- Who is responsible for data processing (controller) and who can I contact?
- On what legal basis and for what purposes are the data processed/stored?
- What data are necessary?
- How do we obtain your data?
- Disclosure of data to third parties
- What are my data protection rights?
- Are you required to transmit data to the Versorgungswerk?
- How long will your data be stored?
- Will data be transferred to a third country?
- Is profiling conducted?
- Is correspondence by e‑mail possible?
- Are data processed when the website is accessed?
- Processing of personal data in the ABV Portal (EESSI) pursuant to Article 26(2) GDPR
I. Who is responsible for data processing (controller) and who can I contact?
The controller is:
Düsternbrooker Weg 75, 24105 Kiel, Germany
Our data protection officer (DPO) can be contacted at:
compolicy GmbH, Dr. Christian Wolff
An den Eichen 15, 24248 Mönkeberg, Germany
II. On what legal basis and for what purposes are the data processed/stored?
The Versorgungswerk manages and administers retirement, surviving dependants and disability insurance for members of the profession. To this end, the Versorgungswerk processes personal data in accordance with the provisions of the EU General Data Protection Regulation (GDPR). Processing is carried out to comply with a legal obligation to which the Versorgungswerk is subject and is necessary for the performance of a task carried out in the public interest. In addition to the GDPR, the German Federal Data Protection Act (Bundesdatenschutzgesetz, “BDSG”), state data protection legislation and the Schleswig-Holstein Act on Professional Societies in the Health Care Sector (Heilberufekammergesetz Schleswig-Holstein), the Articles of Incorporation of the Versorgungswerk, as well as other specialised legislation, such as volumes II, III, V, VI of the German Social Security Code (Sozialgesetzbuch), the German Act on the Apportionment of Pension Entitlements on Divorce (Versorgungsausgleichsgesetz), the German Administrative Proceedings Act (Verwaltungs-verfahrensgesetz) and the German Act on the Enforcement of Administrative Orders (Ver-waltungsvollstreckungsgesetz) serve as the legal basis for processing.
To the extent that you have given consent to processing personal data for specific purposes (such as rolling over contributions to another occupational pension fund), processing is lawful on the basis of that consent.
III. What data are necessary?
All the data relevant to your pension are processed in your member file. In addition to personal data such as your name, place of birth, date of birth and marital status, these also include your address, member number, data on your earnings from self-employed activity and on wages and employers, data on family members/surviving dependants, periods of unemployment and illness, and data on attachments and proceedings to apportion pension entitlements. Periods of membership in other pension funds and other data comparable to the specified categories are also of relevance in the individual case.
Data concerning health may also be relevant, for instance, if you apply for rehabilitation measures or a disability pension.
IV. How do we obtain your data?
We obtain data from you when, for example, you notify us of a change of name or address or when you submit applications by completing forms and submitting the required documents, including via the Apothekerkammer Schleswig-Holstein.
In addition, employers, employment offices and health insurers, for example, report periods during which you are employed, unemployed or sick. These data will be posted to your mem-ber account. We also receive data from, for example, courts, insolvency administrators and other public agencies.
V. Disclosure of data to third parties
As a rule, the data you send to us are intended solely for the Versorgungswerk. However, in some cases, other agencies or persons may require the data as well. .
Generally speaking, we are not permitted to disclose your data to third parties. Disclosure is permitted only if you have consented to this in writing or the transfer of data is expressly prescribed by law. This is the case, for example, with respect to other pension insurers, employment offices and statutory health insurers, other service providers bound by data confidentiality (e.g., website operators, postal service, printers) or with respect to police authorities and courts.
The Versorgungswerk is also required by law, for example, to report pension data to the revenue authority in the context of a so-called “pension notification procedure” (Rentenbe-zugsmitteilungsverfahren). Notifications must be made irrespective of any obligation you may have to file a tax return.
Special requirements for medical data
Medical data such as expert opinions or reports of medical findings are among the most sensitive types of personal data. We are not permitted to transfer such data without your consent.
You may object to the disclosure of medical data at any time without stating reasons. If you object, no medical data may be disclosed without your knowledge and consent. However, in some cases this may mean that you lose or will not be paid benefits due to a failure to cooperate.
VI. What are my data protection rights?
You have the right to access all data stored about you free of charge (Article 15 GDPR), the right to rectification (Article 16 GDPR), the right to erasure (Article 17 GDPR), the right to restriction of processing (Article 18 GDPR) and the right to object (Article 21 GDPR). The right to data portability under Article 20 GDPR is excluded pursuant to Article 20(3) GDPR because the processing of your data is necessary for the performance of a task carried out in the public interest.
Should you determine that your stored data are incorrect, we will rectify them. As soon as we receive proof thereof, we will remove the incorrect data or replace them with correct data. Any incomplete data will be completed by us.
In specific cases, you may request us to erase your data, for example, when we no longer require the data to perform our statutory mandate. Erasure may not be requested if further processing is necessary for compliance with our legal obligations. This would be the case in particular with statutory retention obligations. The right to erasure of personal data would not apply where the aforementioned purposes of processing are still current or the Versorgungswerk is required to retain the data by law.
You may withdraw any consent given to the Versorgungswerk to process your personal data at any time. The foregoing also applies to the withdrawal of consent given prior to the GDPR’s entry into force, i.e., prior to 25 May 2018. Please note that the withdrawal of consent shall have prospective effect; it shall not affect the lawfulness of processing based on consent before its withdrawal.
You also have the right to lodge a complaint with the data protection supervisory authorities (Article 77 GDPR).
VII. Are you required to transmit data to the Versorgungswerk?
In order to manage the Versorgungswerk to your satisfaction, we need your cooperation. Within the scope of the purposes specified under section II and based on the legal bases specified therein, you are required to transfer the necessary data to the Versorgungswerk. Absent this information, it will not be possible to calculate your pension in the correct manner and amount. You could suffer a loss in pension benefits.
VIII. How long will your data be stored?
Your data will be stored and processed within the scope of our statutory mandate for as long as is necessary to correctly process your pension benefits and, any pension benefits paid to your surviving dependants.
The data stored by us will be erased as soon as they are no longer necessary for their intended purpose and provided that their erasure does not conflict with any statutory retention obligations. If your data are not erased because they are necessary for other lawful purposes, their processing will be restricted, meaning that they will be blocked and not processed for other purposes. This applies, for example, to data that must be retained for regulatory or tax purposes.
IX. Will data be transferred to a third country?
Generally speaking, data will not be transferred to agencies in states outside the European Union. Data transfers may become relevant in the event that you have completed pension insurance periods in Switzerland and these periods are to be taken into account in a pension application procedure within the scope of coordinating social security systems under Regulation (EU) No 883/2004. The transfer is permissible because the EU Commission already decided under the old legislation (Article 25(6) of the Data Protection Directive) that Switzerland ensures an adequate level of data protection. This adequacy decision also applies under the GDPR.
The Versorgungswerk does not transfer any personal data to agencies in third countries or to any international organisations either. Transfers are only possible in the event of a statutory obligation or subject to your consent.
X. Is profiling conducted?
Processing aimed at evaluating specific personal aspects of your data (profiling) is not carried out. Your browsing habits are not analysed.
XI. Is correspondence by e‑mail possible?
You may send correspondence to the Versorgungswerk by e‑mail. Please note that this method of communication is not completely secure, and unauthorised third parties could, for instance, manipulate the sender or recipient addresses or the content of the e‑mail.
For data protection reasons, the Versorgungswerk will respond to you by post or, subject to your consent, by (encrypted) e‑mail.
Certain transactions will still require your signature.
XII. Are data processed when the website is accessed?
Whenever you visit our website, our system automatically collects data and information from the requesting PC. Information is collected on the browser type and version used, the user’s operating system, browser ID and IP address, the date and time of access, the websites from which the user’s system accesses our website, and websites accessed by the user’s system via our website.
The temporary storage of the IP address by the system is necessary to send the website to the user’s computer. The user’s IP address has to be stored for the duration of the session. The legal basis for temporary storage is Article 6(1)(f) GDPR. The website’s deployment data will be deleted at the end of the session.
In order to ensure the protection of personal data, our website operator does not use any cookies. In addition, the IP address and browser ID are stored in anonymised form so that the identity of individual visitors cannot be determined. The data are not analysed or otherwise used or disclosed to third parties.
Technical cookies may be used on the Versorgungswerk’s website. These are not stored on the user’s terminal device and serve merely to ensure the smooth operation of the website. Cookies may be used on linked web pages. Please refer to the privacy policies for those websites. You may configure your browser settings to disallow all cookies or present you with a prompt window to inform you in advance when cookies are saved. Cookies that have already been saved may be deleted at any time. The Versorgungswerk does not use any technologies to track the way users access the website.
XIII. Processing of personal data in the ABV Portal (EESSI) pursuant to Article 26(2) GDPR
Information pursuant to Article 26(2) sentence 2 GDPR concerning joint control when processing personal data collected in the ABV Portal, specifically with regard to the use of EESSI
In accordance with Regulation (EC) No 883/2004 on the coordination of social security systems and Regulation (EC) No 987/2009, Apothekerversorgung Schleswig-Holstein (Pharmacists’ Pension Fund of Schleswig-Holstein), Düsternbrooker Weg 75, 24105 Kiel (hereinafter the “Apothekerversorgung”) and Arbeitsgemeinschaft berufsständischer Versorgungsein-richtungen e. V., Luisenstraße 17, 10117 Berlin (Arbeitsgemeinschaft Berufsständischer Versorgungseinrichtungen (Consortium of Professional Association Pension Schemes), hereinafter “ABV”) are required to participate in the Europe-wide Electronic Exchange of Social Security Information (“EESSI”).
In practice, ABV and the relevant occupational pension funds will jointly process the data collected by the electronic portal made available and operated by ABV and forward that data via the existing EESSI infrastructure. In addition, the portal is intended to facilitate a general exchange of data between the relevant occupational pension funds and ABV, as well as between the occupational pension funds inter se.
In this context, Apothekerversorgung and ABV will process the personal data of members of the Apothekerversorgung in particular as joint controllers within the meaning of Article 26 GDPR. In light of their responsibility for processing personal data as joint controllers, ABV and the Apothekerversorgung have entered into an agreement.
According to the terms of that agreement, ABV is responsible for processing personal data to the extent that data relates to the operation of the portal and the use of the EESSI RINA (Reference Implementation for National Application) software for the purpose of processing the data transmitted by the relevant occupational pension funds via the portal and vice-versa for the purpose of forwarding the data received via RINA to the relevant occupational pension funds. Apothekerversorgung is responsible for processing personal data to the extent that data relates to the uploading, downloading and transmission of data via the portal.
In their function as joint controllers, Apothekerversorgung and ABV have also agreed in particular on which of them shall satisfy which obligations set out in the GDPR. This relates in particular to safeguarding the rights of data subjects and satisfaction of duties to provide information pursuant to Article 13 and Article 14 GDPR.
Furthermore, Apothekerversorgung and ABV have stipulated that they would make public which information is required by Articles 13 and 14 GDPR with regard to the data processing by joint controllers as well as the material substance of the agreement.
Data protection rights may be asserted against both Apothekerversorgung as well as ABV. Requests will be processed by the respective responsible controller. The controllers will notify and support each other where necessary. Data subjects will receive notification from the controller which is wholly or partially responsible for the processing operation concerned. If both controllers are responsible in equal measure, ABV will process the request.
Last updated: April 2021