We generally process personal data of persons making use of our web offerings only if and to the extent that this is necessary to make available a functioning website as well as our web content and services. Where a data subject wishes to make use of special services via one of our websites, processing of personal data may thus be necessary.

If processing of personal data is necessary in our view and there is no legal basis for such processing other than consent, we generally obtain such consent from the data subject, except in cases where consent cannot be obtained beforehand for practical reasons and processing of data is permitted by law.

This policy applies to the following websites and associated subdomains:
https://bankenverband.de/,
https://bankenombudsmann.de/,
https://www.edb-banken.de/,
http://einlagensicherung.de/,
https://einlagensicherungsfonds.de/,
http://schulbanker.de/,
https://bw.bankenverband.de/,
https://by.bankenverband.de/,
https://hb.bankenverband.de/,
https://hh.bankenverband.de/,
https://mi.bankenverband.de/,
https://ni.bankenverband.de/,
https://nw.bankenverband.de/ und
https://sh.bankenverband.de/.

2.1 Provision of websites and creation of log files

You may use our websites for information purposes only, i.e. if you don’t register or otherwise send us information, without disclosing any personal data. Nevertheless, whenever you view our web pages, our system automatically records data on every server access concerning our offerings (so-called ‘server log files’). The access data include the name of the web page you requested, file, request date/time, volume of data transferred, ‘successful request’ report, type of browser plus version, your operating system, referrer URL (the page previously visited), IP address and the requesting provider. We use the log file data, without matching it to your person or any other profile, solely for statistical analysis for the purpose of operating, securing and optimising our websites. At the same time, we reserve the right to subsequently check the log file data if we have legitimate grounds for suspecting unlawful use.

Temporary system storage of your IP address is necessary to enable delivery of the website to your computer. For this purpose, your IP address has to remain stored for the duration of the session. The legal basis for temporary storage of data and log files is Article 6(1)(f) of the GDPR.

The data are erased as soon as they are no longer necessary for achieving the purpose of their collection. Where the data are recorded for the purpose of making available our web offerings, this is the case when the respective session ends. Where the data are stored in log files, this is the case after 14 days at the latest. The data may also be stored for longer. In this case, your IP address will be erased or scrambled so that it can no longer be attributed to you.

Recording data for the purpose of making available our web offerings and storing data in log files are essential for operating our websites. You consequently have no right of objection thereto.

2.2 Use of external services

2.2.1 Cookies

We use cookies on our websites. Cookies are small text files that are stored on your computer via your browser. A cookie contains a unique sequence of characters that identify your browser when you visit a website again. The use of cookies improves the user-friendliness and security of our websites.

We also use cookies on our websites that allow us to analyse your surfing behaviour. The data we collect from you in this way are pseudonymised through appropriate technical arrangements. They can therefore no longer be attributed to you. The data are not stored together with other personal data. When you view our web pages, a banner informs you that we use cookies for analysis purposes and refers you to this privacy policy. At the same time, it informs you how you can block storage of cookies in your browser settings.

Cookies are stored on your computer and transmitted to us from there. This means that you, as a user, have full control over the use of cookies. You can deactivate cookies in your browser settings. You can also view our web pages without any cookies. You can delete cookies that have already been stored in your browser settings. However, blocking cookies may result in reduced website functionality. Please note that when you delete all browser cookies you also delete previously set opt-out cookies and need to reset these.

The purpose of using technically necessary cookies is to make using our websites easier for you. We cannot provide some of our website functions without using cookies. These functions need to be able to recognise your browser after you move from one web page to another. We don’t use the data we collect from users via technically necessary cookies to create user profiles. We use analysis cookies to enhance the quality of our websites and their content. Through analysis cookies, we learn how our websites are used and can thus continuously optimise our offerings.

The legal basis for processing personal data using cookies is Article 6(1)(f) of the GDPR. The legal basis for processing personal data using cookies for analytical purposes is your consent to this in accordance with Article 6(1)(a) of the GDPR.
Please note: many online company ad cookies can be managed via the US website http://www.aboutads.info/choices/ or the EU website http://www.youronlinechoices.com/uk/your-ad-choices.

2.2.2. Web analysis using Matomo

We use the software "Matomo" (www.matomo.org) on this website, a service of the provider InnoCraft Ltd, 150 Willis St, 6011 Wellington, New Zealand. The software sets a cookie (a text file) on your computer, with which your browser can be recognized. If subpages of our website are called up, the following data is stored:

the IP address of the user, shortened by the last two bytes (anonymized)
the sub-page called up and the time of the call-up
the page from which the user accessed our website (referrer)
which browser with which plugins, which operating system and which screen resolution is used
the time spent on the website
the pages that are visited from the accessed sub-page

The data collected with Matomo is stored on our own servers. It is not passed on to third parties.
The legal basis on which we process personal data using Matomo is Art. 6 (1) lit. f of the DSGVO.
We need the data to analyze the surfing behavior of users and to obtain information about use of the individual components of the website. This enables us to continuously optimize the website and its user-friendliness. These purposes are the basis of our legitimate interest according to Art. 6 para. 1 lit. f DSGVO. By anonymizing the IP address, we take into account the interest of users in the protection of personal data. The data will never be used to personally identify the user of the website and will not be merged with other data.
The data is deleted when it is no longer needed for our purposes.
You can object to the recording of data in the manner described above in three different ways:

you only consent to the technically necessary cookie in the DSGVO dialog.
you can completely prevent the storage of cookies in your browser. However, this means that you may no longer be able to use some of the functions of our website that require mandatory identification.
you can activate the "Do-not-track" setting in your browser. Our Matomo system is configured to respect this setting.

2.2.3 Shariff/use of social media plugins

We are pleased whenever our readers recommend and discuss content of our websites on Twitter, Facebook and LinkedIn. For this purpose, we use social media buttons (also social media plugins), namely the buttons developed by the c’t ‘Shariff’ project.

Shariff ensures that social networks can only request data from users once these click on the appropriate button. Shariff replaces social networks’ customary ‘Share’ buttons and protects your surfing behaviour from prying eyes. A single click on the button is enough to share information with others. You don’t have to do anything else – the webmaster has already taken care of everything. Customary social media buttons transfer your data every time you visit a web page and give the social networks full details of your surfing behaviour (user tracking). For this, you don’t have be logged in or a network member. A Shariff button, on the other hand, only establishes direct contact between a social network and a visitor when the latter actively clicks on the share button.

Only when you click on the button is the respective social network provider informed that you have visited one of our websites. In addition, data such as IP address, request date/time and request content are transferred. Where Facebook is involved, the provider says that in Germany the IP address is anonymised immediately after being collected. Activating the plugin therefore means that your personal data are transferred to the provider and stored there (where US providers are involved, in the US). As the provider collects data via cookies in particular, we recommend that before clicking on the button you delete all cookies via your browser’s security settings.

We have no influence on the data collected or data processing operations nor do we know the full extent of data collection, the purposes of processing or the storage periods. Likewise, we have no information on erasure of the data collected by the respective social network provider.

The provider stores the data about you in the form of a user profile and uses it for advertising, market research and/or customised website design purposes. It does so in particular (also for non-logged-in users) to deliver personalised ads and to inform other social network users about your activity on our websites. You have the right to object to the creation of such a user profile; to exercise this right, you must contact the respective provider. Through plugins, we give you the opportunity to interact with social networks and other users so that we can improve our web services and make them more attractive for you. The legal basis for using plugins is Article 6(1)(f) of the GDPR.

Data are transferred irrespective of whether you have an account with the provider and are logged in there. If you are logged in with the plugin provider, the data that we collect from you are matched directly to your account with the provider. If you use the activated button and, for example, link a web page, the provider stores this information as well in your user account and publicly discloses it to your contacts. We recommend that after using a social network you always log out, particularly before activating the button, as you can in this way avoid data being matched to your profile with the plugin provider.

For further information on the purpose and scope of data collection and processing of data by the plugin provider, please see the privacy policies of the providers listed below. These also contain further details of your rights and settings to protect your privacy.

Addresses and URLs of social network providers together with privacy policies:

Facebook Inc., 1601 S California Ave, Palo Alto, California 94304, USA; http://www.facebook.com/policy.php; further information on data collection: http://www.facebook.com/help/186325668085084 and https://facebook.com/about/privacy/. Facebook recognises the EU-US Privacy-Shield: https://www.privacyshield.gov/EU-US-Framework.

Twitter, Inc., 1355 Market St, Suite 900, San Francisco, California 94103, USA; https://twitter.com/privacy. Twitter recognises the EU-US Privacy Shield: https://www.privacyshield.gov/EU-US-Framework.

LinkedIn Corporation, 2029 Stierlin Court, Mountain View, California 94043, USA; http://www.linkedin.com/legal/privacy-policy. LinkedIn recognises the EU-US Privacy Shield: https://www.privacyshield.gov/EU-US-Framework.

For further information on Shariff, please go to heise.de.

2.2.4 Facebook Custom Audiences

Our websites contain remarketing tags provided by Facebook (1601 South California Avenue, Palo Alto, CA 94304, USA). When visiting Facebook or other websites also using such tags, website users can in this way enjoy personalised ads (Facebook ads). Our aim is to show you ads that are of interest to you so as to make our websites more attractive for you. The legal basis for processing your data is Article 6(1)(f) of the GDPR.

When you visit our websites, your browser and the Facebook server are automatically directly connected via the remarketing tags. Please note that, as the website provider, we have no influence on the amount of data collected by Facebook through the use of such tags or on how Facebook uses such data and can only inform you to the best of our knowledge as follows: through Custom Audiences integration, Facebook is informed that you have visited one of our web pages or clicked on one of our ads. If you are registered with a Facebook service, Facebook can match this visit to your account. Even if you are not registered with or logged in to Facebook, the provider may obtain and store your IP address and other identifiers. For more information, please see Facebook’s privacy policy (www.facebook.com/about/privacy). If you don’t want your data to be collected via a Custom Audience, you can get more Information about Custom Audiences here: https://www.facebook.com/legal/terms/customaudience?ref=fbb-blog_new-requirements-for-custom-audiences.

According to Facebook, the data we transmit fall into five categories: so-called Http headers, pixel-specific data, button click data, form field names and optional data.

These are explained at https://www.facebook.com/business/gdpr. According to Facebook, the data are automatically erased or anonymised after 90 days. Please see https://www.facebook.com/help/206635839404055?ref=dp.

Data whose storage period has expired are automatically erased once a month.

For further information on data processing by Facebook, please go to http://www.facebook.com/about/privacy.

2.2.5 LinkedIn conversion tracking

We use the LinkedIn conversion tracking retargeting tool provided by LinkedIn Ireland (Wilton Plaza, Wilton Place, Dublin 2, Ireland) (»LinkedIn«). For this purpose, we have integrated the LinkedIn insight tag that allows LinkedIn to gather statistical, pseudonymised data on your visits to and use of our websites and to provide us with aggregated statistics based on these. In addition, such data enable us to make you interesting personalised offers and recommendations. The legal basis for processing data is Article 6(1)(f) of the GDPR.

The relevant data are stored in a cookie. You can block storage of cookies via a browser setting. Alternatively, you can object to this type of data processing by using the following link (https://www.linkedin.com/help/linkedin/answer/62931?lang=en#user-profile) to install an opt-out cookie that remains on your device until you delete the cookies. This option is open to both LinkedIn members and non-members.

The data we transmit comprise the IP address, time stamp, so-called ‘page events’ (according to LinkedIn, these include, for example, page views) and – if you are a LinkedIn member – other personal data. According to LinkedIn, the aforementioned personal data are automatically erased after 90 days, unless they have been edited or are used in LinkedIn campaigns. For further details, please go to https://www.linkedin.com/help/linkedin/answer/87150/linkedin-marketinglosungen-und-die-datenschutz-grundverordnung-dsgvo-?lang=en.

Data whose storage period has expired are automatically erased once a month.

For more information on LinkedIn conversion tracking, please see LinkedIn’s privacy policy.

2.2.6 Embedding of third-party services

Our online content includes services of third parties – YouTube, Vimeo, Twitter, SlideShare, Yumpu, Flickr and Soundcloud. This content can be viewed directly on our website. When you visit the website, these providers will be informed that you have viewed the corresponding sub-page of our website. Further data will also be transmitted irrespective of whether you have a user account which you are logged into or whether you have no user account. If you don’t want data to be matched to your profile, you need to log out before activating the relevant button. You have the right to object to the creation of these user profiles, but to exercise this right, you need to contact the relevant provider. We embed these services to show you content which will be of interest to you in order to make our website more attractive for you. The legal basis for processing your data is Article 6(1)(f) of the GDPR.

2.2.6.1. SlideShare

The SlideShare platform of SlideShare Inc. (1 Montgomery St., Suite 1300, San Francisco, CA 94104, USA) is used on the websites operated by the Association of German Banks to publish our own presentations, among other things. For more information, see the privacy policy of SlideShare at https://www.linkedin.com/legal/privacy-policy. We don’t use SlideShare plugins on our websites.

2.2.6.2. Twitter

Our websites use content produced on Twitter. This service is offered by Twitter Inc. (795 Folsom St., Suite 600, San Francisco, CA 94107, USA). The content is made visible by embedding it on our website. For further information, see Twitter’s privacy policy at http://twitter.com/privacy.

2.2.6.3. YouTube

We have included YouTube videos in our online content. These are stored on http://www.YouTube.com and can be played directly on our website. They are all embedded using the ‘privacy-enhanced mode’, meaning that no data about you will be transmitted to YouTube if you don’t play the videos. Only if you play the videos will data be transmitted. We have no influence over this transmission of data. Further information on the purpose and extent of the collection and processing of data by YouTube is available in its privacy policy at https://www.google.com/intl/en/policies/privacy. Google will also process your personal data in the US and recognises the EU-US Privacy Shield: https://www.privacyshield.gov/EU-US-Framework.

2.2.6.4. Flickr

We use the platform Flickr (Oath (EMEA) Limited, 5-7 Point Square, North Wall Quay, Dublin 1) to publish photographs, among other things. For further information, see Flickr’s privacy policy at https://policies.oath.com/ie/en/oath/privacy/index.html. We don’t use Flickr plugins on our websites.

2.2.6.5. Yumpu

Yumpu is a service of i-Magazine AG (Gewerbestrasse 3, 9444 Diepoldsau, Switzerland), which makes a digital platform available for the publication of magazines, brochures and catalogues. Our websites use Yumpu embeds to display publications. Further information about the tool can be found in the Terms of Service and privacy policy of Yumpu and i-Magazine AG.

2.2.6.6. SoundCloud

Plugins of the social network SoundCloud (SoundCloud Limited, 33 St James Square, London SW1Y 4JS, UK) may be embedded in our web pages. Further information can be found in the privacy policy of SoundCloud at https://soundcloud.com/pages/privacy/05-2018.

2.3 Finanzchat

You can use our Finanzchat (finance chat) service to ask a question. For technical reasons, you need to enter a name to do so. The Association of German Banks doesn’t require you to provide your real name or your email address. If you don’t want information to be matched to your identity, select a user name which will make this impossible, e.g. by entering a pseudonym. The user data entered in the input mask are transmitted to us and stored (time stamp and pseudonym). No data are forwarded to third parties. The data are used only to conduct the chat.

We only process the personal data entered into the input mask for the purpose of replying to the question.

The data are erased as soon as they are no longer needed to achieve the purpose for which they were collected. For personal data entered into the input mask, this is the case when the conversation with the user has ended, i.e. when it can be inferred that the matter in question has been clarified.

2.4 Email contact, including contact forms on the websites

You can contact us at the email addresses made available on our websites. Emails to us are also generated by the contact forms provided. The personal data of users transmitted with these emails are stored in our email archive. No data are passed on to third parties. The data are used only for the purpose of conducting our conversation.

The legal basis for processing data transmitted in an email is Article 6(1)(f) of the GDPR. When we are contacted by email, we have a legitimate interest in processing the personal data therein in order to deal with the reason for the contact. Article 6(1)(b) of the GDPR provides a further basis for processing the data. Processing is necessary for the purpose of handling an enquiry which constitutes a quasi-contractual relationship. The consent criterion in accordance with Article 6(1)(a) of the GDPR also provides justification for storing these data while the task is being handled.

The Association of German Banks generally treats emails as business correspondence and has determined that they will be retained in its email archive for a period of eleven years. At the end of this period, they are automatically deleted. This does not apply to emails sent to our mailbox for job applications, bewerbungen@bdb.de. In this case, applicants’ data are erased six months after the purpose of processing the data no longer applies – or, in other words, after a decision on the application has been made. The common mailboxes for the Ombudsman dispute resolution scheme (e.g. Ombudsmann@bdb.de) are also excluded from the general rules governing emails (for further information, see section 4).

2.5 Enquiries about protection ceiling

Bank customers can contact the Association of German Banks over the internet to enquire about the protection ceiling of a member bank affiliated to the Deposit Protection Fund (cf. no. 20 (1), sentence 5 of the General Business Conditions of the private banks). Enquirers use the input mask on the web page https://einlagensicherungsfonds.de/abfrage-der-sicherungsgrenze/ for this purpose. The enquiry is sent to the association in the form of an email and stored there until a response is sent. The association replies by email, with the personal data of the enquirer automatically included in the reply. For the purpose of preserving evidence, the reply email from the association with the personal data of the enquirer is stored for a long period of time. This is because, if a compensation event occurs, the enquirer could claim that the association had provided inaccurate information about the member bank’s protection ceiling at the time of the enquiry. By storing the reply email, the association will be able to demonstrate the content of the information actually supplied to the enquirer. The storage of email enquiries sent to the Deposit Protection Fund therefore serves the purpose of preserving evidence and thus of protecting the legitimate interests of the Association of German Banks (Article 6(1)(f) of the GDPR). The data are not used for any other purpose; in particular, the information is not released to member banks or third parties. The emails are stored on a separate server at the association’s data centre for 30 years and are not available for processing other than for the above purpose of preserving evidence. Interests of the data subjects which would override the association’s legitimate interests are not discernible. Data subjects are explicitly informed about the storage of their email enquiries and about the purpose of this storage.

2.6 Orders

Brochures and other publications can be ordered on our websites and electronic newsletters, etc. can be subscribed to. A newsletter is subscribed to by means of a declaration of consent (double opt-in method) and by providing an email address (optional: name, first name and company). To receive brochures and other publications by post, orderers are asked to provide their name, first name, address and email (optional: company and telephone details).

The legal basis for processing the data is Article 6(1)(b) of the GDPR. Processing serves the purpose of performing a task in a quasi-contractual relationship. With respect to the newsletter, in particular, processing during the period of dealing with the task is also legitimised by the existence of consent in accordance with Article 6(1)(a) of the GDPR.

The personal data are only processed during the period in which the task is dealt with and are subsequently erased without delay. The only exception to this standard procedure is if an order is placed by email. In this case, the email is automatically deleted from the email archive of the Association of German Banks after eleven years.

2.7. Student competitions

On the websites http://schulbanker.de and http://europeanmoneyquiz.de, interested users can find information about the student competitions we organise and email us questions. They can also register or apply to take part in the competitions. For the European Money Quiz, the procedure described in section 2.4 applies except that the names and contact details of the winners in Germany are forwarded to the European Banking Federation (EBF), which organises the European final in Brussels. The contact details contained in any registrations and applications for the other competition are forwarded direct to the service provider we commission to conduct it. For the Schul|banker bank management game, this is ILTIS GmbH (http://www.iltis.de).

The legal basis for processing the data is Article 6(1)(b) of the GDPR. The data are processed for the purpose of performing a task in a quasi-contractual relationship. In the course of the competition, there may be further processing of personal data. In this case, separate declarations of consent will – if necessary – be obtained from data subjects (consent criterion in accordance with Article 6(1)(a) of the GDPR). This applies, for example, if images or film of those taking part are going to be published. The personal data of those taking part in a competition will be stored for six years after the competition has ended and will then be erased. The data of persons who do not take part will be erased immediately by the service providers. This general rule does not apply if the Association of German Banks is contacted direct by email. These emails will be automatically deleted from our email archive after eleven years.

2.8. Mailjet delivery service

On our website we offer users the opportunity to receive news by email (newsletters/alerts). Anyone wishing to make use of this service must provide a valid email address and confirm that the owner of the email address provided agrees to receive the newsletter. No further data are collected. This information is only used to send the newsletter.
Newsletters are sent by Mailjet (SAS Mailjet, 13-13bis, rue de l’Aubrac – 75012 Paris, FRANCE). Mailjet’s privacy policy can be found at https://www.mailjet.com/privacy-policy/.
The email addresses and other above data of the recipients of our newsletters are stored on Mailjet’s servers. Mailjet uses this information to send and evaluate newsletters on our behalf. Mailjet will not use the data of our newsletter recipients to write to them itself and will not pass on data to third parties.

Privacy policy

1. Introduction

2. Publicly accessible web offerings

3. Contact databases of the Association of German Banks

4. Ombudsman Scheme of the German private banks

5. What rights to data protection do I have?

6. Changes to privacy policy