This data protection notice addresses participants in DZ BANK's internal and external events, which are photographed and/or filmed or which may be  sound recorded. This notice also addresses our staff, who we photograph or film in connection with their work at DZ BANK.
 
 
1 Who is responsible for data processing and who can you contact?

Controller:
DZ BANK AG
Deutsche Zentral-Genossenschaftsbank, Frankfurt am Main
(“DZ BANK”)

Platz der Republik
60325 Frankfurt am Main
telephone: +49 69 7447-01
fax: +49 69 7447-1685
e-mail: mail@dzbank.de

You can contact our data protection officer at the same address at the bottomor via
telephone: +49 69 7447-94101
fax: +49 69 427267-0539
e-mail: datenschutz@dzbank.de

2 What sources and data does DZ BANK use?

On certain occasions, DZ BANK may make photographic, film and sound recordings; usually undertaken by the bank itself or by specialised service providers (e.g. photographers). If data subjects are photographed, filmed or audio recorded, DZ BANK usually stores their names and contact data, their professional roles and the occasion at which they were recorded. Specific reasons for recordings are, for example, audio-visual recording of a speaker at a conference.

3 For what purpose does DZ BANK process your data and on what legal grounds?

The purpose of photographic, film and audio recordings is to provide information and communication about people and events relating to the business purposes of DZ BANK. Regardless of time and/or location, those recordings shall be accessible for professionals, customers, staff and stakeholders in DZ BANK and in our products and services. In connection with DZ BANK’s art collection, recordings may also be processed to produce and publish data (records) for an exhibition.

The following grounds serve as the legal basis for the processing of your personal data:

• Your consent (Art. 6 para. 1 a GDPR): e.g. for photographic and film recordings of staff for use in internal and external media (e.g. website or printed material).
• Contractual agreement with DZ BANK (Art. 6 para. 1 b GDPR): e.g. for photographic and film recordings where you appear as a speaker, moderator or trainer or, in the case of expensive productions for external media applications (e.g. website or printed material).
• If DZ BANK has a legitimate interest, provided this does not outweigh the data subject's interests in protecting their personal data (Art. 6 para. 1 a GDPR), such as when recording at events (annual general meeting, receptions, tours, etc.) at which you are part of a group or a larger number of people. Our main reason for invoking a legitimate interest is usually our need to record our company's events, particularly if they are important events in the company’s history. When publishing records in connection with DZ BANK's art collection, we are also helping to boost the profile of the artists involved and in so doing, we are acting in the interests of third parties.

4 Who receives your data?

For the purposes mentioned above, records may particularly be published in the following print and online media, internet profiles belonging to DZ BANK AG or social media platforms:

• DZ BANK AG's online profiles, such as www.dzbank.de/.com and other internet profiles belonging to DZ BANK AG, as well as social media profiles, such as www.facebook.com/dzbank, www.instagram.com/dz_bank, www.twitter.com/dzbank, www.youtube.com/user/DZBANKAG and other social media profiles of DZ BANK AG). Potential recipient is, as a result, anyone with internet access.
• On DZ BANK AG's intranet, GENOwiki and the VR Banks' portal. Potential recipients are employees of DZ BANK, of companies of the Genossenschaftliche FinanzGruppe (GFG) and all external staff with access to GFG's networks.
• In DZ BANK's magazines and brochures, such as annual reports, sustainability reports, DEZETT staff magazine and other DZ BANK AG print publications). These may also be distributed worldwide.

5 Is data transferred to a third country or an international organisation?

We do not normally knowingly send recordings and other data to third countries, i.e. those outside the EU. Records that have been published on the internet can be downloaded by anyone with internet access, which includes countries, which have no data protection law comparable with the EU and where the confidentiality and integrity (inviolability) of personal data is not guaranteed.

6 For how long is your data stored?
The storage period for the data depends on the purpose for which the recording was made. We keep recordings of events for as long as seems reasonable given the importance of the event. For important events in our company’s history, such as those honouring long-serving directors, founding subsidiaries, etc., we do not normally decide when we will delete them in advance, as they will always be of interest to us. If we only keep records based on consent, we will cease using your data from the time at which consent is withdrawn.

7 What rights do you have as a data subject?
Every data subject has a right of access in accordance with Article 15 of the GDPR, a right to rectification in accordance with Article 16 of the GDPR, a right to erasure (“right to be forgotten”) in accordance with Article 17 of the GDPR, a right to restriction of processing in accordance with Article 18 of the GDPR, a right to data portability in accordance with Article 20 of the GDPR, a right to object in accordance with Article 21 of the GDPR (specific information provided later on in this data protection notice). You also have the right to lodge a complaint with a supervisory data protection authority in accordance with Article 77 of the GDPR.

If you give DZ Bank your consent to process your personal data for specific purposes, you can withdraw your consent for the future at any time. The withdrawal of consent does not affect the lawfulness of processing performed by DZ BANK based on consent before its withdrawal.

8 Are you obliged to provide your data?

You are only obliged to provide photographic, film or audio recordings if these were produced under contract, e.g. in commercial presentations on advertising media, speakers booked at an event.

9 Information regarding your right to object under Article 21 of the GDPR

9.1 Right to object on a case-by-case basis

At any time, you have the right to object to the processing of your personal data on grounds relating to your particular situation under Art. 6 para. 1 f GDPR (data processing based on legitimate interest of DZ BANK).

If you object, we will no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms or the processing is for the purpose of establishment, exercise or defence of legal claims.

9.2 Right to object to processing data for advertising purposes

In some cases, DZ BANK uses your personal data for direct advertising purposes. You have the right to object to your data being processed in this way at any time. This also includes profiling insofar as it relates to such direct advertising.

9.3 Objection

Objections may be made via any of the contact channels detailed above. There are no formal requirements for submitting objections.

10 Updates

We modify and/or update this data protection notice, particularly in response to new technological developments, in response to amended statutory and/or official requirements and organisational changes. These modifications and/or updates are posted on our website at www.dzbank.com/dataprotection. Upon request, we provide our current data protection notices as a file (PDF) or on paper, but we recommend you always refer to our website for the most recent updates. If any changes are made, we will always check if we are required to inform you of them proactively and, should this be the case, we will fulfil our obligation to do so. Otherwise, we will only replace files or printouts with the latest versions if this is something that you have requested.

As at: 01.03.2019