1. Contact details for BaFin and BaFin’s Data Protection Officer

Bundesanstalt für Finanzdienstleistungsaufsicht
Graurheindorfer Str. 108
53117 Bonn
Postfach 1253
53002 Bonn
Phone: +49 (0) 228-4108–0
Fax: +49 (0) 228-4108–1550

E-mail: poststelle@bafin.de or De-Mail: poststelle@bafin.de-mail.de

BaFin’s Data Protection Officer can be reached at: Datenschutz@bafin.de

2. Purpose of processing

Assessment of the acquisition, the increase, the relinquishment or reduction of a qualifying holding in an institution or investment firm, as well as assessment of a new statutory or registered representative or a new personally liable partner appointed by the holder of the qualifying holding.

3. Legal basis for the processing of data

Section 2c of the German Banking Act (Kreditwesengesetz – KWG) in conjunction with the German Holder Control Regulation (Inhaberkontrollverordnung – InhKontrollV) as well as section 24 of the German Investment Firm Act (Wertpapierinstitutsgesetz –WpIG) in conjunction with the German Investment Firm Holder Control Regulation (Wertpapierinstituts-Inhaberkontrollverordnung – WpI-InhKontrollV).

4. Categories of processed personal data

Names, address details, contact details, CVs, details concerning reputation, proof of identity, details of business activities, information on the origin of own and external funds, information on the ownership structure, details of group affiliation and any other opportunities to exercise influence, details concerning acquisition interests, details concerning financial position and creditworthiness, business plan, details concerning strategy, details of plans.

5. Intention to transfer the personal data to recipients in a third country or to an international organisation

BaFin does not intend to transfer your data to a recipient in a third country (non-EU member states and countries outside the European Economic Area) or to an international organisation.

6. Recipient of data

The data are processed within BaFin by the employees responsible for the procedure. In addition, the data are transmitted to the European Central Bank (ECB) or to the competent Regional Office of the Deutsche Bundesbank in the context of joint supervision.

7. Time period for storing your data

30 years

8. Your rights as a data subject

In principle, as a data subject, you have the right of access to personal data (Article 15 of the GDPR), the right to rectification (Article 16 of the GDPR), the right to erasure (Article 17 of the GDPR), the right to restriction of processing (Article 18 of the GDPR), the right to data portability (Article 20 of the GDPR) and the right to object to the processing (Article 21 of the GDPR). Moreover, you have a right to lodge a complaint with the data protection authority competent for BaFin, i.e. the Federal Commissioner for Data Protection and Freedom of Information (Bundesbeauftragte(r) für den Datenschutz und die Informationsfreiheit).

9. Automated individual decision-making (including profiling)

There is no automated individual decision-making.

10. Source of personal data

To the extent the personal data is not provided by you as the proposed acquirer or holder of a qualifying holding, the notifying institution/investment firm or its legal representative is the source of your personal data.

11. Basis for the provision of your data and consequences in the event of failure to provide your personal data

Section 2c of the KWG in conjunction with the InhKontrollV and section 24 of the WpIG in conjunction with the WpI-InhKontrollV.

The notification to BaFin (and the Deutsche Bundesbank) set forth in section 2c of the KWG in conjunction with the InhKontrollV and in section 24 of the WpIG in conjunction with the WpI-InhKontrollV is mandatory for anyone intentionally or unintentionally acquiring a qualifying holding in an institution or investment firm and anyone intentionally or unintentionally increasing a qualifying holding in an institution or investment firm or in the event that the holder of the qualifying holding appoints a new statutory or registered representative or a new personally liable partner. The information is required to assess the (un)intended acquisition or the (un)intended increase in the qualifying holding or to assess the reputation of the newly appointed representative or the new personally liable partner. A wilful or negligent violation of notification obligations is an administrative offence that may be punished with a fine of up to five million euros (section 56 (2) no. 1 (a) and (6) no. 1 of the KWG or section 83 (1) no. 5 (a) and (5) of the WpIG). A notification that does not fulfil the requirements may result in the prohibition of the intended acquisition (see section 2c (1b) sentence 2 of the KWG or section 26 (2) of the WpIG) or, in the event that the acquisition has already been concluded, in the prohibition of an exercise of voting rights, in restrictions on the disposal of the shares, in the appointment of a trustee and in an order to dispose of the shares (see section 2c (2) of the KWG and section 27 of the WpIG). In addition, a notification obligation applies for anyone seeking to relinquish or reduce a qualifying holding. Violations of this obligation are also punishable by a fine (section 56 (2) no. 1 (b) and (6) in conjunction with section 2c (3) sentence 1 or sentence 4 of the KWG or section 83 (1) no. 5 (a) and (5) in conjunction with section 24 (2) sentence 1 and (3) sentence 3 of the WpIG).