Privacy Policy Scalable Capital

1. Controller / contact details

In the following we inform you about the processing of your personal data carried out by Scalable Capital Bank GmbH, Seitzstraße 8e, 80538 Munich, Germany ("Scalable Capital", "we" or "Controller") in connection with the use of our website, our web application and our mobile application (the latter hereinafter collectively referred to as the "App"), as well as in connection with the initiation, conclusion and performance of the products and services offered by us through these channels.

To exercise your rights and for further information, please contact us by e-mail at service@scalable.capital or by post at Scalable Capital Bank GmbH, Seitzstraße 8e, 80538 Munich, Germany.

You can reach our Data Protection Officer at: privacy@scalable.capital.

Further information on Scalable Capital can be found in the legal notice.

2. General information on the processing of personal data

2.1. General information

In principle, you decide which personal data you provide to us. Within the scope of the business relationship, however, you must provide us with such personal data as is necessary for the initiation, performance or termination of the business relationship and the collection and processing of which we are obliged to carry out on the basis of legal requirements, e.g. under anti-money laundering provisions. Without this data, we cannot provide you with our services or functions. Not all processing activities described in this privacy policy apply in the same way to all products, markets, branches and client groups. Where individual processing operations only apply to certain products and offers, we expressly point this out in the relevant section.

2.2. Purposes and legal basis

We only process your personal data insofar as this is permissible in accordance with Art. 6 GDPR. Processing includes, for example, the collection, retrieval, use, storage or transmission of personal data. In the following, we describe the purposes and legal bases of the processing of personal data in detail.

2.2.1 Consent pursuant to Art. 6 (1) (a) GDPR

Processing on the basis of your consent in accordance with Art. 6 (1) (a) GDPR are carried out for defined purposes. You may withdraw your consent at any time with effect for the future. The withdrawal of consent does not invalidate the lawfulness of the processing carried out on the basis of the consent until revocation.

2.2.2 Fulfilment of contractual obligations or measures in the context of contract initiation pursuant to Art. 6 (1) (b) GDPR

We process personal data in accordance with Art. 6 (1) (b) GDPR in the context of contract initiation and fulfilment.This primarily includes processing operations directly related to the opening and provision of accounts. Further information on the scope and purposes of the respective processing depending on the specific product can be found in the corresponding contractual documents.

2.2.3 Compliance with legal requirements pursuant to Art. 6 (1) (c) GDPR

As a financial institution, we are subject to numerous legal requirements arising, for example, from the German Money Laundering Act (GwG), the German Banking Act (KWG), the German Securities Trading Act (WpHG) or tax laws, as well as other banking supervisory requirements (e.g. from supervisory authorities such as the Federal Financial Supervisory Authority, the German Bundesbank or the European Central Bank). The processing of personal data to comply with legal requirements includes, for example, identity and age verification, compliance with tax-related controls and reporting obligations, the processing of client complaints, fraud and money laundering prevention, and the assessment and management of risks within the institution. At the request of authorities, we are entitled to report the transactions carried out by our clients to those authorities.

2.2.4 Legitimate interests pursuant to Art. 6 (1) (f) GDPR

Where necessary, we process your personal data in accordance with Art. 6 (1) (f) GDPR to protect our legitimate interests or those of third parties beyond the actual fulfilment of the contractual relationship. Processing is carried out for the following purposes, for example:

• Testing and optimisation of procedures for demand analysis and client segmentation,
• Performing direct marketing activities or market research on our products and services, to the extent permitted and provided you have not objected to the use of your data in this regard,
• Assertion and enforcement of legal claims and defence in legal disputes,
• Ensuring the IT security, IT operations and IT infrastructure of Scalable Capital,
• Prevention and investigation of criminal offences,
• Measures for business management and development of services and products,
• Ensuring the compliance and security of business processes,
• Financial and risk management, including the regular review of internal risk models,
• Providing personal analyses, evaluations and statistics (e.g. year-end recap), or
• Data exchange with credit agencies to determine creditworthiness and default risks.

2.3 Processing of personal data of third parties

We process personal data of persons who are in contact with us but are not our clients. This includes, for example, authorised representatives, legal guardians, payees, legal representatives, visitors to our website or other persons involved in a transaction. We process the data on the basis of our legitimate interest in providing our services to our clients and to fulfil our legal obligations.

3. Processing of your personal data when accessing our website and apps

3.1. Hosting

For hosting the database and web content, we use Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg ("AWS"), a subsidiary of Amazon Web Services, Inc., P.O. Box 81226, Seattle, WA 98108-1226, USA, as a data processor. The data is generally stored in a German data centre in Frankfurt am Main that meets the highest security standards. In addition, we have agreed corresponding EU standard contractual clauses with Amazon Web Services, Inc. in accordance with Commission Implementing Decision (EU) 2021/914 of 4 June 2021. You can view this Implementing Decision (EU) 2021/914, including the EU standard contractual clauses used, via the following link: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32021D0914. In conjunction with additional technical and organisational measures to ensure an adequate level of protection, this is intended to ensure that the EU data protection requirements can also be complied with when data is processed in the USA.

3.2. Use of our website for information purposes

When you visit our website, we process access data that is stored in so-called log files. The following personal data is processed automatically in the course of this:

• IP address of the requesting device
• Type of web browser used
• Language of the web browser used
• Version of the web browser used
• Operating system and its version
• Date and time of the visit
• Time zone difference from Greenwich Mean Time (GMT)
• Access status/ http status code
• Amount of data transferred
• Web page visited
• Referrer
• Web pages that are called up by the visitor's system via our website
• Internet service provider of the user

The processing of this data is performed out in accordance with Art. 6 (1) (f) GDPR due to our legitimate interest in being able to properly display the website to you as well as to defend against attacks and for the purpose of the security of our systems. The log files are deleted or anonymised immediately after they are no longer required to achieve the aforementioned purposes, but at the latest after 14 days.

3.3. Use of cookies, tracking tools and third-party services on our websites and apps

3.3.1 General information

We use cookies and similar technologies, such as pixels, on our website. Cookies are small text files that are stored on your end device and process device-specific information. There are session-based and persistent cookies. While session-based cookies are deleted immediately at the end of a browser session, persistent cookies enable the settings you have selected to be saved for a longer period of time. Persistent cookies are used to provide you with the most pleasant user experience possible. We use our own code in our apps and also utilise software development kits ("SDKs"). An SDK is provided by our partners and contains code parts that execute certain functions.

The storage and reading (so-called "tracking") of information, e.g. through the setting of cookies or the integration of SDKs on users' end devices, is only permitted on the basis of legal requirements with the express consent of the user (Section 25 (1) TDDDG in conjunction with Art. 6 (1) (a) GDPR). Insofar as the storage and processing is absolutely necessary for the performance of our services, no consent is required in accordance with Section 25 (2) TDDDG. The further processing is carried out in each case pursuant to Art. 6 (1) (f) GDPR to safeguard our legitimate interests, unless your interests or fundamental rights and freedoms requiring the protection of your personal data override those interests, for example for fraud prevention, improving IT security and improving our digital services. If the processing of the following services is based on your consent, you can withdraw your consent at any time with effect for the future and manage and adjust this in the data protection settings.
For further general information on the cookies, tracking technologies and SDKs used, please refer to the Cookie Policy. You can also manage your consent and settings there.

3.3.2 Login to the personal area

To enable you to use our services securely, we use Auth0 Inc, 10800 NE 8th Street, Ste. 600, Bellevue, WA, 98004, USA ("Auth0") as a data processor. For this purpose, Auth0 processes your e-mail address and password together with your IP address, the geolocalisation data derived from the IP address, time stamps and the device information in accordance with Art. 6 (1) (b) GDPR.

To better protect access to your personal area against criminal activities and access by third parties, we take various measures. As part of the login process, we analyse the IP address, the location of the requesting device derived from the IP address and the access metadata (e.g. date and time of the request, information about the end device or action performed). In addition, we use the functions of Auth0 to check at regular intervals whether your login credentials were included in published third-party security breaches. We notify you without undue delay in suspected cases and if we determine that your login credentials are or were affected by such a security breach, in order to support you in changing your login credentials. In these cases, the corresponding personal data is processed in accordance with Art. 6 (1) (f) GDPR on the basis of our legitimate interest in protecting access to your personal area against abusive or unauthorised access.

In the context of this processing, Auth0 does not receive access to any additional personal data. Your data is encrypted and generally processed within the European Union (EU). In individual cases, however, temporary processing of individual data in the USA cannot be ruled out. For these cases, as an additional safeguard, we have concluded corresponding EU standard contractual clauses in accordance with Commission Implementing Decision (EU) 2021/914 of 4 June 2021. You can view this Implementing Decision (EU) 2021/914, including the EU standard contractual clauses used, via the following link: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32021D0914.

3.3.3 Authentication mechanisms

As part of the login procedure and for authentication purposes, we use Futurae Technologies AG, Eichstrasse 23, 8045 Zurich, Switzerland ("Futurae") as a data processor. To activate two-factor authentication on the mobile device, Futurae processes personal data such as IP address, device data, browser information and your telephone number stored with us. This data is processed in accordance with Art. 6 (1) (b) GDPR in order to provide the login procedure and authentication for the use of our services. The transfer of the aforementioned data to Switzerland as a third country is based on an adequacy decision of the European Commission pursuant to Art. 45 GDPR. You can access the relevant adequacy decision at the following link: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32000D0518.

3.3.4 Consent Management Service

On our website and in our apps, we use the Consent Management Service of Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich, Germany ("Usercentrics") to inform you about cookies, similar technologies and SDKs used by us and to ensure that these are only set or activated in accordance with applicable law and, if necessary, only with your consent. In connection with the collection of your consent, we process your IP address, opt-in and opt-out data, referrer URL, user agent, user preferences, consent ID, time of consent, consent type, template version and banner language. Your consent is stored in relation to a Usercentrics Consent ID. The use of Usercentrics is necessary so that we can comply with the legal requirements for the setting of cookies, the use of similar technologies and SDKs, and in particular the applicable requirements for documenting consent. The data is processed on the basis of Section 25 (2) no. 2 TDDDG in conjunction with Art. 6 (1) (c) GDPR.

Further information on data protection when using Usercentrics can be found here https://usercentrics.com/privacy-policy/.

3.3.5 Comfort settings (e.g. language settings)

In order to be able to display content according to your country and language settings, we use session-based or persistent cookies. Your country settings will be deleted as soon as your browser session has ended. Your language settings are saved for a maximum of one year. The legal basis for the processing of these cookies is § 25 (2) TDDDG in conjunction with Art. 6 (1) (f) GDPR.

3.3.6 Performance Monitoring

We use DataDog, Inc. 620 8th Avenue, 45th Floor, New York, NY 10018, USA ("DataDog") as a data processor to collect information about the performance of our website and our apps, as well as any technical malfunctions that may occur. For this purpose, DataDog sets a cookie for the browser session and collects geolocation, device and operating system data of users of our website and mobile applications. We process the aforementioned data in accordance with Section 25 (2) TDDDG in conjunction with Art. 6 (1) (f) GDPR in order to ensure the performance, stability and security of our platform for the provision of our services, to detect and remedy technical malfunctions and to minimise potential risks of damage. Your personal data will be deleted after 15 days. For analysis purposes, we collect and process additional usage data on the basis of your consent in accordance with Section 25 (1) TDDDG in conjunction with Art. 6 (1) (a) GDPR, which you gave us when visiting our website or apps.
Corresponding EU standard contractual clauses have been concluded in accordance with Commission Implementing Decision (EU) 2021/914 of 4 June 2021 as appropriate safeguards for the processing of personal data in non-European countries. You can view this Implementing Decision (EU) 2021/914, including the EU standard contractual clauses used, via the following link: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32021D0914.

3.3.7 Cyber Security Incident Monitoring

We also use DataDog to process information used to detect cybersecurity incidents and any cybersecurity disruptions, and to enable us to respond to them. For this purpose, we process login data, including email address, IP address, device information and geolocation data derived from users' IP addresses when they access our apps. We process the above data on the basis of our legitimate interest to ensure and maintain IT security in accordance with Art. 6 (1) (f) in conjunction with Art. 32 GDPR. Your data will be deleted after 15 days unless it is required for forensic analysis and investigations.

3.3.8 Friendly Captcha (Bot/ Spam Protection)

We use the "Friendly Captcha" service provided by Friendly Captcha GmbH, Am Anger 3-5, 82237 Wörthsee, Germany, to prevent the abusive use of our website and apps by automated programs and scripts (so-called "bots"). For this purpose, a program code from Friendly Captcha has been integrated that presents a calculation task to the visitor's end device. Depending on the result of the calculation task, the respective request, e.g. as part of the login to the personal area or the newsletter subscription, is processed or rejected. Friendly Captcha does not set or read any cookies on the user's end device. Collected IP addresses are processed in hashed form.
This data is processed in accordance with Section 25 (2) TDDDG in conjunction with Art. 6 para. 1 lit. f GDPR to ensure the security and reliability of the website and apps and to protect them from abusive access by bots, i.e. spam protection and attacks (e.g. through mass requests). If personal data is stored, this data is deleted within 30 days.
Further information on data protection when using Friendly Captcha can be found at https://friendlycaptcha.com/legal/privacy-end-users/.

3.3.9 Push Notifications/ messages

We use push notifications to inform you, for example, about the successful execution of securities orders, when price alerts have been reached or when your deposit has been received. For this purpose, a device token from Apple or a registration ID from Google is assigned to your end device. These are device-related identifiers. They are used exclusively to provide the push services. For this purpose, we use the "Simple Notification Service" from AWS as well as the Firebase Cloud Messaging Service from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland for devices with an Android operating system. This data is processed in accordance with Section 25 (2) TDDDG in conjunction with Art. 6 (1) (f) GDPR in order to be able to display informative push notifications on your device. You can activate and deactivate this function at any time in your device settings.

3.3.10 Phrase over the Air

Using "Phrase over the Air", we can update notices and information texts in our apps automatically and in real time. The updates are transferred to the apps without the need to update to a new app version. In this context, we process device identification data and the version of the installed app. This data is processed in accordance with Section 25 (2) TDDDG in conjunction with Art. 6 (1) (f) GDPR to ensure that the information and information texts in disclaimers, FAQs or information boxes are correct and up-to-date.

3.3.11 Google Firebase Crashlytics

We use the "Google Firebase Crashlytics" service to ensure the stability of the apps and to make improvements. In doing so, information about the device used and the use of our apps, such as user ID, device model, operating system version, app version and timestamp of the report, is collected and processed. This generates so-called "crash reports", which contain information about problems and crashes. This data is processed in accordance with Section 25 (2) TDDDG in conjunction with Art. 6 (1) (f) GDPR in order to provide you with functioning apps and to identify and resolve stability problems.

3.3.12 Google Firebase Remote Config

The "Google Firebase Remote Config" service enables us to activate new features in our apps and configure content without having to download the apps again from the respective app stores. In this context, we process the device identification data, such as the version and type of operating system or the device model. This data is processed in accordance with Section 25 (2) TDDDG in conjunction with Art. 6 (1) (f) GDPR to ensure the stable and secure operation of our apps and to provide content and functions in up-to-date form.

3.3.13 Google Tag Manager

We use "Google Tag Manager" as a tag management platform that enables us to technically manage and trigger tracking services and customised tracking tags based on the respective consent given. The data arising in this context is processed in accordance with Section 25 (2) TDDDG in conjunction with Art. 6 (1) (f) GDPR.

3.3.14 Google Firebase Performance Monitoring

We use the "Google Firebase Performance Monitoring" service to collect performance data in our apps and then check and analyse it. The service helps us to understand in real time where the performance of our apps can be improved. The collection and processing of this data takes place exclusively on the basis of your consent in accordance with § 25 para. 1 TDDDG in conjunction with Art. 6 (1) (a) GDPR which you have given us in the course of your visit to our website or apps.

3.3.15 Google Analytics

We use "Google Analytics" to analyse the use of our website and apps. For this purpose, cookies are set in the browser or the "Google Analytics for Firebase" service is used in our apps to collect and analyse information about the use of and interactions with our website and apps and to compile reports on the corresponding activities. We use this data to make user-orientated improvements, among other things. The data processing is based on a pseudonymous identification number. In addition, the following metadata is derived from IP addresses: City including the derived latitude and longitude of the city, continent, country, region and subcontinent. For access originating from the European Union (EU), IP address data is only used to derive location data and then deleted immediately. It is not logged, accessible, or used for any additional use cases. The collection and processing of this data takes place exclusively on the basis of your consent in accordance with § 25 para. 1 TDDDG in conjunction with Art. 6 (1) (a) GDPR which you have given us in the course of your visit to our website or apps.

3.3.16 Google Ads

In order to check the effectiveness of our adverts placed via “Google Ads”, we use conversion tracking on our website. When you click on an ad placed by Google, a cookie for conversion tracking is set on your device. These conversion-cookies lose their validity after 30 days and do not allow any direct conclusions to be drawn about a specific person. As long as the cookie is valid, we can track whether an end device was used to click on an advertisement placed via Google Ads in order to access our website. We can use conversion cookies to measure the effectiveness of our advertising measures. The collection and processing of this data takes place exclusively on the basis of your consent in accordance with § 25 para. 1 TDDDG in conjunction with Art. 6 (1) (a) GDPR which you have given us in the course of your visit to our website or apps.

3.3.17 Google Maps

The use of “Google Maps” allows us to provide users with suggestions and functions for automatically completing the form when they enter address information, thereby improving user-friendliness in the registration process and when changing personal information. By using Google Maps, input data, your location data and IP address will be forwarded to Google, and this data will be collected and processed exclusively on the basis of your consent in accordance with Section 25 (1) TDDDG in conjunction with Art. 6 (1) (a) GDPR which you have given us in the course of your visit to our website or apps.

3.3.18 Google Firebase A/B Testing

The service “Google Firebase A/B Testing” allows us to test changes to the user interface of our apps, features or engagement campaigns before we fully roll out changes. The collection and processing of this data takes place exclusively on the basis of your consent in accordance with § 25 (1) TDDDG in conjunction with Art. 6 (1) (a) GDPR which you have given us in the course of your visit to our website or apps.

3.3.19 YouTube

We have embedded videos on our website via “YouTube”, which is provided by Google. After clicking on a video, device information, IP address and the information that you have watched the video are transmitted to YouTube. If you are logged in to YouTube, this information is also assigned to your user account with YouTube. The collection and processing of this data takes place exclusively on the basis of your consent in accordance with § 25 (1) TDDDG in conjunction with Art. 6 (1) (a) GDPR which you have given us in the course of your visit to our website or apps.
You can find more details on the processing of your personal data by YouTube in YouTube's data protection information at https://policies.google.com/privacy. You can find a general option to object to the processing of your data by Google here: https://tools.google.com/dlpage/gaoptout?hl=en.

3.3.20 Affiliate programs (financeAds and NetSlave)

We cooperate with financeAds GmbH & Co. KG, Karlstraße 9, 90403 Nuremberg, Germany, financeAds International GmbH, Hardenbergstr. 32, 10623 Berlin, Germany (both hereinafter collectively referred to as "financeAds") and NetSlave GmbH, Simon-Dach-Str. 12, 10245 Berlin, Germany ("NetSlave") in order to reach new clients through advertising partners. FinanceAds and NetSlave are affiliate networks that enable commercial operators of websites to display advertisements, which are usually remunerated via click or completion fees, on third-party websites (so-called "affiliates"). Via the affiliate network, an advertising medium, e.g. an advertising banner or text link, is made available, which can be integrated by an affiliate on its own internet pages. In order to assign referrals, determine the effectiveness of the advertising media and process the remuneration of affiliates, we use corresponding cookies on our websites. In this way, we record the time at which a specific advertising medium was clicked on from an end device and process additional device information. In addition, an individual sequence of numbers is stored which affiliate partners cannot trace back to individual users and which documents the affiliate program of an affiliate, the publisher and the time of the user's action ("click" or "view"). The processing of this information is necessary for assigning the referral, settling accounts with affiliates and paying referral premiums. The cookie is set only for people who have previously clicked on an affiliate or referral link and not for every visitor to our website. This data is processed in accordance with Section 25 (2) TDDDG in conjunction with Art. 6 (1) (f) GDPR.

Further information on data protection at financeAds can be found at https://www.financeads.com/privacy-policy/ and at NetSlave at https://www.qualityclick.com/imprint#datenschutz.

3.3.21 Scalable Analytics and Custom Event Tracking

Within our apps, we collect so-called event data in order to be able to analyse user interactions with our apps and offers. Event data includes, for example, clicks on certain buttons, form submissions and/or scroll events. We process the data collected for internal analysis purposes. The data may also be forwarded to recipients used by us, such as Google, and processed there. We also use this data as a basis for improvements to our user interfaces, services and products as well as to optimise our marketing activities, internal processes and as part of risk management, e.g. for fraud prevention. The processing may, where necessary for the aforementioned purposes, include the creation of user profiles. The collection and processing of this data takes place exclusively on the basis of your consent in accordance with § 25 (1) TDDDG in conjunction with Art. 6 (1) (a) GDPR which you have given us in the course of your visit to our website or apps.

3.3.22 Meta

We use the "Meta Pixel" and "Meta Conversion API" services of Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland ("Meta") to place our marketing campaigns in a targeted manner with Meta and within the services of the partners cooperating with Meta (so-called "Audience Network", see: https://www.facebook.com/audiencenetwork/). This allows us to target marketing campaigns to people who have already visited our websites and apps or who have certain characteristics, such as an interest in certain topics or products. In addition, we can determine the effectiveness of our marketing campaigns by recording certain actions (so-called "events") that take place on the website or within the app. This includes, for example, registration, completion of the identification process, conclusion of a client contract and the first transaction (so-called "conversions"). The collection and processing of this data takes place exclusively on the basis of your consent in accordance with § 25 (1) TDDDG in conjunction with Art. 6 (1) (a) GDPR which you have given us in the course of your visit to our website or apps.

The collection and transmission of event data to Meta (but not the further processing of the data) is carried out under joint responsibility with Meta. For this purpose, we have concluded a special agreement with Meta on joint controllership (available at: https://www.facebook.com/legal/controller_addendum), which regulates, among other things, the security measures to be fulfilled (available at: https://www.facebook.com/legal/terms/data_security_terms) and responsibility for fulfilling data subject rights (i.e. users can, for example, send requests for information or deletion requests directly to Meta).
Joint processing is carried out for the following purposes:

• Display of content advertising information that corresponds to the presumed interests of users;
• Delivery of commercial and transactional messages (e.g., targeting users via Facebook Messenger);
• Improve ad delivery and personalization of features and content (e.g., improve the identification of which content or advertising information is likely to be of interest to users).

For more information visit https://www.facebook.com/legal/controller_addendum.

If Meta provides us with analyses and reports in aggregated form and without details of individual users, this processing is carried out on the basis of our data processing agreement with Meta. Further information on the data processing agreement can be found at https://www.facebook.com/legal/terms/dataprocessing and https://www.facebook.com/legal/terms/data_security_terms.

3.3.23 LinkedIn Insight Tag

We use the "LinkedIn Insight Tag" from LinkedIn Corporation, 2029 Stierlin Court, Mountain View, CA 94043, USA. Via the LinkedIn Insight Tag, we receive aggregated and anonymised evaluations of our advertising campaigns on LinkedIn and additionally aggregated and anonymised information on how users interact with our websites and apps. We use the information to understand the effectiveness of our marketing campaigns, to evaluate them and to present corresponding content in our adverts on LinkedIn. The LinkedIn Insight Tag is used to collect data about users' visits to our website, including URL, referrer, IP address, device and browser characteristics, timestamp and page views. The collection and processing of this data takes place exclusively on the basis of your consent in accordance with § 25 (1) TDDDG in conjunction with Art. 6 (1) (a) GDPR which you have given us in the course of your visit to our website or apps.

You can object to the collection of data generated by the cookie and its processing by LinkedIn at the following link: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.

Further information can be found in LinkedIn's privacy policy: https://www.linkedin.com/legal/privacy-policy.

3.3.24 Microsoft Advertising Remarketing

We use "Microsoft Advertising Remarketing" from Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA ("Microsoft") on our website. If you have reached our website via a Microsoft advert, Microsoft will set a so-called "conversion cookie" on the end device, with which we can track that a Microsoft advert has been clicked on, which has redirected the user to our website after a certain target page ("conversion site") has been visited beforehand. Microsoft collects, processes and uses information via the cookie, on the basis of which usage profiles are created using pseudonyms. These usage profiles are used to analyse visitor behaviour and are used to display advertisements. The collection and processing of this data takes place exclusively on the basis of your consent in accordance with § 25 (1) TDDDG in conjunction with Art. 6 (1) (a) GDPR which you have given us in the course of your visit to our website or apps.
You can find more information on data protection at Microsoft in Microsoft's privacy policy at https://privacy.microsoft.com/en-us/privacystatement.

3.3.25 TikTok

We use tracking technologies from TikTok Technology Limited, 10 Earlsfort Terrace, Dublin D02 T380 Ireland, to display targeted and personalised advertising on the "TikTok" platform and to create interest-based user profiles. We use the data to measure the effectiveness of the ads and to optimise the performance of our marketing campaigns on TikTok. We also measure conversions from TikTok advertisements in order to optimise advertisements, create target groups for future advertisements and reach users who have already carried out an event on our website again. We process this data primarily to ensure that the content of our adverts is relevant to our users. The collection and processing of this data takes place exclusively on the basis of your consent in accordance with § 25 (1) TDDDG in conjunction with Art. 6 (1) (a) GDPR which you have given us in the course of your visit to our website or apps.

3.3.26 Reddit Advertising

We use tracking technologies from Reddit Netherlands B.V., Euro Business Center, Keizersgracht 62, 1015CS, Amsterdam, Netherlands, to display targeted and personalised advertising on the "Reddit" platform and to create interest-based user profiles. We also use the data to improve future campaigns and adverts on the Reddit platform and to measure event-based conversions of Reddit adverts in order to better target adverts to our target groups. The collection and processing of this data takes place exclusively on the basis of your consent in accordance with § 25 (1) TDDDG in conjunction with Art. 6 (1) (a) GDPR which you have given us in the course of your visit to our website or apps.

3.3.27 Adjust

In order to measure the success of our app marketing campaigns, for our own market research and to optimise our apps, we use the "Adjust" analysis technology from adjust GmbH, Saarbrücker Str. 37A, 10405 Berlin, Germany. Adjust processes data on interaction with our advertising materials, installation and event data (e.g. start of onboarding, confirmation of onboarding email, conclusion of contract) in the context of the use of our apps and provides these as pseudonymised evaluations. For this purpose, the following data is processed from you: IT usage data (e.g. timestamp of events, assigned click timestamp, IP address), device information (e.g. your IDFA or Android ID, operating system version and type, model number and country code of the end device, internet service provider) as well as the Meta Ads ID, Campaign ID and Ads Set ID. The collected information is used for the execution and optimization of our app advertising campaigns and is additionally forwarded to corresponding providers or advertising partners (e.g. Meta, TikTok or Google). The collection and processing of this data takes place exclusively on the basis of your consent in accordance with § 25 (1) TDDDG in conjunction with Art. 6 (1) (a) GDPR which you have given us in the course of your visit to our website or apps.
Further, you can object to the collection, evaluation and use of your data at following https://www.adjust.com/forget-device.

4. Provision of our services

4.1. Registration / creation of client profile

To make use of our services, you must first register, create a client profile and open a clearing account and securities account. For this purpose, we collect your private contact and identification data (e.g. title, first and last name, address, email address, telephone number, date of birth, place and country of birth and nationality), tax data (e.g. tax number, tax residency) and reference account data (e.g. IBAN). The aforementioned data is also collected and processed, where we offer this in the respective product and market, in connection with opening a securities account for a minor. As part of the registration process, you will also set a password for your personal access. In addition, depending on the services you use, we collect information about your knowledge and experience in relation to transactions in certain types of financial instruments or investment services, information about your investment objectives, including your risk tolerance, and about your financial circumstances, including your ability to bear losses. We process this data in order to be able to recommend a suitable investment strategy to you, depending on the service, or to assess the appropriateness of certain financial instruments. We store your entries made during the registration process for a maximum of six months to enable you to resume your registration. The aforementioned processing is carried out, depending on the specific processing, to fulfil our legal and contractual obligations in accordance with Art. 6 (1) (b) and (c) GDPR.
If you have opened a custody account for the use of our services not with us, but with Baader Bank AG, Weihenstephaner Str. 4, 85716 Unterschleißheim, Germany, Baader Bank AG processes your data under its own responsibility. Information on data protection at Baader Bank AG can be found at https://www.baaderbank.de/en/imprint/data-protection-declaration.

4.2. Identification process

As part of our due diligence obligations under anti-money laundering law, we are required to identify our clients and, where applicable, their representatives when establishing a business relationship. For this purpose, we process the contact and identification data provided during registration, in particular name, nationality, date and place of birth, address, email address and telephone number. Identification is carried out on the basis of a valid identity document or, in the case of minors, on the basis of a birth certificate or a comparable document, if necessary together with an official translation. We store the information required by law, copies of the documents presented and, where the respective procedure provides for this, visual and audio recordings of the identification procedure. The legal basis is Art. 6 (1) (b) and (c) GDPR.

Not all identification procedures described below apply equally to all products, markets, branches and client groups. The procedure used in each individual case depends in particular on the selected product, the market or branch, your country of residence, the availability of the procedure and any identification already carried out. Where an identification already carried out can be reused, we do not carry out a new procedure in every case.
For identification, we use the following data processors depending on the applicable procedure:

• POSTIDENT procedure: Deutsche Post AG, Charles-de-Gaulle-Straße 20, 53113 Bonn, Germany.
• Other procedures: If the POSTIDENT procedure is not used and no existing identification can be reused, the verification is generally carried out by Fourthline B.V., Tesselschadestraat 12, 1054 ET, Amsterdam, the Netherlands. This applies in particular to clients of the branches.

We process the identification data, document copies and other evidence collected in the respective procedure to carry out the identification and to fulfil our legal and contractual obligations on the basis of Art. 6 (1) (b) and (c) GDPR. Further information can be found in the privacy notices of the respective providers.

Where this is necessary to fulfil legal and regulatory obligations, we conduct ongoing comparisons with sanctions lists and checks as to whether our clients are politically exposed persons. For this purpose, we may transfer personal data, in particular identification and contact data, to recipients from the categories of external screening, database and compliance service providers. The legal basis is Art. 6 (1) (c) GDPR. Where the identification procedure provided for you includes identification by video chat, the provider used in each case obtains your express consent pursuant to Art. 6 (1) (a) GDPR at the beginning to take photos and record the conversation. You may withdraw this consent at any time by terminating the video identification process and, where available, using an alternative identification method.

4.3. Trading in securities and other financial instruments, asset management

In order to provide our services, in particular to process orders for securities, we process your personal data and may transfer it to third parties, such as custodian banks, other institutions or comparable institutions. The legal basis for the processing is Art. 6 (1) (b) and (c) GDPR, as this is necessary for the fulfilment of our contractual and legal obligations.

4.4 Credit offering ("Credit")

When applying for a securities-based credit as part of our credit offer and to determine the credit limit, we carry out a creditworthiness assessment. For this purpose, we use an internal scoring system and also forward your data to credit agencies. Further information on scoring can be found in the section Automated decision-making and on credit agencies in the section Recipients or categories of recipients of personal data. The legal basis for the processing is Art. 6 (1) (b) and (f) GDPR, as this is necessary for the fulfilment of our contractual obligations and due to our legitimate interest in determining creditworthiness and default risks.

4.5 Omnibus Trust Account

We cooperate with trustee banks for the purpose of safekeeping client funds. You can check your account statements to see which trustee bank holds your client funds.
For the safekeeping of client funds, we transmit your personal data and information on credit balances at the respective trustee bank for the purposes of deposit guarantee. We transfer your personal data to the respective trustee bank for the purpose of fulfilling our contractual obligations in accordance with Art. 6 (1) (b) GDPR, in particular for the coverage of credit balances by the applicable deposit guarantee. The trustee banks process the data on their own responsibility.

4.6 Preparation of tax information

We process your financial transaction data and tax data (e.g. your personal tax identification number and tax residency) in order to calculate withholding tax and to provide you with relevant tax-related information. Where a corresponding tax statement is prepared for clients resident outside Germany, this is prepared by KPMG AG, Badenerstrasse 172, CH-8036 Zurich, Switzerland ("KPMG"). For this purpose, we transfer the internal identification numbers and financial transaction data required for this purpose (e.g. security number, order type and execution time) to KPMG. The transfer of the aforementioned data to Switzerland as a third country is based on an adequacy decision of the European Commission pursuant to Art. 45 GDPR. Further information can be found here: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32000D0518.
Please note that KPMG processes your data under its own responsibility. For more information, please see KPMG's privacy notice at: https://kpmg.com/ch/en/misc/privacy.html.

The legal basis for the processing of the aforementioned data is Art. 6 (1) (b) and (c) GDPR, as this is necessary for the fulfilment of our contractual and legal obligations.