Data Protection

Aareal Bank AG welcomes you to our website and thanks you for your interest in our company. The protection of your personal data is a serious matter for us and we want you to feel safe during the visit on our websites. Personal Data collected while visiting our website will be processed in accordance with the provisions of the EU General Data Protection Regulation (GDPR) and the data protection rules of the Federal Republic of Germany.

We will treat any personal data you may transmit to us with reasonable care and in compliance with data protection rules. Your data will not be used for any other purpose and will not be forwarded to third parties. For confidential messages, please use the regular mail service for your own safety.

In most cases, you can visit the website of Aareal Bank AG without providing any personal data to us. We only get to know the name of your internet provider and the so-called IP address he has allocated to you, the websites from which you accessed our site and the websites you visit within our internet presence. This information is evaluated for statistical purposes only, the individual user identity remains anonymous. Evaluation takes places on the basis of Article 6 (1)(f) GDPR.

Further personal data will only be collected and processed when you submit it to us (i.e. to order information material), and will be processed solely for the purpose of dealing with your inquiry. The provision of personal data by you, e. g. by using the contact form or e-mail, constitutes your consent to the processing of your personal data according to Article 6 (1) (b) GDPR.

If you have given your consent to the processing of personal data, you have the right to revoke your consent to the processing at any time. This also applies to the revocation of declarations of consent that were given to us before the GDPR was valid, i.e. before 25 May 2018. Please note that the revocation takes effect for the future only. The revocation does not affect the legality of the data processed until the revocation.

In accordance with the applicable data protection laws and regulations, any data received or collected in connection with the services provided by Aareal Bank Group will only be collected, processed and used for the purpose of performing the relevant contract or processing your specific request and to safeguard our own legitimate interests with regard to the advisory services and support for our (prospective) clients as well as a product design that meets our clients' needs. Your personal data will only be passed on to those departments that need your data for the processing of your enquiry, unless mandatory national laws require transmission to a government institution or authority. To the extent that further processing of your personal data is not required by law, we will use your data only for as long as it takes to process your request.

This website uses cookies. Cookies are small text files that are stored on your device when you visit our website and enable, facilitate or improve the use of our website. Cookies that are absolutely necessary for the functions of our website (necessary cookies) are permitted by law to be stored Use and disclosure of personal data and purpose limitationon your device. For the use of other cookies (e.g. web analysis cookies) we require your consent.

To obtain your consent, we use the “Cookiebot” service provided by Cybot A/S (Havnegade 39, 1058 Copenhagen, Denmark). When you first visit our website, Cookiebot displays a dialogue box (banner) that allows you to give your consent to certain categories of cookies. Your selection, together with other data, is stored encrypted on servers within the European Union for a period of twelve months for verification purposes (Art. 7 (1) GDPR).

Your selection is also stored on your device under the name “CookieConsent” as a (necessary) cookie for a period of twelve months and automatically taken into account each time you visit our website. However, you can also delete this cookie beforehand via your browser settings.

After 12 months or after a premature manual deletion of the “CookieConsent” cookie, you must make a new selection when you visit our website.

Details on the scope of the data collected by Cookiebot and the handling of such data can be found here: https://www.cookiebot.com/en/privacy-policy/ .

This website uses the "Piwik/Matomo" web analytics tool. The analysis of user behaviour is important, as this helps us to analyse the demand for specific content and to optimise our offer.

Piwik/Matomo collects the following data: date, number of actions on the website, time spent on the website, country of origin, browser version, operating system, number of new and returning visitors, referring URL, conversion rate.

The Piwik/Matomo version we use anonymises the IP addresses, so that users are not identifiable. The Piwik/Matomo analytics tool works by placing a small text file called a cookie on your device. Piwik/Matomo uses “persistent cookies”, which remain saved on your device after your visit. The cookie is set from the domain “aareal-bank.com” and has the following name: _pk_id.12345 (number serves as an example and is assigned individually). The cookie expires after one week and allows us to:

• recognise visitors who have visited our website before and to create anonymised user profiles to improve our website's user friendliness;

• achieve approximate geolocalisation;

• rectify any errors on the website and improve our service.

If you have consented to the use of web analysis cookies, you can prevent the analysis of user behaviour as a whole for the future by blocking the setting of cookies in your browser by the corresponding domain (aareal-bank.com; ar2020.aareal-bank.com). Please check the help function of your browser for instructions on how to block cookies.

You also have the option at any time to change your selection of the admissibility of web analysis cookies made for our website via the Cookiebot service for the future. To do this, call up the “cookie settings” at the bottom of our website and activate or deactivate the desired cookie categories by setting or removing the respective check marks.

Aareal Bank AG takes technical and organisational measures in order to protect the data against accidental or intentional manipulation, loss, destruction or access by unauthorised persons. Our safety measures are consistently being improved in accordance with the technological development. In addition, our employees are obliged to respect the data security provisions and are bound by banking confidentiality.

Controller of the data processing on this website:

Aareal Bank AG Paulinenstr. 15 65189 Wiesbaden

In line with the legal provisions, Aareal Bank AG has appointed a Data Protection Officer. Should you have any questions concerning the processing of your personal data, you may contact him directly. By E-Mail:

datenschutz(at)aareal-bank.com

or

Datenschutzbeauftragter (Data Protection Officer) c/o Aareal Bank AG Paulinenstr. 15 65189 Wiesbaden

On your request we will provide you with the information in accordance with the data protection regulation, whether and which of your personal data are stored by us. In addition you have the right to rectification, erasure, restriction of processing and the right to data portability.

On grounds relating to your particular situation you have the right to object at any time to processing of your personal data which is based on Article 6(1)(e) (processing of data for the performance of a task carried out in the public interest) or (f) (processing of data for the purposes of legitimate interests).

Your revocation can take place form-free and should be directed if possible to:

Aareal Bank AG

Informationssicherheit und Datenschutz (Information security & data protection) Paulinenstrasse 15 65189 Wiesbaden

If you object to the processing, we will no longer process your personal data, unless we have compelling and legitimate interests that override your interests, rights and freedoms, or the processing of the data is necessary for the establishment, exercise or defence of legal claims.

If you believe that your data are not being processed properly, you have a right to lodge a complaint with the competent supervisory authority. Please address your complaint to:

The Data Protection Officer of Hesse PO Box 3163 65021 Wiesbaden