DATA PROTECTION DECLARATION (INCLUDING LEGALLY REQUIRED INFORMATION CONTENT)

Responsible office in the meaning of data-protection law

Swiss Life Asset Managers Deutschland GmbH
Aachener Straße 186
50931 Köln
Phone +49 221 399 00-0
Fax +49 221 399 00-109
E-Mail-address Contact-de@swisslife-am.com

• Brokerage
• Lease-out
• Sale
• Purchase

• advertising or market and opinion research, as far as you have not objected to the use of your data;
• obtaining information and exchanging data with credit agencies where this goes beyond our economic risk;
• the examination and optimization of processes for needs analysis;
• the further development of services and products as well as existing systems and processes;
• the disclosure of personal data within the framework of due diligence in the course of company sale negotiations;
• for comparison with European and international anti-terrorist lists, insofar as this goes beyond the legal obligations;
• the enrichment of our data, e. g. by using or researching publicly accessible data;
• statistical evaluations or market analysis;
• of benchmarking;
• the assertion of legal claims and defence in legal disputes which are not directly attributable to the contractual relationship;;
• the restricted processing of data, if a deletion is not possible or only possible with disproportionately high effort due to the special type of storage;
• the development of scoring systems or automated decision-making processes;
• the prevention and investigation of criminal offences, if not exclusively for the fulfilment of legal requirements;
• building and plant security (e. g. by means of access control and video surveillance), insofar as this goes beyond the general duties of care;
• internal and external investigations, safety reviews;
• any monitoring or recording of telephone conversations for quality control and training purposes;
• Preservation and maintenance of certifications of a private-law or official government nature;
• the seizure and exercise of domestic authority by means of appropriate measures as well as video surveillance for the protection of our customers and employees as well as for securing evidence in the event of criminal offences and their prevention.

Purposes within the framework of your consent (Art. 6, section 1 a of the GDPR)
Your personal data can also be processed for certain purposes (e.g. use of your e-mail address for marketing purposes) as a result of your consent. As a rule, you can revoke this consent at any time. This also applies to the revoking of declarations of consent that were issued to us before the GDPR went into effect, i.e. prior to 25 May 2018. You shall be separately informed about the consequences of revocation or refusal to provide consent in the re-spective text of the consent.
Generally speaking, revocation of consent only applies to the future. Processing that takes place prior to consent being issued is not affected by such and remains lawful.

• ­personal data (name, date of birth, place of birth, nationality, marital status, occupation/trade and comparable data)
• ­contact data (address, e-mail address, telephone number and similar data)
• ­address data (population register data and comparable data)
• ­payment confirmation/confirmation of cover for bank and credit cards
• ­information about your financial situation (creditworthiness data including scoring, i. e. data for assessing the economic risk)
• ­customer history
• ­data about your use of the telemedia offered by us (e. g. time of access to our websites, apps or newsletter, clicked pages/links of us or entries and comparable data)
• ­Video data

• in connection with the execution of the contract;
• for purposes where we are obligated or entitled to give information, notification or forward data (e.g. employer's liability insurance association, health insurance schemes, fiscal authorities) in order to meet statutory requirements or where the forwarding of data is in the public interest (see number 2.4);
• commissioned by us process data as contract processors or parties that assume certain functions (e.g. external data centres, support and maintenance of IT applications, archiving, document processing, call centre services, compliance services, controlling, data screening for anti-money laundering purposes, data validation and data protection. Plausibility check, data destruction, purchasing/procurement, customer administration, lettershops, marketing, media technology, research, risk controlling, billing, telephony, website management, auditing services, credit institutions, printing plants or companies for data disposal, courier services, logistics);
• as a result of our legitimate interest or the legitimate interest of the third party within the framework of the purposes cited under number 2.2 (e.g. to government authorities, credit agencies, collection agencies, attorneys, courts of law, appraisers, companies belonging to company groups and bodies and control instances);
• if you have given us consent to transmit data to third parties.

Length of time your data is stored
We process and store your data for the duration of our business relationship. This also includes the initiation of a contract (precontractual legal relationship) and the execution of a contract.

Above and beyond this, we are subject to various retention and documentation obligations that emanate inter alia from the German Commercial Code (HGB), the Makler- und Bauträgerverordnung (MaBV) and the German Tax Code (AO). The periods and deadlines for retention and/or documentation stipulated therein are up to ten years beyond the end of the contractual relationship or the precontractual legal relationship.

Furthermore, special statutory provisions may require longer retention such as for example the preservation of evidence in connection with statutory time-barring provisions (statute of lim-itations). Under §§ 195 ff. of the German Civil Code (BGB), the regular time-barred period is three years, but time-barred periods of up to 30 years may also be applicable.

If the data is no longer required to meet contractual or statutory obligations and rights, it is regularly deleted unless its further processing - for a limited period - is necessary to fulfil the purposes listed under number 2.2 due to an overriding legitimate interest. Such an overriding legitimate interest is deemed to be the case, for example, if it is not possible to delete the data as a result of the special type of storage or such is only possible at an unreasonably great expense and processing for other purposes is excluded by appropriate technical and organisational measures.                        

• Thus, you have the right to receive information from us on the data stored on you in accordance with the rules of Art. 15 of the GDPR (if applicable with restrictions in accordance with § 34 of the German Federal Data-Protection Act (BDSG)).
• If you so request, we shall correct data stored on you in accordance with Art. 16 of the GDPR if such data is incorrect or flawed.
• If you so desire, we shall delete your data in accordance with the principles of Art. 17 of the GDPR if such is not prevented by other statutory provisions (e.g. statutory retention obligations or the restrictions laid down in § 35 of the German Federal Data-Protection Act (BDSG)) or an overriding interest on our part (for example, to defend our rights and claims).
• Taking into account the preconditions laid down in Art. 18 of the GDPR, you can demand that we restrict the processing of your data.
• Furthermore, you can file an objection to the processing of your data in accordance with Art. 21 of the GDPR, as a result of which we have to stop processing your data. This right of objection only applies, however, if very special circumstances characterise your personal situation, whereby the rights of our company may run counter to your right of objection.
• You also have the right to receive your data in accordance with the arrangements laid down in Art. 20 of the GDPR in a structured, commonplace and machine-readable format or transmit such data to a third party.
• You furthermore have the right to revoke consent that has been issued to us to process personal data at any time effective into the future (see number 2.3).
• You are in addition entitled to file a complaint with a data-protection supervisory authority (Art. 77 of the GDPR). We recommend, however, to first always send a complaint to our data-protection officer.

1.1

Description and scope of data processing
Each time you visit our website, our systems automatically collect data and information from the computer system of the calling computer (personal data that your browser transmits to our server). This also occurs if you do not register or otherwise transmit information to us, for example by actively entering it. The following data is collected in any case when visiting our websites:

• IP address of the user
• Date and time of the request or access
• Time zone difference to Greenwich Mean Time (GMT)
• Content of the request (specific page)
• Access status/HTTP status code
• Amount of data transferred in each case
• Website from which the request comes (from which the user's system accesses our Website)
• Website that is accessed by the user's system via our website
• Information about the type of browser and the version used
• Operating system and its Interface
• Language and version of the browser software

This data is stored in the log files of our system. Storage together with other of your personal data does not take place on a regular basis.

The storage of the aforementioned data, in particular the IP address, by our systems is generally only temporary for the duration of the session and is necessary to enable the proper operation and display of the website. This processing of your data also serves the purposes of evaluating and continuing to ensure system security and stability, as well as other administrative purposes. Insofar as your data is stored in our log files, this is also only done for the reasons of ensuring the functionality of our websites. In addition, we use the data to optimize and ensure the security of our information technology systems. An evaluation of the data for marketing purposes does not take place in this context.

The legal basis for the processing and temporary storage of your personal data is Art. 6 para. 1 sent. 1 lit. f GDPR. Our legitimate interests follow from the purposes for data collection outlined.

1.4

Duration of storage
Your data will be deleted as soon as they are no longer required to achieve the purpose. In the case of the collection of data for the provision of the website, this is the case when the respective session has ended.

In the case of storage of your data in log files, this is the case after seven days at the latest. Storage beyond this is only provided for in exceptional cases, for example if this is necessary for technical reasons or to improve our systems. In this case, the IP addresses of the users are deleted or alienated so that an assignment is no longer possible.

The collection of your data for the provision of the website and the possible storage in log files is absolutely necessary for the operation of the website. Therefore, there is no possibility to object.

A contact form is integrated on our website, which you can use to contact us. When using the contact form, the following data entered in the input mask is transmitted to us and stored:

• Mandatory: e-mail address, surname, first name
• Voluntary: address, company, telephone number, subject, message

In addition, your IP address and the date and time of the request are stored. For the processing of the data, your consent is obtained during the submission process and reference is made to this data protection information. The data will not be passed on to third parties.

2.2

Legal basis for data processing

The legal basis for the processing of your data when using the contact form is your consent in accordance with Art. 6 para. 1 sent. 1 lit. a GDPR.

The processing of personal data from the input mask is only used to process your contact request with us. The other personal data processed during the submission process serves to prevent misuse of the contact form and to ensure the security of our information technology systems.

We will delete your data as soon as we no longer need it to achieve the purposes described. For the personal data from the input mask of the contact form, this is the case when the respective conversation with you has ended. The conversation is usually ended when the circumstances indicate that the reason for your contacting us has been conclusively clarified.

You have the option to revoke your consent to the processing of personal data at any time.

3.1

Description and scope of data processing

When sending our electronic newsletter, to which you can subscribe, we process the following of your personal data:

• Mandatory: title, first name, last name, e-mail address.
• Voluntary: Address

For sending the electronic newsletter, it is mandatory to provide the e-mail address. The processing of your further data serves the personalization of these contacts as well as the specialization of offers and information and is voluntary.

3.2

Purposes of data processing
We process your e-mail address in order to contact you for the purpose of sending our electronic newsletter as well as for information on further products, services or other activities.

For sending our newsletter and further information to you, we will generally obtain your express declaration of consent.

3.4

Duration of storage

We will delete your data as soon as we no longer need it to achieve the purposes outlined.

You can revoke your consent at any time and thus unsubscribe from receiving information about current and future products, services or other information about us. You can declare the revocation by clicking on the link provided in every newsletter e-mail or by sending a message to our contact details provided. If you object to the use of your data, we will no longer send you promotional communications.

4.

General information on the use of cookies

When visiting and using our website, cookies are stored on your computer. Cookies are text files that are stored in the Internet browser or by the Internet browser on the user's computer system. When a user accesses a website, a cookie may be stored on the user's operating system. This cookie contains a characteristic string of characters that allows the browser to be uniquely identified when the website is accessed again.

Some of them are essential, i.e. they are technically necessary for the operation of our website. Other cookies are used for statistical purposes or to analyze access to our website, or for marketing purposes or to offer you the use of external media. Both temporary/session cookies and longer stored cookies (so-called permanent cookies) are used. Temporary cookies are deleted again as soon as you close your browser. Permanent cookies remain for a longer period of time, but can be deleted manually at any time. Some of the cookies are placed by third parties.

The legal basis for data processing when using essential cookies is Art. 6 para. 1 sent. 1 lit. f GDPR, when using all other cookies the legal basis is your consent according to Art. 6 para. 1 sent. 1 lit. a GDPR. Insofar as we do not process your data on the basis of your explicit consent, your personal data will only be processed to the extent necessary to protect our legitimate interests or the legitimate interests of a third party and to the extent that this does not override your interests or fundamental rights and freedoms that require the protection of personal data.

Detailed information about the use of the respective cookies, in particular about their purpose, the respective functional duration and to what extent they are placed by third parties or third parties have access to the data collected via the cookies, can be found in our cookie banner on our website in addition to the present information of our data protection inormation. You can access this at any time by clicking on the icon at the bottom left of the screen. There you will also find, depending on the category of cookies used, detailed information on the legal basis for the respective data processing.

You can consent to the use of the respective categories of cookies individually; you can change the consent you have given in each case in the cookie banner or revoke it from us at any time.

5.

Links to other websites

Our website may contain links to other websites. We have no influence on whether their operators comply with data protection regulations. We also have no influence on the legality of the content of these websites. Therefore, we reject any responsibility for the contents of other websites.

For questions, suggestions or comments on the subject of data protection, please send an e-mail to info-slamde@swisslife-am.com. The rapid development of new internet technologies makes it necessary to adapt our data protection declaration from time to time.