Data protection information for customers and other affected parties1
With the following information we would like to give you an overview of the processing of your personal data by us and your rights under data protection law. Which data is processed in detail and how it is used depends largely on the services requested or agreed. Therefore not all parts of this information will apply to you.
Data protection information for customers and other affected parties1
With the following information, we would like to give you an overview of the processing of your personal data by us and your rights under data protection law. Which data is processed in detail and how it is used depends largely on the services requested or agreed. Therefore not all parts of this information will apply to you.
Who is responsible for data processing and who can I contact?
Responsible is:
LeasAG Leasing Aktiengesellschaft
Karl-Geusen-Str. 173, 40231 Düsseldorf
Phone: 0211 / 730607-0
info[at]leasag[dot]de
You can reach our company data protection officer at:
LeasAG Leasing Aktiengesellschaft
Data Protection Officer
Karl-Geusen-Str. 173, 40231 Düsseldorf
Phone: 0211 / 730607-0
datenschutzbeauftragter@leasag.de
What sources and data do we use?
We process personal data that we receive from our customers or other affected parties within the scope of our business relationship. In addition, we process - to the extent necessary for the provision of our services - personal data which we obtain from publicly accessible sources (e.g. debtor directories, land registers, commercial and association registers, press, Internet) or which we are entitled to receive from other third parties (e.g. a credit agency).
Relevant personal data are personal data (name, address and other contact data, date and place of birth and nationality), identification data (e.g. ID card data) and authentication data (e.g. specimen signature). In addition, this can also include order data (e.g. SEPA mandate), data from the fulfilment of our contractual obligations (e.g. turnover data in instalment collection), information about your financial situation (e.g. creditworthiness data, scoring or rating data, origin of assets), credit and leasing relevant data (e.g. income and expenses), advertising and sales data (incl. advertising scores), documentation data (e.g. minutes of meetings) as well as other data comparable with the aforementioned categories.
What do we process your data for (purpose of processing) and on what legal basis?
We process personal data in accordance with the provisions of the EU Basic Data Protection Regulation (DSGVO) and the Federal Data Protection Act (BDSG).
a. for the fulfilment of contractual obligations (Art. 6 para. 1b DSGVO) The processing of data takes place for the provision of leasing and hire-purchase agreements and financial services within the framework of the execution of our contracts with our customers or for the execution of pre-contractual measures, which take place on request. The purposes of data processing depend primarily on the specific product (e.g. leasing or hire purchase). For further details on data processing purposes, please refer to the relevant contractual documents and terms and conditions.
b. within the framework of the weighing of interests (Art. 6 para. 1f DSGVO) If necessary, we process your data beyond the actual fulfilment of the contract to safeguard the legitimate interests of us or third parties. Examples:
- Consultation of and data exchange with credit agencies (e.g. SCHUFA) to determine creditworthiness or default risks in leasing or hire-purchase transactions,
- Review and optimisation of procedures for needs analysis in order to address customers directly,
- Advertising or market and opinion research unless you have objected to the use of your data,
- Assertion of legal claims and defence in legal disputes,
- Ensure the IT security and operation of the Bank,
- Prevention and investigation of criminal offences,
- Video surveillance for the protection of the house right, for the collection of evidence in case of robberies or fraud,
- Measures for building and plant security (e.g. access controls),
- Measures to secure the householder's title,
- Measures for business management and further development of services and controls
- Risk control within LeasAG
Privacy policy for customers and other concerned parties
c. on the basis of your consent (Art. 6 para. 1a DSGVO)
If you have given us your consent to the processing of personal data for certain purposes (e.g. passing on data to refinancing banks, evaluation of data for marketing purposes, photographs as part of events, newsletter dispatch), the legality of this processing is given on the basis of your consent. Your consent can be revoked at any time. This also applies to the revocation of declarations of consent given to us before the DSGVO came into force, i.e. before 25 May 2018. The revocation of a consent only takes effect for the future and does not affect the legality of the data processed until the revocation.
d. due to legal requirements (Art. 6 para. 1c DSGVO) or in the public interest (Art. 6 para. 1e DSGVO).
In addition, as a leasing company we are subject to various legal obligations, i.e. legal requirements (e.g. German Banking Act, Money Laundering Act, Securities Trading Act, Tax Acts) as well as banking supervisory requirements (e.g. German Federal Bank and Federal Financial Supervisory Authority). The purposes of processing include, among other things, creditworthiness checks, identity and age checks, fraud and money laundering prevention, compliance with tax control and reporting obligations as well as the assessment and management of risks in our company.
Who receives my data?
Within our company, those entities that need your data to fulfil our contractual obligations will have access to it. Service providers and vicarious agents employed by us may also receive data for these purposes if they, in particular, maintain banking secrecy. These are companies in the categories of banking services, IT services, logistics, printing services, telecommunications, debt collection, consulting as well as sales and marketing.
With regard to the transfer of data to recipients outside our company, it should first be noted that as a leasing company we are obliged to maintain secrecy regarding all customer-related facts and valuations of which we gain knowledge. We may only pass on information about our customers if this is required by law, if the customer has consented or if we are authorised to provide information. Under these conditions, recipients of personal data may be, for example:
- Bodies and institutions (e.g. Deutsche Bundesbank, Bundesanstalt für Finanzdienstleistungsaufsicht, tax authorities, criminal prosecution authorities, courts) where there is a legal or official obligation.
- Other credit and financial service institutions or comparable institutions to which we transfer personal data for the purpose of conducting our business relationship with you (refinancing banks, credit agencies).
- Creditors or insolvency administrators who inquire in the context of a levy of execution
- Third parties who may be involved in the lending process (e.g. insurance companies, trustees, service providers who carry out valuations).
- Other data recipients may be those entities for which you have given us your consent to the transfer of data or to which we are authorised to transfer personal data on the basis of a weighing of interests.
Is data transferred to a third country or to an international organisation?
Data is transferred to offices in countries outside the European Union (so-called third countries) if it is required by law (e.g. tax reporting obligations) or you have given us your consent.
Furthermore, we do not intend to transfer your personal data to third parties.
With the consent of the person concerned or on the basis of legal regulations to combat money laundering, terrorist financing and other criminal acts as well as within the framework of a weighing of interests, in individual cases personal data (e.g. legitimation data) will be transmitted in compliance with the data protection level of the European Union.
How long will my data be stored?
We process and store your personal data as long as this is necessary for the fulfilment of our contractual and legal obligations. It should be noted that our business relationship is a continuing obligation which is intended to last for years.
If the data are no longer required for the fulfilment of contractual or statutory obligations, they are regularly deleted, unless their further processing - for a limited period - is necessary for the following purposes:
- Fulfilment of commercial and tax retention obligations, which may arise, for example, from the German Commercial Code (HGB), the Fiscal Code (AO), the Banking Act (KWG) and the Money Laundering Act (GWG). The periods for storage and documentation specified there are usually two to ten years.
- Preservation of evidence within the framework of the statutory statute of limitations. According to §§195ff of the German Civil Code (BGB), these statutes of limitations can be up to 30 years, whereby the regular statute of limitations is 3 years.
What data protection rights do I have?
Every data subject has the right to information pursuant to Article 15 DSGVO, the right to rectification pursuant to Article 16 DSGVO, the right to deletion pursuant to Article 17 DSGVO, the right to restriction of processing pursuant to Article 18 DSGVO, the right to objection pursuant to Article 21 DSGVO and the right to data transfer pursuant to Article 20 DSGVO. The restrictions under §§ 34 and 35 BDSG apply to the right to information and the right to cancellation. In addition, there is a right of appeal to a competent data protection supervisory authority (Article 77 DSGVO in conjunction with § 19 BDSG).
You can revoke your consent to the processing of personal data at any time. This also applies to the revocation of declarations of consent given to us before the DSGVO came into force, i.e. before 25 May 2018. Please note that the revocation will only take effect in the future. Processing that took place before the revocation is not affected by this.
Is there an obligation for me to provide data?
As part of our business relationship, you must provide us with the personal data that we require to establish, conduct and terminate a business relationship and to fulfil the associated contractual obligations, or which we are legally obliged to collect. Without this information, we will generally not be able to enter into, execute and terminate a contract with you.
In particular, we are required by money laundering regulations to identify you on the basis of your identification document before establishing a business relationship and to collect and record your name, place of birth, date of birth, nationality, address and identification data. To enable us to comply with this legal obligation, you must provide us with the necessary information and documents in accordance with the Money Laundering Act and notify us immediately of any changes arising in the course of the business relationship. If you do not provide us with the necessary information and documents, we may not establish or continue the business relationship you have requested.
To what extent is there automated decision-making?
As a matter of principle, we do not use fully automated decision-making pursuant to Article 22 DSGVO for the establishment and implementation of the business relationship. Should we use these procedures in individual cases, we will inform you of this and your rights in this regard separately, insofar as this is prescribed by law.
Does profiling take place?
We process your data automatically but not with the aim of evaluating certain personal aspects (profiling). We do not use profiling.
Information on your right of objection under Article 21 DSGVO
Right of objection in individual cases
You have the right to object at any time, for reasons related to your particular situation, to the processing of personal data concerning you carried out pursuant to Article 6(1)(e) of the Data Protection Regulation (data processing in the public interest) and Article 6(1)(f) of the Data Protection Regulation (data processing on the basis of a balancing of interests), including profiling based on this provision within the meaning of Article 4(4) of the Data Protection Regulation.
If you file an objection, we will no longer process your personal data unless we can prove compelling legitimate reasons for the processing which outweigh your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.
