The Federal Financial Supervisory Authority (Bundesanstalt für Finanzdienstleistungsaufsicht – BaFin) processes personal data to meet its legal and (pre-)contractual obligations. This also includes data which BaFin collected from you. To promote awareness regarding data processing and your rights as well as to comply with our duty to provide information in accordance with Article 13 and Article 14 of the EU General Data Protection Regulation (GDPR), BaFin informs you as follows:

1. Contact address for BaFin and BaFin’s Data Protection Officer

Bundesanstalt für Finanzdienstleistungsaufsicht
Graurheindorfer Str. 108
53117 Bonn
Postfach 1253
53002 Bonn
Phone: +49 (0) 228-4108-0
Fax: +49 (0) 228-4108-1550

E-mail: poststelle@bafin.de or De-mail: poststelle@bafin.de-mail.de

BaFin’s Data Protection Officer can be reached at: Datenschutz@bafin.de.

2. Purpose of processing

Communication of access data to use the BaFin College Tool for the exchange of data (bafin.sharefile.eu); coordinating cooperation in the college of supervisors in the context of group supervision; sharing personal data with EIOPA in order to enable EIOPA to draw up a contact list of all supervisors in the college.

3. Legal basis for the processing of data

Section 283 (2) of the German Insurance Supervision Act (Gesetz über die Beaufsichtigung der Versicherungsunternehmen – VAG); section 329 (4) of the VAG in conjunction with Article 21(2) sentence 3 (a) of Regulation (EU) No 1094/2010 (EIOPA Regulation); Article 248 of Directive 2009/138/EC of the European Parliament and of the Council of 25 November 2009 on the taking-up and pursuit of the business of Insurance and Reinsurance (Solvency II), Article 357 of Commission Delegated Regulation (EU) 2015/35 of 10 October 2014 supplementing Directive 2009/138/EC of the European Parliament and of the Council on the taking-up and pursuit of the business of Insurance and Reinsurance (Solvency II)

4. Categories of personal data processed

The personal data concerning you is your name and contact details, as well as any other participant preferences.

5. Intention to transfer the personal data to recipients in a third country or to an international organisation

Communication of personal data to third country supervisory authorities participating in the college and to EIOPA.

6. Recipient of data

The data are processed within BaFin only.

7. Time period for storing your data

Data will be erased after termination of your college membership.

8. Your rights as a data subject

In principle, as a data subject, you have the right of access to personal data (Article 15 of the GDPR), the right to rectification (Article 16 of the GDPR), the right to erasure (Article 17 of the GDPR) and the right to restriction of processing (Article 18 of the GDPR), the right to data portability (Article 20 of the GDPR) and the right to object to the processing (Article 21 of the GDPR). Moreover, you have a right to lodge a complaint with the data protection authority competent for BaFin, i.e. the Federal Commissioner for Data Protection and Freedom of Information (Bundesbeauftragte(r) für den Datenschutz und die Informationsfreiheit).

9. Automated individual decision-making, including profiling

There is no automated individual decision-making.

10. Source of the personal data

Where the personal data does not originate from you, the data is collected from the reporting supervisory authority. The source of the data is not generally accessible.

11. Basis for the provision of your data and consequences in the event of failure to provide your personal data

Organisation of the statutory cooperation within the college pursuant to section 283 (2) of the VAG; section 329 (4) of the VAG in conjunction with Article 21(2) sentence 3 (a) of the EIOPA Regulation
If you do not provide the requested contact details, it will not be possible to cooperate within the framework of the College, as you will not be able to use the BaFin tool for data exchange.