With this privacy notice, Deutsche Börse Group (hereinafter "We" or "Us") informs you how we process your personal data. Personal data is any information that concerns you, your employees or other individuals (hereinafter: "Personal Data").

We pay special attention on the processing of Personal Data in accordance with the General Data Protection Regulation EU 2016/679 (“GDPR”) and applicable national data protection laws.

1. Controller
   1. Our identity and contact details

      The responsible data controller is the Deutsche Börse Group entity whose service is being used. This may for instance be:

      Frankfurter Wertpapierbörse Börsenplatz 4 60313 Frankfurt am Main info@deutsche-boerse.com	Eurex Deutschland Mergenthalerallee 61 65760 Eschborn info@eurex.com	Eurex Repo GmbH Mergenthalerallee 61 65760 Eschborn info@eurex.com
      Eurex Clearing AG Mergenthalerallee 61 65760 Eschborn info@eurex.com	Clearstream Banking AG Mergenthalerallee 61 65760 Eschborn web@clearstream.com	European Energy Exchange Augustusplatz 9 04109 Leipzig info@eex.com

   2. Contact details of our Data Protection Officer

      Our Data Protection Officer is:

      Data Protection Officer
      Deutsche Börse AG
      Mergenthalerallee 61
      65760 Eschborn
      dataprotection@deutsche-boerse.com

2. Purpose, Categories of personal data, legal basis and retention
   1. Categories of your personal data, purposes of our processing and their legal basis

      We process the following categories of your personal data for the following purposes:

      1. Performance of contracts and services:

         If you or your company want to be authorized as a customer of one of our services, we collect your personal data (first name, last name, contact data, company) to register you to our service and for the usage of our service. The sole responsible body is the respective above-mentioned company with which a contract is concluded or occurs in the case of pre-contractual measures. The purposes of personal data processing are determined by the specific service or product. This may include especially assessments, consultation, trading activities, and the execution of business accounting and tolls. The legal basis for processing this personal data is Article 6 (1) lit. b GDPR, as processing is necessary to fulfil a contract or for pre-contractual measures between us and the customer. If the user is not the customer who concluded the contract with us, but an employee of the customer or otherwise authorized by the customer to use our services, the legal basis for processing is Article 6 (1) lit. f GDPR, as the processing is in the legitimate interest of the customer. The legitimate interest of the customer is to enable the user to use our services in accordance with the contract. Your personal data processed in this regard will be stored by Us as long as it is necessary to carry out Our relationship (registration and use of our service) with you and required by applicable statutory retention laws.

      2. Operation of the Exchange EDP:

         Your personal data contained in log files or security reports (e.g. IP address, user ID, location and time of access) are used to identify intruders, protect the system, monitor and logging. Processing takes place on the basis of legal provisions (Art. 6 Para. 1 lit. c GDPR), namely Section 5 Paragraph 4 and 4a of the German Exchange Act and Article 32 GDPR to fulfil our legal obligation, to implement technical and organizational measures to guarantee a secure data processing.

      3. Access to the Exchange EDP:

         To enable access to the Exchange EDP, trading participants are assigned individual user IDs and passwords that guarantee the integrity and confidentiality of the systems. Processing takes place on the basis of legal provisions (Art. 6 Para. 1 lit. c GDPR), namely Section 5 Paragraph 4 and 4a of the German Exchange Act and Article 32 GDPR to fulfil our legal obligation, to implement technical and organizational measures to guarantee a secure data processing.

      4. List of listed Trading Participants:

         We keep a list of the admitted trading participants according to 2.1.1, which is regularly transmitted to the Exchange Supervisory Authority. The processing takes place on the basis of legal provisions (Art. 6 Para. 1 lit. c GDPR), namely Section 19 Paragraph 11 German Exchange Act.

      5. General contact by e-mail, post or telephone:

         Name, address, telephone number or e-mail address if you wish to contact us directly. We collect your personal data when you provide it to us via our contact forms or when you contact us directly. Then we process the information that you have provided to us in the course of establishing contact. This includes, in particular, names and contact data provided (address, telephone number or e-mail address), date and reason for contact. The personal data that you collect will only be used to answer and fulfil your specific enquiries. The legal basis is Art. 6 para. 1 lit. (f) GDPR, which permits the processing of personal data for the purpose of our legitimate interest in processing and answering your enquiry. Your personal data processed in this respect will be stored by us for as long as it is necessary to carry out our relationship (communication) with you and in accordance with the applicable legal storage regulations.

      6. Sales, Marketing and invitations:

         We may use your personal data (name, first name, address, company, telephone number, e-mail address) to send you information about our services, partners, promotions and events that we think may be of interest to you. We may contact you by e-mail based on our legitimate interests under Article 6 para. 1 lit. (f) of the GDPR if we have a direct business relationship with you or with the company for which you work, and if you have not objected. We may contact you by telephone if you have given your consent (Article 6 para. 1 lit. (a) GDPR) or on the basis of a presumed consent on the condition that you will welcome the call. We may contact you by post on the basis of our legitimate interests under Article 6 para.1 lit. (f) GDPR as long as you do not object. In such cases, it is our legitimate interest to inform business partners or potential customers about such services and products that may be of interest to them and thus to maintain our existing or future business relationship. Your personal data processed in this respect will be stored by us for as long as it is necessary to carry out our relationship (communication) with you and in accordance with the applicable legal storage regulations.

      7. Newsletter:

         Deutsche Börse Group companies may offer circulars, readiness newsflashes and product newsletters to keep you regularly informed about ongoing initiatives and upcoming projects and any future updates or news about products and events. You can register for the categories you would like to subscribe to on our website by entering your email address. After entering your data, you will receive an e-mail in which you can confirm your registration in order to activate the newsletter. You can unsubscribe from this service in every newsletter and withdraw your consent with effect for the future. With regard to the processing of your personal data, the relevant legal basis is your consent in accordance with Article 6 Paragraph 1 lit. a in connection with Article 7 GDPR.

      8. General use of our website:

         When you use our website and online platform, we will automatically log information about the browser that is used to access the website, such as your IP address, session time, pages viewed from that address and the website from which you are visiting the website. We may also collect device-specific information, such as your hardware model and operating system. We use this information to identify and prevent malpractice and crime and to investigate improper conduct. The legal basis for the processing of your personal data for these purposes is Art. 6 para. 1 lit. (c) GDPR in fulfilling our legal obligation to take technical and organizational measures to ensure secure data processing in accordance with Article 32 GDPR and Article 6 para. 1 lit. (f) GDPR in order to pursue our legitimate interests in data processing for network and information security. After the specified period of 30 days, the above data will be deleted. If data is processed for a longer period of time, we will anonymize or delete the data as soon as their storage no longer serves the respective purposes.

      9. Registration of Independent Software Vendors (ISV):

         We may process your personal data (name, company, business contact details) if you register your employer via the ISV Registration functionality in the Member Section as an Independent Software Vendor (ISV), offering software service to our trading participants or clearing members. Personal data is processed for creating the Member Section account and for assigning the initiator of the registration as the “Central Coordinator” from that ISV entity upon the successful registration. Within this role, you may be contacted by us in the context of the software services. The legal basis for processing is Article 6 (1) lit. f GDPR as the processing is in the legitimate interest of us. The legitimate interest of Us is to enable Us to assist the registered ISV in providing their services to the trading participants or clearing members in accordance with the contract. Your personal data processed in this regard will be stored by Us as long as it is necessary to carry out Our relationship (registration and use of service) with you and required by applicable statutory retention laws.

   2. Do you have to provide personal data to us?

      The provision of your personal data is necessary in order to access the protected areas of the website, which are restricted to members of our customer groups, to contact us directly or to receive a newsletter. This means that it is necessary that you give us your personal data in the context of e.g. to provide a user registration process or contract.

   3. Do we make automated decisions on you?

      We do not make any automated decisions solely on automatic processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

   4. Retention periods

      The retention periods for personal data depend on the purpose of the processing. We will store the personal data mentioned under 2.1 above as long as (i) this is necessary for the respective purpose and / or (ii) this is required in accordance with the applicable statutory retention laws. We will keep personal data that you provide us for as long as our business relationship with you or with your company exists, plus all applicable retention periods that are in accordance with the statutory provisions (e.g. based on tax regulations) or to the extent they are necessary to pursue our legitimate interests after the end of the business relationship (e.g. to assert claims within the statutory limitation periods).

3. Transfer of personal data

   We will not disclose your personal data to third parties unless such disclosure is permitted by law or you have explicitly consented to the transfer.

   To provide our contractual services, we use selected service providers (data processing providers) and vicarious agents of the categories listed below who have access to your personal data to the extent necessary and can use it to process the orders placed by us.

   We may transfer your personal data to public authorities where this is required by applicable law (e.g. the German Stock Exchange Act (Börsengesetz) or the German Securities Trading Act (Wertpapierhandelsgesetz)). A transfer of your personal data is also permitted if there is suspicion of a criminal offence or the abuse of the services offered on our website. In this event, we shall be entitled to transfer your Personal Data to the criminal prosecution authority.

   Otherwise, your personal data will be stored exclusively in our database and on our servers or on those of our commissioned data processing providers, which provide infrastructure, platforms, or software. We will only share your Personal Data with other controllers for their own purposes such as cooperation or advertising partners under the condition that you explicitly and voluntarily agreed to such transfer of your Personal Data; in this case, we will obtain your consent separately from this Notice.

   You are aware that in the context of using the Member Section, confidential information of the company is available to other users registered as users of the same company after successful log-in. Insofar we inform you regarding the disclosure of information (e.g. your contact details or other personal data depending on the nature of the service used) to the extent necessary for provision of the service used to individuals who are registered as users of the company.

   Sometimes the recipients to whom we transfer your personal data are located in countries in which applicable laws do not offer the same level of data protection as the laws of your home country. In such cases, we take measures to implement appropriate and suitable safeguards for the protection of your personal data.

   Under these conditions, recipients of your personal data can be for example:

   public bodies and institutions in the presence of a legal or regulatory obligation (e.g. financial authorities),

   other companies and service providers (processors) / vicarious agents in the following areas:

   print service providers

   telecommunications service provider

   billing service provider

   financial institutions

   collection agencies

   management consultancies as well as business and tax audit companies

   provider of the online platform

   newsletter provider

4. Cookies and similar technologies

   When you visit the website and Our online platform, information is stored on your terminal device in the form of a "cookie." Cookies are small files that are stored on your terminal device and save certain settings and data to exchange with our websites via your browser.

   For example, cookies enable us to tailor a website to better match your interests or to store your password so that you do not have to re-enter it everytime. As a general rule, we never collect personal data via cookies, unless you have given us your express permission to do so.

   If you do not want us to recognize your terminal device, please configure your Internet browser to erase all cookies from your device, to block all cookies or to receive a warning before a cookie is stored. You will find brief instructions on how to do this below.

   Please note that certain functions of our website may no longer work, or not correctly, without cookies.

   1. Types of Cookies

      Cookies can be assigned to four categories, depending on their function and intended purpose: absolutely necessary cookies, performance cookies, functional cookies, and cookies for marketing purposes.

      1. Absolutely necessary cookies:

         Are needed for you to navigate within websites and operate basic website functions, such as the issuance of anonymous Session IDs for bundling several related queries to a server.

      2. Performance cookies:

         Collect information on the usage of our websites, including for example the Internet browsers and operating systems used, the domain name of the website which you previously visited, the number of visits, average duration of visit, and pages called up. These cookies do not store any information that would make it possible to personally identify the user. The information collected with the aid of these cookies is aggregated and is therefore anonymous. Performance cookies serve the purpose of improving the user friendliness of a website and therefore enhancing the user’s experience.

      3. Functional cookies:

         Enable a website to store information the user has already entered (such as user ID, language selection, or the user’s location), in order to offer improved, personalized functions to the user. Functional cookies are also used to enable requested functions such as playing videos and to make a user’s decision to block or disable a certain function (e.g. web analysis) - "opt-out cookies".

      4. Cookies for marketing purposes

         are used to offer more relevant content to users, based on their specific interests. They are also used to limit the display frequency of an ad and to measure and control the effectiveness of advertising campaigns. They register whether users have visited a website or not, and which contents were used. This information may possibly also be shared with third parties, such as advertisers, for example. These cookies are often linked to the functions of third-party websites.

   2. Types of used cookies
      1. Strictly necessary cookies

         Name	Domain	Expiration	Description
         BIGipServerdispatcher.factory.customdomain	membersection.deutsche-boerse.com	Session Cookie	Used for BIGIP to route traffic and ensure sticky session
         bMigrationInfoDontShowAgain	membersection.deutsche-boerse.com	4 years	Store user preference, if a popup with a notification message should be shown again
         JSESSIONID	membersection.deutsche-boerse.com	Session Cookie	Cookie placed on the usersdevice so the server can identify the user.
         JTENANTSESSIONID_qfmsfbeqkc	membersection.deutsche-boerse.com	Session Cookie	This cookie is issued along with the JSESSIONID cookie and is used for session consistency -if it is not send along with the JSESSIONID cookie then the session will be considered invalid.
         MYSAPSSO2	deutsche-boerse.com	Session Cookie	Cookie placed on the users device so the server can identify the user.

   3. Managing cookies

      On our website only technical necessary cookies are being used.

      In the following you will find a summary of links that provide detailed information on the deactivation of cookies in commonly used browsers.

      Mozilla Firefox (https://support.mozilla.org/en-US/kb/delete-cookies-remove-info-websites-stored)

      Internet Explorer (https://support.microsoft.com/en-us/help/17442/windows-internet-explorer-delete-manage-cookies)

      Google Chrome (https://support.google.com/accounts/answer/61416?hl=en)

      Safari (https://support.apple.com/en-en/guide/safari/sfri11471/mac)

5. Your rights

   Under applicable data protection laws, you have rights

   of access to, rectification of, and/or erasure of your Personal Data;

   to restrict or object to its processing;

   to tell Us that you do not wish to receive marketing information; and

   (in some circumstances) to require certain of your Personal Data to be transferred to you or a third party, which you can exercise by contacting Us at the details set out at the beginning of this Notice.

   To the extent Our processing of your Personal Data is based on your consent, you also have the right to withdraw your consent, without affecting the lawfulness of Our processing based on your consent before its withdrawal.

   To exercise your rights, you can contact Us as set out in Section 1.1 above. You can also lodge a complaint about Our processing of your Personal Data with a data protection authority. A list and contact details of the local data protection authorities can be found here.
   https://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=612080