Data Protection

You may exercise the following rights, at any time, by contacting our Data Protection Officer:

• right of access to any of your data that we store and its processing (Article 15 of GDPR);
• rectification of inaccurate personal data (Article 16 of GDPR);
• erasure of data stored by us (Article 17 of GDPR);
• restriction of processing, insofar as we are not allowed to erase your data based on legal obligations (Article 19 of GDPR);
• objection against the processing of your data by us (Article 21 of the GDPR);
• data portability if you have given your consent to the data processing or concluded a contract with us (Article 20 of GDPR).

If you have provided us with your consent to the use of your data, you may withdraw this consent at any time for the future. You may lodge a complaint with the supervisory authority, at any time, e.g. with the competent supervisory authority of the federal state of your place of residence or with the authority which is responsible for us. For a list of supervisory authorities (for the non-public sector), including address, please visit https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html.

Type and purpose of the processing and legitimate interests:

When you visit our websites, i.e. unless you log in (e.g. for online banking) or transfer any other information we automatically collect information of a general type. Such information (server logfiles) contains, for instance, the type of the web browser, the operating system you use, the domain name of your internet service provider, your IP address and similar information. It will be processed, in particular, for the following purposes:

• guaranteeing a smooth connection to the website;
• ensuring the comfortable use of our website;
• evaluating system security and stability;
• protecting against cyber-attacks; and
• for other administrative purposes.

We will not use your data for drawing conclusions on your person. We might assess information of such type for statistical purposes to optimize our internet presentation and the technology behind it.

Legal basis:

The processing is based on our legitimate interest in website stability and functionality enhancement in terms of point (f) of Article 6(1) of GDPR.

Recipients:

Recipients of the data might be technical service providers which are active as processors for operating and maintaining our website.

Storage period:

Data will be erased as soon as such is no longer necessary in relation to the purposes for which it was collected. For data serving the provision of the website, that applies generally at the end of the relevant session.

Provision mandatory or required:

The provision of the above-mentioned personal data is not required on either a legal or contractual basis. However, the service and functionality of our websites is not ensured without the IP address. In addition, individual services might not be available or only available with restrictions. Therefore, an objection is excluded.

Type and purpose of the processing:

If you enter into a product deal for using our personalised services (e.g. current account), we collect some personal data such as name, address, contact and communication data (e.g. phone number and email address). You are our client and may access contents and services that are exclusively available for clients. Registered users are additionally able to change or erase the data provided, at any time, in case of need. Naturally, we will provide you, in addition, with access to the personal data we store about you, at any time.

Legal basis:

The data you enter for closing the product deal will be processed on the basis of a consent by the user (point (a) of Article 6 (1) of GDPR). If the product deal serves to perform a contract to which the data subject is a party or to take pre-contractual measures, an additional legal basis for processing data is point (b) of Article 6 (1) of GDPR.

Recipient:

Recipients of the data might be technical service providers who are active as processors for the operation and maintenance of our websites or for the provision of the application processes.

Storage period:

Data will only be processed in this connection for as long as the consent was given. Afterwards, they will be deleted, unless that is opposed by legal retention periods. Please use the contact data provided at the end of this Privacy Policy.

Provision mandatory or required:

Your personal data is provided voluntarily, solely on the basis of your consent. We are unable to grant access to the services we offer without the provision of your personal data.

Type and purpose of the processing:

Like many other websites, we use so-called “Cookies” and similar tracking technologies (e.g. Pixel). Cookies are small text files which are stored on terminal devices (laptop, tablet, smartphone etc.) when you visit our website.

Insofar as third parties process information from cookies, they collect such information directly from your internet browser.

You may, naturally, also visit our website without cookies. Internet browsers are regularly set to accept cookies. You may generally deactivate the use of cookies, at any time, by making the relevant browser settings. Please use the help function of your internet browser to learn how you may change these settings. Please observe that some functions of our website might not work if you have deactivated the use of cookies.

Cookies and tracking technologies used:

Insofar as you give your consent to the use of cookies by your browser settings or consent, the following cookies and tracking technologies might be used on our websites:

• Essential: These cookies are required for technical reasons so that you can visit our website and may use the functions we offer. That applies, for example, to a cookie which stores the authentication data of a client after they logged in to our secured online banking sections so that the client remains logged in to online banking even after changing the page. That relates, for example, also to those cookies which ensure that any user-related configuration of functionalities on our website (e.g. for online banking) that you have set remains intact across sessions. In addition, these cookies contribute to a secure use of the website that is conformity with the regulations.
• Functional: These cookies enable us to analyse the use of the website and to improve the performance and functionality of our website. They collect, for instance, information on how users use our website, which websites are opened most or whether error messages are displayed on certain pages. That applies, for example, to cookies which are used on our websites for website analysis services. Please note: If you exercise your potential right to object against the use of such a cookie, an opt-out-cookie will be set in your internet browser which blocks the further data collection through an advertising cookie by the operator of the website or any third-party provider. If you erase this opt-out-cookie, a renewed data collection will not be prevented. Please obtain information about the lifespan of an opt-out-cookie. When you re-visit the site, it will recognise automatically that you have already visited us and what entries and settings you prefer. These necessary cookies will be stored on your hard drive and are erased automatically after a certain period of time. These cookies are used, in particular, to make our offer more user-friendly, and more efficient.
• Marketing: Advertising cookies (even third-party providers) enable us to display different offers to you that correspond to your interests. These cookies record the advertising activities of users over a longer period of time. You might recognise the cookies on different devices you use. Please note: If you exercise your potential right to object against the use of such a cookie, an opt-out-cookie will be set in your internet browser which blocks the further data collection through an advertising cookie by the operator of the website or any third-party provider. If you erase this opt-out-cookie, a renewed data collection will not be prevented. Please obtain information about the lifespan of an opt-out-cookie. Cookies for marketing purposes are used to display ads for the user that are relevant for them and aligned to their interests. In addition, they are used to limit the number of times an ad is displayed and to measure the effectiveness of advertising campaigns.

Legal basis:

Given the purposes of use described above, the legal basis for processing personal data by using cookies is point (f) of Article 6 (1) sentence 1 of GDPR: If you have given your consent to use cookies based on a note provided on the website (user settings – “Cookie Banner”), the lawfulness of the use is also based on point (a) of Article 6 (1) sentence 1 of GDPR. Another legal basis is the compliance with a legal obligation pursuant to point (c) of Article 6 (1) sentence 1 of GDPR.

Recipients:

Recipient of the data are third-party providers, if you have given your consent or give us your instructions. That shall also apply in case that you authorise a connection with the account or platform of third parties.

Storage period:

The storage period depends on the relevant function. For further details, please refer to the user settings.

Most internet browsers are set to accept cookies as a standard. You may, however, configure your internet browser so as to accept only certain or no cookies at all. Please note, that you might no longer be able to use the functions of our website and might, instead, receive warnings and error messages if cookies are deactivated on our website due to your browser settings.

You may also erase cookies which are already stored in your internet browser through your browser settings. Furthermore, it is possible to set your internet browser to inform you before cookies are stored. Since different internet browsers might have different functions, please use the help menu of your internet browser to learn more about the configuration options.

If you need a comprehensive overview of all accesses made by third parties to your internet browser, we recommend installing the specifically developed plug-ins.

We recommend to always log out completely from any device after its use that you use jointly with others and the internet browser of which is set to allow cookies.

Provision mandatory or required:

You provide your personal data voluntarily. You may adapt your settings, at any time, at user settings.

Transfer to third countries:

Insofar as we transfer your personal data to countries outside of the European Economic Area (EEA) or engage processors in such countries (e.g. in the US), we comply with the legally required standards and security measures. We do so, for example, by using service providers or by concluding so-called EU standard contracts. For more information, please contact us.

Type and purpose of the processing:

We request additional data in order to render fee-based services, such as e.g. payment data enabling us to perform your electronic transfers.

Legal basis:

Data required for concluding the contract are processed on the basis of point b. of Article 6(1) of GDPR.

Recipients:

Recipients of the data might be processors which we require for handling your orders.

Storage period:

We store such data in our systems until the legal retention periods expire. Data is generally 6 or 10 years for reasons of an orderly bookkeeping and requirements under tax laws.

Provision mandatory or required:

You provide your personal data voluntarily. We are unable to grant access to the contents and services we offer without the provision of your personal data.

Use of Google Maps

Type and purpose of the processing:

We use the services of Google Maps on this Website. Google Maps is operated by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (hereinafter “Google”). This allows us to provide you with interactive maps directly on this Website and it makes using the map feature more convenient for you.

For more information on data processing by Google, please refer to Google’s privacy policy. You may also change your personal data privacy settings in their data protection centre.

For more instructions on managing your own data in connection with Google products, please see here.

Legal basis:

Legal basis for embedding Google Maps and for the associated data transfer to Google is your consent (point (a) of Article 6 (1) of GDPR).

Recipient:

By visiting this Website, Google will receive information that you have accessed the corresponding sub-page of our Website. This is made independently of whether Google provides a user account that you have logged into or whether you have no user account. If you are logged into Google, your data will be directly linked to your account.

If you do not wish for Google to link data to your profile, you have to log out of Google before clicking on the button. Google saves your data as user profiles and utilises them for advertisement, market research, and/or a need-based design of their website. The particular objectives of such analysis (even in case of users who are not logged in) are the provision of need-based advertisement and informing other users of the social network about your activities on our Website. You have the right to object to the creation of these user profiles, which must be exercised towards Google.

Storage period:

We will not collect any personal data by embedding Google Maps.

Transfer to third countries:

Google will process your data in the USA.

Withdrawing your consent:

If you do not want Google to collect, process or use data about you through our internet presentation, deactivate JavaScript in the settings of your browser. In such case, you may, however, not use our Website or only use it with restrictions.

Provision mandatory or required:

Your personal data is provided voluntarily, solely on the basis of your consent. If you restrict the access, that might result in the restriction of functions on the website.

Embedded YouTube videos

Type and purpose of the processing:

We embed YouTube videos on some of our Websites. The operator of the relevant plugins is YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA (hereinafter “YouTube“). If you visit one of our pages equipped with a YouTube plugin, a connection to YouTube’s servers will be made. YouTube will receive information on which sites you visit. If you are logged in to your YouTube account you allow YouTube to directly associate your surfing behaviour to you personally. You can prevent this by logging out of your YouTube account before the visit.

When the playback of embedded YouTube videos is started, the provider uses cookies to collect information on the user behaviour.

For more information on the purpose and scope of the data collection and processing by YouTube, please refer to the Privacy Policy of the provider. It will also give you more information on your associated rights and setting options to protect your privacy (https://policies.google.com/privacy). Google processes your data in the USA and has agreed to comply with the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework .

Legal basis:

Legal basis for embedding YouTube and the associated data transfer to Google is your consent (point (a) of Article 6(1) of GDPR).

Recipients:

Whenever you open YouTube, a connection will automatically be made to Google.

Storage period and withdrawal of consent:

Persons who deactivated the storing of cookies for the Google Ad programme will not receive any such cookies when they watch YouTube videos. However, YouTube also stores non-personal usage data in other cookies. If you wish to prevent that, you need to block the storing of cookies in the browser. For more information on privacy when using “YouTube" refer to the provider’s privacy policy at: https://www.google.de/intl/de/policieis/privacy/.

Transfer to third countries:

Google will process your data in the USA.

Provision mandatory or required:

Your personal data is provided voluntarily, solely on the basis of your consent. If you restrict the access, that might result in the restriction of functions on the website.

Google Ads

Our Website uses Google Conversion tracking. The operating company of the services of Google AdWords is Google LLC. 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. If you visit our website because you clicked on an ad placed by Google, Google AdWords will set a cookie on your computer. The cookie for conversion tracking will be set if a user clicks on an AdWords ad placed by Google.

If a user visits certain pages of our website and the cookie has not yet expired, Google and we can see that the user clicked on the ad and was forwarded to that page. Each Google AdWords customer receives a different cookie. It is thus not possible to track cookies through the websites of AdWords customers. The information obtained using the conversion cookie is used to compile conversion statistics for AdWords customers who have opted for conversion tracking. Customers receive information on the total number of users who have clicked on their ad and have been forwarded to a web page with a conversion tracking tag. They do not, however, receive any information which can be used for the personal identification of users.

Legal basis:

Legal basis for embedding Google AdWords and the associated data transfer to Google is your consent (point (a) of Article 6(1) of GDPR).

Recipients:

Personal data, including your IP address will be transferred to Google in the USA during each visit of our Website. Such personal data is stored by Google. Google might disclose this personal data collected through the technical process to third parties under some circumstances.

Our company will not receive any information from Google which might allow for an identification of the data subject.

Storage period:

These cookies become invalid after 30 days and do not serve the purpose of personal identification.

Transfer to third countries:

Google will process your data in the USA.

Withdrawing your consent:

If you do not want to take part in the tracking, reject the setting of the required cookies – by choosing the browser setting which generally deactivates the automatic setting of cookies or by setting your browser to block the setting of cookies from the “googleleadservices.com” domain. Please note that you must not erase the opt-out-cookies if you do not want the recording of measuring data. If you erased all the cookies in the browser, you need to re-set the opt-out cookie.

Provision mandatory or required:

Your personal data is provided voluntarily, solely on the basis of your consent. If you restrict the access, that might result in the restriction of functions on the website.

Use of etracker

Type and purpose of the processing:

The provider of this website uses the services of etracker GmbH based in Hamburg, Germany (www.etracker.com) to analyse usage data. Cookies are set which allow for a statistical analysis of the use of this website by its visitors and the display of usage-related contents or advertising.

The data generated by etracker will exclusively be processed and stored by etracker in Germany on behalf of the provider of this website and is thus subject to the strict German and European data protection acts and standards. etracker was audited and certified for this purpose and received the ePrivacyseal data protection quality seal.

Our legitimate interest is the optimisation of our online offer and our internet presentation. Since we are committed to the privacy of our visitors, the IP address will be anonymised with etracker as soon as possible and log-in data or device identifications are converted to a unique key which cannot be allocated to any person. No other use, combination with other data or any disclosure to third parties will be done by etracker.

You may object to the above-mentioned data processing at any time, insofar as it relates to personal data. No disadvantages will arise for you if you object.

For more information on data privacy at etracker, please see here.

Legal basis:

The legal basis for the data processing is point (f) of Article 6 (1) of the EU General Data Protection Regulation (EU GDPR) (legitimate interest).

Recipients:

Usage data, including your IP address will be transferred to etracker during each visit of our Website.

Withdrawing your consent:

You may object to the above-mentioned data processing at any time, insofar as it relates to personal data. No disadvantages will arise for you if you object.

Provision mandatory or required:

Your personal data is provided voluntarily, solely on the basis of your settings. You may adapt your settings, at any time, at user settings.

Use of Trusted Shops

Type and purpose of the processing:

In order to display our Trusted Shops Seal of Approval and, if necessary, the compiled evaluations as well as the offer of Trusted Shops products to customers after a purchase, the Trusted Shops Trustbadge is included on this Website.

This serves to safeguard our predominantly legitimate interests within the framework of a balancing of interests in marketing our offer in an optimal manner pursuant to point (f) of Article 6 (1) GDPR. The Trustbadge and the services promoted along with it are an offer from Trusted Shops GmbH, Subbelrather Str. 15C, 50823 Cologne, Germany.

When the Trustbadge is accessed, the web server automatically stores a so-called server logfile, which stores details such as your IP address, the date and time of access, the volume of data transferred, and the requesting provider (access data) and registers your visit. This access data is not analysed and is overwritten automatically seven days after the end of your visit to the site, at the latest.

Further personal data is merely transferred to Trusted Shops insofar as you have given your consent, if you decided to use Trusted Shops products after conclusion of an order, or have already registered for their use. In this case, the contractual agreement concluded between you and Trusted Shops applies.

Legal basis:

The legal basis for the data processing is point (f) of Article 6 (1) of the EU General Data Protection Regulation (EU GDPR) (legitimate interest).

Recipients:

Personal data, including your IP address will be transferred to Trusted Shops during each visit of our Website.

Withdrawing your consent:

You may object to the above-mentioned data processing at any time, insofar as it relates to personal data. No disadvantages will arise for you if you object. Provision mandatory or required: Your personal data is provided voluntarily, solely on the basis of your settings. You may adapt your settings, at any time, at user settings.

Use of reCAPTCHA

Nature and purpose of processing:

We use the services of reCAPTCHA on this website. reCAPTCHA is operated by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043 USA (hereinafter "Google"). This service protects the website from bots. This service collects and analyzes a user's interactions on the website and creates a score which helps to identify suspicious user behavior. The reCAPTCHA analyses run solely in the background. Visitors to the website are not made aware that any analysis is taking place. You can find more information about data processing by Google in the Google privacy policy. It is here that you can also change your personal privacy settings in the Privacy Center.

Legal basis:

The legal basis for the integration of reCAPTCHA and the associated data transfer to Google is the legitimate interest in protecting offers on the Web from attacks and spying (Art. 6 para. 1 lit. f DSGVO).

Recipients:

Whenever you visit our website, personal data, including your IP address, is transferred to Google in the USA. This personal data is stored by Google. Google may pass on this personal data collected via these technical processes to third parties. Our company does not retain any information from Google by means of which the data subject could be identified.

Storage period:

Data is deleted as soon as it is no longer required for our recording purposes.

Third-country transfer:

Google processes your data in the USA.

Withdrawal of consent:

If you do not want Google to collect, process or use data about you via our website, you can deactivate JavaScript in your browser settings. In this case, however, you will not be able to use our website or only to a limited extent.

Provision mandatory or required:

The provision of your personal data is voluntary, based solely on the settings you have made. If you disable access, this may result in functional restrictions on the website.

Use of IBM Watson Assistant - Chatbot

Nature and purpose of processing:

This website uses an external service provider that develops AI-based chatbots (AI = Artificial Intelligence). A chatbot is a text-based dialog system that allows communication with a technical system. The chatbot has one area each for text input and output, which can be used to communicate with the system in natural language. Such systems are also called virtual personal assistants.

OLB's customer service employees are relieved of recurring inquiries by a chatbot. For OLB customers, the chatbot is available around the clock (24/7); the chatbot can also handle a high number of parallel inquiries.

No contract-specific customer inquiries are resolved via the chatbot. Such inquiries will continue to be handled by our competent employees at the branch, by mail, or by telephone.

Legal basis:

The legal basis for the integration of a chatbot and the associated data processing for handling your request is your consent (Art. 6 para. 1 lit. a DSGVO).

Recipient:

The collected data is processed in a cloud-based dialog system of the service provider. The service provider ensures a high processing quality and regularly controls the internal processes as well as the technical and organizational measures to ensure that the processing is carried out in accordance with the requirements of the applicable data protection law and that the protection of the rights of the data subject is guaranteed.

Storage period:

The questions you ask in the chatbot are stored for a maximum of 30 days in order to train the chatbot and better respond to requests in the future. After that, they are irrevocably deleted. Personal data is not evaluated in the process.

Revocation of consent:

It is possible to revoke consent at any time with future effect by discontinuing communication with the virtual assistant or no longer using it. Your objection has no subsequent consequences for you.

The data processing that has taken place up to this point is not affected.

Provision mandatory or required:

The provision of your personal data is voluntary. Without the provision of your personal data, we may not be able to process your request. If necessary, use other communication channels (e.g. telephone / mail / branch) to contact us.

Use of pagestrip – interactive annual report

Nature and purpose of processing:

To display the annual report, the software tool software pagestrip is integrated, which is operated by alice interactive GmbH, Löwengasse 18/13c, 1030 Vienna, Austria. When the annual report is called up, the web server automatically saves a so-called server log file, which contains, for example, the first three digits of the IP address, the date and time of the call-up, the volume of data transferred and the requesting provider (access data) and documents the call-up. This access data is not evaluated and is deleted at the latest 14 days after the end of the page visit.

Legal basis

The data processing is carried out on the legal basis of Art. 6 para .1 lit a (consent) of the EU Data Protection Regulation (EU-DSGVO). The IP address is not stored in full in so-called server logs, but must be transmitted for technical reasons for the delivery of content and is not processed for any other purpose (Art. 5 para.1 lit b/c).

Recipient

The recipient of the so-called HTTP request to deliver the content is alice interactive GmbH.

Storage period

The storage of non-personal data is limited to a maximum of 14 days. Personal data is not stored by alice interactive GmbH.

Third country transfer

A transfer to a third country does not take place.

Revocation of consent:

If users do not wish to transfer their IP address to alice interactive GmbH, where a time-limited storage of parts of the IP address occurs as described above, they can deactivate this in our "Privacy settings". In this case, however, the digital version of the annual report cannot be viewed.

Provision mandatory or required:

The provision of personal data (IP address), which as described above is not stored in full and therefore loses its personal reference, is voluntary. If you as a user do not allow access, you will not be able to view the digital version of the annual report.

In the following, we inform you about the social media presences operated by Oldenburgische Landesbank AG. You can reach these in the individual networks or via the social media icons in the footer of this website.

Please note: These social media buttons merely provide links to the respective providers. As long as these buttons are not clicked, no transmission/forwarding to these providers takes place. If you click on these buttons, you will be forwarded to the website of the respective provider. Depending on whether you were logged in to the respective providers at the time of clicking, your data will be processed according to the data usage guidelines of these providers and may be used for profiling, which is not our responsibility.

The following social media icons are integrated into our website footer:

Facebook

Nature and purpose of processing:

OLB Bank operates a fan page on Facebook in order to communicate with customers, interested parties and users active there and to be able to inform them about our services there.

If you visit our fan page, Meta Platforms Ltd, 4 Grand Canal Square, Grand Canal Harbour, D2 Dublin, collects, stores and processes your personal data in accordance with its privacy policy. The privacy policy can be found here: https://de-de.facebook.com/policy.php. Data processing by us beyond this only takes place to a very limited extent:

For statistical evaluation purposes, we use the Facebook Insights function. In this context, we receive anonymized data on the users of our Facebook fan page. It is not possible for us to draw any conclusions about you personally.

You can find more information about Facebook Insights here: www.facebook.com/legal/terms/information_about_page_insights_data

With regard to the processing of Insights data, there is joint responsibility between Facebook and us. Details of this are governed by the Joint Controller Addendum, which can be found here: www.facebook.com/legal/terms/page_controller_addendum

To data subjects, Facebook Ireland provides the gist of the Page Insights Addendum. We recommend that you contact Facebook directly for more information.

In the context of sweepstakes, data is collected for their processing. The details of this, such as what data is collected for what purpose, can be found in the privacy notices and conditions of participation of the respective sweepstakes.

Legal basis:

The legal basis for the integration of Facebook and the associated data transfer is your consent (Art. 6 para. 1 lit. a DSGVO).

Recipient:

When using the link on our websites, anonymized usage data is transferred to Facebook.

Storage period:

We do not collect any personal data through the integration of Facebook.

Third-country transfer:

Facebook processes your data in the USA.

Provision mandatory or required:

The provision of your personal data is voluntary. Without the provision of your personal data, we cannot provide you with the service.

Instagram

Type and purpose of processing:

On the Instagram channel "olb.bank" we inform you about young financial knowledge, interesting facts from the OLB working world and OLB as a training company. You can also leave comments and ask questions.

If you visit our fan page, personal data will be stored and processed by Meta Platforms Ltd, 4 Grand Canal Square, Grand Canal Harbour, D2 Dublin, as the provider of Instagram in accordance with Instagram's privacy policy. The privacy policy can be found here: https://help.instagram.com/519522125107875

By us, data processing beyond this only takes place to a very limited extent. For the purpose of demand-oriented design and continuous optimization of our pages, we use the statistics service Instagram Insights. This service records your activity on our site and makes it available to us in anonymized statistics. This gives us insights into, among other things, the interactions of our fan page visitors, the views of our page, the reach of posts, information about the activity of our subscribers as well as information about which countries and cities our visitors come from as well as statistics about the gender ratios of our visitors. Conclusions about individual users as well as access to individual user profiles by the administrator are not possible.

In the context of competitions, data is collected for their processing. The details of this, such as what data is collected for what purpose, can be found in the privacy notices and conditions of participation of the respective sweepstakes.

Legal basis:

The legal basis for the integration of Instagram and the associated data transfer is your consent (Art. 6 para. 1 lit. a DSGVO).

Recipient:

When using the link on our websites, anonymized usage data is transferred to Facebook.

Storage period:

We do not collect any personal data through the integration of Instagram.

Third-country transfer:

Facebook processes your data in the USA.

Provision mandatory or required:

The provision of your personal data is voluntary. Without the provision of your personal data, we cannot provide you with the service.

YouTube

Type and purpose of processing:

The YouTube channel "Oldenburgische Landesbank AG" presents videos on the subject of banking, e.g. all about the offers from OLB Bank or helpful tips on how to use the offers from OLB Bank.

Personal data is stored and processed by Google LLC ("Google"), Amphitheatre Parkway, Mountain View, CA 94043, USA, as operator of YouTube, in accordance with Google's privacy policy. The privacy policy can be found here: https://policies.google.com/privacy?hl=de&gl=de

Legal basis:

The legal basis for the integration of YouTube and the associated data transfer is your consent (Art. 6 para. 1 lit. a DSGVO).

Recipient:

When using the link on our websites, anonymized usage data is transferred to Google.

Storage period:

We do not collect any personal data through the integration of Google.

Third-country transfer:

Google processes your data in the USA.

Provision mandatory or required:

The provision of your personal data is voluntary. Without the provision of your personal data, we cannot provide you with the service.

LinkedIn

Type and purpose of processing:

On the LinkedIn channel "Oldenburgische Landesbank AG" we publish company news and content related to OLB Bank.

Personal data is stored and processed by Linkedin Ireland Unlimited Company, 70 Sir John Rogerson's Quay - D02 R296 Dublin as the provider of LinkedIn in accordance with LinkedIn's privacy policy. The privacy policy can be found here: https://de.linkedin.com/legal/l/dpa

Legal basis:

The legal basis for the integration of LinkedIn and the associated data transfer is your consent (Art. 6 para. 1 lit. a DSGVO).

Recipient:

When you use the link on our websites, anonymized usage data is transferred to LinkedIn.

Storage period:

We do not collect any personal data through the integration of LinkedIn.

Third-country transfer:

Linkedin processes your data in the USA.

Provision mandatory or required:

The provision of your personal data is voluntary. Without the provision of your personal data, we cannot provide you with the service.

XING

Type and purpose of processing:

On the XING channel "Oldenburgische Landesbank AG", we publish company news and content related to OLB Bank.

Personal data is stored and processed by New Work SE, Dammtorstraße 30, 20354 Hamburg, Germany as the provider of XING in accordance with XING's privacy policy. The privacy policy can be found here: https://privacy.xing.com/de/datenschutzerklaerung

Legal basis:

The legal basis for the integration of XING and the associated data transfer is your consent (Art. 6 para. 1 lit. a DSGVO).

Recipient:

When you use the link on our websites, anonymized usage data is transferred to XING.

Storage period:

We do not collect any personal data through the integration of XING.

Third-country transfer:

Xing processes your data in the USA.

Provision mandatory or required:

The provision of your personal data is voluntary. Without the provision of your personal data, we cannot provide you with the service.

Type and purpose of the processing:

Your data will exclusively be used for sending the newsletter to which you subscribed by email. Your name is necessary to personally address you in the newsletter and to identify you, if necessary, if you wish to exercise your rights as data subject.

It suffices to provide your email address for receiving our newsletter. When subscribing to our Newsletter, the data provided by you will exclusively be used for this purpose. Subscribers may also be informed about circumstances via email that are relevant to the service or the registration (such as changes to the newsletter offer or technical conditions).

We need a valid email address for an effective registration. We use the “double opt-in” procedure to check whether a subscription has actually been made by the owner of an email address. For this purpose, we protocol the ordering of the newsletter, the sending of a confirmation mail, and the receipt of the reply requested therein. No other data is collected. The data is only used for sending the Newsletter and will not be disclosed to any third parties.

Legal basis:

Based on your explicitly given consent (point (a) of Article 6 (1) of GDPR), we will send our newsletter or comparable information on a regular basis by email to the email address you provided.

You can withdraw your consent to the storage of your personal data and its use for sending the Newsletter at any time, with effect for the future. You can find a corresponding link in each Newsletter. You can also unsubscribe directly on this website at any time or inform us about your withdrawal via the contact stated at the end of this Privacy Policy.

Recipients:

Recipients of the data might be processors whom we engage for sending the newsletter.

Storage period:

Data will only be processed in this connection for as long as we have the relevant consent. It will be deleted afterwards.

Unsubscribing:

You may unsubscribe from the newsletter, at any time, directly in the newsletter. For this purpose, confirm the “Unsubscribe link” contained in the email. Another consequence is that your consent to advertising by email will be deleted from our systems. You may also unsubscribe by withdrawing the advertising consent to sending emails.

Provision mandatory or required:

Your personal data is provided voluntarily, solely on the basis of your consent. We will, unfortunately, not be able to send you our newsletter without your consent.

Nature and purpose of processing:

The data which you input will be stored for the purpose of individual communication with you. Various items of personal data may be required for this purpose, depending on the nature of your inquiry. As a rule, your name and a valid e-mail address are sufficient. In case of Investor Relations inquiries, we may require additional data. These data enable us to categorize your inquiry and to respond to it. In the Investor Relations section of our website, you may sign up to receive financial news from us, for instance. This is subject to our newsletter terms (see above). You may optionally provide further data.

Legal basis: As a rule, the data which you provide via our contact forms will be processed on the basis of your voluntary consent (Art. 6(1)(a) of the GDPR).

The purpose of our contact form is to provide an easy way for you to get in touch with us. Your details will be stored in order to process your inquiry and for possible follow-up questions.

In the event that you contact us to request a quotation, your contact form data will be processed for the implementation of pre-contractual measures (Art. 6(1)(b) of the GDPR).

Recipients:

The recipients of your data are internal contacts within our company. We may receive support from processors.

Storage period:

Data will be deleted, at the latest, 6 months after the processing of your inquiry.

In the event that a contractual or investor relationship is established, we will be subject to the statutory retention periods under the German Commercial Code (Handelgesetzbuch - HGB) and the German Securities Trading Act (Wertpapierhandelsgesetz – WpHG) and will delete your data upon expiry of these periods.

Type and purpose of processing:

In order to place our existing customer relationship on a legally new basis in accordance with the BGH ruling of April 27, 2021, we ask you to agree to the current terms and prices. The clauses for contract amendments by means of fictitious consent are new: Amendments to terms and conditions by means of fictitious consent are now only possible in the exceptional cases specified in No. 1 (2) of our GTC. The fictitious consent shall no longer apply to the amendment of charges. All other contractual agreements with you remain unchanged.

You can give your consent conveniently via our website.

The data you enter will be processed for identification and agreement of the GTCs. If you use this option, the data is processed for the implementation of contractual measures (Art. 6 para. 1 lit. b DSGVO).

Recipients:

Recipients of the data are, if applicable, order processors.

Storage period:

Data is stored for the duration of the customer relationship with us as well as beyond that for the fulfillment of the statutory retention obligations according to HGB and AO.

After expiry of the periods, your data will be deleted.

Provision mandatory or required:

The provision of your personal data is voluntary. However, you can only give your consent on our website if you provide the necessary data for identification and agreement of the GTCs.

Type and purpose of the processing:

On this website, we make use of the pass creation offer from YOUR PASS. In this way, for example, information or campaign passes for products can be created and stored on a private smartphone.

Wallet passes are small files which contain all the information required to display the pass – e.g. images and text. The passes are made available for iPhones and Android smartphones.

Once wallet passes are saved, the iPhone sends the user a message via the Apple Push Notification Service (APNS). In turn, this generates a random ID (a so-called Device Library Identifier) which is sent to YOUR PASS. This ID is used to update wallet passes, but does not allow the user to be identified. When the pass is deleted or the push notifications are deactivated, YOUR PASS is informed of this from APNS, which means that from that point in time, no more updates are sent to the smartphone of the user. 

The passes of third-party provider apps for presenting wallet passes on Android smartphones work in the same way as was described for Apple products, with the difference that the Google push notification service is used.

When wallet passes are downloaded and opened via the smartphone (contents e.g. for the apps Apple Wallet or third-party provider apps for Android), there is no contractual relationship between the user and YOUR PASS. Only the obtained data “anonymous pass ID” and the associated “time stamp” are collected. The data processing is for securing the YOUR PASS system against attacks, for obtaining the desired pass and for allocating an anonymous ID.

Legal basis:

The legal basis for integrating YOUR PASS and the associated data processing is your consent (point (a) of Art. 6(1) GDPR).

Recipient:

The data recipient is YOUR PASS (YOUR PASS, s.r.o., Türkova 2319/5b, 149 00 Prague 4 – Chodov, Czech Republic) – and at the same time, the place of the processing in connection with Amazon Web Services in Frankfurt (GDPR Centre, Data Residency, FAQ Data Protection), which can be contacted by post via Amazon Web Services, 2021 Seventh Ave., Seattle, Washington 98121 USA. The functions within the EU are server infrastructure, web services, database and hosting.

Storage period:

Your personal data is erased or blocked as soon as the purpose for which it was stored no longer applies. The technically necessary collection of accesses by users generally takes place for a period of a few hours, up to 7 days at a maximum. The data may also be stored if this has been stipulated accordingly by the European or domestic legislator in the regulations, laws or other ordinances of the European Union to which the controller is subject. A blocking or erasure of data also takes place if a retention period which is prescribed by the aforementioned standards expires, unless the continued retention of the personal data is required for entering into or fulfilling a contract. 

Transfer to third countries:

Your data is processed on servers outside of the EU (e.g. USA) where no appropriate level of data protection can be guaranteed. For further information on this, please observe the terms of use and data protection information of YOUR PASS, s.r.o., Türkova 2319/5b, 149 00 Prague 4 – Chodov, Czech Republic. These can be found here with the privacy policy.

Withdrawing your consent:

You can object to the mandatory data protection at any time if this relates to your person. Your objection has no retrospective consequences for you. Processing which has already taken place remains unaffected by the objection.

Provision mandatory or required:

The data (anonymous ID) is provided voluntarily. If users prevent access to this, the desired pass cannot be stored.

OLB Online Banking (incl. apps).

Type and purpose of processing:

Registration

We process personal data for the purpose of logging in to Online Banking. The following login data are processed in the process: personal access data and personal identification data or media.

Transaction

To carry out a transaction in online banking, we process the transaction number (TAN) assigned to you personally and the IP address of the terminal device from which the transaction was initiated in the course of two-factor authorization (PIN-TAN procedure).

Photo transfer

To use the photo transfer tool, relevant payment information data (payee, purpose, amount, etc.) is extracted from an image file using text recognition software and inserted into the transfer mask. To use the function, access to the device camera and, if necessary, to the photo or document archive for uploading files is required. Consent can be revoked at any time in the smartphone settings.

OLB Cash - Cash payments

To process deposits and withdrawals via OLB Cash, relevant account information and the corresponding transaction data are transmitted to the selected OLB Cash partner. To display the OLB Cash partners, the location is processed if consent has been given. Consent can be revoked at any time in the settings of the smartphone. Further information can be found in the privacy policy of the operating system of the smartphone.

CDCVM - Consumer Device Cardholder Verification Method (e.g. FaceID)

CDCVM is an authentication method using the smartphone or tablet. Authorization can take place via a fingerprint sensor or the device's camera, for example. CDCVM is mainly used in online banking. After assigning a login password, an optional log-in is possible via Touch ID or Face ID on iOS or via fingerprint on Android. This data is only stored locally on the device and is not passed on to third parties for processing. The setting can be revoked at any time in the smartphone settings.

Location information - Nearby

For the display of the closest branches and ATMs, the current location is processed and transmitted to the respective card provider of the application platform. Consent can be revoked at any time in the smartphone settings. For more information, please refer to the privacy policy of your smartphone's operating system.

Branch and ATM search

For the use of the branch and ATM search, the Google Maps service is used within online banking to display maps and to create directions. You can find more information on the use of Google Maps on this page under "External services".

Use of individual digital services in online banking

When using special digital services in online banking (e.g. paydirekt), additional data processing may take place. The supplementary data protection notices are listed in the individual terms of use of the respective service. Further information on the individual terms of use of the digital services can be found here.

Cookies

In addition, we use cookies for various purposes in the context of online banking. You can find out how we use these cookies in our online banking and which deactivation options are available to you on this page under "Cookies and similar technologies".

Legal basis:

The data processing is carried out on the legal basis of Art. 6 para. 1 lit. b (contract execution/initiation) of the EU Data Protection Regulation (EU-DSDGVO). If, in individual cases, data is collected beyond this, consent is obtained for this on the basis of the legal basis of Art. 6 (1) a DSGVO.

Recipients:

Recipients of the data are, if applicable, order processors whose systems are used for the provision of the services as well as external services (e.g. Google), if you use the services on the basis of the consent given to us.

Storage period:

We store this data in our systems until the statutory retention periods have expired. These are generally 6 or 10 years for reasons of proper accounting and tax law requirements.

Provision mandatory or required:

The provision of your personal data is voluntary. Without the provision of your personal data, we cannot grant you access to our online banking and the respective services.

Use of live chat

Nature and purpose of processing:

OLB Bank enables you, as a user of the Website, to contact the Bank in real time via a short, rapid communication channel by means of the live chat function. The live chat software of the company purpleview GmbH, Kampstraße 6, 44137 Dortmund, Germany, is used for this purpose.

As soon as a participation in the chat takes place, cookies are set. The data collected is not used to identify you personally as a user of the live chat, but to ensure the functionality of an exchange in real time as requested by you. As soon as the chat session is terminated, the cookies activated by the chat are automatically discarded.

If you communicate with us as a user via this channel, you do not have to legitimize yourself - information via the chat can thus be provided anonymously. Consequently, OLB Bank does not request any personal data, since only general and no account-specific or personal inquiries are processed via the live chat.

Conversation histories are not stored and, like the cookies activated via the live chat, are automatically discarded after the live chat is closed.

Legal basis:

The data processing is carried out on the legal basis of Art. 6 para. 1 lit b (contract implementation/initiation) of the EU Data Protection Regulation (EU-DSGVO).

Recipients:

Recipients of the data are, if applicable, order processors whose systems are used for the provision of the service.

Storage period:

The data is deleted as soon as it is no longer required for the purpose for which it was collected. This is generally the case for data used for the functionality of the live chat when the respective chat session has ended.

Provision mandatory or required:

The provision of your personal data is voluntary. Without the provision of your personal data, we cannot provide you with the service.

Use of video consultation

Nature and purpose of processing:

Individual information about your personal and factual circumstances that may be mentioned in connection with the use of video consulting, in particular within the conversation between you and your consultant will be collected by us only for the purpose that you have given us in this regard (contract execution(initiation). We use the data we collect about you exclusively to enable the functionalities you have requested and to provide the services requested by means of the functionalities.

If you communicate with us via this channel, you do not have to register. You will receive an access code from us for use. In addition to your name and (optionally) your e-mail address, we store the time and duration of your dial-in. This serves your consultant as a chronicle of the calls you have made. In addition, your data will only be used for the purpose of dialing into the video consulting service. After the call, no stored communication content remains on the servers.

If you turn on your webcam, your image will be transmitted.

The conversations are generally not stored (neither image nor sound), this also applies to the information you may provide in the chat. Should a recording be necessary due to a legal requirement, we will obtain your consent in advance.

For statistical purposes, the topic, duration and time of the conversation are recorded anonymously. This helps us to optimize our services. It will not be passed on to third parties.

Legal basis:

The data processing is carried out on the legal basis of Art. 6 Para .1 lit b (contract implementation/initiation) of the EU Data Protection Regulation (EU-DSGVO).

Recipients:

Recipients of the data are, if applicable, order processors whose systems are used for the provision of the service.

Storage period:

If there is a need to record and store data, we will comply with the statutory retention periods and delete your data after these periods have expired.

Provision mandatory or required:

The provision of your personal data is voluntary. Without the provision of your personal data, we cannot provide you with the service.

Handling of emails

Wherever you will be able to send a message to OLB from its websites, the contents of such message will be subject to cryptographic encryption. We use the email address provided by you to send you an email with the information you requested. We will not send any unencrypted notifications about customer matters by email. If the contents of your message relate to a contractual relationship, we will keep the email.

Before sending any unencrypted email through your internet provider, please remember that its contents will not necessarily be protected on the internet against unauthorised access, distortion, etc.

Encryption

We use automatic cryptographic end-to-end encryption for each dialogue through OLB Websites which might contain personal data. The key size is at least 128 bits each.

Access protection at OLB

The OLB data processing network is protected against the outside world by a state-of-the-art firewall system. Internal OLB applications are accessible for authorised persons through a log-in procedure, including an individual user key and password. User rights within the applications are restricted according to the business needs based on legitimation systems.

Duties of secrecy

Employees of OLB must comply with

• bank secrecy;
• data secrecy;
• secrecy of telecommunication;
• trade and business secrets;
• private secrecy;
• and social secrecy, if appropriate.

Data protection officers must comply with a special professional secrecy, in addition.

This body is also available for requests for access, suggestions, complaints, objections, and withdrawals relating to data protection matters.

Insofar as we are obliged to transfer data based on legal regulations or a court decision, we cooperate with the competent authorities.

We engage processors for providing and operating our services and we concluded contractual regulations with them which comply with the applicable data protection laws.

We reserve the right to amend this Privacy Policy to ensure its consistent compliance with the current legal requirements or to implement changes in our services in the Privacy Policy, e.g. by launching new services. The new Privacy Policy will then apply to any new visit.

If you have questions about data privacy, please write an email or directly contact the person in our organisation who is responsible for data protection. Contact our corporate Data Protection Officer at:

Oldenburgische Landesbank AG
Data protection officer
Stau 15/17
26122 Oldenburg
Phone: 0441 221-0
Fax: 0441 221-1457
Email: datenschutz@olb.de

The corporate Data Protection Officer is responsible for observing the “Data Protection Principles”.

Even authorised accesses will be verified for their business purpose, on a spot-check basis. The automatic processing of personal data at OLB is supervised by the competent Data Protection Supervisory Authority.

These Data Protection Principles relate to all websites belonging to the www.olb.de domain.

Adaptation of the Data Protection Principles

Any launch of new products or services by OLB or any future amendments of the data protection and information security technology might affect the “Data Protection Principles”. Therefore, we reserve the right to change or supplement the principles in case of need. We endeavour to publish any change immediately here, to enable you to understand, at any time, what data we collect, how such is used and under what circumstances they might be disclosed.

Change history

02 March 2010/Version 0: Initial publication of the Data Protection Principles.
04 July 2016/Version 1: Sitecore information supplemented..
08 Oct. 2020/Version 2: Revision of the Data Protection Principles regarding the consent for processing.

Contact for data protection matters

If you have questions about the collection, processing or use of your personal data by Oldenburgische Landesbank AG, please contact: datenschutz@olb.de.

 

 

Information on data usage

We wish to inform you about the use of your data according to the provisions in data protection laws. You can find relevant information here under the heading "Datenschutzgrundverordnung" (available in German language only). You may request to have them sent to you.