1. Contact details for BaFin and BaFin’s Data Protection Officer

Bundesanstalt für Finanzdienstleistungsaufsicht
Graurheindorfer Str. 108
53117 Bonn
Postfach 1253
53002 Bonn
Phone: +49 (0)228 / 4108 – 0
Fax: +49 (0)228 / 4108 – 1550
E-Mail: poststelle@bafin.de oder De-Mail: poststelle@bafin.de-mail.de

BaFin’s Data Protection Officer can be reached at: Datenschutz@bafin.de

2. Purpose of processing

Market transparency, market surveillance, institutional supervision

3. Legal basis for the collection of data

Section 3 of the German Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG); Article 6(1)(e) of the GDPR; section 44 (1) sentence 1 of the German Banking Act (Kreditwesengesetz – KWG); section 6 (3) of the German Securities Trading Act (Wertpapierhandelsgesetz – WpHG); section 6 (5) of the WpHG in conjunction with Articles 5, 14, 15, 17, 18, 19, 22 of Regulation (EU) No 596/2014 (Market Abuse Regulation – MAR), section 26 (1) and (4) of the WpHG in conjunction with the Securities Trading Reporting and Insider List Regulation (Wertpapierhandelsanzeige- und Insiderverzeichnisverordnung – WpAV), section 120 of the WpHG, section 6 (1) and (2), section 53 (1) and (2) sentence 1 of the WpHG in conjunction with Article 33(2) of Regulation (EU) No 236/2012 (EU Short Selling Regulation), section 6 (2) and (3) of the WpHG

4. Categories of processed personal data

The personal data held about you or third parties include in particular:
Names, date of birth, address details, contact details, account numbers, securities account numbers and customer identification numbers.

5. Intention to transfer the personal data to recipients in a third country or to an international organisation

BaFin does not intend to transfer your data to a recipient in a third country (non-EU member states and countries outside the European Economic Area) or to an international organisation. However, your data may be transferred to another supervisory authority in a third country in connection with a request for administrative assistance made to BaFin.

6. Recipient of data

The data are processed by BaFin as required for the performance of its duties.

7. Time period for storing your data

5 years

8. Your rights as a data subject

In principle, as a data subject, you have the right of access to personal data (Article 15 of the GDPR), the right to rectification (Article 16 of the GDPR), erasure (Article 17 of the GDPR) and restriction of processing (Article 18 of the GDPR), the right to data portability (Article 20 of the GDPR) and the right to object to the processing (Article 21 of the GDPR). Moreover, you have a right to lodge a complaint with the data protection authority competent for BaFin, i.e. the Federal Commissioner for Data Protection and Freedom of Information (Bundesbeauftragte(r) für den Datenschutz und die Informationsfreiheit).

9. Automated individual decision-making, including profiling

There is no automated individual decision-making.

10. Source of personal data

Investment services enterprises, other credit institutions, asset management companies and operators of off-exchange markets on which financial instruments are traded. The data source is not generally accessible.

11. Source of personal data

See no 3 above. The provision of your personal data is required in order to process requests for information and documentation.