How we handle your data & your rights – Information pursuant to Articles 13, 14 and 22 of the General Data Protection Regulation (GDPR)

Dear Client,

in the following we inform you about the processing of your personal data by us and the claims and rights to which you are entitled under data protection law.

Which data is processed in detail and how it is used depends largely on the services applied for or agreed in each case.
‍

1. Who is responsible for data processing and who can I contact?

The controller is:

QORE Solutions GmbH
Brüsseler Straße 1-3
60327 Frankfurt am Main, Germany
‍
T +49 69 950 64 78 00
F +49 69 950 64 78 50
M info@qoresolutions.de

‍

2. Which sources and data do we use?

We process personal data that we receive from you in the course of our business relationship. In addition — to the extent necessary for the provision of our services — we process personal data that we have permissibly received from other companies (e.g. SCHUFA) (e.g. for the purpose of carrying out creditworthiness checks, for the performance of contracts, or on the basis of consent granted by you). We also process personal data that we have permissibly obtained from publicly accessible sources (e.g. the BaFin register, annual reports on company websites) and are permitted to process.

Relevant personal data includes personal details (name, address and other contact data, date and place of birth, and nationality), identification data (e.g. ID document data) and authentication data (e.g. specimen signature). It may also include order data (e.g. payment orders, securities orders), data arising from the performance of our contractual obligations (e.g. transaction data in payment services, credit lines, product data [e.g. deposit, lending and custody business]), information about your financial situation (e.g. creditworthiness data, scoring/rating data, origin of assets), advertising and sales data (including advertising scores), documentation data (e.g. advisory records), register data, data on your use of digital services offered by us (e.g. the time at which you access our websites, apps or newsletters, pages or entries of ours that you click on) as well as other data comparable to the categories mentioned.

3. What do we process your data for (purpose of processing) and on what legal basis?

We process personal data in accordance with the provisions of the European General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).
‍

3.1 For the performance of contractual obligations (Article 6 (1) (b) GDPR)

Personal data (Article 4 No. 2 GDPR) is processed for the provision and brokerage of our services, in particular for the performance of our contracts or pre-contractual measures with you and the execution of your orders, as well as for all activities required for the operation and administration of a company.

The purposes of data processing depend primarily on the specific product (e.g. brokerage) and may include, among other things, needs analyses, advice, asset management and asset servicing, and the execution of transactions.

Further details on the purpose of data processing can be found in the respective contractual documents and terms and conditions.
‍

3.2 Within the framework of a balancing of interests (Article 6 (1) (f) GDPR)

Where necessary, we process your data beyond the actual performance of the contract in order to safeguard legitimate interests of ours or of third parties, for example in the following cases:

• Ensuring IT security and IT operations;
• Reviewing and optimising procedures for needs analysis and direct customer contact;
• Advertising or market and opinion research, insofar as you have not objected to the use of your data;
• Asserting legal claims and mounting a defence in legal disputes;
• Measures for building and facility security (e.g. access controls);
• Measures to safeguard our domiciliary rights;
• Measures for business management and the further development of services and products;
• Consulting and exchanging data with credit agencies (e.g. SCHUFA) to determine creditworthiness and default risks;
• Preventing and investigating criminal offences.
  

‍

3.3 On the basis of your consent (Article 6 (1) (a) GDPR)

Insofar as you have granted us consent to process personal data for specific purposes (e.g. transfer of data, analysis of user data for marketing purposes), the lawfulness of this processing is based on your consent. Consent granted may be withdrawn at any time. This also applies to the withdrawal of declarations of consent — such as, for example, the SCHUFA clause — granted to us before the GDPR came into effect, i.e. before 25 May 2018.

Please note that a withdrawal only takes effect for the future. Processing carried out before the withdrawal is not affected.

‍

3.4 On the basis of legal requirements (Article 6 (1) (c) GDPR) or in the public interest (Article 6 (1) (e) GDPR)

In addition, we are subject to various legal obligations, i.e. statutory requirements (e.g. the German Banking Act (KWG), the German Anti-Money Laundering Act (GwG), the German Securities Trading Act (WpHG), tax laws) as well as banking supervisory requirements (e.g. of the European Central Bank, the European Banking Authority, the Deutsche Bundesbank and the German Federal Financial Supervisory Authority (BaFin)). The purposes of processing include, among other things, creditworthiness checks, identity and age verification, fraud and money laundering prevention, the fulfilment of control and reporting obligations under tax law, and the assessment and management of risks.

4. Who receives my data?

Within our company, those units that need your data to fulfil our contractual and legal obligations are granted access to it. Processors engaged by us (Article 28 GDPR) may also receive data for these stated purposes. With regard to the transfer of data to recipients outside our company, please note that we only pass on information about you if legal provisions require it, if you have consented, or if we are authorised to provide information.

Under these conditions, recipients of personal data may include, for example:

Public bodies and institutions (e.g. Deutsche Bundesbank, the German Federal Financial Supervisory Authority (BaFin), the European Banking Authority, the European Central Bank, tax authorities) where a legal or regulatory obligation exists.

Other credit and financial services institutions or comparable entities to which we transfer personal data in order to conduct the business relationship with you (depending on the contract: e.g. correspondent banks, custodian banks, stock exchanges, credit agencies). Other recipients of data may be those bodies for which you have granted us your consent to the transfer of data or in respect of which you have released us from banking secrecy by agreement or consent.

Finally, the storage period is also determined by the statutory limitation periods, which, for example, under Sections 195 et seq. of the German Civil Code (BGB), are generally three years, but in certain cases can be up to thirty years.
‍

5. How long is my data stored?

To the extent necessary, we process and store your personal data for as long as is necessary to achieve the purposes of processing and/or to fulfil statutory retention obligations.

If you were not selected for the position you applied for, we delete your data six months from the date of the rejection. If an employment contract is concluded between you and QORE, your application documents will be added to your personnel file and stored for at least the duration of the employment relationship and the retention obligations following on from it. If and to the extent that you have granted us consent to data processing for specific purposes — such as continuing to store your data and contacting you in order to offer you other open positions — the duration of processing results from the purpose of the consent granted. Finally, the storage period is also determined by the statutory limitation periods, which, for example, under Sections 195 et seq. of the German Civil Code (BGB), are generally three years, but in certain cases can be up to thirty years.

‍

6. Is data transferred to a third country or to an international organisation?

Data is only transferred to third countries (countries outside the European Economic Area – EEA) insofar as this is necessary for the execution of your orders, is required by law, or you have granted us your consent. In these cases, data is only accessed if either an adequacy decision of the European Commission exists for the country in question, we have agreed with the service providers the standard contractual clauses provided by the EU Commission for such cases, or the company in question has established its own binding internal data protection rules that have been recognised by the data protection supervisory authorities. We will inform you separately about the details, where required by law.

7. What data protection rights do I have?

Every data subject has the right of access under Article 15 GDPR, the right to rectification under Article 16 GDPR, the right to erasure under Article 17 GDPR, the right to restriction of processing under Article 18 GDPR and the right to data portability under Article 20 GDPR. The restrictions under Sections 34 and 35 BDSG apply to the right of access and the right to erasure. In addition, there is a right to lodge a complaint with a data protection supervisory authority (Article 77 GDPR in conjunction with Section 19 BDSG). You may withdraw consent granted to the processing of personal data from us at any time. This also applies to the withdrawal of declarations of consent granted to us before the General Data Protection Regulation came into effect, i.e. before 25 May 2018. Please note that a withdrawal only takes effect for the future. Processing carried out before the withdrawal is not affected.
‍

8. Is there an obligation to provide data?

An application to our company is voluntary. However, the provision of your personal data concerning your previous professional and/or educational background, your qualifications, your skills, information about yourself and your contact details is necessary so that we can determine whether you, as an applicant, are suitable for the position to be filled and so that we can carry out an appropriate personnel selection. Without the provision of this data by you as an applicant, no personnel selection can take place in the application process. Consequently, a failure to provide personal data means that you cannot be considered as a candidate when the position is filled.

9. To what extent is there automated decision-making in individual cases?

We do not use fully automated decision-making pursuant to Article 22 GDPR. Should we use these procedures in individual cases, we will inform you of this and of your rights in this regard separately, where required by laableor

10. To what extent is my data used for profiling (scoring)?

As a matter of principle, we do not use profiling pursuant to Article 22 GDPR. Should we use this procedure in individual cases, we will inform you of this separately, where required by law.

Data Protection Notices for Applicants

How we handle your data and your rights – Information pursuant to Articles 13, 14 and 21 of the General Data Protection Regulation (GDPR):

Dear Applicant,

in the following we inform you about the processing of your personal data by us and the claims and rights to which you are entitled under data protection law.

1. Who is responsible for data processing and who can I contact?

QORE Solutions GmbH
Brüsseler Straße 1-3
60327 Frankfurt am Main, Germany
‍
T +49 69 950 64 78 00
F +49 69 950 64 78 50
M info@qoresolutions.de
‍
‍
2. Which sources and categories of data do we use?

We process personal data that we receive directly from you in the course of your application. This is the data that you make available to us by submitting your application documents and through your statements in job interviews. We also visit applicants' profiles on career-oriented social networks, where such profiles exist. We do not visit profiles on private social networks. Furthermore, we may receive data from recruitment agencies to which you have provided your application documents and which propose you to us as a candidate for a position. If references are to be requested from previous employers, this will be discussed separately with the applicant. Relevant personal data includes, for example, name, address and other contact data, date of birth, educational and professional background, references, certificates, etc.

‍

3. What do we process your data for (purpose of processing) and on what legal basis?

We process personal data in accordance with the provisions of the European General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG); processing takes place exclusively where it is permitted by law or where we have obtained your consent to the data processing.

‍

3.1. Processing of your data for the purpose of filling vacancies (Article 6 (1) (b) GDPR)

The data processing takes place for the purposes of personnel selection to fill open positions. These are pre-contractual measures that serve the initiation of employment contracts.

‍

3.2. Processing of your data on the basis of legitimate interests within a balancing of interests (Article 6 (1) (f) GDPR)

Where necessary, we process your data beyond the actual initiation or performance of the contract in order to safeguard legitimate interests of ours or of third parties — provided your interests deserving protection do not prevail — for example in the following cases: Background research on applicants for positions of particular compliance relevance: We have a legitimate interest in researching whether an applicant may be shortlisted for certain fields of activity on the basis of the information they have provided. Improving our application process and applicant satisfaction surveys: We use findings from surveys or individual discussions on the subject of applicant satisfaction to identify potential for improvement and to make the application process more effective. Where possible, we process your data in pseudonymised form, i.e. in a form in which you cannot be directly identified. Defence against and assertion of legal claims: In addition, we store applicants' data so that we can, where necessary, defend ourselves against asserted claims, for example under the German General Equal Treatment Act (AGG). We disclose personal data to offices, authorities and courts where this is necessary to defend ourselves in legal disputes or to enforce legal claims.

3.3. Processing of your data on the basis of your consent (Article 6 (1) (a) GDPR)

We also process your personal data if and insofar as you have consented to data processing for specific purposes pursuant to Art. 6 (1) (a) GDPR. The purposes for which data processing takes place in this context result from the respective consent. Consent granted may be withdrawn at any time. This also applies to the withdrawal of declarations of consent granted to us before the GDPR came into effect, i.e. before 25 May 2018.

Please note that a withdrawal only takes effect for the future. Processing carried out before the withdrawal is not affected.

3.4 Processing of your data on the basis of legal requirements (Article 6 (1) (c) GDPR)

We also process your personal data where we are obliged to do so on the basis of legal requirements. This includes, for example, reports to the Federal Employment Agency (Agentur für Arbeit) as well as information provided to offices, authorities and courts, insofar as we are obliged to do so.

‍

4. Who receives my data?

We treat the fact that you are applying to us, as well as your personal data, confidentially. Within our company, only those departments and employees who need your data to fulfil the purposes mentioned above are granted access to it. These are usually employees of the HR department and of the specialist department in which the position is to be filled, e.g. the manager in whose team the position is located. With regard to the transfer of data to recipients outside our company, please note that we only pass on information about you if legal provisions require it, if you have consented, or if we are authorised to provide information. Under these conditions, recipients of personal data may include, for example, public bodies and institutions (e.g. authorities) where a legal or regulatory obligation exists. In addition, we work with service providers who support us. We only transfer your personal data to our service providers and cooperation partners where there is a legal basis for doing so. These are service providers in the following areas:

• Recruitment consultants and agencies
• Headhunters
• Service providers for verifying applicant qualifications
  

Other recipients of data may be those bodies for which you have granted us your consent to the transfer of data, or to which we are authorised to transfer personal data on the basis of a balancing of interests.

5. How long is my data stored?

To the extent necessary, we process and store your personal data for as long as is necessary to achieve the purposes of processing and/or to fulfil statutory retention obligations.

If you were not selected for the position you applied for, we delete your data six months from the date of the rejection. If an employment contract is concluded between you and us, your application documents will be added to your personnel file and stored at least for the duration of the employment relationship and the retention obligations following on from it. If and to the extent that you have granted us consent to data processing for specific purposes — such as continuing to store your data and contacting you in order to offer you other open positions — the duration of processing results from the purpose of the consent granted. Finally, the storage period is also determined by the statutory limitation periods, which, for example, under Sections 195 et seq. of the German Civil Code (BGB), are generally three years, but in certain cases can be up to thirty years.

‍

6. Is data transferred to a third country or to an international organisation?

Data is only transferred to third countries (countries outside the European Economic Area – EEA) insofar as this is necessary for the execution of your orders, is required by law, or you have granted us your consent. In these cases, data is only accessed if either an adequacy decision of the European Commission exists for the country in question, we have agreed with the service providers the standard contractual clauses provided by the EU Commission for such cases, or the company in question has established its own binding internal data protection rules that have been recognised by the data protection supervisory authorities. We will inform you separately about the details, where required by law.

‍

7. What data protection rights do I have?

Every data subject has the right of access under Article 15 GDPR, the right to rectification under Article 16 GDPR, the right to erasure under Article 17 GDPR, the right to restriction of processing under Article 18 GDPR and the right to data portability under Article 20 GDPR. The restrictions under Sections 34 and 35 BDSG apply to the right of access and the right to erasure. In addition, there is a right to lodge a complaint with a data protection supervisory authority (Article 77 GDPR in conjunction with Section 19 BDSG). You may withdraw consent granted to the processing of personal data from us at any time. This also applies to the withdrawal of declarations of consent granted to us before the General Data Protection Regulation came into effect, i.e. before 25 May 2018. Please note that a withdrawal only takes effect for the future. Processing carried out before the withdrawal is not affected.

8. Is there an obligation to provide data?

An application to our company is voluntary. However, the provision of your personal data concerning your previous professional and/or educational background, your qualifications, your skills, information about yourself and your contact details is necessary so that we can determine whether you, as an applicant, are suited to the position to be filled and so that we can carry out an appropriate personnel selection. Without the provision of this data by you as an applicant, no personnel selection can take place in the application process. Consequently, a failure to provide personal data means that you cannot be considered as a candidate when the position is filled.

‍

9. To what extent is there automated decision-making in individual cases?

We do not use fully automated decision-making pursuant to Article 22 GDPR. Should we use these procedures in individual cases, we will inform you of this and of your rights in this regard separately, where required by law.

‍

10. To what extent is my data used for profiling (scoring)?

As a matter of principle, we do not use profiling pursuant to Article 22 GDPR. Should we use this procedure in individual cases, we will inform you of this separately, where required by law.

‍

Information about your right to object under Article 21 of the General Data Protection Regulation (GDPR)

You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you which is carried out on the basis of Article 6 (1) (e) GDPR (data processing in the public interest) and Article 6 (1) (f) GDPR (data processing on the basis of a balancing of interests). If you object, we will no longer process your personal data for these purposes unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. You have a right to object — without restriction — pursuant to Art. 21 (2) and (3) GDPR to any form of processing for direct marketing purposes. If you object to processing for the purposes of direct marketing, we will no longer process your personal data for these purposes.

‍
The objection may be made without any particular form and should preferably be addressed to:

‍
QORE Solutions GmbH
Brüsseler Straße 1-3
60327 Frankfurt am Main
‍
T +49 69 950 64 78 00
F +49 69 950 64 78 50
M info@qoresolutions.de