We process the personal data you disclosed to us in your
capacity as the authorised representative or beneficial owner
of the legal entity (interested parties and/or customers). Data
we have legitimately obtained from publicly available sources
(e.g. land registers, commercial registers and registers of
associations, press, media, or the internet) are rightfully
processed as well.
The representative's personal data we process include, inter
alia, the following details:
Basic data (first and last name, academic degree,
address and contact data (telephone number, email
address)) and further personal data (date and place of
birth, gender, nationality, marital status, legal capacity,
professional title/nature of employment (employed/selfemployed))
Identification data (such as ID card data) and
authentication data (such as specimen signature)
Legally relevant data in accordance with the KYC
principle (e.g. customer profile, documentation about
the purpose and nature of the business relationship,
proof of source of funds, PEP check) Our corresponddence with you (e.g.written communications,
consultation records, memos)
Information derived from electronic communications
with DenizBank (Wien) AG (e.g. apps or cookies)
In general, the contents and the scope of the personal data
we collect depend on the respective products/services. Apart
from the data mentioned above, we are allowed to collect,
process and retain further personal data.
The aforementioned personal data are processed in
accordance with the data protection regulations. Moreover,
our data processing is based on the justifications stipulated in
Article 6 Section 1 GDPR only. The main purposes are as
follows:
Fulfilment of contractual obligations
Personal data are processed for the execution of banking
transactions and brokering activities involving insurances.
These transactions and activities are carried out within the
framework of the performance of the contracts entered into
with you or for the implementation of precontractual
measures.
The specific details concerning the purpose of the processing
of your personal data primarily depend on the respective
product/service (see section 2). They can be looked up in the
corresponding contractual documents and in our terms and
conditions.
Fulfilment of legal obligations or grounds of public
interest
As a bank, we are subject to different legal provisions (e.g.
Kreditwesengesetz – Banking Act, Börsegesetz – Stock
Exchange Act, Geldwäschegesetz – Anti-Money Laundering
Act, Wertpapierhandelsgesetz – Securities Trading Act,
Zahlungsdiensteaufsichtsgesetz – Payment Services
Supervision Act and tax laws) and banking regulations (such
as those stipulated by the European Central Bank, the
European Banking Supervisors, the Deutsche Bundesbank
and the BaFin – Federal Financial Supervisory Authority).
We may process your personal data for the following
purposes (non-exhaustive list):
Verification of your
identity
Measures for the prevention of money laundering
and terrorism financing
Compliance with the provisions concerning
market abuse and insider informationCompliance with
the fiscal control and reporting obligations (exchange
of information with tax or financial crime authorities)
Measures for risk assessment and management at both
the bank and the parent company
Based on your consent
If you have given your consent to the processing of your
personal data for specific purposes (e.g. for email
advertising), the processing operation performed on the basis
of your consent is deemed lawful. Your personal data will be
processed exclusively for the purposes and within the scope
defined in your declaration of consent. You may revoke your
declaration of consent at any time with effect for the future.
This also applies to declarations of consent given before entry
into force of the GDPR (25 May 2018).
Safeguarding of legitimate interests
If required for the safeguarding of our legitimate interests or
those of third parties, we will process your data beyond the
actual fulfilment of the contract based on the balancing of
interests. Data processing for the safeguarding of legitimate
interests occurs, for instance, in the following cases:
Consultation of and data exchange with credit agencies
(e.g.SCHUFA) in order to identify credit and/or default
risks
Recording of telephone calls (e.g. in the context of
complaint management)
Assertion of legal claims and defence in the event of
legal disputes
Safeguarding of the Bank's IT security and the smooth
running of the Bank's IT operations
Prevention and investigation of criminal offences
Measures concerning the safety of buildings and
facilities and the protection of customers, employees
and the Bank's property (e.g. video recordings inside/in
front of branch offices)
Measures for the prevention of money laundering and
terrorism financing
General risk and business management measures as
well as measures for the development of products and
services
Personal data will only be processed and retained for as long
as necessary for the fulfilment of the aforementioned
purposes and, in any case, for the duration of the entire
business relationship as well as beyond this period in
compliance with the supervision requirements or statutory
retention periods, the statutory warranty periods or
contractual guarantee periods or whenever there are any other
lawful reasons that justify the retention on a case-by- case
basis.
Your data will be deleted upon fulfilment of the purpose as
well as upon termination of the statutory retention periods, the
statutory warranty periods or the contractual guarantee
periods. In case of legal disputes, however, when the data
are needed as evidence, they will not be deleted before the
disputes are settled. The retention periods and
documentation obligations result, inter alia, from the
Handelsgesetzbuch – Commercial Code, the
Abgabenordnung – Tax Code, the Kreditwesengesetz –
Banking Act, the Geldwäschegesetz – Anti-Money
Laundering Act, Wertpapierhandelsgesetz – Securities
Trading Act.
Within the scope of our due diligence obligations relating to
the prevention of money laundering and terrorism financing,
we are obliged to obtain and retain certain personal
documents and information at the time the business
relationship is entered into or whenever occasional
transactions are to be executed. In particular, we will retain
copies of the documents and information required for the
fulfilment of the due diligence obligations described. The
same applies to the transaction slips and records required for
the tracing of transactions.
The statutory limitation periods pursuant to the Bürgerliches
Gesetzbuch – Civil Code (BGB) are to be considered as
regards the retention periods. The BGB stipulates an absolute
limitation period of up to 30 years (from the date of
damage/occurrence of the damage) and a general limitation
period of three years (from the date on which the damage and
the injuring party are known). Where processing is based on
your consent, the data will not be deleted until you have
revoked your consent.
Within the Bank, only those departments and/or employees
that require your data for the fulfilment of our contractual,
statutory and supervisory obligations as well as for our
legitimate interests will be given access to your data. Apart
from that, we may disclose your personal data to processors
(service providers) if these comply with the data protection
requirements stipulated in writing in the order processing
agreements and if these are bound by confidentiality
obligations. Even though we commission a processor, we
remain responsible for the protection of your personal data.
As regards the disclosure of data to recipients outside the
Bank, we point out that as a bank, we are obliged not to
disclose any customer-related information confided or made
available to us due to the business relationship (banking
secrecy according to § 38 BWG, Austrian Banking Act and
according to our General Terms and Conditions). We are not
entitled to disclose your personal data unless required by legal
and/or supervisory provisions. Besides, we may disclose your
personal information if you have given your consent or
released us from our secrecy obligation in writing. Where this
is strictly necessary for the aforementioned purposes, we will
disclose your personal data to the categories of recipients
mentioned below. However, this only occurs to the extent
necessary.
Parent company
Branch offices of our bank
Information services providers
Financial institutions, financial companies and financial
services providers
Society for Worldwide Interbank Financial
Telecommunication (S.W.I.F.T.)
Insurance companies
(Supervisory) authorities
Deutsche Bundesbank
Ministry of Finance
Administrative authorities, courts and public corporations
External legal representatives, notaries, tax consultants,
auditors and annual auditors
US tax authorities
Creditor protection associations
IT services providers
Other service providers and partners
Collection agencies for the purpose of debt recovery
Data are not transmitted outside the European Union (to socalled third countries) unless required to execute
your orders,
stipulated by law (e.g. due to fiscal reporting obligations) or
allowed due to your consent.
If required in individual cases, we may transmit your data to
an IT services provider (processor) established in a third
country in order to ensure the smooth running of the Bank's
IT operations. However, this is done in compliance with the
European level of data protection. In this respect, we would
like to point out that we do not use processors outside the
European Union unless the European Commission has taken
an adequacy decision with regard to the third country
concerned, or unless we have agreed upon EU standard
contractual terms or binding internal data protection
regulations which oblige the processor to comply with the
European level of data protection.
Appropriate technical and organisational measures have
been implemented in order to ensure the protection and
security of your personal data. These technical and
organisational measures protect your personal data against
access by unauthorised third parties. They include, in
particular, an authorisation concept as well as procedural,
organisational and digital protective measures concerning
our IT infrastructure
These measures are updated on a continuous basis using
state-of-the-art technology. Besides, they are checked on a
regular basis within the framework of internal and external
audits.
In general, we do not use automated decision-making when
entering into business relationships or during established
business relationships. In certain cases, the processing of your
personal data is automated with the objective of evaluating
certain personal aspects (so-called profiling). Should we use
these processes in individual cases, we will inform you
accordingly if required by law.
In particular, profiling is used in the following cases:
Due to statutory and regulatory provisions, we are obliged
to fight money laundering and terrorism financing. To this
end, we evaluate, for instance, your payments and
transactions. At the same time, these measures are
intended to protect you.
Moreover, we may evaluate your data in order to
appropriately inform and advise you on products. This is
done using evaluation systems (e.g. statistical procedures).
We use the results in order to be able to contact you in a
needs-based and target-oriented way.
Provision of your data
Within the framework of our business relationship, you are
required to disclose the personal data necessary for the
establishment and implementation of a business relationship
and compliance with the associated contractual obligations.
The same applies to data the collection of which is required
by law
If you fail to provide us with the requisite information
anddocuments, we are not allowed to establish the desired
business relationship, enter into the contract and/or execute
the order.
Your data protection rights, especially your rights of
access, rectification and deletion
Every person whose data are or were processed by us has
the following rights, provided that these are not subject to
statutory limitations and do not infringe any statutory
provisions:
Right to receive information on whether personal
data are processed and, if so, on the nature of the
data and the extent of their processing
Right to rectification, completion and/or deletion
of the personal data
Right to restrict the processing of personal data
Right to transfer personal data
Right to object to a processing activity (under
certain conditions)
Right to revoke the declaration of consent at any
time. This revocation does not affect the lawfulness of
the processing activities that occurred as a result of
the consent up to the date of its revocation.
Moreover, the person concerned has the right to file a
complaint with the Data Protection Authority.
Right to object on a case-by-case
basis
You are entitled to object to the processing of your personal
data if it serves grounds of public interest and the balancing
of interests
If you file an objection, we will no longer process your
personal data unless we provide compelling legitimate
grounds for the processing that outweigh your interests, rights
and liberties. The same applies if the processing occurs for
the purpose of asserting, exercising or defending any legal
claims.
Right to object to the processing of personal data for
marketing purposes
If, within the scope of direct advertising measures, you have
given your consent to the processing of your personal data
for marketing purposes, you are entitled to object to this type
of processing at any time without stating any reasons.
If you object to the processing for marketing purposes, we will
no longer use your personal data for these purposes.
The withdrawal of your consent can be addressed without a
form requirement to DenizBank (Wien) AG, Münchener
Straße 7, 60329 Frankfurt am Main or
datenschutzDE@denizbank.de
Supervisory authority responsible for monitoring
compliance with data protection regulations:
Der Hessische Datenschutzbeauftragte
(Hessian Data Protection Commissioner)
Gustav-Stresemann-Ring 1
65189 Wiesbaden
Postfach 31 63
Telefon:
+4961114080
Fax: +49 611 140 89 900
Website:
http://www.datenschutz.hessen.de
poststelle@datenschutz.hessen.de
