1. Contact details for BaFin and BaFin’s Data Protection Officer

Bundesanstalt für Finanzdienstleistungsaufsicht
Graurheindorfer Str. 108
53117 Bonn
Postfach 1253
53002 Bonn
Phone: +49 (0)228 / 4108 – 0
Fax: +49 (0)228 / 4108 – 1550
E-Mail: poststelle@bafin.de oder De-Mail: poststelle@bafin.de-mail.de

BaFin’s Data Protection Officer can be reached at: Datenschutz@bafin.de

2. Purpose of processing

Assessing whether the conditions for granting authorisation for direct market access within the meaning of section 102 of the WpHG are fully met.

3. Legal basis for the collection of data

Art. 6 (1) lit. e of REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL in conjunction with Section 102 of the German Securities Trading Act (Wertpapierhandelsgesetz – WpHG) in conjunction with the German Market Access Information Regulation (Marktzugangsangabenverordnung – MarktangV)

4. Categories of processed personal data

The personal data held about you include:

Address details, contact details, CVs, details concerning reliability, additional positions held, a list of management or supervisory board memberships in other companies, proof of identity, details of business activities, information on the origin of own and external funds, information on the ownership structure, details of group affiliation as well as any other opportunities to exercise influence.

5. Intention to transfer the personal data to recipients in a third country or to an international organisation

Yes. However, only the data provided by the applicant will be transferred.

6. Recipient of data

The data are processed within BaFin and the exchange supervisory offices of the federal states only.

7. Time period for storing your data

10 years after expiry of the authorisation

8. Your rights as a data subject

In principle, as a data subject, you have the right of access to personal data (Article 15 of the GDPR), the right to rectification (Article 16 of the GDPR), erasure (Article 17 of the GDPR) and restriction of processing (Article 18 of the GDPR), the right to data portability (Article 20 of the GDPR) and the right to object to the processing (Article 21 of the GDPR). Moreover, you have a right to lodge a complaint with the data protection authority competent for BaFin, i.e. the Federal Commissioner for Data Protection and Freedom of Information (Bundesbeauftragte(r) für den Datenschutz und die Informationsfreiheit).

9. Automated individual decision-making, including profiling

There is no automated individual decision-making.

10. Source of personal data

To the extent the personal data is not provided by you as the applicant, the applying institution or its legal representative is the source of your personal data.

11. Source of personal data

There is a statutory duty under section 102 of the WpHG to provide these data. The provision of these data is required in order to process applications for authorisation. Applications cannot be processed without these data and may have to be rejected at a charge.