DEGIRO's Privacy & Cookie Statement

Who is responsible for processing my data and who can I contact if I have questions regarding data protection?

The Controller within the meaning of the EU General Data Protection Regulation is:

flatexDEGIRO Bank SE

Omniturm, Große Gallusstraße 16-18

60312 Frankfurt am Main

Phone: +49 (0) 69 450001 0

E-mail: kundeninfo@flatexdegiro.com

Internet: www.flatexdegiro.com

Our Data Protection Officer can be contacted at:

flatexDEGIRO Bank SE

Data Protection Officer

Omniturm, Große Gallusstraße 16-18

60312 Frankfurt am Main

Phone: +49 (0) 69 450001 0

E-mail: privacy@flatexdegiro.com

Where do we receive your data from?

We receive most of the personal data we process from you directly, for example when you:

• Visit our website
• Sign up for the newsletter
• Participate in a lottery,
• Register for an event (e.g. roadshow or webinar).

What personal data do we collect from you?

Personal data is any information that relates to you or that we can associate with you. This includes your name, address, date of birth, IP address and other data. By ‘processing’, we mean the collection, recording, organisation, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

The personal data we collect includes, among others:

• Identification and contact details, such as your first name, last name, and e-mail address.
• Data about your online behaviour and preferences, e.g., IP addresses, unique identifiers for mobile devices, data about your visits to our websites and apps, devices you used to visit our website or app. This helps us recognise whether you are visiting our website or using our mobile apps.
• Information about your interests and preferences that you share with us, e.g. via our Service Desk or when you participate in an online survey.
• Your interactions with flatexDEGIRO Bank SE on social media such as Facebook, X and Instagram. We track public messages, posts, likes and reactions to and about flatexDEGIRO Bank SE on the internet.

For what purposes do we process your data and on what legal basis?

We process your personal data in accordance with applicable data protection laws and other relevant legislation:

• Provision of the website and integrated services

  We process your personal data in connection with the provision of the website and the integrated functions to ensure their technical functionality and to offer you the best possible user experience.

  The processing of your personal data for this purpose is based on a balancing of interests (Article 6(1)(f) of the GDPR). Our legitimate interest is to offer the website and the integrated functions, as well as ensuring their technical functionality and the best possible user experience.

• Automated customer communication via AI chatbot

  When you use the AI chatbot on the website, your personal data will be processed in order to respond to your inquiries in AI support. Your personal data is processed based on a balancing of interests (Article 6(1)(f) of the GDPR). Our legitimate interest is to provide and implement AI support and answering the questions asked as best as possible.

• Customer management and marketing

  In the context of customer management and marketing, we process your data on the basis of your consent (Article 6(1)(f) of the GDPR) or a balancing of interests (Article 6(1)(f) of the GDPR). Our legitimate interests are to offer the most suitable products and services and in improving and further developing our products and services.

  We may ask you for your opinion on our products and services and use this data to improve our offerings or tailor our products and services to you. We may send you newsletters informing you about these products and services. If you do not wish to receive these offers, you can, of course, object or withdraw your consent. Below, we provide information on how we can improve our service based on your feedback:

  1. Provision of the most suitable products, services and (direct) advertising

     In some cases, we use and process your data for advertising purposes and for market and opinion research. This way we can develop and improve our products and services, our customer service, customer segmentation and customer profiling and the results of (targeted) marketing activities. We do this to establish a relationship with you or to maintain and develop this relationship and to address you in a way that meets your needs. You have the right to object to personalised direct marketing or advertising activities, including profiling in connection with these activities, or to withdraw your consent. You can also unsubscribe from receiving personalised offers at any time.

  2. Improving and developing our products and services

     By analysing how you use and interact with our products and services, we can better understand you and learn where and how we can improve and develop our services. For example, we analyse the results of our marketing activities to measure their effectiveness and the relevance of our campaigns.

• Participation in lotteries

  When participating in and conducting lotteries, we process your personal data that is collected in the context of participation in lotteries and is necessary for their execution. Your data is processed for the fulfilment of contractual obligations (Article 6(1)(b) of the GDPR).

• Registration and participation in events

  When you register for and participate in events, your personal data is collected for the purposes of technical and organisational administration and participation evaluation. Data processing is carried out to fulfil contractual obligations (Article 6(1)(b) of the GDPR) to the extent necessary to enable you to participate in the event. We also use your e-mail address, which we received in connection with the conclusion of this contract, to inform you about our products and services. Your data is processed based on a balancing of interests (Article 6(1)(f) of the GDPR). Our legitimate interest is to inform you about topics, products and services relevant to you following your participation in an event. You can object to this promotional use at any time.

  The photos taken at events are used to promote subsequent events and for public relations work on the website, in social media and in the form of press releases. The photos are processed based on a balancing of interests (Article 6(1)(f) of the GDPR), whereby our legitimate interest lies in the promotion of subsequent events and public relations work.

• Internal management

  We also process your data as part of measures to manage business operations and further develop services and products. The processing of your personal data for these purposes is based on a balancing of interests (Article 6(1)(f) of the GDPR). Our legitimate interests are to have better and more targeted management of business operations and the further development of our services and products.

If your data is processed for purposes that are not listed above, we will ask for your explicit consent prior to processing. You can refuse or withdraw your consent at any time. The lawfulness of processing of your data up to the point of withdrawal of consent remains unaffected.

Who will receive my data?

Within flatexDEGIRO Bank SE, all persons who need to access your data to fulfil the aforementioned purposes will have access to it.

In addition, external parties in the form of service providers and processors we use (e.g., in IT services and marketing) may also be recipients of your data. You can request an overview and more detailed information about the service providers and processors we use.

Will data be transferred to a third country or an international organisation?

We also work with service providers and processors whose headquarters are not located in the European Union or the European Economic Area to run our website and carry out marketing activities. In this case, except in cases permitted by law, we ensure prior to the transfer that the recipient either has an adequate level of data protection or that appropriate safeguards are in place. You can request an overview of the recipients in third countries and a copy of the appropriate or adequate safeguards.

Furthermore, data will only be transferred to locations in countries outside the European Union if you have explicitly consented to this.

How long do we store your data?

We process and store your data as long as it is necessary for the purposes stated, in particular for providing the services you have requested or making the functionalities available. Once the processing of your data is no longer required for the purposes stated, it is deleted on a regular basis.

What are my rights regarding data protection?

As a data subject, you have the following rights when it comes to the processing of your data:

• Right of access: You have the right to obtain information about your personal data we process.
• Right to rectification: You may request the rectification of inaccurate data concerning you and the completion of incomplete data.
• Right to erasure: For certain reasons, you may request the immediate erasure of your personal data.
• Right to restriction of processing: For certain reasons, you have the right to request that the processing of your personal data be restricted.
• Right to data portability: If you have provided us with data based on a contract or consent, you may request that you receive the data you have provided in a structured, commonly used, and machine-readable format or that we transfer it to another controller.

• Right to object to the processing of data for direct marketing purposes: If we use your data for direct marketing or advertising activities, you can object to the processing without giving a reason; this also includes profiling insofar as it relates to such direct marketing. If you object to the processing for direct marketing purposes, we will no longer process your personal data for these purposes.

  The objection can be made informally and should be addressed to:

  flatexDEGIRO Bank SE

  Omniturm, Große Gallusstraße 16-18

  60312 Frankfurt am Main

  Fax: +49 (0) 69 5450001 0

  E-mail: kundeninfo@flatexdegiro.com

• Right to object in individual cases

  You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on a balancing of interests (Article 6(1)(f) of the GDPR).

  If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

• Right to lodge a complaint with the supervisory authority: In addition, you have the right to lodge a complaint with the data protection supervisory authority if you believe that the processing of your personal data is unlawful. The supervisory authority responsible for flatexDEGIRO Bank SE is:

  Der Hessische Beauftragte für Datenschutz und Informationsfreiheit

  Wilhelmstraße 7,

  65185 Wiesbaden.

Am I obligated to provide data?

You are not obliged to provide us with personal data. However, if you wish to use services or functionalities that require personalisation and/or the collection and processing of contact details and other personal data, your data is required. If you do not provide us with this data, we will not be able to provide the service or functionality.