1. Contact details for BaFin and BaFin’s Data Protection Officer

Bundesanstalt für Finanzdienstleistungsaufsicht
Graurheindorfer Str. 108
53117 Bonn
Postfach 1253
53002 Bonn
Phone: +49 (0) 228-4108–0
Fax: +49 (0) 228-4108–1550
E-mail: poststelle@bafin.de or De-mail: poststelle@bafin.de-mail.de

Die/den behördliche/n Datenschutzbeauftragte/n erreichen Sie über die E-Mail-Adresse: datenschutz@bafin.de

2. Purpose of processing

Granting permission to acquire a significant holding in an institution.

3. Legal basis for the processing of data

Section 2c of the German Banking Act (Kreditwesengesetz – KWG) in conjunction with Delegated Regulation (EU) 2017/1946 and the German Holder Control Regulation (Inhaberkontrollverordnung).

4. Categories of processed personal data

The personal data held about you include:

Names, address details, contact details, CVs, details concerning reputation, proof of identity, details of business activities, information on the origin of own and external funds, information on the ownership structure, details of group affiliation and any other opportunities to exercise influence, details concerning acquisition interests, details concerning financial position and creditworthiness.

5. Intention to transfer the personal data to recipients in a third country or to an international organisation

BaFin does not intend to transfer your data to a recipient in a third country (non-EU member states and countries outside the European Economic Area) or to an international organisation.

6. Recipient of data

The data are processed within BaFin by the employees responsible for the procedure. In addition, the data are transmitted to the Deutsche Bundesbank in the context of joint supervision.

7. Time period for storing your data

10 years after the permission expires; if the intention to acquire a qualifying holding is given up, 2 years after that point in time; if the qualifying holding was acquired and then completely sold, three years after the sale.

8. Your rights as a data subject

In principle, as a data subject, you have the right of access to personal data (Article 15 of the GDPR), the right to rectification (Article 16 of the GDPR), the right to erasure (Article 17 of the GDPR) and the right to restriction of processing (Article 18 of the GDPR), the right to data portability (Article 20 of the GDPR) and the right to object to the processing (Article 21 of the GDPR). Moreover, you have a right to lodge a complaint with the data protection authority competent for BaFin, i.e. the Federal Commissioner for Data Protection and Freedom of Information (Bundesbeauftragte(r) für den Datenschutz und die Informationsfreiheit).

9. Automated individual decision-making, including profiling

There is no automated individual decision-making.

10. Source of personal data

To the extent the personal data is not provided by you as the applicant, the applying institution or its legal representative is the source of your personal data.

11. Basis for the provision of your data and consequences in the event of failure to provide your personal data

Section 2c of the KWG in conjunction with Delegated Regulation (EU) 2017/1946 and the German Holder Control Regulation.

The written notification to BaFin and the Deutsche Bundesbank set forth in section 2c of the KWG is mandatory for anyone intending to acquire a significant holding in an institution. The information is required to assess the intended acquisition. A culpable violation of notification obligations is an administrative offence that may be punished with a fine of up to five million euros (section 56 (2) no. 1a and (6) no. 1 of the KWG). A notification that does not fulfil the requirements may result in the prohibition of the intended acquisition (see section 2c (1a) sentence 2 of the KWG) or, in the event that the acquisition has already been concluded, in the prohibition of an exercise of voting rights, in restrictions on the disposal of the shares, in the appointment of a trustee and in an order to dispose of the shares (see section 2c (2) of the KWG).