Published by Deutsche Wealth Management. © Deutsche Bank AG, All rights reserved

Online Banking and Mobile Banking Privacy Statement

fundamental responsibilities. We have been safeguarding our clients’ privacy for decades by

maintaining strict standards of security and procedures which are specially designed to prevent

misuse of this information. This Privacy Statement describes how we, Deutsche Bank (Suisse) SA

(“Deutsche Bank”), located at Prime Tower, Hardstrasse 201, 8005 Zürich, email dbs.dpo@db.com,

as controller collect and process personal data and other information of you or of you in your capacity

as the authorised representative / agent of the legal entity (hereinafter referred to as “you”), when

using eBanking services via Online Banking (https://dwoch.db.com) and Mobile Banking.

1. What categories of Personal Data do we collect and process?

We collect and process information by which you can be identified (“Personal Data”).

We also process the following Personal Data available in your eBanking account including log in

credentials, account data incl. statements, portfolio data, and transaction data (“Account Data”), which

we received from you upon account opening and eBanking opening and which depend on the

transactions on your account.

We also collect device and usage information, which includes information specific to the used device

to access Online Banking and Mobile Banking (including language preferences) (“Usage

Information"). We collect such information when you are browsing Online Banking and Mobile

Banking.

We collect and process your Log in Data and Account Data to provide you with the eBanking services

and to better serve your financial needs, i.e. that you can access your account statements online, and

to administer our business. We collect, retain and use Usage Data about you for the purposes of better

serving you, e.g. to remember your language preferences.

The legal basis for the processing of Log in Data and Account Data is E-banking enrollment. The legal

basis for Usage Data are our legitimate interests which are the following: to maintain the performance

of Online Banking and Mobile Banking and to analyze usage.

and you will not receive marketing materials by us.

3. How long will Personal Data be stored?

Log in Data and Account Data will normally be stored until it has fulfilled the purpose it was collected

for, i.e. during the eBanking enrollment with you. Once our relationship has come to an end, we will

store your Log in Data and Account Data according to statutory limitation periods and then delete

them, unless statutory retention periods apply or if necessary to establish, exercise or defend a legal

claim. This also applies to Usage Data, unless you object to the respective processing in which case

we will erase or anonymize such information.

Cookies are used to improve the end-user experience by using the former mentioned tracking

technologies. Users can configure their browser to prevent or warn against cookies. However certain

functions or services might not be available in this case.

5. Who will have access to my Personal Data?

The Personal Data gathered will be stored by Deutsche Bank and only accessed by the team

responsible for you. Personal Data may be shared with service providers that provide IT services for

us and act as processors. Those service providers are located in Switzerland (for which an adequacy

decision of the EU Commission exists) and process Personal Data in Switzerland. If your relationship

manager is with another Deutsche Bank group company, your Personal Data may also be accessed

by the relationship manager of such other Deutsche Bank group company in order to better serve your

financial needs. It will only be used according to the purpose for which the data has been collected.

We reserve the right to disclose your information only in circumstances where disclosure is required

under the law, to cooperate with regulators or law enforcement authorities or to protect our rights and

6. How is Personal Data protected?

implemented additional, comprehensive security procedures for our internet-banking-system. A

firewall is deployed as a means to prevent external access to account information from Deutsche

Bank’s system. We also deploy multiple layers of encryption and identification to address the concern

of unauthorized inquiries or interception by the transmission of client information.

If, at any time, you are not satisfied with our procedure to protect your privacy or if you have questions

regarding the collecting and/or use of your Personal Data or regarding our privacy statement, please

contact us. We will use all commercially reasonable efforts to promptly address your concern.

7. Your rights

Pursuant to applicable data protection law you may have the right (i) to request access to your

a. Right of access

You may have the right to obtain from us confirmation as to whether or not Personal Data concerning

you is processed, and, where that is the case, to request access to the Personal Data. The access

concerned, and the recipients or categories of recipient to whom the Personal Data have been or will

be disclosed.

You may have the right to obtain a copy of the Personal Data undergoing processing. For further

copies requested by you, we may charge a reasonable fee based on administrative costs.

You may have the right to obtain from us the rectification of inaccurate Personal Data concerning you.

Depending on the purposes of the processing, you may have the right to have incomplete Personal

Data completed, including by means of providing a supplementary statement.

Under certain circumstances you may have the right to obtain from us restriction of processing your

Personal Data. In this case the respective data will be marked and may only be processed by us for

certain purposes.

Under certain circumstances you may have the right to receive the Personal Data concerning you,

which you have provided to us, in a structured, commonly used and machine-readable format and you

may have the right to transmit those data to another entity without hindrance from us.

f. Right to object

Under certain circumstances you may have the right to object, on grounds relating to your particular

situation, at any time to the processing of your Personal Data, including profiling, by us and we can be

required to no longer process your Personal Data. As we process and use your Personal Data

primarily for purposes of carrying out the contractual relationship with you, we will in principle have a

legitimate interest for the processing which will override your objection request, unless the objection

request relates to marketing activities.

To exercise your rights please contact us as stated below.

We reserve the right to modify this Privacy Statement at any time. Nevertheless we will actively inform

you about changes.