Privacy Policy

As a securities firm, we take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with applicable data protection laws and this Privacy Policy.

Personal data is data that can be used to identify you personally or make you identifiable. This privacy policy explains what data we collect and how we use it. It also explains how and for what purpose this is done.

Date of Privacy Policy

Effective: 02/2026

Given the constant pace of technological change and the ongoing development and improvement of our processes, this policy is updated regularly. We therefore recommend that you review our information and guidelines on data processing at regular intervals. You can find Solidvest’s privacy policy on the Solidvest website.

Data Controller

DJE Kapital AG

Pullacher Straße 24

82049 Pullach

Phone: +49 89 790453-0

Email: info@dje.de

Represented by the Executive Board: Dr. Jens Ehrhardt (Chairman), Dr. Jan Ehrhardt (Vice Chairman), Christian Janas, Peter Schmitz

Scope of Application

This privacy notice explains the nature, scope, and purpose of the processing of personal data by the data controller, which is represented by the management.

The legal basis for data protection within Germany is set forth in particular in the EU General Data Protection Regulation (GDPR), the Federal Data Protection Act (BDSG-neu), and the Telecommunications and Telemedia Data Protection Act (TDDDG).

Handling of Personal Data

Personal data is information relating to an identified or identifiable natural person (data subject).

The processing of such data is lawful only if at least one of the following conditions is met:

• the data subject has consented to the processing of their personal data for one or more purposes (e.g., a declaration of consent for promotional communications),

• the processing is necessary for the performance of a contract or for the implementation of precontractual measures (e.g., a concluded contract, the provision of services, the supply of products),

• the processing is necessary to comply with a legal obligation to which the controller is subject (e.g., disclosure of data to government authorities),

• the processing is necessary to protect the legitimate interests of the data controller or a third party, and the data subject’s conflicting interests do not outweigh these interests (e.g., data transfer to collection agencies and attorneys, video surveillance).

Description of the source groups

To the extent that we have not received the data directly from you, we obtain your personal data (first name, last name, phone number, cell phone number, email address, and your message) from intermediaries, referral sources, or other financial institutions in accordance with Article 6(1)(b) of the GDPR.

Transfer of Personal Data to a Third Country

Personal data is generally not transferred to a third country. Should this nevertheless be the case, the data transfer is governed by an adequacy decision (e.g., Canada), consent, Binding Corporate Rules, or concluded EU Standard Data Protection Clauses, supplemented by appropriate technical and organizational measures (so-called “supplementary measures”).

Standard Retention Periods for the Deletion of Personal Data

Personal data is deleted upon expiration of the statutory and contractual retention periods in accordance with Section 257 of the German Commercial Code and Section 147 of the German Fiscal Code. We are obligated to process data in this manner pursuant to Article 6(1)(c) of the GDPR.

If personal data is not subject to any retention periods, it will be deleted as soon as the stated purposes no longer apply. If you submit a valid request for erasure or revoke your consent to data processing, your data will be erased unless we have other legally permissible grounds for storing your personal data (e.g., retention periods under tax or commercial law); in the latter case, the data will be deleted once these grounds no longer apply.

Data Protection Officer

We have appointed a Data Protection Officer who acts on behalf of the company in accordance with Art. 37 et seq. of the GDPR:

Carolin Bauer

aigner business solutions GmbH

Goldener Steig 42

94116 Hutthurm

Phone: +49 8505 91927-0

Email: Datenschutz@dje.de

Website: https://www.aigner-business-solutions.com

Below, we would like to inform you about your rights under the GDPR:

Right of Access

You have the right to request information from the data controller regarding whether and which of your personal data are being processed.

To this end, the data controller provides an overview of the purposes of processing, the categories of personal data being processed, and the respective recipients or categories of recipients in accordance with Article 15 of the GDPR.

Rights to Rectification, Erasure, and Restriction of Processing

Pursuant to Article 16 of the GDPR, you have the right to request the immediate rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you also have the right to request the completion of incomplete personal data.

Pursuant to Article 17 of the GDPR, you have the right to request that the controller erase personal data concerning you without undue delay, provided that no other legal requirement precludes such erasure.

Pursuant to Article 18 of the GDPR, you have the right to request the restriction of processing if

• the accuracy of the personal data is disputed,

• the processing is unlawful and you oppose the erasure of the personal data and instead request that its use be restricted,

• the controller no longer needs the personal data for the purposes of processing, but needs it to assert, exercise, or defend legal claims,

• you object to the processing pursuant to Article 21 of the GDPR.

Right to Withdraw Consent

You have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of your consent prior to withdrawal.

Right to Object

You have the right under Article 21 of the GDPR to object at any time to the processing of your personal data. The controller will then no longer process the personal data unless it can demonstrate compelling legitimate grounds for the processing that override the interests, rights, and freedoms of the data subject.

If personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing purposes. This also applies to profiling to the extent that it is related to direct marketing. If you object, your personal data will no longer be processed for direct marketing purposes (Art. 21(2) GDPR).

Right to Data Portability

You have the right to have data that the controller processes automatically—based on your consent or in fulfillment of a contract—provided to you or to a third party in a commonly used, machine-readable format. If you request the direct transfer of the data to another controller, this will only take place to the extent that it is technically feasible.

Right to File a Complaint

You have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data violates this Regulation.

Automated Individual Decision-Making, Including Profiling

You have the right not to be subject to a decision based solely on automated processing—including profiling—that produces legal effects concerning you or similarly significantly affects you.

If you are interested in our products and services, we will process your personal data in order to provide you with a quote. We also process your personal data when you enter into contracts with us regarding the use of our products and services. We would like to provide you with the following information regarding this:

Categories of Data Processed

We process the following personal data:

• Identity information (e.g., first and last name, ID card or passport number, nationality, place and date of birth, gender, photo, IP address)

• Contact information (address, email address, and phone number)

• Tax information (tax identification number, tax status)

• Bank, financial, and transaction data (e.g., bank account information (IBAN))

• Money transfers from and to your account/securities account

• Assets

• Disclosed investor profile, investment behavior

• Financial situation (income and expenses)

• Customer contact information collected during the initial business engagement phase and throughout the business relationship—particularly through in-person, telephone, or written communications initiated by you or by DJE Kapital AG—as well as any additional personal data arising therefrom, such as information regarding the contact channel, date, reason, and outcome; (electronic) copies of correspondence; as well as information regarding participation in direct marketing activities and details of requests you have made to us.

• Audiovisual data (information from the video identification process, recordings of calls)

In securities trading:

• Information regarding knowledge and/or experience with securities (MiFID status)

• Investment behavior/strategy (time period, scope, and frequency of the customer’s transactions in financial instruments; the customer’s risk tolerance)

• Information regarding education and occupation (e.g., level of education, occupation, employer’s name)

• Income (e.g., earnings)

• Financial situation

  • Assets, liabilities, income (e.g., from employment or self-employment / business operations); expenses

  • Foreseeable changes in financial circumstances (e.g., reaching retirement age)

  • Specific goals / key priorities for the future (e.g., planned purchases, repayment of liabilities)

  • Marital status, matrimonial property regime, and maintenance obligations

  • Tax information (e.g., details regarding church tax liability), documentation (e.g., declarations of suitability)

In interest rate, currency, and liquidity management:

• Information regarding knowledge and/or experience with interest rate/currency products and financial investments

• MiFID client classification

• Investment behavior/strategy (time frame, scope, and frequency of the customer’s transactions in financial instruments; the customer’s risk tolerance)

• Education, professional qualifications, occupation, position within the company, industry

• Financial situation

  • (assets, liabilities, income—e.g., from employment or self-employment, or business operations; expenses)

  • Anticipated changes in financial circumstances (e.g., reaching retirement age)

  • Specific goals / key priorities for the future (e.g., planned purchases, repayment of liabilities)

  • Tax information (e.g., indication of church tax liability), documentation data (e.g., consultation records)

Processing of Personal Data of Children

To the extent requested by clients, we also collect personal data from children. In doing so, we ensure that the holders of parental responsibility consent to the processing of the personal data or, in certain cases, consent to the child’s processing of such data.

Special Categories of Personal Data

Personal data regarding racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, as well as genetic data, biometric data for the unique identification of a natural person, health data, or data concerning sex life or sexual orientation, are processed by us only to the extent that we are legally authorized to do so.

Purposes and Legal Bases

Pre-contractual and contractual processing pursuant to Art. 6(1)(b) of the GDPR

When you use our products and services, when we provide financial services to you, or when you submit specific inquiries regarding these matters, we process your data for the purposes of contract initiation or contract performance. The purposes of data processing depend primarily on the specific product and may include, among other things, needs assessments, consulting, asset management and advisory services, as well as the execution of transactions. The processing of your data is necessary, for example, when it is used for billing purposes as part of contract fulfillment or to provide you with an offer you have requested.

Consent pursuant to Art. 6(1)(a) GDPR and Art. 9(2)(a) GDPR

To the extent that you have given us consent to process personal data for specific purposes (e.g., sharing data within the group or using your data for specific advertising purposes), the lawfulness of this processing is based on your consent. Data processing for the purpose of contacting us is based on your voluntary consent, for example, when you use the contact form or subscribe to the newsletter on our websites www.dje.de and www.solidvest.de, or when you provide us with a business card. Consent that has been given may be revoked at any time. This also applies to the revocation of consent given to us prior to the entry into force of the EU General Data Protection Regulation, i.e., before May 25, 2018. Please note that the withdrawal of consent applies only to future processing. Processing that took place prior to the withdrawal is not affected. If we intend to use your personal data for purposes other than those mentioned above, we will inform you accordingly and, if necessary, obtain your consent.

Legal obligations under Article 6(1)(c) of the GDPR

As a financial services institution, we are subject to various legal obligations, i.e., statutory requirements (e.g., the EU Financial Markets Directive and Regulation, the Securities Institutions Act, the Money Laundering Act, the Securities Trading Act, tax laws; distance selling law, general civil law obligations), as well as banking supervisory requirements (e.g., from the European Supervisory Authority, the Deutsche Bundesbank, and the Federal Financial Supervisory Authority (BaFin)). The purposes of processing include, among other things, the obligations under the Securities Institutions Supervision Act (WpIG) to record each client’s knowledge and experience with securities services and financial instruments, the client’s financial circumstances and investment objectives, identity and age verification, fraud and money laundering prevention, compliance with sanctions and embargo regulations, responding to official inquiries from a competent government agency or judicial authority, fulfilling tax-related audit and reporting obligations, and the assessment and management of risks at DJE Kapital AG.

Legitimate interest pursuant to Art. 6(1)(f) of the GDPR

We may also process your personal data in our legitimate interest. This includes, for example, being able to process your inquiries to us. Your rights and freedoms, on the other hand, are not considered to take precedence, as the inquiry was initiated by you. We also pursue our legitimate interests when we transfer your data to a lawyer or debt collection agency to collect outstanding debts or enforce our rights. Your rights and freedoms, however, are not considered to take precedence, as it is a reasonable expectation of a data subject that lawyers or debt collection service providers will be engaged in the event of legal disputes or claims.

In addition, we process your data, to the extent necessary, beyond the actual performance of the contract to safeguard our legitimate interests or those of third parties, for example in the following cases:

• Reviewing and optimizing procedures for needs analysis and direct customer outreach, including customer segmentation and calculating the probability of closing a deal

• Advertising or market and opinion research, provided you consent to the use of your data

• Asserting legal claims and defending against legal disputes

• Ensuring IT security and the IT operations of DJE Kapital AG

• Prevention of criminal offenses, in particular fraud prevention

• Measures for building and facility security (e.g., access controls)

• Other measures to ensure the enforcement of property rights

• Measures for business management and the further development of services and products

Source of Your Personal Data

As a general rule, we collect data directly from you. In some cases, we also receive your data from third parties. For example, if you are being assisted by an intermediary or a referral source, your personal data will be transmitted to us by your advisor as part of the application process. Furthermore, we may receive your data from banks, financial portals, Deutsche Post AG (POSTIDENT), and service providers conducting risk assessments in accordance with the Anti-Money Laundering Act (GwG). In addition, in some cases, we obtain information from various public registries.

Recipients of Your Personal Data

Within DJE Kapital AG, access to your data is granted to those departments that require it to fulfill our contractual and legal obligations. Service providers and agents we engage may also receive data for these purposes, provided they maintain banking secrecy and comply with our written data protection guidelines. We may only disclose information about you if required by law, if you have given your consent, or if data processors commissioned by us guarantee compliance with the provisions of the GDPR or the BDSG. Under these conditions, recipients of personal data may include, for example:

• Public authorities and institutions (e.g., the Deutsche Bundesbank, the Federal Financial Supervisory Authority (BaFin), the European Supervisory Authority, tax authorities, the Federal Central Tax Office) where there is a legal or regulatory obligation to do so.

• Other credit and financial services institutions, comparable entities, and processors to whom we transfer personal data in order to conduct our business relationship with you. These companies are also legally or contractually obligated to handle personal data with the necessary care. In particular, we work with IT service providers, financial service providers, and custodian banks.

• Intermediaries, referral sources, and service providers who assist us with the following activities:

  • Support / maintenance of computer/IT applications

  • Archiving

  • Document processing

  • Call center services

  • Compliance services

  • Controlling

  • Data Screening for Anti-Money Laundering Purposes

  • Data Destruction

  • Purchasing / Procurement

  • Space Management

  • Real Estate Appraisals

  • Loan Processing Services

  • Collateral Management

  • Debt Collection

  • Customer Management and Support

  • Mailing Services

  • Marketing

  • Shipping of Customer Gifts

  • Media Technology

  • Reporting

  • Research

  • Risk Management

  • Expense Reporting

  • Telephony

  • Video Verification

  • Website Management

  • Securities Services

  • Share Register

  • Fund Management

  • Auditing services

  • Payment Transactions

• Members of certain regulated professions, such as attorneys, notaries, or auditors

• Other recipients of your data may include those entities to which you have given your consent for data transfer or for which you have exempted us pursuant to an agreement or consent.

Digital Application Process

As part of the preparatory activities, as well as during the process of opening a securities account and the associated data exchange with the custodian bank, we process your personal data in digital form (digital application process).

We generally collect this information directly from you or receive it from your referral source.

This includes the following information:

• Personal identification data: First name, last name, date of birth, place of birth, nationality

• Address information: Street address

• Contact information: Phone number, cell phone number, email address

• Asset data: Portfolio balance, asset overviews

• Contract data: Transaction data, information regarding the asset management agreement

We do not process special categories of personal data as defined in Article 9 of the GDPR.

To facilitate a digital application process and the associated faster account opening, we use a service provider with whom we have entered into a data processing agreement in accordance with Article 28 of the GDPR.

A contractual relationship is possible even without using the digital application process. However, even when processing is done manually, the transfer of your personal data is necessary to fulfill the contract.

Transfer to Third Countries

Data transfers to countries outside the EU or the EEA (so-called third countries) take place only to the extent that this is necessary to execute your orders (e.g., payment and securities orders) or is required by law (e.g., tax reporting obligations), you have given us your consent, or as part of data processing on our behalf. If service providers in third countries are used, they are obligated—in addition to written instructions—to comply with European data protection standards through the EU Standard Contractual Clauses. If you need a printed copy of these provisions or information regarding their availability, you may contact us in writing using the contact information provided.

Obligation to Provide Your Personal Data

As part of our business relationship, you must provide the personal data necessary for establishing and conducting a business relationship and fulfilling the associated contractual obligations, or data that we are legally required to collect. Without this data, we will generally have to refuse to enter into the contract or execute the order, or we will no longer be able to perform an existing contract and may have to terminate it. In particular, under anti-money laundering regulations, we are required to identify you before establishing the business relationship—for example, by verifying your identification card—and in doing so, to collect and record your name, place of birth, date of birth, nationality, as well as your residential address and identification details. In order for us to comply with this legal obligation, you must provide us with the necessary information and documents pursuant to Section 11(6) of the Money Laundering Act and promptly notify us of any changes that arise during the course of the business relationship. If you do not provide us with the necessary information and documents, we may not establish or continue the business relationship you have requested.

Retention Periods

We process and store your personal data for as long as necessary to fulfill our contractual and legal obligations. Please note that our business relationship is a continuing obligation designed to last for several years. If the data is no longer necessary for the fulfillment of contractual or legal obligations, it will be deleted on a regular basis, unless its—temporary—further processing is necessary for the following purposes:

• Compliance with commercial and tax retention periods to fulfill legal obligations (Art. 6(1)(c) GDPR): These include the German Commercial Code, the German Fiscal Code, the Money Laundering Act, and the Securities Trading Act. The retention and documentation periods specified therein range from two to ten years.

• Preservation of evidence within the framework of the statute of limitations provisions in the overriding legitimate interest (Art. 6(1)(f) GDPR). According to Sections 195 et seq. of the German Civil Code (BGB), these statutes of limitations can be up to 30 years, although the standard statute of limitations is three years. For applicants who do not subsequently enter into a contract, a retention period of six months applies. By contrast, your rights and freedoms are not to be regarded as overriding, as it is within a data subject’s reasonable expectation that their data will be retained for a certain period to preserve evidence for potential disputes. Data processing is strictly limited to the specified purpose.

• Defense and assertion of rights and claims in the overriding legitimate interest (Art. 6(1)(f) GDPR): To assert and defend our rights and claims, it may be necessary to continue retaining your personal data in the event of a dispute. By contrast, your rights and freedoms are not to be regarded as overriding, as it is within the reasonable expectation of a data subject that their data will be retained for a certain period of time in the event of a dispute to preserve evidence. Data processing is strictly limited to the specified purpose.

• Backup Retention: In our overriding legitimate interest (Art. 6(1)(f) GDPR) in protecting our business operations and ensuring data protection and information security, we create backup copies at regular intervals. By contrast, your rights and freedoms are not to be regarded as overriding, as it is the reasonable expectation of a data subject that backup copies will be created. Data processing is strictly limited to the specified purpose.

As soon as none of the above-mentioned purposes for further processing of your data apply, we will delete your data.

Data Exchange with Your Advisor (Referrer)

In cases where you are referred to us by your advisor—our referral source—for our services or products, we may exchange personal data with your advisor. This applies to the following data about you:

• Name

• Address

• Contact information

• Account balance

• Asset summaries

• Transaction Data

• Information on the Asset Management Agreement

We receive your data from the referral source as part of the contract initiation process in accordance with Article 6(1)(b) of the GDPR when we receive your request to enter into a contract.

If you have given us your consent pursuant to Article 6(1)(a) of the GDPR, we will also transfer your data to the referral source so that they can provide you with high-quality service and so that we can settle the referral source’s commission with them. Consent is voluntary and may be revoked at any time with future effect. You will not suffer any disadvantages if you do not give your consent or if you revoke your consent at a later date. However, if you do not give your consent or revoke your consent, the support provided by your advisor may be affected because we will then no longer be able to provide them with further information.

Data Processing

We use online conferencing tools, among other things, to communicate with our customers and conduct informational webinars. The specific tools we use are listed below. If you communicate with us via video or audio conference over the Internet, or participate in one of our webinars online, your personal data will be collected and processed by us and by the provider of the respective conferencing tool.

The conferencing tools collect all data that you provide or use to access the tools (email address and/or your phone number). Furthermore, the conferencing tools process the duration of the conference, the start and end times of your participation in the conference, the number of participants, and other “contextual information” related to the communication process (metadata).

In addition, the tool provider processes all technical data necessary for facilitating online communication. This includes, in particular, IP addresses, MAC addresses, device IDs, device type, operating system type and version, client version, camera type, microphone or speaker, and the type of connection.

If content is exchanged, uploaded, or otherwise made available within the tool, it is also stored on the tool provider’s servers. Such content includes, in particular, cloud recordings, chat/instant messages, voicemails, uploaded photos and videos, files, whiteboards, and other information shared while using the service.

Please note that we do not have full control over the data processing activities of the tools used. Our options depend largely on the corporate policies of the respective provider. For further information on data processing by the conferencing tools, please refer to the privacy policies of the respective tools, which we have listed below this text.

Purpose and Legal Basis

The conference tools are used to communicate with prospective or existing contractual partners or to offer specific services to our customers (Art. 6(1)(b) GDPR). Furthermore, the use of these tools serves to generally simplify and expedite communication with us or our company, as well as to conduct webinars and informational events (legitimate interest within the meaning of Article 6(1)(f) of the GDPR). To the extent that consent has been requested, the use of the relevant tools is based on this consent (Art. 6(1)(a) GDPR); consent may be revoked at any time with future effect.

Retention Period

The data collected directly by us via the video and conferencing tools is deleted from our systems as soon as you request deletion, revoke your consent to storage, or the purpose for data storage no longer applies. Stored cookies remain on your device until you delete them. Mandatory statutory retention periods remain unaffected by this.

We have no influence over the retention period of your data that is stored by the operators of the conferencing tools for their own purposes. For details, please contact the operators of the conferencing tools directly.

Conference Tools Used

We use the following conference tools:

Zoom

We use Zoom. This service is provided by Zoom Communications Inc., San Jose, 55 Almaden Boulevard, 6th Floor, San Jose, CA 95113, USA. For details on data processing, please refer to Zoom’s Privacy Policy: https://zoom.us/de-de/privacy.html.

Data transfers to the United States are based on the European Commission’s Standard Contractual Clauses. Details can be found here: https://zoom.us/de-de/privacy.html.

GoToWebinar

We use GoToWebinar. The provider is LogMeIn, Inc., 320 Summer Street, Boston, MA 02210, USA. For details on data processing, please refer to GoToMeeting’s privacy policy: https://www.goto.com/de/company/legal/privacy.

Data transfers to the United States are based on the European Commission’s Standard Contractual Clauses. Details can be found here: https://logmeincdn.azureedge.net/legal/lmi-customer-dpa-2020v1-de.pdf

We would like to contact you for promotional purposes to provide you with information about our company’s offerings and services, particularly regarding webinars, customer satisfaction surveys, promotions, and events.

Legal Basis for Data Processing

The legal basis for this is either your consent pursuant to Article 6(1)(a) of the GDPR and Section 7 of the UWG, or our legitimate interest in direct marketing pursuant to Article 6(1)(f) of the GDPR in conjunction with Section 7 of the UWG.

Purposes of Processing Your Data

Data processing for these purposes includes the processing of your lawfully stored data in conjunction with the relevant information regarding your financial circumstances, your risk tolerance, and securities account data for personalized advertising, market research, statistics, and analyses. It also includes the use of this data to uniquely identify you, to provide you with the best possible services and customer experiences, and to avoid any inconsistencies in connection with the aforementioned purposes of promotional communication.

To this end, automated processes are used to match and merge data in order to identify potential matches across two or more data records from different sources and systems, with the goal of generating a unique, accurate, and consistently up-to-date customer master record.

Marketing Communications Based on Your Consent

If you provide us with your consent, we base the aforementioned data processing on your consent pursuant to Art. 6(1)(a) GDPR/§ 7 UWG. The following provisions apply to data processing in connection with the submission of this declaration of consent:

Contact Channels

To respect your personal rights to the greatest extent possible, we offer you a choice between various communication channels (phone, email, mail, cell phone/text message) whenever possible. Accordingly, we will only use those channels to which you have consented.

Processing of Data for Documentation Purposes

For record-keeping purposes and to fulfill our accountability obligations under Article 5 of the GDPR, we will retain your declaration of consent and the personal data it contains until the purpose for which it was stored no longer applies within our company. Consequently, your declaration of consent will be deleted in accordance with data protection regulations 5 years after you revoke your consent to receive marketing communications.

Consequences of Non-Submission and Withdrawal

Your consent is always voluntary. You are free at any time to withdraw a declaration of consent you have previously provided, effective for the future, or to decline to provide a declaration of consent when requested. This action will have no negative consequences for you. Please note, however, that if you revoke or do not provide your consent, we will not be able—or will no longer be able—to provide you with information and offers from our company.

Marketing Communications and Sweepstakes or Events

If you have provided us with personal data in connection with a sweepstakes or event, we will process this data solely for the purpose of promotional communications, provided that you have given us your explicit and voluntary consent in accordance with Article 6(1)(a) of the GDPR.

Marketing Communications Based on Our Legitimate Interest

In some cases, we also process your personal data for the purposes mentioned above based on our legitimate interest pursuant to Article 6(1)(f) of the GDPR. Our legitimate interest in this context lies in non-intrusive direct marketing, and your rights and freedoms are not considered to take precedence over this interest.

If we send you advertising via electronic mail (email), we use only email addresses that we have collected in connection with the sale of a product or service, send direct marketing only for our own similar products or services, and use your email address only as long as you have not objected to receiving direct marketing.

If we send you direct marketing by mail based on our legitimate interest, we will use your data for this purpose until you have objected to this form of direct marketing.

With this form of direct marketing, you have the right to object at any time pursuant to Article 21(2) of the GDPR, without having to provide a reason.

Processing of Data for Record-Keeping Purposes

If necessary to pursue our legitimate interests, we will process the declaration of consent or the data stored therein or in connection therewith, to the extent that we are authorized to do so. This may also include the disclosure of this information to legal counsel or government agencies in accordance with Article 6(1)(f) of the GDPR.

Direct Marketing Without Personal Reference

Provided that contact data is not personally identifiable and the recipient of the direct marketing is not a consumer as defined in § 13 BGB, we also use this data for telephone-based direct marketing, to the extent that we may assume the recipient’s implied consent. Furthermore, we also collect contact information from third parties for the purposes of promotional communication, to the extent permitted by law.

Blacklist/Robinson List

Contact information for individuals who do not have a customer account with us and who have exercised their right to object to direct marketing pursuant to Article 21(2) of the GDPR or Section 7 of the UWG is stored by us in a blacklist/Robinson list. The purpose of this data processing is our legitimate interest under Article 6(1)(f) of the GDPR in managing and properly addressing objections to direct marketing. By contrast, the interests or fundamental rights and freedoms of the data subjects are not to be regarded as prevailing, as the data processing is necessary to safeguard the rights and freedoms of the data subjects; without this list, objections to direct marketing could not be taken into account when sending out advertising.

Purposes of Data Processing

As the organizer of a sweepstakes, DJE will process personal data to the extent necessary to establish the legal relationship with the participant and to subsequently conduct and administer the sweepstakes (Art. 6(1)(b) GDPR). This also includes verifying eligibility requirements and determining the winner. The winners’ data will be stored within the statutory retention periods (in particular under the German Commercial Code (HGB), the German Fiscal Code (AO), and the German Securities Trading Act (WpIG)) in accordance with Article 6(1)(c) of the GDPR.

DJE will also send all participants an email newsletter containing information about DJE’s offers and services based on their consent pursuant to Art. 6(1)(a) of the GDPR. Participation in the sweepstakes is not possible without providing this consent. Consent may be revoked at any time with future effect.

Should legal disputes arise in the course of conducting the sweepstakes or thereafter, we will retain the data of the participants concerned for as long as we need it to defend our rights in accordance with Article 6(1)(f) of the GDPR.

Categories of Data Collected

Data from contest participants is collected. This typically includes the participant’s title, first and last name, the company to which the participant belongs, as well as their email address, phone number, and mailing address.

Duration of Data Retention

Data from winners is retained in accordance with the statutory retention requirements under Section 257 of the German Commercial Code and Section 147 of the German Fiscal Code. Data from all participants is processed after the contest has been concluded until their declaration of consent is revoked, and is retained for an additional five years to serve as proof that the declaration of consent was provided.

Recipients of the Data

Data will not be disclosed to third parties without your prior consent. DJE uses the services of data processors to send out the newsletter. In accordance with Article 28 of the GDPR, these processors are obligated to process the data only on DJE’s instructions and to treat it confidentially.

Obligation to Provide Your Data

You are not required to provide your data to DJE. However, if you do not provide your data and do not consent to receiving the newsletter, you will not be able to participate in the contest.

We process the personal data of our business partners.

Data Subjects and Data

When we process personal data of our business partners, this primarily involves data pertaining to their employees or contact persons. We process only the data necessary to fulfill the intended purpose. In particular, this includes:

• Identity information (e.g., first and last name, gender, company affiliation, job title/position)

• Contact information (address, email address, and phone number)

• Communication data (content and timing of communication, details regarding the recipient and sender of communication)

• Contract information (details regarding the contract, contract terms, and contract status)

Data Processing

This is done, on the one hand, in the context of contract initiation and performance pursuant to Article 6(1)(b) of the GDPR, in order to fulfill existing contracts or to negotiate the conclusion of contracts.

Furthermore, we process your personal data based on our legitimate interest in safeguarding and pursuing our legal claims pursuant to Article 6(1)(f) of the GDPR.

If we are legally required to process your personal data, we process your data in accordance with Article 6(1)(c) of the GDPR.

Transfer to Third Countries

Data transfers to countries outside the EU or the EEA (so-called third countries) take place only to the extent that this is necessary to execute your orders (e.g., payment and securities orders) or is required by law (e.g., tax reporting obligations), you have given us your consent, or as part of data processing on our behalf. If service providers in third countries are used, they are obligated—in addition to written instructions—to comply with European data protection standards through the EU Standard Contractual Clauses. If you need a printed copy of these provisions or information, you may contact us in writing using the contact information provided.

Obligation to Provide Your Personal Data

As part of our business relationship, you must provide the personal data necessary for establishing and conducting a business relationship and fulfilling the associated contractual obligations, or data that we are legally required to collect. Without this data, we will generally have to refuse to enter into the contract or execute the order, or we will no longer be able to perform an existing contract and may have to terminate it.

In particular, under anti-money laundering regulations, we are required to identify you before establishing the business relationship—for example, by verifying your identification card—and in doing so, to collect and record your name, place of birth, date of birth, nationality, as well as your residential address and identification details. In order for us to comply with this legal obligation, you must provide us with the necessary information and documents in accordance with Section 11(6) of the Money Laundering Act and promptly notify us of any changes that arise during the course of the business relationship. If you do not provide us with the necessary information and documents, we may not establish or continue the business relationship you have requested.

Retention Periods

We process and store your personal data for as long as necessary to fulfill our contractual and legal obligations. Please note that our business relationship is a continuing obligation designed to last for several years. If the data is no longer necessary for the fulfillment of contractual or legal obligations, it will be deleted on a regular basis, unless its—temporary—further processing is necessary for the following purposes:

• Compliance with commercial and tax law retention periods to fulfill legal obligations (Art. 6(1)(c) GDPR): These include the German Commercial Code, the German Fiscal Code, the Money Laundering Act, and the Securities Trading Act. The retention and documentation periods specified therein range from two to ten years.

• Preservation of evidence within the framework of the statute of limitations provisions in the overriding legitimate interest (Art. 6(1)(f) GDPR). According to Sections 195 et seq. of the German Civil Code (BGB), these statutes of limitations can be up to 30 years, although the standard statute of limitations is three years. For applicants who do not subsequently enter into a contract, a retention period of six months applies. By contrast, your rights and freedoms are not to be regarded as overriding, as it is within a data subject’s reasonable expectation that their data will be retained for a certain period to preserve evidence in the event of any disputes. Data processing is strictly limited to the specified purpose.

• Defense and assertion of rights and claims in the overriding legitimate interest (Art. 6(1)(f) GDPR): To assert and defend our rights and claims, it may be necessary to continue retaining your personal data in the event of a dispute. By contrast, your rights and freedoms are not to be regarded as overriding, as it is within the reasonable expectation of a data subject that their data will be retained for a certain period of time in the event of a dispute to preserve evidence. Data processing is strictly limited to the specified purpose.

• Backup Retention: In our overriding legitimate interest (Art. 6(1)(f) GDPR) in protecting our business operations and ensuring data protection and information security, we create backup copies at regular intervals. By contrast, your rights and freedoms are not to be regarded as overriding, as it is the reasonable expectation of a data subject that backup copies will be created. Data processing is strictly limited to the specified purpose.

As soon as none of the above-mentioned purposes for further processing of your data apply, we will delete your data.

Recipients of the Data

Within DJE Kapital AG, access to your data is granted to those departments that need it to fulfill our contractual and legal obligations. Service providers and agents we engage may also receive data for these purposes, provided they maintain banking secrecy and comply with our written data protection guidelines. We may only disclose information about you if required by law, if you have given your consent, or if data processors commissioned by us guarantee compliance with the relevant regulations—in particular the GDPR and the BDSG. Under these conditions, recipients of personal data may include, for example:

• Public authorities and institutions (e.g., the Deutsche Bundesbank, the Federal Financial Supervisory Authority (BaFin), the European Supervisory Authority, tax authorities, and the Federal Central Tax Office) where there is a legal or regulatory obligation to do so.

• Other credit and financial services institutions, comparable entities, and data processors to whom we transfer personal data in order to conduct our business relationship with you. These companies are also legally or contractually obligated to handle personal data with the necessary care. In particular, we work with IT service providers, financial service providers, and custodian banks.

• Intermediaries, referral sources, and service providers who assist us with the following activities:

  • Support / maintenance of computer/IT applications

  • Archiving

  • Document processing

  • Call center services

  • Compliance services

  • Controlling

  • Data Screening for Anti-Money Laundering Purposes

  • Data Destruction

  • Purchasing / Procurement

  • Space Management

  • Real Estate Appraisals

  • Loan Processing Services

  • Collateral Management

  • Debt Collection

  • Customer Management and Support

  • Mailing Services

  • Marketing

  • Shipping of Customer Gifts

  • Media Technology

  • Reporting

  • Research

  • Risk Management

  • Expense Reporting

  • Telephony

  • Video Verification

  • Website Management

  • Securities Services

  • Share Register

  • Fund Management

  • Auditing services

  • Payment Services

• Members of certain regulated professions, such as attorneys, notaries, or auditors

• Other recipients of your data may include those entities to which you have given your consent for data transfer or for which you have exempted us pursuant to an agreement or consent.

When you apply for a job with us, we process your personal data as follows:

Purpose and Legal Basis for Data Processing

Application Process

The storage of your data as part of the application process and the associated processing of that data serve the purpose of filling a vacant position at our company.

a) Application for a Specific Job Posting

We publish job openings for our company on our website and on job portals. If you are interested in one of these job openings, you can apply to us for that specific position. Your application data will then be used solely for the application process for this specific position and processed in accordance with Art. 6(1)(b) of the GDPR and § 26 of the BDSG. If your application is not successful, your data will be deleted within four months after the end of the application process.

b) Unsolicited Application

You have the option of sending a speculative application to our company without referring to a specific job posting. These applications will be reviewed. Your application data will then be used solely for the application process and processed in accordance with Article 6(1)(b) of the GDPR and Section 26 of the BDSG. If your application is not successful, your data will be deleted within four months after the end of the application process.

Candidate Pool

If, as part of an application—whether for an advertised position or a speculative application—you have provided consent in accordance with Article 6(1)(a) of the GDPR, this consent applies to your inclusion in our applicant pool and the associated extended storage of your documents for up to 1 year. Only after you have given your consent will you be added to our pool with the data you have provided to us.

Access to the applicant pool is granted for the following purpose: to fill a position within our company. Your data is therefore compared with the job profile, and you are included in the application process. This data processing is carried out pursuant to Section 26 of the German Federal Data Protection Act (BDSG) in conjunction with Article 88 of the GDPR for the purpose of establishing an employment relationship.

For record-keeping purposes

Furthermore, we process your data in accordance with Article 6(1)(f) of the GDPR if this is necessary for a legitimate interest and your rights do not override that interest. This applies in particular to the retention of your application documents for evidentiary purposes in the event of a legal dispute related to the application process.

Legal Obligations

Processing your data within our company may also be necessary to comply with a legal obligation to which we are subject, pursuant to Article 6(1)(c) of the GDPR. An example of this is compliance with statutory retention periods.

Description of the Data Processed

We store and process all data that you provide to us during the application process. This includes both the data from your application documents and the information you provide to us during a phone interview or in-person interview.

The data processed includes, among other things, your contact information such as last name, first name, address, phone number, and email address, as well as all data regarding your professional and educational qualifications and degrees.

In addition, special categories of personal data within the meaning of Article 9 of the GDPR may also be subject to processing. This may include, in particular, data regarding health status, religious or philosophical beliefs, and membership in political parties or labor unions. Furthermore, submitted application photos may contain personal data that falls under the special categories of personal data. This includes, for example, information regarding racial and ethnic origin and health status. The processing of this special data serves solely to enable us to use your application documents for the purpose of recruitment. Our company will not take this special information into account in its decision-making process, unless there is a legal obligation to do so. If you do not wish for this data to be processed, you are free to submit new application documents that do not include this information. This action will not affect the prospects of your application.

Data Disclosure

1. Data Transfer to Our Company

In some cases, we also receive application materials and other information from recruitment service providers. Where applicable, we will process the personal data contained therein in the manner described here as part of our application process.

2. Data Disclosure by Our Company

Data may be disclosed by our company to fulfill legal obligations under Article 6(1)(c) of the GDPR (e.g., to government agencies, law enforcement, etc.). It may also occur based on our legitimate interest pursuant to Article 6(1)(f) of the GDPR (e.g., to attorneys, tax advisors, government agencies, etc.).

Obligation to Provide Data

You are not obligated to provide us with your data under any legal or contractual provisions. However, providing your data is necessary in order to be considered for a vacant position.

There is no obligation to grant permission for long-term storage. However, without this consent, we cannot consider your data for placement beyond the application process for a specific position or an unsolicited application.

Standard Retention Periods for Personal Data

If processing is based on consent you have provided, we will process your data until you revoke that consent. Personal data will be deleted upon expiration of the statutory and contractual retention periods. If personal data is not subject to any retention periods, it will be deleted as soon as the stated purposes no longer apply. If your application is unsuccessful, your data will be deleted four months after the application process ends. If you are hired by our company, your application documents will be transferred to your personnel file and will then be subject to the corresponding retention periods. If we are permitted to store and process your data based on a declaration of consent you have provided, your data will be stored until you revoke your consent.

Transfer of Personal Data to a Third Country

As a general rule, personal data is not transferred to a third country. Should this nevertheless occur, the data transfer is governed by an adequacy decision (e.g., Canada), consent, Binding Corporate Rules, or EU Standard Data Protection Clauses.

Privacy Policy of DJE Investment S.A.