1. Contact details for BaFin and BaFin’s Data Protection Officer

Bundesanstalt für Finanzdienstleistungsaufsicht
Graurheindorfer Str. 108
53117 Bonn
Postfach 1253
53002 Bonn
Phone: +49 (0) 228-4108–0
Fax: +49 (0) 228-4108–1550
E-mail: poststelle@bafin.de or De-mail: poststelle@bafin.de-mail.de

BaFin’s Data Protection Officer can be reached at: Datenschutz@bafin.de

2. Purpose of processing

Conducting administrative proceedings under section 48 of the ZKG or handling complaints under the ZKG.

3. Legal basis for the processing of data

Sections 46 (2), 48 and 49 of the ZKG in conjunction with section 4b of the German Act Establishing the Federal Financial Supervisory Authority (Finanzdienstleistungsaufsichtsgesetz – FinDAG) in conjunction with section 3 of the German Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG)

4. Intention to transfer the personal data to recipients in a third country or to an international organisation

BaFin does not intend to transfer your data to a recipient in a third country (non-EU member states and countries outside the European Economic Area) or to an international organisation.

5. Recipient of data

BaFin or entities supervised by BaFin offering basic payment accounts under the ZKG.

6. Time period for storing your data

5 years; 30 years in the case of an order in accordance with section 49 of the ZKG

7. Your rights as a data subject

In principle, as a data subject, you have the right of access to personal data (Article 15 of the GDPR), the right to rectification (Article 16 of the GDPR), the right to erasure (Article 17 of the GDPR) and the right to restriction of processing (Article 18 of the GDPR), the right to data portability (Article 20 of the GDPR) and the right to object to the processing (Article 21 of the GDPR). Moreover, you have a right to lodge a complaint with the data protection authority competent for BaFin, i.e. the Federal Commissioner for Data Protection and Freedom of Information (Bundesbeauftragte(r) für den Datenschutz und die Informationsfreiheit).

8. Automated individual decision-making, including profiling

There is no automated individual decision-making.

9. Source of personal data

It is necessary for you to provide your personal data in order for BaFin to be able to conduct the administrative proceedings or to handle your complaint. Without the provision of your personal data, BaFin may not be able to give you any response. In addition, it may not be possible to obtain the response of the supervised entity concerned, which in turn is necessary to handle your complaint.