DATA PROTECTION NOTICE: PHOTOGRAPHIC, FILM AND AUDIO RECORDINGS

As at: 01.03.2019

This data protection notice informs you about who is responsible for video surveillance, the purposes for which video surveillance is carried out, and which rights you have with respect to video surveillance in your capacity as the data subject.


1 Who is responsible for the data processing and who can you contact?

Controller:

DZ BANK AG
Deutsche Zentral-Genossenschaftsbank, Frankfurt am Main
(“DZ BANK”)

Platz der Republik
60325 Frankfurt am Main
Germany
telephone: +49 69 7447-01
fax: +49 69 7447-1685
e-mail: mail@dzbank.de

You can contact our
data protection officer
at the same address at the left

or via
telephone: +49 69 7447-94101
fax: +49 69 427267-0539
e-mail: datenschutz@dzbank.de
 

2 What sources and data does DZ BANK use?

DZ BANK uses video surveillance (live streams) to monitor security-relevant areas inside and outside its buildings and premises. In a few cases, videos are also recorded.
Several cameras have been installed as part of a “virtual patrol” of the building concerned in the framework of DZ BANK’s general security concept. This enables the outer facade of the building, as well as its immediate vicinity, to be assessed quickly at all times, without endangering the company’s own personnel. In doing so, public spaces are principally not subjected to general video surveillance.
As soon as you enter an area covered by camera surveillance, you become the subject of this data processing.


3 For what purpose does DZ BANK process your data and on what legal grounds?

DZ BANK has a legitimate interest in using video surveillance (point (f) of Article 6 (1) GDPR. It contributes significantly towards ensuring the most comprehensive security possible for its buildings and personnel in a way that both saves on, and protects the wellbeing of, its staff.
Depending on the prevailing circumstances of the locations concerned, we use the video surveillance to pursue the following goals:
• to secure the outer facade of the building against vandalism
• to perform the (necessary) monitoring of alarm-protected doors
• to detect illegal attempts to enter our premises
• to recognise blocked emergency exits
Video surveillance allows counter-measures to be taken immediately in order to remedy defects in the above-mentioned points. They not only serve to protect our buildings, but also your own personal safety and security.
Local or national regulations which are in force at some of DZ BANK’s operating locations may also stipulate mandatory video surveillance of specific areas. The legal basis for such surveillance would then be, additionally to DZ BANK’s legitimate interest, a legal obligation in accordance with point (c) of Article 6 (1) GDPR.


4 Who receives your data?

Video data are only evaluated where required. DZ BANK may charge external service providers with evaluating the video surveillance. These then receive, in addition to the live streams, also access to recordings of the video cameras in their respective, contractually defined area of responsibility.
For infringements of house rules, perpetrations of criminal offences, and where legal guidelines so require, the recordings may, or must, be handed over to the law enforcement authorities.


5 For how long is your data stored?

Video material is not generally recorded or stored.
Where recordings are made – namely in connection with a specific event, recordings triggered by an alarm, or continuous recordings – they will be erased after the deadlines specifically defined for the location concerned, unless they are needed in the context of investigative proceedings. The erasure deadlines are possibly determined by national legal requirements. For locations in Germany, a standard erasure deadline of ten days applies.


6 What rights do you have as a data subject?

Every data subject has a right of access in accordance with Article 15 of the GDPR, a right to rectification in accord-ance with Article 16 of the GDPR, a right to erasure (“right to be forgotten”) in accordance with Article 17 of the GDPR, a right to restriction of processing in accordance with Article 18 of the GDPR, a right to data portability in accordance with Article 20 of the GDPR, a right to object in accordance with Article 21 of the GDPR (specific information provided later on in this data protection notice). You also have the right to lodge a complaint with a supervi-sory data protection authority in accordance with Article 77 of the GDPR.


7 Are you obliged to provide your data?

The data are provided when you enter an area covered by video surveillance facilities.
At places where DZ BANK employs video surveillance, this will be indicated by appropriate signage.
In areas in which video surveillance is required by law, we have no means of allowing you to reside in these areas without you disclosing your data (video surveillance) – even at your express wish. In all other areas, video surveillance may be waived, provided that you state your legitimate reasons (objection) to us beforehand, and provided that we are unable to provide any compelling legitimate reasons for the processing which outweigh your own interests, rights and freedoms (balancing of interests).


8 Information regarding your right to object under Article 21 of the GDPR

8.1 Right to object on a case-by-case basis
You have the right to object at any time on grounds relating to your particular situation to processing of personal data concerning you which is based on point (f) of Article 6(1) of the GDPR (processing of data based on a legitimate interest).
If you object, we will no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms or the processing is for the purpose of establishment, exercise or defence of legal claims.

8.2 Objection
Objections may be made via any of the contact channels detailed above. There are no formal requirements for submitting objections.

9 Updates
We modify and/or update this data protection notice, particularly in response to new technological developments, in response to amended statutory and/or official requirements and organisational changes. These modifications and/or updates are posted on our website at www.dzbank.com/dataprotection. Upon request, we provide our current data protection notices as a file (PDF) or on paper, but we recommend you always refer to our website for the most recent updates. If any changes are made, we will always check if we are required to inform you of them proactively and, should this be the case, we will fulfil our obligation to do so. Otherwise, we will only replace files or printouts with the latest versions if this is something that you have requested.
 

This data protection notice addresses participants in DZ BANK's internal and external events, which are photographed and/or filmed or which may be sound recorded. This notice also addresses our staff, who we photograph or film in connection with their work at DZ BANK.



1 Who is responsible for data processing and who can you contact?

Controller:

DZ BANK AG
Deutsche Zentral-Genossenschaftsbank, Frankfurt am Main
(DZ BANK)

Platz der Republik
60325 Frankfurt am Main
telephone.: +49 69 7447-01
fax: +49 69 7447-1685
e-mail: mail@dzbank.de

You can contact our
data protection officer at
the same address at the left (DZ BANK AG)

or via
telephone: +49 69 7447-94101
fax: +49 69 427267-0539
e-mail: datenschutz@dzbank.de
 

2 What sources and data does DZ BANK use?

On certain occasions, DZ BANK may make photographic, film and sound recordings; usually undertaken by the bank itself or by specialised service providers (e.g. photographers). If data subjects are photographed, filmed or audio recorded, DZ BANK usually stores their names and contact data, their professional roles and the occasion at which they were recorded. Specific reasons for recordings are, for example, audio-visual recording of a speaker at a conference.


3 For what purpose does DZ BANK process your data and on what legal grounds?

The purpose of photographic, film and audio recordings is to provide information and communication about people and events relating to the business purposes of DZ BANK. Regardless of time and/or location, those recordings shall be accessible for professionals, customers, staff and stakeholders in DZ BANK and in our products and services. In connection with DZ BANK’s art collection, recordings may also be processed to produce and publish data (records) for an exhibition.
The following grounds serve as the legal basis for the processing of your personal data:
• Your consent (Art. 6 para. 1 a GDPR): e.g. for photographic and film recordings of staff for use in internal and external media (e.g. website or printed material).
• Contractual agreement with DZ BANK (Art. 6 para. 1 b GDPR): e.g. for photographic and film recordings where you appear as a speaker, moderator or trainer or, in the case of expensive productions for external media applications (e.g. website or printed material).
• If DZ BANK has a legitimate interest, provided this does not outweigh the data subject's interests in protecting their personal data (Art. 6 para. 1 a GDPR), such as when recording at events (annual general meeting, receptions, tours, etc.) at which you are part of a group or a larger number of people. Our main reason for invoking a legitimate interest is usually our need to record our company's events, particularly if they are important events in the company’s history. When publishing records in connection with DZ BANK's art collection, we are also helping to boost the profile of the artists involved and in so doing, we are acting in the interests of third parties.


4 Who receives your data?

For the purposes mentioned above, records may particularly be published in the following print and online media, internet profiles belonging to DZ BANK AG or social media platforms:
• DZ BANK AG's online profiles, such as www.dzbank.de/.com and other internet profiles belonging to DZ BANK AG, as well as social media profiles, such as www.facebook.com/dzbank, www.instagram.com/dz_bank, www.twitter.com/dzbank, www.youtube.com/user/DZBANKAG and other social media profiles of DZ BANK AG). Potential recipient is, as a result, anyone with internet access.
• On DZ BANK AG's intranet, GENOwiki and the VR Banks' portal. Potential recipients are employees of DZ BANK, of companies of the Genossenschaftliche FinanzGruppe (GFG) and all external staff with access to GFG's networks.
• In DZ BANK's magazines and brochures, such as annual reports, sustainability reports, DEZETT staff magazine and other DZ BANK AG print publications). These may also be distributed worldwide.


5 Is data transferred to a third country or an international organisation?

We do not normally knowingly send recordings and other data to third countries, i.e. those outside the EU. Records that have been published on the internet can be downloaded by anyone with internet access, which includes countries, which have no data protection law comparable with the EU and where the confidentiality and integrity (inviolability) of personal data is not guaranteed.


6 For how long is your data stored?

The storage period for the data depends on the purpose for which the recording was made. We keep recordings of events for as long as seems reasonable given the importance of the event. For important events in our company’s history, such as those honouring long-serving directors, founding subsidiaries, etc., we do not normally decide when we will delete them in advance, as they will always be of interest to us. If we only keep records based on consent, we will cease using your data from the time at which consent is withdrawn.


7 What rights do you have as a data subject?

Every data subject has a right of access in accordance with Article 15 of the GDPR, a right to rectification in accordance with Article 16 of the GDPR, a right to erasure (“right to be forgotten”) in accordance with Article 17 of the GDPR, a right to restriction of processing in accordance with Article 18 of the GDPR, a right to data portability in accordance with Article 20 of the GDPR, a right to object in accordance with Article 21 of the GDPR (specific information provided later on in this data protection notice). You also have the right to lodge a complaint with a supervisory data protection authority in accordance with Article 77 of the GDPR.
If you give DZ Bank your consent to process your personal data for specific purposes, you can withdraw your consent for the future at any time. The withdrawal of consent does not affect the lawfulness of processing performed by DZ BANK based on consent before its withdrawal.


8 Are you obliged to provide your data?

You are only obliged to provide photographic, film or audio recordings if these were produced under contract, e.g. in commercial presentations on advertising media, speakers booked at an event.


9 Information regarding your right to object under Article 21 of the GDPR

9.1 Right to object on a case-by-case basis
At any time, you have the right to object to the processing of your personal data on grounds relating to your particular situation under Art. 6 para. 1 f GDPR (data processing based on legitimate interest of DZ BANK).
If you object, we will no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms or the processing is for the purpose of establishment, exercise or defence of legal claims.

9.2 Right to object to processing data for advertising purposes
In some cases, DZ BANK uses your personal data for direct advertising purposes. You have the right to object to your data being processed in this way at any time. This also includes profiling insofar as it relates to such direct advertising.

9.3 Objection

Objections may be made via any of the contact channels detailed above. There are no formal requirements for submitting objections.


10 Updates
We modify and/or update this data protection notice, particularly in response to new technological developments, in response to amended statutory and/or official requirements and organisational changes. These modifications and/or updates are posted on our website at www.dzbank.com/dataprotection. Upon request, we provide our current data protection notices as a file (PDF) or on paper, but we recommend you always refer to our website for the most recent updates. If any changes are made, we will always check if we are required to inform you of them proactively and, should this be the case, we will fulfil our obligation to do so. Otherwise, we will only replace files or printouts with the latest versions if this is something that you have requested.