Transparency statement
With the following information, we provide you with an overview of how we process your personal data and your rights under data protection law.
Who is responsible for data processing and whom can I contact?
The person responsible in terms of data protection is
Federal Association of German Leasing Companies
Linkstrasse 2
10785 Berlin
Phone: +49 30 206337-0
E-mail: bdl(at)leasingverband.de
What sources and data do we use?
We process so-called required personal data that we receive from our members and business partners in the course of our business relationships. In addition, we process - insofar as it is relevant to the provision of our services - personal data that we obtain from publicly accessible sources (e.g. commercial and association registers, press, Internet) in a permissible manner (e.g. business cards) or that are transmitted to us by other companies or third parties (e.g. a credit agency) on a justified basis.
Relevant personal data are personal details (name, address and other contact details, date and place of birth and nationality), identification data (e.g. ID card data), authentication data (e.g. specimen signature) and order data (e.g. payment order). Rather, in the case of associations, information on the political party, interest group, etc. is indispensable for the activity or statutory purpose of the BDL. Since these organizations or persons who maintain regular contacts such as the BDL in connection with their purpose of activity are referred to and disclosed, no separate consent is required in the sense of the exemption provision of Article 9(2)(d) DSGVO.
In addition, this may also be data from the fulfillment of our contractual obligations as well as other data comparable to the aforementioned categories.
What do we process your data for (purpose of processing) and on what legal basis?
We process personal data in accordance with the provisions of the EU General Data Protection Regulation (DSGVO) and the German Federal Data Protection Act (BDSG), relevant legal bases for BDL are:
a) for the fulfillment of contractual obligations (Art. 6 para. 1 lit. b) DSGVO).
The processing of data is carried out for the fulfillment of the statutory obligations between the BDL and the members and business partners. This includes all processing measures that are necessary in representing the interests of the German leasing industry.
b) Within the framework of the balancing of interests (Art. 6 para. 1 lit. f) DSGVO).
To the extent necessary, we process your data beyond the actual performance of the contract in order to protect the legitimate interests of us or third parties. For example, for consultation and data exchange with credit agencies, for the assertion of legal claims and defense in legal disputes, for the prevention or investigation of criminal acts or for business management measures.
c) Based on your consent (Art. 6 para. 1 lit. a) DSGVO).
Insofar as you give us consent to process personal data for specific purposes (e.g. to send newsletters), the lawfulness of this processing is based on your consent. Consent given can be revoked at any time. This also applies to the revocation of declarations of consent given to us before the DSGVO came into force, i.e. before May 25, 2018. The revocation of consent only takes effect for the future and does not affect the lawfulness of the data processed until the revocation.
d) Due to legal obligations (Art. 6 para. 1 lit. c) DSGVO).
Insofar as processing is necessary to comply with a legal obligation to which the controller is subject (Art. 6 para. 1 lit. c) DSGVO) e.g. general laws such as retention and storage periods or notification or reporting obligations, e.g. under the Infectious Disease Protection Act.
Who gets my data?
Within the BDL, those offices that need your data to fulfill their contractual obligations will receive access to it.
Furthermore, personal data may be passed on to other bodies for the purpose of representing your interests.
Other data recipients may be those bodies for which you have given us your consent to transfer data or for which we are authorized to transfer personal data on the basis of a balancing of interests.
Is data transferred to a third country or to an international organization?
In principle, no transfer of personal data to countries outside the European Union (so-called third countries) takes place, unless it is required by law (e.g. reporting obligations under tax law) or you have given us your consent.
If data is transferred outside the EU or if the EU Commission has not determined an adequate level of data protection at the place of processing, e.g. to Switzerland or the USA, this is based on data protection regulations pursuant to Art. 44 et seq. DSGVO, such as the conclusion of standard contractual clauses for commissioned processing or other requirements.
How long will my data be stored?
We process and store your personal data as long as this is necessary for the fulfillment of our contractual and legal obligations. If the data are no longer required for the fulfillment of the obligations, they are regularly deleted, unless their - limited - further processing is necessary for the following purposes:
- Fulfillment of retention obligations under commercial and tax law, which may result, for example, from: German Commercial Code (HGB), German Fiscal Code (AO). The periods specified there for storage or documentation are generally two to ten years.
- Preservation of evidence within the framework of the statutory limitation provisions. According to §§ 195 ff. of the German Civil Code (BGB), these limitation periods can be up to 30 years, with the regular limitation period being 3 years, calculated from the end of the year in which the business relationship ends.
What data protection rights do I have?
Every data subject has the right to information under Article 15 of the GDPR, the right to rectification under Article 16 of the GDPR, the right to erasure under Article 17 of the GDPR, the right to restriction of processing under Article 18 of the GDPR, the right to object under Article 21 of the GDPR and the right to data portability under Article 20 of the GDPR. With regard to the right to information and the right to erasure, the restrictions pursuant to Sections 34 and 35 BDSG apply. In addition, there is a right of appeal to the competent data protection supervisory authority (Article 77 DSGVO in conjunction with Section 19 BDSG).
You may revoke your consent to the processing of personal data at any time. This also applies to the revocation of declarations of consent given to us before the DSGVO came into force, i.e. before May 25, 2018. Please note that the revocation is only effective for the future. Processing that took place before the revocation is not affected.
Is there an obligation to provide data?
In the context of our business relationships, you must provide those personal data that are required for the establishment, execution and termination of a business relationship and for the fulfillment of the associated contractual obligations, or which we are required to collect by law. Without this data, we will generally not be able to conclude, execute or terminate a contract with you.
To what extent is there automated decision-making?
As a matter of principle, we do not use fully automated decision-making pursuant to Art. 22 DSGVO for the establishment and execution of business relationships. Should we use these procedures in individual cases, we will inform you separately about this and about your rights in this regard, insofar as this is required by law.
Does profiling take place?
Profiling, with the aim of evaluating certain personal aspects, does not take place through us.
Information about your right to object according to Art. 21 DSGVO
Individual right of objection
You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that is carried out on the basis of Art. 6(1)(e) DSGVO (data processing in the public interest) and Art. 6(1)(f) DSGVO (data processing based on a balance of interests). This also applies to profiling based on this provision within the meaning of Art. 4 No. 4 DSGVO.
If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves the assertion, exercise or defense of legal claims.
Recipients of the objection
The objection can be made informally with the subject "Objection", stating your name, address and date of birth, and should be addressed to:
Bundesverband Deutscher Leasing-Unternehmen e. V.
Linkstrasse 2
10785 Berlin
Phone: +49 (30) 206337-0
E-mail: bdl(at)leasingverband.de