This data protection notice informs you about who is responsible for video surveillance, the purposes for which video surveillance is carried out, and which rights you have with respect to video surveillance in your capacity as the data subject.

1 Who is responsible for the data processing and who can you contact?

Controller:
DZ BANK AG
Deutsche Zentral-Genossenschaftsbank, Frankfurt am Main
(“DZ BANK”)

Platz der Republik
60325 Frankfurt am Main
Germany
telephone: +49 69 7447-01
fax: +49 69 7447-1685
e-mail: mail@dzbank.de

You can contact our data protection officer at the same address at the bottom

or via
telephone: +49 69 7447-94101
fax: +49 69 427267-0539
e-mail: datenschutz@dzbank.de

2 What sources and data does DZ BANK use?

DZ BANK uses video surveillance (live streams) to monitor security-relevant areas inside and outside its buildings and premises. In a few cases, videos are also recorded.
Several cameras have been installed as part of a “virtual patrol” of the building concerned in the framework of DZ BANK’s general security concept. This enables the outer facade of the building, as well as its immediate vicinity, to be assessed quickly at all times, without endangering the company’s own personnel. In doing so, public spaces are principally not subjected to general video surveillance.
As soon as you enter an area covered by camera surveillance, you become the subject of this data processing.

3 For what purpose does DZ BANK process your data and on what legal grounds?

DZ BANK has a legitimate interest in using video surveillance (point (f) of Article 6 (1) GDPR. It contributes significantly towards ensuring the most comprehensive security possible for its buildings and personnel in a way that both saves on, and protects the wellbeing of, its staff.
Depending on the prevailing circumstances of the locations concerned, we use the video surveillance to pursue the following goals:

• to secure the outer facade of the building against vandalism
• to perform the (necessary) monitoring of alarm-protected doors
• to detect illegal attempts to enter our premises to recognise blocked emergency exits
  

Video surveillance allows counter-measures to be taken immediately in order to remedy defects in the above-mentioned points. They not only serve to protect our buildings, but also your own personal safety and security.
Local or national regulations which are in force at some of DZ BANK’s operating locations may also stipulate mandatory video surveillance of specific areas. The legal basis for such surveillance would then be, additionally to DZ BANK’s legitimate interest, a legal obligation in accordance with point (c) of Article 6 (1) GDPR.

4 Who receives your data?

Video data are only evaluated where required. DZ BANK may charge external service providers with evaluating the video surveillance. These then receive, in addition to the live streams, also access to recordings of the video cameras in their respective, contractually defined area of responsibility.
For infringements of house rules, perpetrations of criminal offences, and where legal guidelines so require, the recordings may, or must, be handed over to the law enforcement authorities.

5 For how long is your data stored?

Video material is not generally recorded or stored.
Where recordings are made – namely in connection with a specific event, recordings triggered by an alarm, or continuous recordings – they will be erased after the deadlines specifically defined for the location concerned, unless they are needed in the context of investigative proceedings. The erasure deadlines are possibly determined by national legal requirements. For locations in Germany, a standard erasure deadline of 72 hours applies.

6 What rights do you have as a data subject?

Every data subject has a right of access in accordance with Article 15 of the GDPR, a right to rectification in accord-ance with Article 16 of the GDPR, a right to erasure (“right to be forgotten”) in accordance with Article 17 of the GDPR, a right to restriction of processing in accordance with Article 18 of the GDPR, a right to data portability in accordance with Article 20 of the GDPR, a right to object in accordance with Article 21 of the GDPR (specific information provided later on in this data protection notice). You also have the right to lodge a complaint with a supervi-sory data protection authority in accordance with Article 77 of the GDPR.

7 Are you obliged to provide your data?

The data are provided when you enter an area covered by video surveillance facilities.
At places where DZ BANK employs video surveillance, this will be indicated by appropriate signage.
In areas in which video surveillance is required by law, we have no means of allowing you to reside in these areas without you disclosing your data (video surveillance) – even at your express wish. In all other areas, video surveillance may be waived, provided that you state your legitimate reasons (objection) to us beforehand, and provided that we are unable to provide any compelling legitimate reasons for the processing which outweigh your own interests, rights and freedoms (balancing of interests).

8 Information regarding your right to object under Article 21 of the GDPR

8.1 Right to object on a case-by-case basis
You have the right to object at any time on grounds relating to your particular situation to processing of personal data concerning you which is based on point (f) of Article 6(1) of the GDPR (processing of data based on a legitimate interest).
If you object, we will no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms or the processing is for the purpose of establishment, exercise or defence of legal claims.

8.2 Objection
Objections may be made via any of the contact channels detailed above. There are no formal requirements for submitting objections.

9 Updates
We modify and/or update this data protection notice, particularly in response to new technological developments, in response to amended statutory and/or official requirements and organisational changes. These modifications and/or updates are posted on our website at www.dzbank.com/dataprotection. Upon request, we provide our current data protection notices as a file (PDF) or on paper, but we recommend you always refer to our website for the most recent updates. If any changes are made, we will always check if we are required to inform you of them proactively and, should this be the case, we will fulfil our obligation to do so. Otherwise, we will only replace files or printouts with the latest versions if this is something that you have requested.

As at: 15.04.2020