Data protection information

Am I obliged to provide my personal data? What happens if I do not want to?

We rely on your personal data for our business relationship (bookings, answering contact inquiries). If you do not wish this, we may unfortunately not be able to provide certain services. If we only process your data on the basis of your consent, you are not obliged to give this consent and provide the data.

To whom will my personal data be passed on?

Your personal data may be forwarded to:

• Processors commissioned by us and other service providers (controllers), e.g. for IT, back office, legal and tax advice, insofar as they require the data for their task.
• third parties, insofar as this is mandatory for the fulfillment of the contract or legal regulations.
• validation services such as Rundfunk und Telekom Regulierungs-GmbH, if this is necessary to verify an electronic signature or electronic seal transmitted by you
• Trust service providers, e.g. A-Trust, when we electronically sign a document containing your data.

Data may also be passed on to third parties if and for as long as you have consented to this.

Will my personal data be transferred to a third country?

Your personal data may be transferred to a third country in the following cases:

• If this is necessary in order to assert, exercise or defend legal claims or if there is a legal obligation, e.g. at the request of the authorities under a mutual legal assistance agreement.
• If it is necessary for your contract or for pre-contractual measures.
• Our processors and sub-processors may be located in third countries. If the transfer is not based on an adequacy decision of the European Commission, we transfer the data on the basis of suitable or appropriate guarantees. We will be happy to provide you with these on request.
• In other cases in which data is transferred to a third country, you will be informed separately.

How long will my personal data be stored?

(All links as of September 2024)

Your personal data will be stored for as long as is necessary for the respective purpose, for example if a law prescribes storage.

The key legal provisions for us are, for example

• German Commercial Code § 212 (7 years)
• Federal Fiscal Code § 132 (7 years or for the duration of tax proceedings)

An overview of other statutory retention obligations applicable in Austria can be found here, for example:

https://www.wko.at/service/wirtschaftsrecht-gewerberecht/eu-dsgvo-speicher-und-aufbewahrungsfristen.html

The Bank has a legitimate interest in retaining your personal data in the following cases:

• Financing applications can be stored for up to one year after they have been created. This serves our legitimate interest in documenting customer contact and being able to process the application quickly when you come back to us.
• SWIFT messages are stored for 30 years to prevent and combat fraud and to prevent money laundering and terrorist financing.
• Data on receivables sold is retained for 30 years from the date of sale. This serves the bank’s legitimate interest in averting possible objections arising from the sale of receivables.
• Your personal data may also be retained for the purpose of documenting past claims, as a decision-making aid for entering into new or extended customer relationships. Specifically:
  • 7 years in the event of a claim if
    • the amount of loss at the time the case was closed was a maximum of 20,000 euros or
    • there is otherwise no interest in a business relationship due to special circumstances
  • 12 years in the event of a claim if
    • the amount of loss was more than 20,000 euros when the case was closed or
    • insolvency proceedings were opened against your assets during our ongoing business relationship.
  • 30 years in particularly serious exceptional cases after detailed examination of the individual case.

The retention period begins when the claim has been closed, i.e. as soon as there is no longer a debt/claim or insolvency proceedings have been terminated or lifted. In addition, data on past claims must be retained for regulatory purposes, e.g. the data is also used for our model for calculating defaults. However, only a limited group of people have access to this data. It is no longer visible to customer advisors. The data also has no effect on an existing or future business relationship.