Pri­va­cy pol­i­cy and data pro­tec­tion infor­ma­tion for members

The Ver­sorgungswerk (Pen­sion Fund) main­tains, among oth­er things, a mem­ber file and a mem­ber account for you in which we process all the data that will lat­er be impor­tant for your pen­sion. Your pen­sion can only be cal­cu­lat­ed accu­rate­ly if these data are com­plete. This pri­va­cy pol­i­cy explains why we require your data, how they are pro­tect­ed and what your rights are.

Overview

  1. Who is respon­si­ble for data pro­cess­ing (con­troller) and who can I contact?
  2. On what legal basis and for what pur­pos­es are the data processed/stored?
  3. What data are necessary?
  4. How do we obtain your data?
  5. Dis­clo­sure of data to third parties
  6. What are my data pro­tec­tion rights?
  7. Are you required to trans­mit data to the Versorgungswerk?
  8. How long will your data be stored?
  9. Will data be trans­ferred to a third country?
  10. Is pro­fil­ing conducted?
  11. Is cor­re­spon­dence by e‑mail possible?
  12. Are data processed when the web­site is accessed?
  13. Pro­cess­ing of per­son­al data in the ABV Por­tal (EESSI) pur­suant to Arti­cle 26(2) GDPR

I. Who is respon­si­ble for data pro­cess­ing (con­troller) and who can I contact?
The con­troller is:

Apothek­erver­sorgung Schleswig-Holstein,
Düstern­brook­er Weg 75, 24105 Kiel, Germany
www.av-sh.de

Our data pro­tec­tion offi­cer (DPO) can be con­tact­ed at:

com­pol­i­cy GmbH, Dr. Chris­t­ian Wolff
An den Eichen 15, 24248 Mönke­berg, Germany
info@compolicy.de

II. On what legal basis and for what pur­pos­es are the data processed/stored?

The Ver­sorgungswerk man­ages and admin­is­ters retire­ment, sur­viv­ing depen­dants and dis­abil­i­ty insur­ance for mem­bers of the pro­fes­sion. To this end, the Ver­sorgungswerk process­es per­son­al data in accor­dance with the pro­vi­sions of the EU Gen­er­al Data Pro­tec­tion Reg­u­la­tion (GDPR). Pro­cess­ing is car­ried out to com­ply with a legal oblig­a­tion to which the Ver­sorgungswerk is sub­ject and is nec­es­sary for the per­for­mance of a task car­ried out in the pub­lic inter­est. In addi­tion to the GDPR, the Ger­man Fed­er­al Data Pro­tec­tion Act (Bun­des­daten­schutzge­setz, “BDSG”), state data pro­tec­tion leg­is­la­tion and the Schleswig-Hol­stein Act on Pro­fes­sion­al Soci­eties in the Health Care Sec­tor (Heil­berufekam­merge­setz Schleswig-Hol­stein), the Arti­cles of Incor­po­ra­tion of the Ver­sorgungswerk, as well as oth­er spe­cialised leg­is­la­tion, such as vol­umes II, III, V, VI of the Ger­man Social Secu­ri­ty Code (Sozialge­set­zbuch), the Ger­man Act on the Appor­tion­ment of Pen­sion Enti­tle­ments on Divorce (Ver­sorgungsaus­gle­ichs­ge­setz), the Ger­man Admin­is­tra­tive Pro­ceed­ings Act (Ver­wal­tungs-ver­fahrens­ge­setz) and the Ger­man Act on the Enforce­ment of Admin­is­tra­tive Orders (Ver-wal­tungsvoll­streck­ungs­ge­setz) serve as the legal basis for processing.

To the extent that you have giv­en con­sent to pro­cess­ing per­son­al data for spe­cif­ic pur­pos­es (such as rolling over con­tri­bu­tions to anoth­er occu­pa­tion­al pen­sion fund), pro­cess­ing is law­ful on the basis of that consent.

III. What data are necessary?

All the data rel­e­vant to your pen­sion are processed in your mem­ber file. In addi­tion to per­son­al data such as your name, place of birth, date of birth and mar­i­tal sta­tus, these also include your address, mem­ber num­ber, data on your earn­ings from self-employed activ­i­ty and on wages and employ­ers, data on fam­i­ly members/surviving depen­dants, peri­ods of unem­ploy­ment and ill­ness, and data on attach­ments and pro­ceed­ings to appor­tion pen­sion enti­tle­ments. Peri­ods of mem­ber­ship in oth­er pen­sion funds and oth­er data com­pa­ra­ble to the spec­i­fied cat­e­gories are also of rel­e­vance in the indi­vid­ual case.

Data con­cern­ing health may also be rel­e­vant, for instance, if you apply for reha­bil­i­ta­tion mea­sures or a dis­abil­i­ty pension.

IV. How do we obtain your data?

We obtain data from you when, for exam­ple, you noti­fy us of a change of name or address or when you sub­mit appli­ca­tions by com­plet­ing forms and sub­mit­ting the required doc­u­ments, includ­ing via the Apothek­erkam­mer Schleswig-Holstein.

In addi­tion, employ­ers, employ­ment offices and health insur­ers, for exam­ple, report peri­ods dur­ing which you are employed, unem­ployed or sick. These data will be post­ed to your mem-ber account. We also receive data from, for exam­ple, courts, insol­ven­cy admin­is­tra­tors and oth­er pub­lic agencies.

V. Dis­clo­sure of data to third parties

As a rule, the data you send to us are intend­ed sole­ly for the Ver­sorgungswerk. How­ev­er, in some cas­es, oth­er agen­cies or per­sons may require the data as well. .

Gen­er­al­ly speak­ing, we are not per­mit­ted to dis­close your data to third par­ties. Dis­clo­sure is per­mit­ted only if you have con­sent­ed to this in writ­ing or the trans­fer of data is express­ly pre­scribed by law. This is the case, for exam­ple, with respect to oth­er pen­sion insur­ers, employ­ment offices and statu­to­ry health insur­ers, oth­er ser­vice providers bound by data con­fi­den­tial­i­ty (e.g., web­site oper­a­tors, postal ser­vice, print­ers) or with respect to police author­i­ties and courts.

The Ver­sorgungswerk is also required by law, for exam­ple, to report pen­sion data to the rev­enue author­i­ty in the con­text of a so-called “pen­sion noti­fi­ca­tion pro­ce­dure” (Rentenbe-zugsmit­teilungsver­fahren). Noti­fi­ca­tions must be made irre­spec­tive of any oblig­a­tion you may have to file a tax return.

Spe­cial require­ments for med­ical data

Med­ical data such as expert opin­ions or reports of med­ical find­ings are among the most sen­si­tive types of per­son­al data. We are not per­mit­ted to trans­fer such data with­out your consent.

You may object to the dis­clo­sure of med­ical data at any time with­out stat­ing rea­sons. If you object, no med­ical data may be dis­closed with­out your knowl­edge and con­sent. How­ev­er, in some cas­es this may mean that you lose or will not be paid ben­e­fits due to a fail­ure to cooperate.

VI. What are my data pro­tec­tion rights?

You have the right to access all data stored about you free of charge (Arti­cle 15 GDPR), the right to rec­ti­fi­ca­tion (Arti­cle 16 GDPR), the right to era­sure (Arti­cle 17 GDPR), the right to restric­tion of pro­cess­ing (Arti­cle 18 GDPR) and the right to object (Arti­cle 21 GDPR). The right to data porta­bil­i­ty under Arti­cle 20 GDPR is exclud­ed pur­suant to Arti­cle 20(3) GDPR because the pro­cess­ing of your data is nec­es­sary for the per­for­mance of a task car­ried out in the pub­lic interest.

Should you deter­mine that your stored data are incor­rect, we will rec­ti­fy them. As soon as we receive proof there­of, we will remove the incor­rect data or replace them with cor­rect data. Any incom­plete data will be com­plet­ed by us.

In spe­cif­ic cas­es, you may request us to erase your data, for exam­ple, when we no longer require the data to per­form our statu­to­ry man­date. Era­sure may not be request­ed if fur­ther pro­cess­ing is nec­es­sary for com­pli­ance with our legal oblig­a­tions. This would be the case in par­tic­u­lar with statu­to­ry reten­tion oblig­a­tions. The right to era­sure of per­son­al data would not apply where the afore­men­tioned pur­pos­es of pro­cess­ing are still cur­rent or the Ver­sorgungswerk is required to retain the data by law.

You may with­draw any con­sent giv­en to the Ver­sorgungswerk to process your per­son­al data at any time. The fore­go­ing also applies to the with­draw­al of con­sent giv­en pri­or to the GDPR’s entry into force, i.e., pri­or to 25 May 2018. Please note that the with­draw­al of con­sent shall have prospec­tive effect; it shall not affect the law­ful­ness of pro­cess­ing based on con­sent before its withdrawal.

You also have the right to lodge a com­plaint with the data pro­tec­tion super­vi­so­ry author­i­ties (Arti­cle 77 GDPR).

VII. Are you required to trans­mit data to the Versorgungswerk?

In order to man­age the Ver­sorgungswerk to your sat­is­fac­tion, we need your coop­er­a­tion. With­in the scope of the pur­pos­es spec­i­fied under sec­tion II and based on the legal bases spec­i­fied there­in, you are required to trans­fer the nec­es­sary data to the Ver­sorgungswerk. Absent this infor­ma­tion, it will not be pos­si­ble to cal­cu­late your pen­sion in the cor­rect man­ner and amount. You could suf­fer a loss in pen­sion benefits.

VIII. How long will your data be stored? 

Your data will be stored and processed with­in the scope of our statu­to­ry man­date for as long as is nec­es­sary to cor­rect­ly process your pen­sion ben­e­fits and, any pen­sion ben­e­fits paid to your sur­viv­ing dependants.

The data stored by us will be erased as soon as they are no longer nec­es­sary for their intend­ed pur­pose and pro­vid­ed that their era­sure does not con­flict with any statu­to­ry reten­tion oblig­a­tions. If your data are not erased because they are nec­es­sary for oth­er law­ful pur­pos­es, their pro­cess­ing will be restrict­ed, mean­ing that they will be blocked and not processed for oth­er pur­pos­es. This applies, for exam­ple, to data that must be retained for reg­u­la­to­ry or tax purposes.

IX. Will data be trans­ferred to a third country?

Gen­er­al­ly speak­ing, data will not be trans­ferred to agen­cies in states out­side the Euro­pean Union. Data trans­fers may become rel­e­vant in the event that you have com­plet­ed pen­sion insur­ance peri­ods in Switzer­land and these peri­ods are to be tak­en into account in a pen­sion appli­ca­tion pro­ce­dure with­in the scope of coor­di­nat­ing social secu­ri­ty sys­tems under Reg­u­la­tion (EU) No 883/2004. The trans­fer is per­mis­si­ble because the EU Com­mis­sion already decid­ed under the old leg­is­la­tion (Arti­cle 25(6) of the Data Pro­tec­tion Direc­tive) that Switzer­land ensures an ade­quate lev­el of data pro­tec­tion. This ade­qua­cy deci­sion also applies under the GDPR.

The Ver­sorgungswerk does not trans­fer any per­son­al data to agen­cies in third coun­tries or to any inter­na­tion­al organ­i­sa­tions either. Trans­fers are only pos­si­ble in the event of a statu­to­ry oblig­a­tion or sub­ject to your consent.

X. Is pro­fil­ing conducted?

Pro­cess­ing aimed at eval­u­at­ing spe­cif­ic per­son­al aspects of your data (pro­fil­ing) is not car­ried out. Your brows­ing habits are not analysed.

XI. Is cor­re­spon­dence by e‑mail possible? 

You may send cor­re­spon­dence to the Ver­sorgungswerk by e‑mail. Please note that this method of com­mu­ni­ca­tion is not com­plete­ly secure, and unau­tho­rised third par­ties could, for instance, manip­u­late the sender or recip­i­ent address­es or the con­tent of the e‑mail.

For data pro­tec­tion rea­sons, the Ver­sorgungswerk will respond to you by post or, sub­ject to your con­sent, by (encrypt­ed) e‑mail.

Cer­tain trans­ac­tions will still require your signature.

XII. Are data processed when the web­site is accessed?

When­ev­er you vis­it our web­site, our sys­tem auto­mat­i­cal­ly col­lects data and infor­ma­tion from the request­ing PC. Infor­ma­tion is col­lect­ed on the brows­er type and ver­sion used, the user’s oper­at­ing sys­tem, brows­er ID and IP address, the date and time of access, the web­sites from which the user’s sys­tem access­es our web­site, and web­sites accessed by the user’s sys­tem via our website.

The tem­po­rary stor­age of the IP address by the sys­tem is nec­es­sary to send the web­site to the user’s com­put­er. The user’s IP address has to be stored for the dura­tion of the ses­sion. The legal basis for tem­po­rary stor­age is Arti­cle 6(1)(f) GDPR. The web­site’s deploy­ment data will be delet­ed at the end of the session.

In order to ensure the pro­tec­tion of per­son­al data, our web­site oper­a­tor does not use any cook­ies. In addi­tion, the IP address and brows­er ID are stored in anonymised form so that the iden­ti­ty of indi­vid­ual vis­i­tors can­not be deter­mined. The data are not analysed or oth­er­wise used or dis­closed to third parties.

Tech­ni­cal cook­ies may be used on the Ver­sorgungswerk’s web­site. These are not stored on the user’s ter­mi­nal device and serve mere­ly to ensure the smooth oper­a­tion of the web­site. Cook­ies may be used on linked web pages. Please refer to the pri­va­cy poli­cies for those web­sites. You may con­fig­ure your brows­er set­tings to dis­al­low all cook­ies or present you with a prompt win­dow to inform you in advance when cook­ies are saved. Cook­ies that have already been saved may be delet­ed at any time. The Ver­sorgungswerk does not use any tech­nolo­gies to track the way users access the website.

XIII. Pro­cess­ing of per­son­al data in the ABV Por­tal (EESSI) pur­suant to Arti­cle 26(2) GDPR

Infor­ma­tion pur­suant to Arti­cle 26(2) sen­tence 2 GDPR con­cern­ing joint con­trol when pro­cess­ing per­son­al data col­lect­ed in the ABV Por­tal, specif­i­cal­ly with regard to the use of EESSI

In accor­dance with Reg­u­la­tion (EC) No 883/2004 on the coor­di­na­tion of social secu­ri­ty sys­tems and Reg­u­la­tion (EC) No 987/2009, Apothek­erver­sorgung Schleswig-Hol­stein (Phar­ma­cists’ Pen­sion Fund of Schleswig-Hol­stein), Düstern­brook­er Weg 75, 24105 Kiel (here­inafter the “Apothek­erver­sorgung”) and Arbeits­ge­mein­schaft beruf­sständis­ch­er Ver­sorgung­sein-rich­tun­gen e. V., Luisen­straße 17, 10117 Berlin (Arbeits­ge­mein­schaft Beruf­sständis­ch­er Ver­sorgung­sein­rich­tun­gen (Con­sor­tium of Pro­fes­sion­al Asso­ci­a­tion Pen­sion Schemes), here­inafter “ABV”) are required to par­tic­i­pate in the Europe-wide Elec­tron­ic Exchange of Social Secu­ri­ty Infor­ma­tion (“EESSI”).

In prac­tice, ABV and the rel­e­vant occu­pa­tion­al pen­sion funds will joint­ly process the data col­lect­ed by the elec­tron­ic por­tal made avail­able and oper­at­ed by ABV and for­ward that data via the exist­ing EESSI infra­struc­ture. In addi­tion, the por­tal is intend­ed to facil­i­tate a gen­er­al exchange of data between the rel­e­vant occu­pa­tion­al pen­sion funds and ABV, as well as between the occu­pa­tion­al pen­sion funds inter se.

In this con­text, Apothek­erver­sorgung and ABV will process the per­son­al data of mem­bers of the Apothek­erver­sorgung in par­tic­u­lar as joint con­trollers with­in the mean­ing of Arti­cle 26 GDPR. In light of their respon­si­bil­i­ty for pro­cess­ing per­son­al data as joint con­trollers, ABV and the Apothek­erver­sorgung have entered into an agreement.

Accord­ing to the terms of that agree­ment, ABV is respon­si­ble for pro­cess­ing per­son­al data to the extent that data relates to the oper­a­tion of the por­tal and the use of the EESSI RINA (Ref­er­ence Imple­men­ta­tion for Nation­al Appli­ca­tion) soft­ware for the pur­pose of pro­cess­ing the data trans­mit­ted by the rel­e­vant occu­pa­tion­al pen­sion funds via the por­tal and vice-ver­sa for the pur­pose of for­ward­ing the data received via RINA to the rel­e­vant occu­pa­tion­al pen­sion funds. Apothek­erver­sorgung is respon­si­ble for pro­cess­ing per­son­al data to the extent that data relates to the upload­ing, down­load­ing and trans­mis­sion of data via the portal.

In their func­tion as joint con­trollers, Apothek­erver­sorgung and ABV have also agreed in par­tic­u­lar on which of them shall sat­is­fy which oblig­a­tions set out in the GDPR. This relates in par­tic­u­lar to safe­guard­ing the rights of data sub­jects and sat­is­fac­tion of duties to pro­vide infor­ma­tion pur­suant to Arti­cle 13 and Arti­cle 14 GDPR.

Fur­ther­more, Apothek­erver­sorgung and ABV have stip­u­lat­ed that they would make pub­lic which infor­ma­tion is required by Arti­cles 13 and 14 GDPR with regard to the data pro­cess­ing by joint con­trollers as well as the mate­r­i­al sub­stance of the agreement.

Data pro­tec­tion rights may be assert­ed against both Apothek­erver­sorgung as well as ABV. Requests will be processed by the respec­tive respon­si­ble con­troller. The con­trollers will noti­fy and sup­port each oth­er where nec­es­sary. Data sub­jects will receive noti­fi­ca­tion from the con­troller which is whol­ly or par­tial­ly respon­si­ble for the pro­cess­ing oper­a­tion con­cerned. If both con­trollers are respon­si­ble in equal mea­sure, ABV will process the request.

Apothek­erver­sorgung Schleswig-Holstein

Last updat­ed: April 2021