Dear Client

The following data protection notice provides an overview of how personal data held at our institute may be processed and your rights in relation to this information under the new EU General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DPA). The observance of data protection was outsourced by us to the Liechtensteinische Landesbank (Österreich) AG. The specific data that will be processed and how data will be used will essentially depend on the services and products that will be provided and / or have been agreed in each case. The institute is required under bank-client confidentiality rules to protect your privacy and keep your information confidential and will therefore implement a range of technical and organisational measures to ensure data security for all processing of personal data.

In the course of our business relationship, we will need to process personal data that are required for the purpose of setting up and conducting the business relationship, meeting applicable statutory or contractual requirements, providing services and executing orders. Without such data we would normally be unable to enter into or to maintain a business relationship, process orders, or offer services and products.

If you have any questions regarding specific data processing activities or wish to exercise your rights, as described under section 5 below, please contact the controller:

Liechtensteinische Landesbank (Österreich) AG, Heßgasse 1, 1010 Wien, Austria, Telephone: +43 1 536 16-0

Contact details of the Data Protection Officer:
Liechtensteinische Landesbank (Österreich) AG, Datenschutzbeauftragter, Heßgasse 1, 1010 Wien, Austria, Telephone: +43 1 536 16-0 / E-mail: datenschutz@llb.at

1. Which categories of data will be processed and what are the sources of this information?

We collect and process personal data that we obtain in the course of our business relationship with our clients. Personal data may be processed at any stage of the business relationship and the type of data will vary depending on the group of persons involved.

As a general rule, we will process personal data that you provide in the course of submitting agreements, forms, correspondence or other documents to us. We will also process any personal data that may be required for the purpose of providing services, which are generated or transmitted as a result of using products or services, or that we have lawfully obtained from third parties (e.g. credit reference agencies) or public authorities (e.g. UNO and EU sanctions lists) or by other companies within the LLB Group. Finally, we may process personal data from publicly available sources (e.g. debtor records, land registers, commercial registers and registers of associations, the press, the Internet).

In addition to client data, we may, where appropriate, also process personal data of other third parties involved in the business relationship, including data pertaining to authorised agents, representatives, cardholders, parties jointly and severally liable for credit facilities, guarantors, legal successors or beneficial owners under a business relationship.

Please ensure that such third parties are also aware of this data protection notice.

Personal data concerns the following categories of data in particular:

Master data

• Personal details (e.g. name, date of birth, nationality)
• Address and contact details (e.g. physical address, telephone number, e-mail address)
• Identification information (e.g. passport or ID details) and authentication information (e.g. specimen signature)
• Data from publicly available sources (e.g. tax numbers)

Further basic data

• Information on services and products used (e.g. investment experience and investment profile, consultancy minutes, sales data in payment transactions)
• Information about household composition and relationships (e.g. information about spouse or partner and other family details, authorised signatories, statutory representatives)
• Information about the financial characteristics and financial circumstances (e.g. portfolio and account number, credit history information, origin of the assets)
• Information about the professional and personal background(e.g. professional activity, hobbies, wishes, preferences)
• Technical data and information about electronic transactionswith the Bank (e.g. access logs or changes)
• Image and sound files (e.g. video recordings or recordingsof telephone calls)

2. For what purposes and on what legal basis will your data be processed?

We process personal data in accordance with the provisions of the GDPR and the DPA for the following purposes and on the following legal basis:

• For the performance of a contract or to take steps prior to entering into a contract in connection with supplying and acting as intermediary in relation to financial services and for the purpose of executing orders. The purposes for which data are processed will depend primarily on the specific service or specific product involved (e.g. securities, brokerage) and may include, for example, needs analysis, advisory services, wealth and asset management and carrying out transactions.
• For compliance with a legal obligation or in the public interest, including compliance with statutory and regulatory requirements (e.g. compliance with the GDPR, the DPA, ImmiInvFG, InvFG, the Austrian Banking Act, due diligence and anti-money laundering rules, regulations designed to prevent market abuse, tax legislation and tax treaties, monitoring and reporting obligations, and for the purpose of managing risks)
• For the purposes of the legitimate interests pursued by us or by a third party that have been specifically defined, including determining credit ratings, setting up and realising collateral, pursuing claims, developing products, marketing and advertising, performing business checks and risk management, reporting, statistics and planning, preventing and investigating criminal offences, video surveillance to ensure compliance with house rules and prevent threats, recordings of telephone calls.
• In reliance on consent given by you for the purpose of supplying and acting as intermediary in relation to banking and financial services or for the purpose of executing orders, including, for example, transferring data to Group companies, service providers or contracting partners of the institute. You have the right to withdraw your consent at any time. This also applies to declarations of consent provided to the institute before the GDPR took effect, i.e. prior to 25 May 2018. Consent may only be withdrawn with effect for the future and does not affect the lawfulness of data processing undertaken before consent was withdrawn.

We reserve the right to engage in the further processing of personal data, which we have collected for any of the foregoing purposes, including any other purposes that are consistent with the original purpose or which are permitted or prescribed by law (e.g. reporting obligations).

3. Who will have access to personal data and how long will the data be held?

Parties within and outside the institute may obtain access to your data. Departments and employees within the institute may only process your data to the extent required for the purpose of discharging our contractual, statutory and regulatory duties and pursuing legitimate interests. Other Group companies, service providers or agents may also have access to personal data for such purposes, subject to compliance with bank-client and data confidentiality requirements. The categories of processors may include companies supplying IT, logistics, printing, debt collection, advisory, consultancy, distribution and marketing services. In this context, recipients of your data may also include other credit and financial services institutions or similar organisations to which we transfer personal data for the purposes of conducting the business relationship (e.g. correspondent banks, custodian banks, brokers, stock exchanges, information centres). Public bodies and organisations (e.g. supervisory authorities, tax authorities) may also receive your personal data where there is a statutory or regulatory obligation.

Data will only be transferred to countries outside the EU or EEA (so-called third countries) if

• this is required for the purpose of taking steps prior to entering into a contract, performing a contract, supplying services or executing orders (e.g. executing payment orders and securities transactions or issuing credit cards);
• you have given us your consent (e.g. for client support provided by another Group company);
• this is necessary for important reasons of public interest (e.g. anti-money laundering compliance); or
• this is prescribed by law (e.g. tax disclosure obligations).

We process and store your personal data throughout the continuation of the business relationship, unless there is a strict obligation to erase specific data at an earlier date. It is important to note that our business relationships may subsist for many years. In addition, the length of time that data will be stored will depend on whether processing continues to be necessary and the purpose of processing. Data will be erased at regular intervals, if the information is no longer required for the purpose of fulfilling contractual or statutory duties or pursuing our legitimate interests, i.e. the objectives have been achieved, or if consent is withdrawn, unless further processing is necessary by reason of contractual or statutory retention periods or documentation requirements, or in the interests of preserving evidence throughout any applicable statutory limitation periods.

4. Will there be automated decision-making including profiling?

We do not normally make decisions based solely on the automated processing of personal data. We will inform you separately in accordance with the statutory regulations of any intention to use this method in particular circumstances.

Certain business areas involve the automated processing of personal data at least to a certain extent, where the objective is to evaluate certain personal aspects in line with statutory and regulatory requirements (e.g. money laundering prevention), carry out needs analysis in relation to products and services, assess loan affordability and credit standing, or for the purpose of managing risks.

The institute reserves the right, in future, to analyse and evaluate client data (including the data of any third parties involved) by automated means for the purpose of identifying key personal characteristics in relation to clients, predicting developments and creating client profiles. Such data will be used, in particular, to perform business checks, provide customised advice, offer products and services and provide any information that the institute and its Group companies may wish to share with clients. Client profiling mayalso result in automated individual decision-making in future,for example to enable automated acceptance and executionof client orders in e-banking.

The institute will provide a suitable point of contact for clients who have concerns about an automated individual decision, insofar as the law stipulates that such an opportunity to raise concerns must be provided.

5. What data protection rights do you have?

You have the following data protection rights pursuant to the GDPR in respect of personal data relating to you:

• Right of access: you may obtain information from us about whether and to what extent personal data concerning you are being processed (e.g. categories of personal data being processed, purpose of processing).
• Right to rectification, erasure and restriction of processing: You have the right to obtain the rectification of inaccurate or incomplete personal data concerning you. In addition, your personal data must be erased if the data are no longer necessary in relation to the purposes for which they were collected or processed, if you have withdrawn your consent, or if the data have been unlawfully processed. You also have the right to obtain restriction of processing.
• Right to withdraw consent: You have the right to withdraw your consent to the processing of personal data concerning you for one or more specific purposes at any time, where the processing is based on your explicit consent. This also applies to declarations of consent provided before the GDPR took effect, i.e. prior to 25 May 2018. Please note that consent may only be withdrawn with effect for the future and does not affect any data processing undertaken prior to withdrawing consent. Moreover, the withdrawal of consent has no effect in relation to data processing undertaken on other legal grounds.
• Right to data portability: you have the right to receive the personal data concerning you, which you have provided to the controller, in a structured, commonly used and
  machine-readable format, and to transmit those data to another controller.
• Right to object: You have the right to object, on grounds relating to your particular situation, without any formal requirements, to the processing of personal data concerning you, if such processing is in the public interest or in pursuit of the legitimate interests of the Bank or a third party. You also have the right to object, without any formal requirements, to the use of personal data for marketing purposes. If you object to the processing of your personal data for direct marketing purposes, we will discontinue processing your personal data for this purpose.
• Right to lodge a complaint: You have the right to lodge a complaint with the relevant Austrian supervisory authority. You may also lodge a complaint with another
  supervisory authority in an EU or EEA member state, e.g. your place of habitual residence, place of work or the place in which the alleged breach took place.

The contact details for the data protection authority in Austria are set out below:
Österreichische Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna, Austria, Telephone: + 43 1 52 152-0, E-mail: dsb@dsb.gv.at

If you have any questions about individual data processing or want to exercise your rights, you can reach us under the above mentioned contact data or under datenschutz@llb.at.