Information provided by DZ BANK AG pursuant to Articles 13 and 14 GDPR

The following information supplements our general privacy notice and explains how the personal data of guests on DZ BANK AG premises is processed. We use video surveillance in certain areas of our locations. We provide separate information about this through notices posted on site and at www.dzbank.com/dataprotection.
 

1. Scope of this Notice

This privacy notice is addressed in particular to:

•    visitors to DZ BANK AG,
•    participants in events held on our premises, 
•    external persons entering our locations for professional or other reasons.

2. What Data Do We Process?
In connection with your visit, we process the following personal data in particular:

•    first and last name,
•    company or organization, where applicable,
•    the person visited or inviting you,
•    the date and duration of the visit, and
•    the number of the visitor badge issued, where applicable.

We collect your data either directly from you—particularly when you register at reception—or receive it from the person inviting you or from your company, for example as part of a visitor or event registration. In addition, data may be recorded by the reception and security personnel commissioned by us. Depending on the occasion and location, additional information required for access control may be processed. 

Processing the aforementioned data is a prerequisite for access to our premises. There is no statutory obligation to provide this information; however, without it, we cannot grant you authorization to enter.
 

3. Purposes of Processing, Legal Basis and Recipients
We process your personal data to organize and document your visit, verify your authorization to enter, and manage visitor badges issued. Processing also serves to exercise our right to determine who may enter our premises and to protect people, buildings, information, and other assets. The legal basis is Article 6(1)(f) GDPR; our legitimate interest arises from the purposes stated above. Your data is accessible only to the parties that require it for the stated purposes—responsible DZ BANK employees and commissioned reception and security service providers that act solely on our instructions. In the event of security-related incidents or legal obligations, data may also be disclosed to public authorities, courts, or external legal advisers.

4. How Long Is Your Data Stored?
We store your visitor data only for as long as necessary for the purposes set out in Section 3. At the Frankfurt am Main, Düsseldorf, and Hanover locations, the retention period is no more than 180 days. This period is necessary to investigate security-related incidents retrospectively and trace access to the premises. At all other locations, we delete your data no later than four weeks after your visit. Data is stored beyond this period only where statutory retention obligations apply or where the data is required to establish, exercise, or defend legal claims.

5. General Information (Controller Contact Details, Data Subject Rights)
Further general information on the processing of personal data by DZ BANK AG, particularly regarding
•    the contact details of the controller and the Data Protection Officer,
•    your rights under Articles 15 et seq. GDPR,

is available at: www.dzbank.com/dataprotection

As of: September 2026