Privacy Policy Scalable Capital

1. Data Controller

Thank you for your interest in the services of Scalable Capital GmbH, Seitzstraße 8e in 80538 Munich, e-mail: support-it@scalable.capital, registered in the Commercial Register of the Local Court of Munich under HRB 217778 ("Scalable Capital"). In the following, we would like to inform you about the collection, processing and use of personal data (collectively "data use") in the context of the use of our website and apps as well as of our digital offers.

2. Processing of your personal data when accessing our website and apps

2.1. General information

In general, you decide which personal data you provide to us. Within the scope of the business relationship, you are required to provide the personal data that is necessary for the initiation, implementation and termination of a business relationship and which we are legally obliged to collect and process, e.g. in accordance with anti-money laundering regulations. Without this data, we are not able to provide you with our services or functions.

Insofar as service providers process personal data on our behalf, we have concluded a contract processing agreement with these service providers and agreed on appropriate guarantees to ensure the protection of personal data. We carefully select our service providers. In addition, these service providers process personal data exclusively for the performance of their tasks and are contractually bound to our instructions, have appropriate technical and organisational measures in place to protect personal data and are regularly monitored by us. Where relevant, appropriate EU standard contractual clauses have been concluded for the transfer of personal data to processors in third countries (as an appropriate guarantee for data processing in non-European countries). You can view the EU standard contractual clauses used via the following link: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32021D0914.
The transfer of personal data to certain third countries, such as Switzerland, is based on an adequacy decision. According to the EU Commission, such countries have an "adequate level of protection" and a data transfer does not require any special authorisation. An overview of the countries with an adequacy decision can be found here: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en

2.2 Hosting

For hosting the database and web content, we use Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg, Luxembourg ("AWS"), a subsidiary of Amazon Web Services, Inc., P.O. Box 81226, Seattle, WA 98108-1226, USA, as an order processor. The data is stored exclusively in a German data centre (Frankfurt/Main), which is certified according to ISO 27001, 27017 and 2018 as well as PCI DSS Level 1 and accordingly meets the highest security standards. In addition, we have agreed on corresponding EU standard contractual clauses with Amazon Web Services, Inc. You can view the EU standard contractual clauses used via the following link: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32021D0914. In conjunction with additional technical and organisational measures to ensure an adequate level of protection, it is guaranteed that the EU data protection requirements can also be met when processing data in the USA.

2.3. Informational use of our website

When you visit our website, we process access data that is stored in so-called log files. The following personal data is processed automatically in the log files:

• IP address of the requesting device
• Type of web browser used
• Language of the web browser used
• Version of the web browser used
• Operating system and its version
• Date and time of the visit
• Time zone difference from Greenwich Mean Time (GMT)
• Access status/ http status code
• Amount of data transferred
• Web page visited
• Referrer
• Web pages that are called up by the visitor's system via our website
• Internet service provider of the user

The processing of this data is carried out in accordance with Art. 6 (1) (f) GDPR due to our legitimate interest in being able to properly display the website to you as well as to defend against attacks and for the purpose of the security of our systems. The log files are deleted or anonymised immediately after they are no longer required to achieve the aforementioned purposes, but at the latest after 14 days.

We use AWS as a processor for hosting the website.

2.4. Comfort settings (e.g. language settings)

In order to be able to display content such as your country and language settings as desired, we use session-based or persistent cookies. Your country settings are deleted as soon as your browser session ends, your language settings are stored for a maximum of one year. The legal basis for the processing of these cookies is §25 (2) Telecommunications and Telemedia Data Protection Act (TTDSG) so that we can provide the telemedia service expressly requested by the user. The legal basis for the further processing of this technically necessary personal data is Article 6 (1) (f) GDPR.

2.5. Performance Monitoring

We use DataDog, Inc. 620 8th Avenue, 45th Floor New York, NY 10018, USA ("DataDog") as a processor to collect information about the performance of our website and any technical malfunctions that may occur. For this purpose, DataDog sets up a cookie for the browser session and collects geolocation, device, and operating system data of the user of our website and mobile applications. We process the above data to ensure the security of our platform for the provision of our services and to minimise a possible risk of damage (in accordance with §25 (2) Telecommunications and Telemedia Data Protection Act (TTDSG) so that we can provide the telemedia service expressly requested by the user. This data processing is carried out on the basis of our legitimate interest to ensure IT security in accordance with Art. 6 (1) (f) in conjunction with Art. 32 GDPR. Your data will be deleted after 15 days. Appropriate EU standard contractual clauses have been concluded as an adequate guarantee for data processing in non-European countries. You can view the EU standard contractual clauses used via the following link: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32021D0914.

2.6. Cybersecurity Incident Monitoring

We use Palo Alto Networks, B.V. De Entrée 99-197, Oval Tower, 5th Floor 1101 HE Amsterdam, the Netherlands ("Palo Alto") as a processor to collect information for the purpose of detecting cybersecurity incidents, or any cybersecurity malfunctions that may occur and respond to the said incident. For this purpose, we process login data incl. email address, IP address, device information, geolocation data derived from IP address of the user when accessing our applications. We process the above data on the basis of our legitimate interest to ensure and maintain IT security in accordance with Art. 6 (1) (f) in conjunction with Art. 32 GDPR. Your data will be deleted after 30 days unless it is required for forensic analysis and investigations. Appropriate EU standard contractual clauses have been concluded with Palo Alto as an adequate guarantee for data processing in non-European countries. You can view the EU standard contractual clauses used via the following link: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32021D0914

3. Use of our services

3.1. Registration/ Creation of customer profile

In order to use our services (wealth management, brokerage), you must first register and create a user account ("registration"). For this purpose, we collect your private contact and identification data (e.g. title, first and last name, address, e-mail address, telephone number, date, place and country of birth as well as nationality), certain tax data (e.g. tax number, tax residency) as well as your reference account (e.g. IBAN). As part of the registration process, you will also set a password for your personal access. In addition, depending on the services you use, we may collect information about your knowledge and experience of dealing in certain types of financial instruments or investment services, your investment objectives, including your risk tolerance, and your financial circumstances, including your ability to bear losses. We process this data in order to be able to recommend a suitable investment strategy to you or to assess the appropriateness of certain financial instruments (Art. 6 (1) (b) GDPR).

Please note that in order to use our services it is necessary to open a custody account with a custodian bank cooperating with us.

At present, we cooperate with Baader Bank Aktiengesellschaft, Weihenstephaner Str. 4, 85716 Unterschleißheim, Germany ("Baader Bank") and ING-DiBa AG, Theodor-Heuss-Allee 2, 60486 Frankfurt am Main, Germany ("ING"). The custodian banks process your data under their own responsibility. Information on how the custodian banks process your data can be found following https://www.baaderbank.de/Data+Protection+Declaration-436 for Baader Bank and https://www.ing.de/datenschutz/ for ING.

To enable you to use our services securely and to facilitate a secure log-in, we rely on Auth0 Inc, 10800 NE 8th Street, Ste. 600, Bellevue, WA, 98004, USA ("Auth0") as a processor. For this purpose, Auth0 processes your user name or e-mail address and password together with your IP address, geolocation data derived from IP address, and device information in accordance with Art. 6 (1) (b) GDPR. Your data is encrypted at all times and processed exclusively within the European Union. In individual cases, however, a transient processing of data in the USA cannot be ruled out.
To further protect the access to your account and prevent bad actors signing up or logging in with stolen credentials, Auth0 identifies if any credentials were part of security breaches on major third-party sites that are publicly available. This allows us to notify clients whose data was part of such a breach and assist them in changing their credentials. The aforementioned processing is necessary to protect your account from unauthorised access (Art. 6 (1) (f) GDPR).
Auth0 does not have access to any other personal data at any time. We have concluded the EU standard contractual clauses as appropriate safeguarding measures. You can view the EU standard contractual clauses used via the following link: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32021D0914.

As part of the use of our digital offer, we use Futurae Technologies AG, Eichstrasse 23, 8045 Zurich, Switzerland ("Futurae") as a processor for the two-factor authentication. For the activation of the two-factor authentication on the mobile device, data (e.g. IP address, device/browser information) is processed by Futurae. The transfer of the aforementioned data to Switzerland is based on the adequacy decision of the European Commission pursuant to Art. 45 GDPR. You can find further information here: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32000D0518

After your cancellation, you can still log in to your personal area and retrieve documents in your mailbox. You will continue to receive important documents there, such as your annual tax certificate. Your account will be deactivated no later than two years after the end of your contract. If required, access to your personal area can also be deactivated immediately after the end of the contract. To do so, please contact us using the contact options mentioned below under “Points of contact”.

3.2. Identification

For the purpose of identification, we process the private contact and identification data provided by you (e.g. your name, nationality, date and place of birth, address, email address, telephone number). Pursuant to the German Anti-Money Laundering Law, we are legally obliged to verify your identity by means of a valid identification document as part of the account opening process, to store the required information and a copy of the identification document as well as a visual and acoustic recording of the identification process carried out with us. The legal basis for the data processing is Art. 6 (1) (b) GDPR in connection with Art. 6 (1) (c) GDPR (contractual and legal obligation) in conjunction with the German Anti-Money Laundering Law.

For the purpose of identification, we use Deutsche Post AG ("Deutsche Post"), Charles-de-Gaulle-Straße 20 in 53113 Bonn, Germany as data processor. For this purpose, we use the POSTIDENT process which, in addition to identification by means of the online ID function ("eID"), also enables identification by video chat or at a post office branch. After completion of the process, Deutsche Post AG transmits to us your identification data, a copy of the identification document and a visual and acoustic recording of the identification process that has taken place, which are processed exclusively for the purpose of fulfilling the statutory obligations under German Anti-Money Laundering Law. Further information on the data processing within the POSTIDENT process by Deutsche Post AG can be found here: https://www.deutschepost.de/de/p/postident/postident-datenschutzhinweise.html

We reserve the right to transfer your personal contact and identification data (such as your first and last name, address and date of birth) to our data processors Onfido Ltd, 3 Finsbury Ave, London EC2M 2PA, United Kingdom (“Onfido”), or Fourthline B.V., Tesselschadestraat 12, 1054 ET, Amsterdam, The Netherlands (“Fourthline”) for the purpose of checking against sanctions lists and whether our customers are so-called politically exposed persons (“PeP”) at regular intervals. We process this data for the purpose of complying with legal and regulatory obligations.

For Brokerage clients residing in Spain, Italy, The Netherlands and France, the identification process is carried out by Fourthline. In order to comply with regulatory requirements, it is necessary to accept Fourthline's Terms and Conditions, which do not impose any obligations on you as a customer other than verifying your identity. Once you have gone through the identification process, Fourthline will send the results to us. We process this data for the purpose of complying with legal and regulatory obligations.
For Fourthline privacy notices, please visit https://fourthline.com/privacy-statement.

If you opt for identification via video chat ("video identification"), the provider is obliged to ensure the authenticity of your identification document (e.g. ID card or passport). At the beginning of the video identification, your explicit consent is obtained in accordance with Art. 6 (1) (a) GDPR to take the photos and record the conversation. You can object to this processing at any time by cancelling the video identification process and choosing an alternative method of identification.

We process this above-mentioned data for as long as is necessary for the aforementioned purpose and generally delete it immediately after the legal basis ceases to apply. According to §§ 8, 10 GwG we are obliged to keep your private identification and contact data as well as the results of the check against PeP and sanctions lists for at least five years.

3.3. Securities trading

In order to be able to provide our services and in particular to enable the transmission of trading orders to the custodian banks and securities trading to the custodian banks, we process the personal data mentioned in section 3 Use of our Services. This includes, in particular, the transmission of orders (together with the corresponding personal data) to the custodian bank. The legal basis of the processing is Art. 6 (1) (b) GDPR (fulfilment of contractual obligations). The data is processed in our hosting databases provided by AWS.

3.4. Tax information for brokerage clients outside Germany

For brokerage clients residing outside of Germany the overview of the taxes to be paid is prepared by KPMG AG, Badenerstrasse 172, CH-8036 Zurich, Switzerland ("KPMG"). For this purpose, we forward your internal user-ID and financial transaction data (e.g. portfolio ID, security number, type of order, time of execution) to KPMG. The legal basis for processing the aforementioned data is Art. 6 (1) (b) GDPR (fulfilment of contractual obligations). The transfer of the aforementioned data to Switzerland is based on the adequacy decision of the European Commission pursuant to Art. 45 GDPR. You can find further information here: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32000D0518
Please note that KPMG processes your data under its own responsibility. For more information, please see KPMG's privacy notice at: https://home.kpmg/ch/de/home/misc/privacy.html.

3.5. Risk management and crime prevention, detection and investigation

We process the personal data collected when initiating the contract or during the contractual relationship, for the purposes of fraud and money laundering prevention as well as for risk management purposes in order to identify and assess the financial risks arising for the institution and to counteract them appropriately. In the event of suspicious cases, we may collect further information from publicly available sources and take this into consideration in the decision-making process for blocking/ unblocking suspicious transactions. The processing is carried out on the basis of our legitimate interest in averting damage to Scalable Capital pursuant to Art. 6 (1) (f) GDPR in conjunction with the relevant legal obligation pursuant to Art. 6 (1) (c) GDPR. At the same time, these measures also serve to protect clients from possible unauthorised dispositions by third parties.
To process and coordinate cases of suspicion, we are using a ticketing system provided by Atlassian. Pty Ltd, Level 6, 341 George Street, Sydney NSW 2000, Australia ("Atlassian") as a data processor. We have entered into a processing agreement with Atlassian. In addition, we have concluded appropriate EU standard contractual clauses with Atlassian based in Australia. You can view the EU standard contractual clauses used via the following link: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32021D0914.

3.6. Retention obligations/ disclosure to third parties

We store and process your personal data for the duration of the contractual relationship with you. We delete your data after completion and settlement of the legal relationship with you, at the earliest, however, after expiry of the statutory, regulatory and/or other sovereign retention periods and insofar as the data is no longer required for the assertion, exercise and/or defence of legal claims.

As a regulated company, we are subject to various statutory recording and storage obligations, which stem primarily from the German Banking Act (KWG), the German Securities Trading Act (WpHG), the German Anti-Money Laundering Law (GwG), the German Commercial Code (HGB) and the German Fiscal Code (AO). These statutory obligations to retain data and records require us to store information for at least two years and up to ten years, depending on the regulation. These obligations also apply to processes that enable the initiation of a contractual relationship or the conclusion of a contract. The legal basis for the storage of personal data for these purposes is Art. 6 (1) (c) GDPR (legal obligations).

In addition, the retention periods under civil law are also relevant to determine the duration of the data storage. These limitation periods can be up to 30 years according to the regulations in the German Civil Code (BGB), however, the regular limitation period is three years.

Furthermore, we may be required to disclose personal data processed in connection with the provision of our services to public authorities and institutions such as the German Federal Bank (Deutsche Bundesbank), the German Federal Financial Supervisory Authority (Bundesanstalt für Finanzdienstleistungsaufsicht - BaFin), European banking supervisory authorities, the European Central Bank (ECB) and financial authorities.

4. Customer service and support

4.1. General Information about the processing of Client Service requests

You can contact us via our service hotline, the contact form, the chat as well as by e-mail and send us a request. In this context, we process the information and data you provide (including personal data such as first name, last name, email address and telephone number) and, if applicable, the time and duration of your call in a ticket in order to contact you and process your request (Art. 6 (1) (b) GDPR). When using the chat, the chat log, your usage data (e.g. start and end time of request, duration of interaction, IP address), device identification data (e.g. type of operating system, device model) as well as event data are stored and, if applicable, assigned to your account. In order to efficiently respond to your requests and to ensure a high level of service, user input may be viewed by our staff during the current request ("session") in the context of the live chat.

4.2. Information about Processors

We are supported in processing your requests by Sipgate GmbH, Gladbacher Straße 74, 40219 Düsseldorf, Germany ("Sipgate"), Aircall.io, Inc, 11 Rue Saint-Georges, 75009 Paris, France ("Aircall"), Teleperformance A.E., 330 Thisseos Avenue, 17675 Kallithea, Greece ("Teleperformance"), TELUS International Services Limited, Point Village, East Wall Road, Dublin 1, Ireland (“Telus International”) and Salesforce.com Germany GmbH, Erika-Mann-Str. 31-37, 80636 Munich, Germany ("Salesforce") as data processors. In addition, we have agreed to appropriate EU standard contractual clauses with Salesforce.com Inc. based in the US. You can view the EU standard contractual clauses used via the following link: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32021D0914.

We delete your data as soon as we have answered your inquiry to your satisfaction, provided that no other retention periods (e.g. tax retention periods) are opposed.

4.3. Client Success Call Recordings for client interaction analysis and feedback surveys

When you contact us via phone or take part in satisfaction surveys over the phone, before the conversation begins, we ask you for your consent to record the call for quality assurance purposes and to derive and implement measures to enhance our Client Success experience as well as products and services (Art. 6 (1) (a) GDPR). You can revoke your consent to the recording of the conversation at any time by informing the agent during the conversation or by contacting us using the contact details mentioned below under “Points of contact”.
If you have given us your express consent to record one or more conversations, we will record your conversation and link the recording to the existing history of previous conversations. Call recordings and client interactions will be used to assist in the quality assurance of agent performance, investigating and resolving complaints, identifying training needs and ensuring Client Success quality standards, improving our Client Support as well as our products and services. We delete the recording after 30 days if the deletion is not contrary to any other retention obligations.

5. Information events

To provide more insights about us and our services, we offer on-site events, webinars and information sessions. You can register for all information events at https://de.scalable.capital/events. For the implementation of webinars, events and information sessions, we process your private contact and identification data that you have provided to us, e.g. by means of a registration form (e.g. first and last name, e-mail address, telephone number) (pursuant to Art. 6 (1) (b) GDPR).
In the course of conducting webinars, we use the GoToWebinar webinar software of GoTo Technologies Ireland Unlimited Company, The Reflector, 10 Hanover Quay, Dublin 2, D02R573, Ireland ("GoToWebinar"), which we use as a processor. In the course of conducting webinars, personal data may be processed, e.g. your IP address, your e-mail address and, if applicable, your first and last name. After the webinar has been held, we receive from GoToWebinar the information as to whether a user has attended the webinar, the registration date as well as the user's registration time and the duration of participation.
The integration of GoToWebinar is based on our legitimate interest (Art. 6 (1) (f) GDPR) to facilitate a technically flawless execution of the webinar with professional tools.
We use the Youtube.com platform of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to conduct online live seminars. Further information on the processing of your data can be found in our data protection information on social networks.
The collection and processing of your personal data is based on the contract initiation or contract performance with regard to the implementation of an online webinar in accordance with Art. 6 (1) (b) GDPR. After participation in a webinar, your data will be stored for a maximum of 12 months.

6. Marketing activities and communication

6.1. Marketing emails

To conduct market research, facilitate product improvements and to send out personalised marketing content of us and affiliated third parties, we ask for your consent when opening an account or when signing up for the newsletter on our website. To ensure that you receive personalised information that is relevant to you and matches your personal interests, we review and analyse your user behaviour (e.g. recent transactions, participation in events and webinars) and use this information for some marketing emails. In addition, we have embedded so-called pixels in our newsletter to better understand your interaction with our newsletter and content. The processing is based on your consent (Art. 6 (1) (a) GDPR). You may revoke your consent at any time with effect for the future by clicking the “unsubscribe” link at the bottom of each marketing email or by contacting us using the contact options mentioned below under “Points of contact”. The revocation of consent does not invalidate the lawfulness of the processing carried out on the basis of the consent until revocation.

To ensure that no one can register with a third-party email address, we have implemented the so-called double opt-in procedure. This means that you will receive an email after registration asking you to confirm your registration. The confirmation of the subscription to the newsletter is logged in order to be able to prove the subscription process in accordance with the legal requirements. For this purpose, we process the IP address, date and time of access in accordance with Art. 6 (1) (f) GDPR.

To facilitate marketing communication, we rely on Salesforce as a data processor. Appropriate EU standard contractual clauses have been concluded in order to adequately protect your personal data. You can view the EU standard contractual clauses used via the following link: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32021D0914.

6.2. Press Newsletter

To receive current press releases by email, you can be added to our distribution list. To do so, please send us your email address and your first and last name by e-mail to presse@scalable.capital. We process your data exclusively to inform you about the current developments of our company and to send press releases. We cooperate with Finsbury Glover Hering Europe GmbH, Berliner Allee 44, 40212 Düsseldorf, Germany, as a consulting firm for strategic communication for the management of press releases. You can object to the processing at any time by sending an email to presse@scalable.capital or by using the contact details mentioned below under “Points of contact” and revoke your consent. The revocation of consent does not invalidate the lawfulness of the processing carried out on the basis of the consent until revocation.

6.3. Promotions

If you become a customer of ours as part of a promotion or raffle (the respective conditions of participation apply), we process your personal data such as first and last name, e-mail address, and user ID, to determine the prize pursuant to Art. 6 (1) (b) GDPR. Depending on the respective promotion or sweepstakes, we additionally process the data listed in the corresponding conditions of participation.
We delete personal data as soon as the promotion or the competition has ended and the data is no longer required for the fulfilment of the aforementioned purposes and unless there is another legal basis (e.g. commercial and tax retention periods).

6.4. Participation in Beta-Testphase

To test certain new features, you have the option of signing up for participation in the test phase via a sign-up page provided for the respective feature. For this purpose, we collect your e-mail address based on your consent in accordance with Art. 6 (1) (a) GDPR to enable you to try the feature and for us to contact you by e-mail in the event of further inquiries. You can revoke your consent at any time free of charge with effect for the future. To do so, please contact us using the contact options mentioned below under “Points of contact”.
To provide the sign-up page, we rely on Salesforce as a data processor. We will delete your information after the beta test phase has been completed at the latest or if you have revoked your consent. The revocation of consent does not invalidate the lawfulness of the processing carried out on the basis of the consent until revocation.

7. Use of cookies, tracking tools and third-party services on our websites and apps

7.1. General information

We use cookies on our website. Cookies are small files that are sent by us to the browser of your terminal device during your visit to our website and stored there. Some functions of our website cannot be offered without the use of technically necessary cookies. Other cookies, however, enable us to perform various analyses. Cookies are, for example, able to recognise the browser you are using when you visit our website again and to transmit various information to us. With the help of cookies, we can, among other things, make our website more user-friendly and effective for you, for example by tracking your use of our website and determining your preferred settings (e.g. country and language settings). If third parties process information via cookies, they collect the information directly from your browser.

The data processing is regularly carried out on the basis of your consent according to § 25 (1) Telecommunications and Telemedia Data Protection Act (TTDSG) in conjunction with Art. 6 (1) (a) GDPR. If we consider the use of cookies to be absolutely necessary in order to provide you with the desired telemedia service, this will be done on the basis of § 25 (2) No. 2 Telecommunications and Telemedia Data Protection Act (TTDSG). The further processing takes place in each case according to Art. 6 (1) GDPR. You can manage and adjust your consent in the privacy settings. The revocation of consent does not invalidate the lawfulness of the processing carried out on the basis of the consent until revocation.

For more information about our cookies, please refer to the Cookie Policy.

7.2. Consent Management Service

In order to use the third-party cookies, tracking tools and services mentioned below only with your consent, we use the Consent Management Service of Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich, Germany ("Usercentrics"). Usercentrics is used on the website and in our mobile applications to inform you about the cookies and tracking services used by Scalable and to obtain and record your consent for any voluntary tracking.

In connection with the collection of your consent, we process your IP address, opt-in and opt-out data, referrer URL, user agent, user preferences, consent ID, time of consent, consent type, template version and banner language. The consent provided by the user is stored relative to a Consent ID by Usercentrics. The use of Usercentrics is necessary so that we can comply with the legal requirements for the setting of cookies and in particular the applicable requirements for the documentation of consent. The data is processed here on the basis of § 25 (2) no. 2 TTDSG in conjunction with Art. 6 (1) (c) GDPR.
Further information on data protection when using Usercentrics can be found here https://usercentrics.com/privacy-policy/.

7.3. Google services

On our website and in our app we use the following services of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Further information on the handling of user data can be found in Google's privacy policy: https://www.google.de/intl/de/policies/privacy. The storage of information in the end user's device or the access to information is carried out in accordance with § 25 (1) TTDSG in conjunction with Art. 6 (1) (a) GDPR. The legal basis for further processing is your consent according to Art. 6 (1) (a) GDPR. You can revoke your consent at any time in the data protection settings. If the use of cookies can be considered absolutely necessary to provide you with the desired telemedia service, this is done on the basis of § 25 (2) no. 2 TTDSG in conjunction with Art. 6 (1) (f) GDPR.

7.3.1. Google Analytics

To analyse the use of our website and our app, we use the service "Google Analytics" from Google. For this purpose, cookies are set in the browser and the "Google Analytics for Firebase" service is used in the apps to collect information about the use of our website and app by users. Google processes the transmitted information on our behalf to evaluate the use and interaction of the user with our website and our apps to compile reports on the activities on our website and to provide us with other services related to the use. We use this data to perform user-oriented improvements to the design of our online services. The data processing is based on a pseudonymous identification number. Google Analytics does provide coarse geo-location data by deriving the following metadata from IP addresses: City (and the derived latitude, and longitude of the city), Continent, Country, Region, Subcontinent (and ID-based counterparts). For EU-based traffic, IP-address data is used solely for geo-location data derivation before being immediately discarded. It is not logged, accessible, or used for any additional use cases.

This data is processed exclusively on the basis of your consent (pursuant to §25 (1) Telecommunications and Telemedia Data Protection Act (TTDSG) in accordance with Art. 6 (1) (a) GDPR) which you have given us in the course of your visit to our website. You can manage and adjust your consent in the privacy settings.

For more information on the terms of use and data protection at Google Analytics, please visit http://www.google.com/analytics/terms/en.html, https://www.google.de/intl/de/policies/ or https://support.google.com/firebase/answer/9234069?hl=en

7.3.2. Google Ads

In order to check the effectiveness of our advertisements placed via Google Ads, we use the so-called conversion tracking on our website. When you click on an ad placed by Google, a cookie for conversion tracking is set on your device. These conversion-cookies lose their validity after 30 days and do not allow any direct conclusions to be drawn about an individual user. As long as the conversion-cookie is valid, we can track whether a user has clicked on an ad placed via Google Ads to reach our website. With the help of the conversion-cookies, we can draw conclusions about the effectiveness of our advertising measures. This data is processed exclusively on the basis of your consent (pursuant to §25 (1) Telecommunications and Telemedia Data Protection Act (TTDSG) in accordance with Art. 6 (1) (a) GDPR) which you have given us in the course of your visit to our website.

You can revoke your consent at any time if you do not wish to participate in the tracking. For this purpose, you can revoke your consent to data processing by the Google Ads service in the privacy settings. After deactivating the cookie, you will not be included in the conversion tracking statistics. Further information on Google Ads and Google conversion tracking can be found in Google's privacy policy: https://policies.google.com/privacy?hl=en.

7.3.3. Google Analytics Remarketing

We use the technology "Google Remarketing" to display ads for users who have already visited our websites and online services and are interested in a certain offer. Within the Google advertising network, this allows targeted and interest-based advertisements to be displayed on our site. Google remarketing uses cookies for this analysis. This enables our visitors to be recognised as soon as they call up websites within the Google advertising network. Within the Google advertising network, targeted and interest-based advertisements can thus be displayed, which are based on the websites of the Google advertising network (which also use the Google remarketing function) previously visited by the visitor.
This data is processed exclusively on the basis of your consent (pursuant to §25 (1) Telecommunications and Telemedia Data Protection Act (TTDSG) in accordance with Art. 6 (1) (a) GDPR) which you have given us in the course of your visit to our website. You can find a general objection option to Google processing your data for these purposes here: https://www.google.de/settings/ads

7.3.4. Google Tag Manager

On the website as well as in the app, we use "Google Tag Manager" from Google. This tool does not process personal data, but ensures the triggering of scripts that are required by other services to collect data.

7.3.5. Google Optimize

In addition, we use Google Optimize on our website. Google Optimize analyses the use of different variants of our website and helps us improve the user experience according to the behaviour of our users on the website. Google Optimize is a tool integrated into Google Analytics. This data is processed only on the basis of your consent (pursuant to § 25 (1) TTDSG in conjunction with Art. 6 (1) (a) GDPR), which you have given us in the course of your visit to our website.

7.3.6. Google Maps

In addition, we use the Google Maps service on our website and in the apps. The use of Google Maps allows us to offer users suggestions and functions for automatically filling out the form when they enter address information, thus improving the user-friendliness in the registration process and when changing personal information. By using this service, your location data and IP address are forwarded to Google. This data is processed only on the basis of your consent (pursuant to § 25 (1) TTDSG in conjunction with Art. 6 (1) (a) GDPR), which you have given us in the course of your visit to our website or in the app.

7.3.7. YouTube

We have embedded videos on our website via the YouTube service, which is provided by Google. After clicking on the video, device information, IP address and the information that you have viewed the video are transmitted to Youtube. If you are logged in to YouTube, this information is also assigned to your user account with YouTube.

This data is processed only on the basis of your consent (pursuant to § 25 (1) TTDSG in conjunction with Art. 6 (1) (a) GDPR), which you have given us in the course of your visit to our website or in the app.

You can find more details on the processing of your personal data by Youtube in Youtube's data protection information at https://policies.google.com/privacy. You can find a general option to object to the processing of your data by Google here: https://tools.google.com/dlpage/gaoptout?hl=en.

7.3.8. Firebase Crashlytics / Performance Monitoring

We use Google's Firebase Crashlytics technology as part of the Google Cloud Platform to ensure the stability of the app and to make improvements. Information about the device used and the use of our app is collected (e.g. user ID, device model, operating system version, app version, timestamp of the message), which enables us to diagnose problems and remedy them in the long term. In the process, so-called "crash_reports" are generated, which only receive information about problems and crashes. We use Crashlytics for the purpose of providing a functional mobile app and fixing stability issues. The data is collected in accordance with Section 25 (2) no. 2 TTDSG, as this is a function that is absolutely necessary to ensure the stable and secure operation of the app. The processing is carried out within the scope of our legitimate interest pursuant to Art. 6 (1) (f) GDPR to provide you with a stable and secure app.

7.3.9. Firebase Remote Config

Firebase Remote Config by Google allows us to unlock new features in the app and configure content without having to download the app again from the respective app store. In this context, we process device identification data (e.g. version and type of operating system and device model). In this context, we process the device identification data (e.g. version and type of operating system and device model) pursuant to Section 25 (2) no. 2 TTDSG, as this is a function that is absolutely necessary to ensure the stable and secure operation of the app. We use this service on the basis of our legitimate interest (pursuant to Art. 6 (1) (f) GDPR) to continuously develop and improve the app and to ensure the security and stability of the app.

7.4. Meta

In order to display the Meta ads placed by us to users on Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Meta”) and within the services of partners cooperating with Meta (so-called "Audience Network", see: https://www.facebook.com/audiencenetwork/) who have already visited our online offer or who have certain characteristics (e.g. interest in certain topics or products that are evident from the websites visited), we use the "Meta Pixel" service. By means of Meta Pixel, it is possible for Meta to determine the visitors of Scalable Capital's online offer as a target group for the display of dedicated advertising content (so-called "Meta Ads"). Furthermore, it is possible for us to track the effectiveness of our Meta ads for statistical and market research purposes. For this purpose, we analyse whether users were redirected to our online offers after clicking on a Meta ad (so-called "conversion measurement"). We collect and process your personal data only if you have given us your consent under data protection law (pursuant to §25 (1) TTDSG in accordance with Art. 6 (1) (a) GDPR)). You can manage and adjust your consent in the privacy settings.

The collection and transmission of so-called "event data" (but not the further processing of the data) is carried out under joint responsibility with Meta Platforms Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Meta”). For this purpose, a special agreement ("Addendum for Responsible Parties", see: https://www.facebook.com/legal/controller_addendum) has been concluded with Meta, in which, among other things, the security measures to be fulfilled (https://www.facebook.com/legal/terms/data_security_terms) and the responsibility in the assumption of the fulfilment of the data subject rights (i.e. users can, for example, direct information or deletion requests directly to Meta) are regulated.

Shared responsibility is for the following purposes:

• Display of content advertising information that corresponds to the presumed interests of users;
• Delivery of commercial and transactional messages (e.g., targeting users via Facebook Messenger);
• Improve ad delivery and personalization of features and content (e.g., improve the identification of which content or advertising information is likely to be of interest to users).

For more information visit https://www.facebook.com/legal/controller_addendum.

If Meta provides Scalable Capital with measurements, analyses and reports in aggregated form and without information on individual users, then this processing is carried out on the basis of our order processing agreement with Meta. Further information on agreed data processing can be found at https://www.facebook.com/legal/terms/dataprocessing and https://www.facebook.com/legal/terms/data_security_terms. Appropriate EU standard contractual clauses as well as the Meta European Data Transfer Addendum have been concluded in order to adequately protect your personal data. You can view the EU standard contractual clauses used via the following link: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32021D0914.

7.5. LinkedIn Insight Tag

On our website, we use "LinkedIn Conversion Tracking" as part of the "LinkedIn Insight Tag" from LinkedIn (LinkedIn Inc.). Via "LinkedIn Conversion Tracking" we receive aggregated and anonymised evaluations of our advertising campaigns on LinkedIn and additionally aggregated and anonymised information on how users interact with our website. We use "LinkedIn Conversion Tracking" to be able to track the efficiency of our advertising campaigns and to present interest-based advertising on LinkedIn to visitors to our website. Using the "LinkedIn Insight Tag", data is collected from users' visits to our website, including URL, referrer, IP address, device and browser characteristics, timestamp and page views. This data is encrypted, anonymized within seven days, and deleted within 90 days. We process their data to evaluate campaigns and collect information about website visitors who may have reached us through our campaigns on LinkedIn. We collect and process your personal data only if you have given us your consent under data protection law (pursuant to §25 (1) Telecommunications and Telemedia Data Protection Act (TTDSG) in accordance with Art. 6 (1) (a) GDPR)). You can manage and adjust your consent in the privacy settings.

LinkedIn does not forward the personal data to the website operator, but only provides aggregated evaluations of the target group and the advertising performance of the website. In addition, LinkedIn offers the possibility of retargeting via the Insight Tag. This enables us to display personalised ads based on our website with the help of this data without identifying the user.

You can object to the collection of the data generated by the cookie and its processing by LinkedIn. To do so, follow the instructions in this link: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out. You can find more information in LinkedIn's privacy policy: https://www.linkedin.com/legal/privacy-policy.