§ 1 Information on the Processing of Personal Data

(1) We provide you with MAIN TOWER, a mobile app that you can download to your mobile device. Below, we inform you about the processing of personal data when using our mobile app. Personal data includes all data that can be related to you personally, e.g., name, address, email addresses, user behavior. With this information, we would like to inform you about our processing activities and at the same time comply with our legal obligations, particularly under the EU General Data Protection Regulation (GDPR).

(2) The controller according to Art. 4(7) GDPR is:

Landesbank Hessen-Thüringen, Neue Mainzer Straße 52–58, 60311 Frankfurt am Main

You can contact our Data Protection Officer at datenschutz@helaba.de or at our postal address with the addition “Data Protection Officer” — see also § 5 subsection (3).

§ 2 Your Rights

(1) You have the right of access pursuant to Article 15 GDPR, the right to rectification pursuant to Article 16 GDPR, the right to erasure pursuant to Article 17 GDPR, the right to restriction of processing pursuant to Article 18 GDPR, the right to object under Article 21 GDPR, as well as the right to data portability under Article 20 GDPR. The restrictions under Sections 34 and 35 of the German Federal Data Protection Act (BDSG) apply to the right of access and the right to erasure.

(2) You also have the right to lodge a complaint with a competent data protection supervisory authority (Article 77 GDPR in conjunction with Section 19 BDSG). The supervisory authority responsible for Helaba since 01 January 2024 is:

The Hessian Commissioner for Data Protection and Freedom of Information

Gustav-Stresemann-Ring 1

65189 Wiesbaden

Referat Kreditinstitute

Telefon: +49-0611-1408-0

Fax: +49-0611-1408-900-901

E-Mail: poststelle@datenschutz.hessen.de

According to Art. 2(1) of the State Treaty on the Establishment of a Joint Savings Bank Organization of Hesse-Thuringia, responsibility alternates between the Hessian and Thuringian supervisory authorities every 4 years. Starting 01 January 2028:

The Thuringian State Commissioner for Data Protection and Freedom of Information

Häßlerstraße 8

99096 Erfurt

Telefon: +49-0361-57-3112900

E-Mail: poststelle@datenschutz.thueringen.de

§ 3 Processing of Personal Data When Using Our Mobile App

(1) When downloading the mobile app, the necessary information is transmitted to the App Store, in particular your username, email address, and customer number of your account, the time of the download, and the individual device identifier. In addition, the App Store independently collects various data and provides you with analysis results. We have no influence on this data processing and are not responsible for it. We only process the data insofar as it is necessary for downloading the mobile app to your mobile device.

(2) When using the mobile app, we process the personal data described below to enable the use of the app's functions. If you wish to use our mobile app, we process the following data, which is technically required for us to provide the app’s functions and ensure its stability and security, and thus must be processed by us. The legal basis is Art. 6(1) sentence 1 lit. b GDPR:

– IP address: Your IP address is stored and forwarded via an API when using the City Finder feature to the Photon interface of Komoot at https://photon.komoot.io/ .

– Images: Any photos you take are stored exclusively on your device. No data is transmitted to Helaba or to any third parties. Access to the camera function must be manually enabled by you.

– Standortdaten: Standortdaten werden nur nach Ihrer ausdrücklichen Zustimmung gespeichert und verarbeitet.

§ 4 Processing of Data from Your Device

The technical operation of the mobile app requires that your acceptance of the terms of use be stored locally on your device. If the app is deleted from your device or if the terms of use are updated, any previously granted consent will be automatically deleted. In the event of an update to the terms of use, you will be asked to give your consent again; this new consent will then also be stored locally on your device. The legal basis for this processing is Art. 6(1) sentence 1 lit. f GDPR.

§ 5 Objection or Withdrawal of Consent to Data Processing

(1) If you have given consent to the processing of your data, you may withdraw this consent at any time. Such a withdrawal affects the permissibility of processing your personal data after you have communicated the withdrawal to us. The lawfulness of processing carried out prior to your withdrawal remains unaffected.

(2) If we base the processing of your personal data on a balancing of interests, you may object to the processing. This applies in particular if the processing is not required for the performance of a contract with you, as explained in the respective descriptions of the app’s functions. If you lodge such an objection, we ask you to explain the reasons why you believe we should not process your personal data as we have been doing. We will then examine the situation and either adjust or discontinue the data processing, or explain to you our compelling legitimate grounds on the basis of which we will continue the processing.

(3) The objection may be submitted informally with the subject “Objection” and must include your name and address. It should be addressed to:

Landesbank Hessen-Thüringen Girozentrale

Landesbank Hessen-Thüringen Girozentrale Institution under public law

Data Protection Officer of Helaba

Kaiserleistraße 29 – 35

63067 Offenbach

E-Mail: datenschutz@helaba.de