Privacy Information in Accordance with Art. 13 of the GDPR

Introduction

  1. As part of an existing or future contractual relationship, you may receive advice on and/or mediation of insurance and/or investment transactions.
  2. This information aims to give you an overview of how we process your personal data (“data”) and to explain which rights you have in this context.
  3. You receive this information either as a contracting party or as an involved party.
  4. You are a contracting party if we have, or are about to enter into, a contractual relationship with you.
  5. You are an involved party if you are involved in, or will be involved in, a transaction that we have mediated or advised on—such as:
    • Account holder
    • Authorized representative
    • Insured person
    • Beneficiary
    • Person with beneficial ownership under the German Anti-Money Laundering Act

For readability, only the masculine form is used; all references apply equally to all genders.

1. Who is responsible for processing your data?

  1. As the data controller, we determine the means and purposes of processing your data. You may contact us at any time regarding data processing or your rights:

Data Protection Officer
Dr. Christian Borchers
c/o datenschutz süd GmbH
Website: www.datenschutz-nord-gruppe.de
Phone: +499313049760
Email: office[at]datenschutz-sued.de

2. For which purposes do we process your data?

  1. We process your data to initiate and carry out contracts, orders, or related advice and mediation services for insurance and investment transactions.
  2. We must also process data to fulfill legal obligations (e.g., tax, commercial, industry, anti-money laundering regulations).
  3. Some data is processed to improve workflows or communication (e.g., via videoconferencing or electronic signatures), which may require your consent.
  4. With your consent, we may also use your data to advertise our products and services.
  5. With explicit consent, we perform preliminary risk assessments (e.g., health data, occupation, hobbies) for insurance. If approved, we then submit the actual insurance application with your support.
  6. We use your personal data for marketing purposes, especially via email, phone, or mail regarding certain products and services.

3. On what legal basis do we process your data?

  1. Data under section 2(1) is processed based on contract fulfillment.
  2. Special categories of data (e.g., health, biometric data) require your explicit consent.
  3. Required legal obligations form their own legal basis.
  4. Data under sections 2(3)–(5) is processed only with your consent.
  5. Marketing to you is based on legitimate interest, or consent for email/phone campaigns; special rules apply for existing customers.

4. How do we receive your data?

  1. Contracting party data usually comes directly from you; occasionally from third parties (e.g., insurers, guardians).
  2. If a broker pool is involved, your data is exchanged between them and us, potentially including special categories of data.
  3. We may use sub-intermediaries (e.g., broker pools) who process data for the same purposes. This includes:
    • ID documents (passport, ID, tax ID)
    • Contact details (phone, email)
    • Date of birth, address
    • Contract correspondence
    • Bank details
    • Insurance claims and policy documents
    • Data related to electronic signatures
    • Application/contract data including health data

A current list of broker pools and sub-intermediaries is available on request or on our website.

  1. As an involved party, we receive similar data from you or the contracting party.

5. What happens if you don’t provide your data?

You are free to withhold your data. However, if essential data or consent for required processing is not provided, advice, mediation, or contract execution may not take place or may be limited. Details are provided in the consent document.

6. To whom do we transfer your data?

  1. Sub-intermediaries receive data as described in section 4(3), only when legally and contractually permitted.
  2. We may share data with:
    • Product providers (insurers, investment firms, banks, fund companies)
    • Regulatory authorities
    • Data processors (see 6(4))
    • Social insurance institutions
    • Our tax advisor
  1. If a successor takes over service (e.g., due to business closure), we will inform you beforehand; you may object.
  2. Data processors (e.g., IT providers, broker pools) handle your data under GDPR Article 28.

7. How long do we retain your data?

  1. We retain data only for as long as we have a basis (see 7(4)). Once expired, we delete it promptly.
  2. Contract-related data is deleted after contract completion or if no contract is concluded, except where legal obligations apply.
  3. Legally required data is retained for the statutory period, which can be up to 30 years.
  4. Data based on consent is deleted upon revocation of consent.

8. Is your data transferred to third countries?

  1. Some data processors may transfer data outside the EU, secured via Standard Contractual Clauses and additional measures (e.g., encryption). Copies of agreements are available on request.
  2. No other transfers to non-EU countries take place.