Art. 13(1)(c)): Provision of investor relations content, compliance documentation, user request management
• Legal basis (Art. 13(1)(a)/(f)): Legitimate interests of the company in investor relations + where applicable consent for tracking elements
• Recipients (Art. 13(1)(e)): EQS Group AG as processor or joint controller (depending on configuration)
• Third-country transfer (Art. 13(1)(f)): To be verified by the operator; according to the provider in some cases US infrastructure (AWS)
• Retention period (Art. 13(2)(a)): Depending on use and consent

Note: Tool-specific text templates are problematic. Better: a topic-oriented structure (e.g. "Investor relations and website analysis") with an enumeration of data recipients.

C. Provider of EQS IR Services: EQS Group AG

• Legal name: EQS Group AG
• Registered office: Karlstraße 47, 80333 Munich, Germany
• Country of seat: Germany (European Economic Area)
• Privacy Policy: https://www.eqs.com/en-us/about-eqs/data-protection/ / https://www.eqs.de/datenschutz.html
• DPF status: Not required (seat in the EEA)
• DPA: Available; the operator should enquire about DPA status with EQS
• Data protection contact: datenschutz@eqs.com

D. Data Processing by EQS IR Services – Procedure

E. Data Collected When Using EQS IR Services

EQS records various categories of user data when integrating IR services:

• Web server log data: IP address, date/time/time zone, request URL, referrer, HTTP status codes
• Click paths: Pages visited, news items clicked, links clicked, news downloads, timestamps
• Browser information: Browser name, browser version, user agent string
• Device data: Device type (desktop/tablet/mobile), operating system, display resolution, language setting
• Coarse location data: IP-based location at city/municipality level
• User profiles: If a user account is created: username, email address, login history, favourite news, subscriptions
• Conversion events: News download, registration for IR alert, contact request, event registration
• Interaction data: Clicks on news share buttons (LinkedIn, Twitter), dwell time on pages, scroll depth

F. Purposes of Use When Using EQS IR Services

The data is processed for the following purposes:

• Provision of functionality: Display of news, share price integration, provision of IR functionality
• User-individual product improvement: Personalised news recommendations, content optimisation based on user behaviour
• General product improvement: Analysis of frequently visited content, optimisation of the IR website structure
• General marketing: Reach analysis of news distributions, success analysis of press releases
• Compliance: Documentation of news publication and dissemination for stock exchange compliance
• Communication: Answering investor enquiries via contact forms

G. Legal Bases for EQS IR Services

Step 1 – Categorisation: EQS IR Services are functional and business optimisation tools for publicly listed companies.

Step 2 – Legal Bases:

• For provision of functionality (news, IR website): Legitimate interests under Art. 6(1)(f) GDPR. The company has a legitimate interest in disseminating investor relations content.
• For website tracking and user profiles:
  • With cookieless anonymisation: Legitimate interests Art. 6(1)(f)
  • With cookie use: Consent Art. 6(1)(a) in conjunction with § 25(1) TDDDG
• For contact forms: Legitimate interests Art. 6(1)(f) (answering enquiries)

Case-by-case examination required: Depending on the scope of EQS integration and whether tracking cookies are used.

H. Special Features and Notes on EQS IR Services

• Processing relationship required: The operator should clarify whether EQS acts as processor (Art. 28 GDPR) or joint controller (Art. 26 GDPR). A DPA is likely required.
• Sub-processors and third-country transfers: According to the provider: HubSpot and AWS (USA). Data protection impact assessment (DPIA) recommended; SCC required.
• Tracking and cookies: The news widget integration may set cookies. The operator must clarify whether tracking cookies are possible without consent or whether user consent is required.
• Contact forms: Email addresses and names of investors are recorded. Retention period and purpose of disclosure must be clearly documented.
• Accountability: The operator should document which EQS modules are integrated and which data is processed.

I. FAQ on EQS IR Services

J. Conclusion and Recommendation on EQS IR Services

Summary: EQS IR Services are specialised tools for investor relations. The operator should carry out a data protection impact assessment (DPIA), especially where tracking cookies or sub-processors in the USA are involved.

Common error: Operators copy EQS standard texts for the privacy policy without documenting the specific configuration of their integration. This is not GDPR-compliant under Art. 12(1) GDPR. Better: Document precisely which EQS modules you use, which data flows, and which legal basis applies.