Policy on Privacy

1 Introduction and legal basis

GLOBAL BANK FINANCIAL (hereinafter referred to as “We”, “Our” or the “Company”) is committed to protecting the confidentiality of all personal data obtained in the course of its activities. The founding principles of this commitment are set out in this Privacy Policy. “You” and “your” means any person who has applied for, registered with, or used a product or service offered by Us (the “Service”), including co-applicants, guarantors or legal representatives.

This Privacy Policy has been designed to comply with Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 (“GDPR”) as well as the German Federal Data Protection Act (Bundesdatenschutzgesetz, “BDSG”). It explains the types of personal data We collect, how it is used and the measures put in place to ensure its security. The term “personal data” means any information relating to an identified or identifiable natural person (art. 4(1) GDPR). This data may be collected directly from you, during your interactions with us, or from external sources such as public registries, credit reporting agencies, other financial institutions, service providers or any other source with your consent or in accordance with applicable law.

Protecting your privacy is fundamental to GLOBAL BANK FINANCIAL. Therefore, we provide you with this policy to explain our practices regarding the collection, use and disclosure of data we receive in connection with our services. This policy does not apply to third party websites, services or applications, even if they are accessible through our Services.

GLOBAL BANK FINANCIAL uses third-party processors to process and store the personal data we collect. This data is hosted in the European Economic Area (EEA) or, in some cases, outside the EEA, in strict compliance with the appropriate safeguards provided by the GDPR (in particular the standard contractual clauses approved by the European Commission). GLOBAL BANK FINANCIAL remains responsible for all data it collects and ensures that any international transfer is carried out in accordance with the requirements of the GDPR and applicable German law.

2 Data protection principles (GDPR / DSGVO)

This policy is designed to comply with the principles relating to the processing of personal data established in Article 5 of the GDPR and included in the German BDSG. All employees of GLOBAL BANK FINANCIAL have the responsibility to implement, respect and maintain these principles at all times.

We may modify this privacy policy at any time. In the event of material changes, we will notify you by publication on our website or by electronic notification, in accordance with the requirements of the GDPR.

3 Collection of your personal data

When you make an inquiry, provide a warranty, or use a product or service as a current or former customer, we may collect and confirm personal data about you, such as:

• information to establish your identity, such as your name, address, occupation, date of birth and other identification documents required by law (in particular the German Money Laundering Act, GwG);
• information about your financial situation, including your annual income, assets, liabilities, and credit history;
• information reflecting your business relationship with us;
• information about your transactions, including payment history and account activity;
• information regarding your browsing activity, your browser, and your device;
• information on beneficial owners, intermediaries and other parties required by European anti-money laundering regulations (Directive 2015/849/EU);
• other information we may require to provide you with a specific product or service;
• tax status (in particular for the purposes of FATCA/CRS compliance and German tax law, Abgabenordnung);
• other information with your consent, or where European or German law permits or requires it.

4 Use of your personal data

Based on the legal grounds referred to in Article 6 of the GDPR, we may use your personal data in order to:

• verify your identity, in particular by carrying out the checks required by European and German regulations relating to the fight against money laundering and the financing of terrorism;
• assess your current and future creditworthiness, including by consulting authorized credit reporting agencies (such as SCHUFA);
• evaluate and process your application, account, transactions, and reports;
• provide you with the products and services you have requested;
• communicate with you in general, including responding to your requests;
• understand your needs for products and services;
• send you commercial communications, subject to your prior consent in accordance with Article 7 UWG (German Anti-Unfair Competition Act);
• determine your eligibility for certain of our products and services and offer them to you;
• help us manage and assess our risks, operations, and our relationship with you;
• prevent and detect fraud and errors;
• collect amounts owed to us;
• maintain the accuracy and integrity of information held by credit reporting agencies;
• comply with the legal and regulatory requirements applicable in European and German law (in particular BaFin, BCE, ABE).

We may also use your personal data for other purposes with your explicit consent or where required or permitted by European or German law.

5 Communication of your personal data

We may disclose your personal data to third party processors and service providers, to the extent necessary for the purposes described above or to offer you a product or service. Any recipient of your data is bound by processing agreements in accordance with Article 28 of the GDPR.

We may communicate your personal data:

• to our employees, agents, service providers and any other entity acting on our behalf, who are required to respect the same confidentiality obligations; any transfer outside the EEA is governed by appropriate guarantees (standard contractual clauses, adequacy decision of the European Commission, etc.);
• to other financial institutions for the purposes of processing payments or verifying information such as your identity;
• to payment networks for the purposes of operating or administering the payment system;
• in response to a judicial decision, letter rogatory or any other request from a competent German or European authority;
• to meet applicable legal, audit, prudential supervision (BaFin, BCE, ABE) and regulatory requirements;
• in the context of restructuring, transfer or merger operations involving all or part of our activity, in accordance with the GDPR;
• to any person or organization for the purposes of prevention, detection or repression of fraud and criminal activities;
• to enable us to recover a debt or enforce a legal or contractual obligation;
• with your explicit consent; and where European or German law permits or requires it.

Additional collection, use and disclosure

6 Cookies and web technologies

Cookies

Cookies are small text files placed on your device by our web server when you access our services. In accordance with the GDPR and the recommendations of the European Data Protection Authorities (EDPS), we use session cookies and persistent cookies only with your consent, except when strictly necessary for the operation of the service. Session cookies are deleted when the browser is closed. Persistent cookies remain on your device for a specific period of time.

You can withdraw your consent or change your preferences at any time via our consent manager or your browser settings. Refusing certain cookies may limit access to certain features of the services.

Web beacons and tracking pixels

Web beacons (tracking pixels, clear GIFs) are small images with a unique identifier that may be integrated into our Services. In accordance with the GDPR, their use requires your prior consent, unless they are strictly necessary for the operation of the service. We use them to measure the performance of our services and the effectiveness of our communications.

Log Data

Our servers automatically record certain information relating to the use of our services. This log data may include IP address, browser type, operating system, pages visited, time spent on each page, and links clicked. These data are processed on the basis of our legitimate interest (art. 6(1)(f) GDPR) for the purposes of administration and security of the services. IP addresses are pseudonymized as soon as possible.

Mobile devices

We collect certain information transmitted by your mobile device when you use our Services, such as a device identifier, your user settings and operating system. This information is processed for the provision and improvement of services in compliance with the GDPR.

7 Protection of your personal data

In accordance with Article 32 of the GDPR, we have implemented technical and organizational measures adapted to the level of risk linked to the processing of your personal data. These measures aim to ensure the confidentiality, integrity, availability and resilience of processing systems, and to protect your data against loss, theft, unauthorized access, disclosure, modification or destruction. Only duly authorized employees, agents and subcontractors have access to your data within the strict framework of their duties.

Communications

We may monitor and/or record communications between you and our representatives (telephone calls, emails, online chats) for the purposes of training, quality control, mutual protection and to improve customer service. You will be informed of this in accordance with applicable European and German law.

Links to Other Sites

Our Services may contain links to third-party websites and services. Any information communicated to a third party service is subject to its own privacy policy. We are not responsible for the privacy practices of third-party services and recommend that you carefully review their policies before disclosing your data to them.

8 Your rights over your personal data

In accordance with articles 15 to 22 of the GDPR, you have the following rights regarding your personal data processed by: GLOBAL BANK FINANCIAL :

• Right of access (art. 15 GDPR) — Obtain confirmation that your data is processed and obtain a copy.
• Right of rectification (art. 16 GDPR) — Have your inaccurate or incomplete data corrected.
• Right to erasure (art. 17 GDPR) — Request the deletion of your data in the cases provided for by the GDPR (“right to be forgotten”).
• Right to restriction of processing (art. 18 GDPR) — Request the temporary suspension of the processing of your data.
• Right to portability (art. 20 GDPR) — Receive your data in a structured, commonly used and machine-readable format.
• Right to object (Art. 21 GDPR) — Object at any time to processing based on our legitimate interest or for commercial prospecting purposes.

To exercise any of these rights, please send a written request to our Data Protection Officer. We will respond within one (1) month of receipt of your complete request, with the possibility of extending it for an additional two months in the event of complexity or large volume, after having informed you.

In certain situations required by law, we may not be able to comply with your request (for example, if doing so would infringe confidential business information or data about a third party). In this case, we will inform you and indicate the available remedies, in particular with the competent supervisory authorities.

9 Retention and deletion of personal data

In accordance with the principle of limitation of retention provided for in Article 5(1)(e) of the GDPR, we keep your personal data only for the period necessary for the purposes for which they were collected. The periods also take into account the legal retention obligations imposed by German law, in particular the Commercial Code (HGB: 6 to 10 years) and the Tax Code (AO: 10 years).

At the end of the applicable retention period, your data will be securely deleted or irreversibly anonymized. After termination or deactivation of our Services, we or our contractors may retain certain data for legally required periods of time for archival, auditing, or dispute resolution purposes.

For any questions regarding the retention period of your data or the deactivation of your services, please contact us directly at: rgpd@globalbankfinancial.com.

Electronic Communications

We may contact you electronically (SMS, email, voice messages) to inform you about our products and services or to comply with our legal obligations, in compliance with European regulations on electronic communications (ePrivacy Directive) and the German Anti-Unfair Competition Act (UWG). You can object to receiving commercial communications at any time.

10 Withdrawal of consent and right to object

When the processing of your personal data is based on your consent (art. 6(1)(a) or 9(2)(a) GDPR), you can withdraw this consent at any time, without affecting the lawfulness of the processing carried out before this withdrawal. Withdrawing consent may result in us not being able to provide you with certain products or services.

If you hold a credit product with us (loan, mortgage, guarantee), you cannot, during the term of the contract, withdraw your consent to the processing of data directly linked to this product, to the extent that this processing is necessary for the execution of the contract (art. 6(1)(b) GDPR) or for legal obligations to which we are subject (art. 6(1)(c) GDPR).

You cannot object to the processing of your data when this processing is required by a binding European or German legal or regulatory provision.

You can at any time object to the use of your data for commercial prospecting purposes, including profiling carried out for these purposes, in accordance with Article 21(2) of the GDPR.

Your Choices

We offer you the opportunity to exercise your choices regarding the collection, use and sharing of your personal data, within the limits permitted by European and German law. If you decide not to provide us with certain data, you may not be able to access all or some of the features of our services.

Unsubscribing from commercial communications

If you have subscribed to our mailing list, you will receive commercial newsletters. You can unsubscribe at any time via the unsubscribe link in each email or by contacting our customer service in accordance with Article 21(3) GDPR and Article 7 UWG. Certain service communications cannot be unsubscribed because they are necessary for the performance of the contract or our legal obligations.

Contact us

We are committed to providing you with clear and easily accessible information on the management of your personal data. To exercise your rights (access, rectification, erasure, portability, opposition, limitation), ask questions relating to our confidentiality policy or withdraw your consent, you can send a written request to our Data Protection Officer (DPO) or contact us directly: