BNP Paribas Lease Group GmbH & Co. KG Vordere Zollamtsstraße 13 Phone +43 (0)1 2724312-0 www.leasingsolutions.bnpparibas.at 1030 Vienna Fax +43 (0)1 2724312-220 VAT Reg No ATU51440908

Data protection information for customers

The protection of your personal data is an important con- • Health data, e.g. for the conclusion of certain insur- cern of the BNP Paribas Group1, which is why strong data ance contracts; these data are processed only by protection principles have been defined for the entire those persons who need to know about them. Group. This data protection information contains detailed explana- Personal data relating to racial or ethnic origin, political tions on the protection of your personal data by BNP Pari- beliefs, religious or philosophical views or membership of bas Lease Group GmbH & Co. KG ("we"). a trade union as well as genetic data and information on sexual life or sexual orientation are not processed by us As data controller, we are responsible for the collection unless required to do so by law or within the framework of and processing of your personal data in connection with its the products and services it offers. business activities. With this data protection information we inform you about which personal data it collects about The data used by us can either be provided directly by you you, why it uses and passes on such data, how long it or come from the following sources in order to check or stores them, what rights you have and how you can exer- enrich our databases: cise them. • Publications and databases made available by au- thorities (e.g. the Federal Gazette) If you are interested in a specific product or service, you may receive additional information. • Corporate customers, service providers or our busi- ness partners 1. WHAT PERSONAL DATA DO WE USE? • Third parties, such as credit bureaus and anti-fraud We collect personal data and use it to the extent nec- pools or data brokers used in accordance with data essary in the course of its business activities in order protection regulations to provide you with a high-quality, individual range of • Websites/social media pages with information pub- products and services. lished by you (e.g. your own website or social media The different types of personal data that may be col- page) and lected include, but are not limited to • Databases made publicly accessible by third parties. • Identity information (e.g. name, ID or passport number, nationality, place and date of birth, gender, 2. SPECIAL CASES OF THE COLLECTION OF PER- photograph, IP address) SONAL DATA INCLUDING AN INDIRECT DATA COLLECTION • Contact information (e.g. address, e-mail address, In certain cases, we collect personal data from persons telephone number) with whom it has, may have had or may have had a di- • Information on the family situation (e.g. marital rect relationship and may use such data. This includes, status, number of children) for example • Tax information (for example, tax identification • Potential customers number, tax status) • Information on education and occupation (e.g. We may have collected information about you although educational background, occupation, employer’s you have no direct relationship with it. name, earnings, etc.) This may be the case, for example, if your employer • Bank, financial and transaction data, creditwor- has provided us with information about you or if we thiness data (e.g. bank details, credit card number, have received your contact details from one of its cus- money transfers, assets, investor profile, credit histo- tomers and you are one of the following persons: ry, debt and expenditure, rating) • Family members • Data on your habits and preferences: • Co-applicant, guarantor, guarantor − Data on the use of our products and services in re- • lation to banking, financial and transaction data Legal representatives (authorized representatives) • − Data on interaction with us: its branches (contact Beneficiaries of payment transactions of our cus- reports), its websites, use of its apps, its social me- tomers dia pages, personal meetings, telephone calls, chat • Beneficiaries of insurance contracts and trust com- contact, e-mail, surveys, telephone calls) panies • Video and photo surveillance data and geoloca- • Landlord tion data of financing objects. • Beneficial owners • Debtors of customers (for example in the event of in- The following sensitive data may only be collected if you solvency) have expressly agreed to this beforehand: • Shareholders • Biometric data, e.g. fingerprints, voice or facial pat- terns, which can be used for identification and secu- • Representatives of legal entities (e.g. customers or rity purposes service providers)

1 The members of BNP Paribas Group can be seen on the following website: https://invest.bnpparibas.com/en/consolidated-financial-statements

Office Vienna, Commercial court Vienna, FN 204162p Insurance agent Gisa-Zahl: 25189759 General partner: BNP Paribas Lease Group GmbH & Co. KG is tied insurance intermediary of Allianz BNP Paribas Lease Group GmbH Elementar Versicherungs AG. Vordere Zollamtsstraße 13, 1030 Vienna A request for the registration is possible under GmbH office in Vienna, Commercial court Vienna VK-XX-2317-BPLG-A / v01 https://www.gisa.gv.at/versicherungsvermittlerregister, a free complaint option is set up at FN 204110m, VAT IN. ATU56652303 Page 1 of 4 / 01.07.2019 the Federal Ministry of Economics.

BNP Paribas Lease Group GmbH & Co. KG Vordere Zollamtsstraße 13 Phone +43 (0)1 2724312-0 www.leasingsolutions.bnpparibas.at 1030 Vienna Fax +43 (0)1 2724312-220 VAT Reg No ATU51440908

• Employees of service providers or business part- timize the risk management of their group of compa- ners. nies or to improve existing products and services or to create new products and services 3. WHY AND ON WHAT BASIS DO WE USE YOUR • Personalization of our own offer and the offer of affil- PERSONAL DATA? iated business units: a. In order to fulfil its legal and supervisory obliga- − improving the quality of our financial and insurance tions products and services; We use your personal data to comply with various le- − the application of products matching your situation gal and regulatory obligations, including: and profile. • Banking and financial provisions on the basis of which we: This can be achieved by: − take security measures to prevent abuse and fraud • The segmentation of its existing and potential cus- − reveal transactions that deviate from usual pat- tomers terns • The analysis of your habits and preferences on the − your credit risk and your repayment ability are de- various channels (visits to our branches, e-mails or termined news, visits to our website, etc.) − monitors and reports any risks to which it may be • The transfer of your data to business units affiliated exposed with us, especially if you are a customer of this busi- − recording, if necessary, of telephone calls, chats, ness unit or if you would like to become one e-mails, etc. • The comparison of the products or services you • Reply to an official request from a competent state have already purchased or used with other data body or judicial authority about you held by us • • Prevention of money laundering and terrorist financ- Monitoring all transactions to detect transactions that ing deviate from the usual routine. • Compliance with sanctions and embargo provisions Your information may be aggregated into anonymous • Combating tax evasion and fulfilling tax control and statistics that may be offered to professional business notification obligations. partners to help them develop their business. In this case your personal data will never be passed on to third parties b. To enter into or perform a contract with you and the recipients of these anonymous statistics will not We use your personal data to conclude and fulfil its be able to assign your identity. contracts. This includes, among other things, that we d. To respect your decision, if we have asked you for • provide you with information about our products and your consent to a specific data processing meas- services ure In some cases, we may require your consent and/or an • help you and answer your questions exemption from banking secrecy in order to process • checks whether and under what conditions we can your data, e.g.: offer you a product or service and • for training our staff by recording incoming calls in • offer products and services. our call centers • if we have to take further data processing measures c. In order to pursue our legitimate interests for purposes other than those mentioned above, we We use your personal data to market and develop our will inform you accordingly and, if necessary, ask for products and services while optimizing its risk man- your consent. agement and safeguarding its legal rights. This in- cludes the following activities: 4. TO WHOM DO WE PASS ON YOUR PERSONAL • Request information from credit agencies regarding DATA? your creditworthiness and credit default risk, as well For the aforementioned purposes, your personal data as transmitting data to credit agencies about your will only be passed on to the following parties: contractual obligations and the repayment status in • Business units affiliated with us (so that you can use the event of a credit default. our entire range of products and services, for exam- • Preparation of transaction statements ple) • Fraud prevention • Service providers acting on behalf of us • IT management including infrastructure management • Independent agents, intermediaries or brokers, bank (e.g. common platforms) and measures to ensure and business partners with whom we have regular operational continuity and IT security business relationships • Creation of individual statistical models based on the • Refinance partners, credit insurers analysis of transactions, for example to better de- • Financial or judicial authorities, state agencies or termine your credit risk public institutions (upon request and to the extent • Development of aggregated statistics, tests and permitted by law) models for research and development in order to op-

Office Vienna, Commercial court Vienna, FN 204162p Insurance agent Gisa-Zahl: 25189759 General partner: BNP Paribas Lease Group GmbH & Co. KG is tied insurance intermediary of Allianz BNP Paribas Lease Group GmbH Elementar Versicherungs AG. Vordere Zollamtsstraße 13, 1030 Vienna A request for the registration is possible under GmbH office in Vienna, Commercial court Vienna VK-XX-2317-BPLG-A / v01 https://www.gisa.gv.at/versicherungsvermittlerregister, a free complaint option is set up at FN 204110m, VAT IN. ATU56652303 Page 2 of 4 / 01.07.2019 the Federal Ministry of Economics. BNP Paribas Lease Group GmbH & Co. KG Vordere Zollamtsstraße 13 Phone +43 (0)1 2724312-0 www.leasingsolutions.bnpparibas.at 1030 Vienna Fax +43 (0)1 2724312-220 VAT Reg No ATU51440908

• Members of certain regulated professions such as relationships with us, the fulfilment of legal claims or lawyers, notaries or auditors compliance with official orders require this. For exam- • Credit agencies ple, most customer data is retained for the duration of the contractual relationship and for a period of ten • Guarantors. years starting at the end of the year of contract termi- nation. Applicants without a subsequent contract con- 5. UNOCCUPIED clusion have a retention period of five years starting at the end of the year of application. 6. TRANSFER OF PERSONAL DATA TO COUNTRIES OUTSIDE THE EEA 9. WHAT RIGHTS DO YOU HAVE AND HOW CAN YOU If international data transfers are made to countries EXERCISE THEM? outside the European Economic Area (EEA) and the According to the valid legal regulations you are entitled European Commission considers that a non-EEA to the following rights: country guarantees an adequate level of data protec- • Information: You can request information on the tion, your personal data will be transferred on this ba- processing of your personal data and a copy of this sis. data. In the case of transfers to non-EEA countries whose • Correction: If in your opinion your personal data is level of data protection has not been recognised by the incorrect or incomplete, you can request a corre- European Commission, we may consider an appropri- sponding change to this data. ate exception (for example, if the transfer of data is • You may request that your personal data necessary to fulfil our contract with you and make an Deletion: be deleted to the extent permitted by applicable law. international payment) or take one of the following measures to ensure the protection of your personal da- • Restriction on data processing: You may request ta: a restriction on the processing of your personal data. • Use of standard contractual clauses approved by the • Revocation of consent to data processing: If you European Commission have consented to the processing of your personal data, you can revoke this consent at any time. • Formulation of binding, company-internal rules. • Data transferability: If legally possible, you can re- If you need a printout of these provisions or information claim the personal data provided to us or have it on their availability, you can contact us in writing (as transferred to a third party, if this is technically feasi- described in Section 11). ble. • Automated decisions: If a decision to conclude or 7. IS PROFILING TAKING PLACE? fulfil a contract has only been made in an automatic We process some of your data automatically with the process and this decision has legal effect against aim of evaluating certain personal aspects (profiling). you or significantly affects you in a similar manner, For example, it uses profiling in the following cases: you can request a further manual review from us af- • We are required by law and regulation to combat ter you have presented your position and requested money laundering, terrorist financing and asset- the manual review. In the event of such a decision, it polluting crimes. Data is also evaluated (for example, will also inform you separately about the reason, the in payment transactions). These measures also scope and the intended effects of such data pro- serve to protect you. cessing. • In order to provide you with targeted information and advice on products, we use evaluation instruments. You have the right to object to the processing of These enable demand-oriented communication and your personal data in the public interest or on the advertising, including market and opinion research. basis of a balance of interests with reference to your particular situation; this also applies to pro- • We use scoring to assess your creditworthiness. The probability with which a customer will meet his pay- filing based on this. Further processing by us will then only take place if proof is provided of over- ment obligations in accordance with the contract is calculated. The calculation may include, for example, riding interests that require mandatory protec- tion. income, expenses, existing liabilities, occupation, employer, length of employment, experience gained In addition, you have the unlimited right to pro- in the previous business relationship, contractual re- hibit the processing of your personal data for di- payment of previous loans and information from rect marketing purposes and to refuse any asso- credit bureaus. Scoring is based on a mathematically ciated profiling. and statistically recognized and proven procedure. The calculated score values support us in decision- making within the framework of product transactions To assert these rights, please contact our data protec- and are included in ongoing risk management. tion officer via a data protection request under https://leasingsolutions.bnpparibas.at/datenschutz 8. HOW LONG DO WE KEEP YOUR PERSONAL DA- In accordance with the applicable legal provisions, in TA? addition to exercising the above rights, you may file a We shall keep your personal data for at least the peri- complaint with the competent supervisory authority at od prescribed by applicable law. Longer retention is the following address: possible if operational requirements such as proper account management, the management of customer

Office Vienna, Commercial court Vienna, FN 204162p Insurance agent Gisa-Zahl: 25189759 General partner: BNP Paribas Lease Group GmbH & Co. KG is tied insurance intermediary of Allianz BNP Paribas Lease Group GmbH Elementar Versicherungs AG. Vordere Zollamtsstraße 13, 1030 Vienna A request for the registration is possible under GmbH office in Vienna, Commercial court Vienna VK-XX-2317-BPLG-A / v01 https://www.gisa.gv.at/versicherungsvermittlerregister, a free complaint option is set up at FN 204110m, VAT IN. ATU56652303 Page 3 of 4 / 01.07.2019 the Federal Ministry of Economics. BNP Paribas Lease Group GmbH & Co. KG Vordere Zollamtsstraße 13 Phone +43 (0)1 2724312-0 www.leasingsolutions.bnpparibas.at 1030 Vienna Fax +43 (0)1 2724312-220 VAT Reg No ATU51440908

Österreichische Datenschutzbehörde Barichgasse 40-42 1030 Wien

10. HOW CAN YOU INFORM YOURSELF ABOUT CHANGES TO THIS PRIVACY NOTICE? In the light of constant technical change, we may have to update its data protection information at regular in- tervals. The current version is available online. We will inform you of fundamental changes on its website or through other usual communication channels.

11. HOW TO CONTACT US If you have any questions about the use of your per- sonal data in accordance with this data protection in- formation, please contact our data protection officer via a data protection request under https://leasingsolutions.bnpparibas.at/datenschut z.

Office Vienna, Commercial court Vienna, FN 204162p Insurance agent Gisa-Zahl: 25189759 General partner: BNP Paribas Lease Group GmbH & Co. KG is tied insurance intermediary of Allianz BNP Paribas Lease Group GmbH Elementar Versicherungs AG. Vordere Zollamtsstraße 13, 1030 Vienna A request for the registration is possible under GmbH office in Vienna, Commercial court Vienna VK-XX-2317-BPLG-A / v01 https://www.gisa.gv.at/versicherungsvermittlerregister, a free complaint option is set up at FN 204110m, VAT IN. ATU56652303 Page 4 of 4 / 01.07.2019 the Federal Ministry of Economics.