The Federal Financial Supervisory Authority (Bundesanstalt für Finanzdienstleistungsaufsicht – BaFin) processes personal data to meet its legal and (pre-)contractual obligations. This also includes data which BaFin collects from you in the context of your formal obligation under the VerpflG, such as your name, the place and date of your signature on the written record of your formal obligation under the VerpflG and, if necessary, your address, telephone number, e-mail address, date and place of birth. To promote awareness regarding data processing and your rights and to comply with our duty to provide information in accordance with Article 13 of the EU General Data Protection Regulation (GDPR), BaFin informs you as follows:

1. Contact details for BaFin and BaFin’s Data Protection Officer

Bundesanstalt für Finanzdienstleistungsaufsicht
Graurheindorfer Str. 108
53117 Bonn
Postfach 1253
53002 Bonn
Fon: 0228/4108-0
Fax: 0228/4108-1550

E-mail: poststelle@bafin.de or De-mail: poststelle@bafin.de-mail.de
BaFin’s Data Protection Officer can be reached at: datenschutz@bafin.de

2. Purpose of processing

In general, BaFin formally charges all external service providers who are to be working for BaFin with faithfully performing their duties and obligations under the VerpflG. It is a prerequisite for external service providers to be formally charged in order to take up their activities for BaFin, e.g. to be allowed to enter BaFin’s premises.

In addition to the above, a formal obligation may be required for certain persons under applicable law, namely section 230 of the German Insurance Supervision Act (Versicherungsaufsichtsgesetz – VAG), section 21 of the German Deposit Guarantee Act (Einlagensicherungsgesetz – EinSiG), section 13 of the German Investor Compensation Act (Anlegerentschädigungsgesetz – AnlEntG) and section 15 of the German Occupational Pensions Act (Betriebsrentengesetz – BetrAVG).

Such a formal obligation must be enter into orally. Section 1 (3) of the VerpflG furthermore requires this obligation to be recorded in writing.

In order to determine who is legally charged and to be able to match a written record to a specific person, the name of the person legally charged is noted in the record. In some cases, the date and place of birth are additionally recorded to enable differentiation between persons with the same or a similar name.

The address, phone number and e-mail address may also be recorded to enable us to contact you and formally charge you with faithfully performing your duties and obligations. The place and date of the signature on the written record are noted as well, as proof of effectiveness of the legal obligation under the VerpflG.

3. Legal basis for the processing of data

Section 1 (1) and (3) of the VerpflG

4. Intention to transfer the personal data to recipients in a third country or to an international organisation

BaFin does not intend to transfer your data to a recipient in a third country (non-EU member states and countries outside the European Economic Area) or to an international organisation.

5. Recipient of data

Your data are only processed within BaFin by those BaFin employees responsible for the formal obligation under the VerpflG.

6. Time period for storing your data

The formal obligation of external service providers is not an end in itself. Formal obligations are imposed by BaFin in the context of a specific procedure (e.g. a procurement procedure or an IT project) or under specific legal requirements (e.g. section 230 of the VAG).

The personal data collected in the context of the formal obligation under the VerpflG (name, place and date of the signature on the written record of the formal obligation under the VerpflG and, if necessary, address, telephone number, e-mail address, date and place of birth) are stored for as long as this is required in the context of the specific procedure (and its documentation). The data will be erased as soon as storage of the personal data is no longer required.

If the formal obligation is entered into under section 230 of the VAG, section 21 of the EinSiG, section 13 of the AnlEntG or section 15 of the BetrAVG, data may have to be stored for 30 years or longer; for formal obligations in the context of other procedures, the time might be cosiderably shorter. Please ask the employee formally charging you for more information on the time period your personal data is stored for.

7. Your rights as a data subject

In principle, as a data subject, you have the right of access to personal data (Article 15 of the GDPR), the right to rectification (Article 16 of the GDPR), the right to erasure (Article 17 of the GDPR) and the right to restriction of processing (Article 18 of the GDPR), the right to data portability (Article 20 of the GDPR) and the right to object to the processing (Article 21 of the GDPR). Moreover, you have a right to lodge a complaint with the data protection authority competent for BaFin, i.e. the Federal Commissioner for Data Protection and Freedom of Information (Bundesbeauftragte(r) für den Datenschutz und die Informationsfreiheit).

8. Automated individual decision-making, including profiling

There is no automated individual decision-making.

9. Basis for the provision of your data and consequences in the event of failure to provide your personal data

The basis for the provision of your data is section 1 (1) and (3) of the VerpflG; if you do not provide your personal data, you cannot be formally charged with faithfully performing your duties and obligations under the VerpflG and you cannot take up your activities as an external service provider for BaFin or for a guarantee scheme under section 230 of the VAG, a deposit guarantee scheme under section 21 of the EinSiG, a statutory compensation scheme under section 13 of the AnlEntG or the organisation responsible for insolvency insurance under section 14 of the BetrAVG. You may then not be able to fulfil your duties and obligations under your (work) contract; this may lead to your (work) contract being cancelled, withdrawn from or contested.