ESRS G1 – Business Conduct

Material Impacts, Risks, and Opportunities

As part of the double materiality assessment, we identified both negative and positive impacts related to business conduct for Beiersdorf that arise from our business activities.

As a globally operating company with complex value chains, Beiersdorf bears a high level of corporate responsibility and is obliged to comply with various legal requirements and other regulations. Policies such as our Codes of Conduct (CoC) reflect the principles and values of our corporate culture and help us fulfill this obligation.

Corporate Culture and Business Conduct Policies

The core values of the Consumer Business Segment are Care, Simplicity, Courage and Trust. They serve as a daily benchmark ensuring that we communicate and act consistently across all our business areas. At tesa, the core principles include Respect, Honesty, Trust, Tolerance, and Integrity. These values of both business segments are reflected in our CoC as well as in key policies that further elaborate the requirements of the CoC. The CoC of Consumer and tesa were developed jointly and in alignment with all major functions. They are binding for all companies within the business segments across the Group.

It is the responsibility of managers to implement the CoC and resulting policies within the business units and to monitor compliance. At the same time, they must prevent unacceptable behavior or take appropriate measures to prevent violations of rules within their area of responsibility. They receive significant support from Compliance Officers in the regions and subsidiaries, as well as from local management.

We further reaffirm our expectations and minimum standards through memberships in recognized initiatives and associations. Both Beiersdorf AG and tesa SE are members of the United Nations (UN) “Global Compact” and are committed to the core labor standards of the ”International Labour Organization” (ILO), the “UN Universal Declaration of Human Rights,” and the “OECD Guidelines for Multinational Enterprises.” These international guidelines form the basis of the Codes of Conduct for our Consumer and tesa Business Segments. With the CoC of both business units, we address our material impacts on business conduct and on our own workforce.

Group-Wide Compliance Management Systems (CMS)

Consumer and tesa each have their own closely aligned CMS. Both systems are based on recognized international standards such as the CMS audit standard IDW PS 980. The purpose of our CMS is to ensure compliance with key legal requirements and internal rules in all countries where Beiersdorf operates. Their responsibilities therefore include, among other things, implementing essential compliance programs in a structured manner across the organization and, in particular, timely identification and management of relevant compliance risks.

We pursue the following principles:

• Prevention: We implement preventive measures to avoid improper behavior. This includes our CoC, additional policies, communication, and training measures.

• Detection: We conduct annual risk analyses centrally and locally in subsidiaries to identify key compliance risks at an early stage across the Group.

• Response and improvement: We present the results of the risk analyses to the Executive Board and use them to continuously adapt and improve our global and local compliance programs. Any violations of legal or internal requirements are addressed appropriately based on the individual case. We also derive continuous improvements for the CMS of both business segments.

Local Compliance Officers in regions and subsidiaries communicate the compliance program elements to employees and support their local implementation. This ensures that all CMS components are anchored, monitored, and improved at sites worldwide.

Group-Wide Whistleblower and Reporting Systems

As part of their CMS, Consumer and tesa have implemented and communicated various reporting systems and channels. These allow reporting of any behavioral misconduct – illegal or contrary to internal policies – anonymously if desired. Policies and guidelines, for example on whistleblowing, case management, and ad-hoc reporting, are implemented.

The Consumer Business Segment operates the “Speak up. We care.” platform. The tesa Business Segment uses the “Your voice – Our bond.” whistleblower platform. Both platforms are provided by the same system provider and are available worldwide 24/7. They are accessible in multiple languages and available not only to employees but also to external stakeholders such as customers, consumers, suppliers, and other parties wishing to report a concern. Examples of reportable misconduct include violations of corporate policy, human rights issues, corruption, and bribery. Information on how to submit complaints and on the subsequent processing steps is openly available on corporate websites, the intranet, and the whistleblower platform landing pages. Additionally, there are further internal reporting channels available to our employees: for example, they can contact local or central Compliance Officers, use central email addresses, or – within the Consumer business unit – call a central compliance hotline. Employees are regularly informed about the reporting systems and channels as part of communication activities.

In accordance with the EU Whistleblower Directive (EU 2019/1937), we have established processes to respond promptly to incoming reports. Access to and processing of reports is systemically restricted to selected employees in Corporate Compliance, Corporate Audit, and relevant internal experts (“case managers”). Case managers receive training on the reporting procedure and the related processes as needed. They only receive access to reports relevant to their area. Processing follows internal procedures, standards, and the Hinweisgeberschutzgesetz (German Whistleblower Protection Act, HinSchG). This obliges case managers and other persons entrusted with investigating the report to handle all information and investigative measures confidentially and objectively, and to act independently. Any conflicts of interest in dealing with the reporting person, the complaint, or the investigative measures must be disclosed and managed without delay. The identity of the reporting person is treated as confidential throughout the entire process – also to protect them from potential retaliation. Disclosures are made only where legally required or strictly necessary for proper clarification, and, where possible, is agreed in advance with the reporting person. The same applies to the identity of, and the handling of information relating to, the person accused and any other individuals involved. In addition to protecting the confidentiality of the reporting person’s identity, further protection mechanisms are in place. For example, affected employees are offered support from social services or other psychosocial assistance if needed. They may also contact other trusted functions at any time, such as the works council, if they fear retaliation or similar adverse consequences.

Compliance Trainings

A key component of our CMS is a risk-based and target-group-specific training concept including e-learning and classroom training on various compliance topics. Beiersdorf has established unified global training procedures coordinated with the responsible Executive Board member and implemented them in all subsidiaries.

Training on the CoC of the business segments takes place every two years (tesa) or every four years (Consumer). Participation is mandatory for all employees worldwide. Training covers topics such as governance, personal integrity, handling of corporate resources, information, and data, and what to do in the event of violations. Training on anti-corruption, antitrust, and data privacy is conducted every two years for both business segments.

For the Consumer Business Segment, anti-corruption training is mandatory worldwide for all employees (except production workers), targeting functions with higher corruption risk, including sales, marketing, procurement, and management. Antitrust training is likewise offered globally to all employees (except production workers) with additional advanced training for high-risk functions. Data privacy training is mandatory for all employees EU-wide (except production workers).

For tesa, training on anti-corruption, antitrust, and data privacy follows a risk-based approach. All employees with computer access receive data privacy training. Anti-corruption and antitrust training is targeted at employees with higher risk exposure, especially managers and employees in key areas such as Sales, Marketing, Procurement, Legal & Compliance and other relevant functions. Assignments are made on a topic-specific basis. Additional training may be conducted as needed but is not factored into the participation rate.

Beiersdorf has defined a minimum global participation rate of at least 95% annually for the compliance training topics mentioned above. This rate is determined on the basis of the annual target groups for each compliance training focus area, separately for the Consumer and tesa Business Segments as described above and defined in their respective training policies. It is then measured against the training courses successfully completed by the respective target groups in Consumer and tesa during the reporting year.

For the Consumer Business Segment, the participation rate includes not only Beiersdorf companies but also the La Prairie, Chantecaille, and S-Biomedic entities. NIVEA-Kao is not included. The participation rate and the measures necessary to achieve it are continuously monitored by the local Compliance Officers. They are supported by a global training cockpit that displays the annual target group and the status of training participation. The data is provided automatically through the global training system.

The tesa Business Segment also continuously monitors its participation rate. The required data is likewise provided automatically through the global training system. Compliance with the global target rate is ensured through clearly defined escalation processes and close collaboration with the local compliance organization.

Participation target achievement is reported separately for each business segment and is part of the annual joint reporting to the Executive Board and Supervisory Board. In the reporting year 2025, the participation rate was 98% for Consumer Business Segment and 99% for tesa Business Segment.

In addition to training, employees are regularly informed about relevant compliance topics and updates through various communication channels such as the intranet and emails. We also maintain regular contact with local subsidiaries, for example regarding relevant updates, emerging questions, and best practices.