1. Contact details for BaFin and BaFin’s Data Protection Officer

Bundesanstalt für Finanzdienstleistungsaufsicht
Graurheindorfer Str. 108
53117 Bonn
Postfach 1253
53002 Bonn
Phone: +49 (0) 228-4108–0
Fax: +49 (0) 228-4108–1550
E-mail: poststelle@bafin.de or De-mail: poststelle@bafin.de-mail.de

BaFin’s Data Protection Officer can be reached at: Datenschutz@bafin.de

2. Purpose of processing

Handling of enquiries and conducting of an arbitration procedure in accordance with the procedural rules of the arbitration board applicable to the procedure concerned.

3. Legal basis for the processing of data

Section 14 (1) nos. 6 and 7 of the German Injunctions Act (Unterlassungsklagengesetzes – UKlaG) in conjunction with the German Regulation on Financial Dispute Resolution Entities (Finanzschlichtungsstellenverordnung – FinSV) and section 3 of the German Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG)

4. Categories of processed personal data

The personal data held about you include:

First and last name, date and place of birth where necessary, marital status where necessary, your address, further contact details such as your e-mail address and your phone number, identification data where necessary (e. g. information from your passport or identity card), in addition to personal data about your legal representatives or representatives in legal transactions.

In addition, we process further data that you or the entity you are complaining about provide to us in the course of the arbitration proceedings, in particular data on the contracts entered into, account statements, correspondence on the contracts concerned, information on your financial situation (e. g. information from Schufa, overviews of your financial situation, etc.), documentation data (e.g. consultation minutes) etc.

5. Intention to transfer the personal data to recipients in a third country or to an international organisation

BaFin does not intend to transfer your data to a recipient in a third country (non-EU member states and countries outside the European Economic Area) or to an international organisation.

6. Recipient of data

Your data are only transmitted to the persons directly involved in the arbitration procedure. These include your legal representatives and representatives in legal transactions who may represent you in the arbitration procedure, staff of the departments working on your application at the entities you are complaining about as well as arbitrators and staff of the arbitration board.

In certain cases, we may also have to refer your request to the competent consumer dispute resolution entity if we are not responsible for your application (section 24 of the FinSV). In this case, the staff and arbitrators of the competent consumer dispute resolution entity will receive your data. You will be contacted seperately should your request be forwarded.

7. Time period for storing your data

5 years

Exception: 30 years in the event of arbitration decisions/proposals

8. Your rights as a data subject

In principle, as a data subject, you have the right of access to personal data (Article 15 of the GDPR), the right to rectification (Article 16 of the GDPR), the right to erasure (Article 17 of the GDPR) and the right to restriction of processing (Article 18 of the GDPR), the right to data portability (Article 20 of the GDPR) and the right to object to the processing (Article 21 of the GDPR). Moreover, you have a right to lodge a complaint with the data protection authority competent for BaFin, i.e. the Federal Commissioner for Data Protection and Freedom of Information (Bundesbeauftragte(r) für den Datenschutz und die Informationsfreiheit).

9. Automated individual decision-making, including profiling

There is no automated individual decision-making.

10. Use of data sources

We process the personal data we obtain in the course of the arbitration proceedings from you or your representatives, from the entity you are complaining about or, as the case may be, from other resolution entities. In individual cases, we process personal data from generally accessible sources (e.g. telephone books or directories, newspapers, media, etc.) where we are permitted to obtain and process such data.

11. Basis for the provision of your data and consequences in the event of failure to provide your personal data

In order to implement the requirements of the FinSV it is necessary to process your personal data to ensure that your request can be handled by the arbitration board.