Your Privacy i DNB Denmark

The right to object gives you, in certain cases, the opportunity to request that we stop using your personal data. We will always consider and respond to such an objection.

When processing personal data for direct marketing purposes, you always have the right to object (right to opt out).

The right to object applies in different contexts with slightly different conditions:

• In cases where your personal data is processed because it is necessary to attend to a legitimate interest. Or because it is necessary to perform a task in the public interest. In such cases, you have the right to object on grounds relating to your particular situation. We address such objections specifically and individually. We may reject the objections if there are compelling reasons.

• In cases where your personal data is processed for direct marketing purposes without your consent. In these cases, we will always make sure to stop the processing of your personal data.

• If your personal data is processed for scientific or historical research purposes or for statistical purposes. In such cases, you may have the right to object on grounds relating to your particular situation. We will process your objection as quickly as possible, normally within 30 days.

How to exercise your right to object in DNB?

If you would like to object to a specific processing of your personal data, please contact us in writing at the address provided under “How to exercise your rights”.

For a more detailed overview of what types of processing you can object to, see the chapter entitled ‘Why we process personal data’. You may always request that we stop using your personal data for marketing aimed directly at you, including profiling for such a purpose.

For any use where we use your consent as a legal basis, you can revoke your consent at any time by contacting us at the contact details above or by following the steps below. If you revoke your consent, you may not be able to use our products and services in the intended way.

f we process personal data about you, you have, in some cases, the right to demand that your data will be deleted.

You may request the erasure of personal data if one of the following grounds is met:

• You withdraw your consent for the processing.
• You have objected to the processing of the data that you request to be deleted, and your objection is upheld. See more about the right to object above.
• The data you request to be deleted has been processed unlawfully.
• The information must be deleted in order to comply with a legal obligation to which we are subject.

In many cases, we are required to retain information about you, even if you request erasure. This applies both during your customer relationship, and for a certain time after agreements and your customer relationship has ended. In practice, this means that you cannot demand that your personal data be deleted when we have a legal obligation to retain your personal data or we must safeguard our legitimate interests. This also applies if we need to establish, exercise or defend a legal claim.

How to exercise your right to erasure in DNB?

If you wish to request the erasure of your personal data, please contact us in writing at the address provided under “How to exercise your rights”.

Automated decision-making is the process of making decisions solely based on personal data we are processing about you, without any human involvement.

You can always get an explanation of what is behind the automated decision and express your opinion. You can also contest the decision and demand that the decision made via the algorithm be reviewed by a person.

In DNB Denmark we use automated decision as part of the credit assessment when you apply for a loan or leasing which may lead to a rejection of the application.

You have the right to receive certain personal data that we process about you so that it can be reused across different systems and services. The information you request is sent directly to you in a machine-readable format and may make it easier for you to transfer your information to a new service provider. This right is called ‘data portability’ and applies only to the personal data that:

• you yourself have provided directly, and

• is processed on the basis of your consent, or
• is processed on the basis of an agreement that we have with you.

Exceptions: You are not entitled to receive the following personal data, even if the above conditions are met:

• Personal data that is only available in paper form or as scanned documents in our electronic archives.
• The transfer of your data infringes the rights of others.
• Personal data that is not collected directly from you and is thus not covered by this right.
• Personal data prepared in analyses or assessments for internal use.

How to request to have your personal data in DNB transferred to others?

To request a portable copy of the personal data in scope of data portability, please contact us in writing at the address provided under “How to exercise your rights”.

We will provide your data in a structured, commonly used and machine-readable format.

You may request that we restrict the way we process your personal data. This means that we cannot use your personal data actively. This is often in combination with other rights, for example to restrict the processing of your personal data while we consider a request for erasure or rectification.

For example, if you have asked us to correct your personal data, you can in the meantime request that we restrict the processing of this data until the error has been rectified.

We are obliged to restrict processing in some specific cases:

• If you believe that the personal data is inaccurate, the processing may be restricted to a period so that both you and DNB can check whether the personal data is correct and perform corrections if necessary.

• If the processing is unlawful, but you oppose the erasure of the personal data and requests the restriction of the use instead.

• If we no longer require the data for the purpose of the processing, but we need the data to establish, enforce or defend a legal claim and therefore wish to retain your personal data.

• If you have objected to the processing and are awaiting feedback on the assessment of whether we have legitimate reasons for continued processing that take precedence over your interests.

How to restrict the processing of personal data in DNB?

If you would like to restrict the way we process your personal data, please contact us in writing at the address provided under “How to exercise your rights”.

In order to provide you with services, comply with statutory requirements and quality assure the information you have provided to us, we collect personal data about you from third parties such as:

• publicly available sources and other external sources managed by public authorities (e.g. the National Population Register and Danish tax authorities when we apply customer due diligence measures pursuant to anti-money laundering rules and legislation
• databases to adverse media search
• debt registers and the credit reporting agencies companies within the DNB Group
• other financial institutions
• employers
• company registers
• law enforcement authorities
• sanctions lists
• social media
• agents and distributors

DNB is a group consisting of different companies, and thus there are multiple companies that are data controllers. There may be one or more companies within the Group that are the data controller for your personal data, depending on your relationship with one or more companies.

Sometimes we need to share personal data about you within the Group. For instance, this may be to fulfil customer agreements, to meet obligations under company law because requirements to our information security make it necessary, or due to anti-money laundering obligations. It may also be because we have a legitimate interest for various purposes mentioned in the privacy notice.

There are strict rules on confidentiality for financial services and investment firms, including for companies in the DNB Group. Before sharing personal data, we will always ensure that we also comply with our duty of confidentiality.

DNB has a shared customer register. The purpose of the Group customer register is to manage your customer relationship and coordinate offers of services and advice from the various companies in the DNB Group. The Group customer register contains information about you, such as name, date of birth, address and other contact details, which Group company you are a customer of, and the services and products for which you have entered into an agreement.

DNB Bank ASA Denmark Branch always strives to process your personal data within the EU/EEA. In certain cases, we may disclose your personal data to countries outside the EU/EEA. If personal data is transferred to such a country, we will ensure that the personal data is still secure and that the transfer takes place in accordance with the law.

When transferring personal data to a country outside the EU/EEA that does not provide an adequate level of data protection, we apply the European Commission's standard contractual clauses for the transfer of personal data to countries outside the EU/EEA. In order for us to transfer your personal data outside the EEA, the GDPR requires us to have a valid legal basis for the transfer.

One of the following conditions must also be met:

• When the European Commission has determined that there is an adequate level of protection in the country in question.
• When other suitable security measures have been implemented and/or the data processor has provided the necessary guarantees that the personal data will be processed in a secure manner. This may be through the use of standard contracts (EU Standard Contractual Clauses) approved by the European Commission, or that the data processor has valid Binding Corporate Rules (BCRs).
• When there are exceptions in special cases, for example to fulfil an agreement with you or when you give your consent to the specific transfer.