Privacy notice and information on the right to object

In accordance with the General Data Protection Regulation (GDPR), the following privacy notice gives an overview of the processing of your data by KfW Capital and your privacy rights.

The following party is responsible for the data processing:

KfW Capital GmbH & Co. KG
Represented by KfW Capital Verwaltungs GmbH
(hereinafter referred to as “KfW Capital”, “we” or “us”)
Bockenheimer Landstr. 98 – 100
60323 Frankfurt am Main
Tel: 069 74 31-88 80
Fax: 069 74 31-88 81
E-Mail:

The contact details of KfW Capital’s data protection officer are:
KfW Capital GmbH & Co. KG
Data protection officer
Bockenheimer Landstr. 98 – 100
60323 Frankfurt am Main
E-Mail:

KfW Capital processes the personal data that KfW Capital receives from you or other third parties as part of the business relationship (e.g. to execute orders, perform contracts or based on your consent).

In addition, KfW Capital processes personal data that KfW Capital receives from business partners in their capacity as representatives of a legal entity (as a prospect, customer or other contractual partner).

Furthermore, KfW Capital processes personal data that it permissibly obtained from publicly accessible sources (e.g. debtors’ register, land register, commercial register and register of associations) and may process or – for the provision of services – must process. This includes, in particular, personal data that KfW Capital is obliged to collect due to obligations under German Money Laundering Act (Geldwäschegesetz, GwG).

Personal data processed in the context of prospects, authorised representatives, a contractual relationship or money laundering checks include:

Name, address and other contact details (telephone number, e-mail address), date and place of birth, gender, nationality, legitimation data (e.g. identification data), authentication data (e.g. signature lists), information on your employer and sales data.

KfW Capital processes your personal data in accordance with the provisions of the General Data Protection Regulation (GDPR) and the Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG).

a. Performance of the contract (Art. 6(1)(b) GDPR)

We process your personal data in order to provide investment services to our clients and business partners, in particular investment advice and investment brokerage (Anlageberatung und Anlagevermittlung), as well as financial portfolio management (Finanzportfolioverwaltung) and proprietary business (Eigengeschäft), in respect to which we may conclude contracts and carry out pre-contractual measures.The purposes of data processing are primarily based on the specific product (e.g. fund investments). Further details on the processing purpose can be found in the respective contractual documents.

b. Due to legal requirements (Art. 6(1)(c) GDPR)

As a medium sized investment firm with, among other things, a public investment mandate and a subsidiary of a promotional bank, we are subject to various legal obligations or statutory requirements (e.g. under the German Banking Act within the scope of KfW group’s risk management, German Investment Code, Investment Firm Regulation, Investment Firm Directive, German Investment Firm Act (WpIG), German Money Laundering Act, German Securities Trading Act, tax laws) as well as banking and securities regulatory requirements (e.g. of the Federal Financial Supervisory Authority and the German Central Bank).

The purposes of data processing resulting from our legal requirements include, among others, activities for identity checks, fraud and money laundering prevention, as well as compliance with control and notification obligations under tax or financial regulatory laws. The processing purposes also include the assessment and control of risks in the company and in the group.

c. For public interests (Art. 6(1)(e) GDPR)

KfW Capital as an investment firm with a public investment mandate and, where applicable, reliable third parties engaged by KfW Capital may, in performance of their public tasks, process data for the purpose of economic and business analyses, statistical analyses and evaluations, and for the verification of sustainability aspects. In addition, data can be matched with other data using pseudonyms and be analysed on an anonymous basis to improve products and services. KfW Capital can also publish the results of surveys in anonymised form and pass on the required data to the responsible ministries, third parties commissioned by the ministries and, upon request, to committees of the German Bundestag.

d. Within the framework of the balancing of interests (Art. 6(1)(f) GDPR)

To the extent necessary, KfW Capital processes personal data for the fulfilment of legitimate interests.

In this context, KfW Capital and any reliable third parties engaged by KfW Capital may process data necessary for the establishment, exercise or defence of legal claims, or defence against legal disputes, including assertion in court. This also includes processing your data for investigating and assessing the facts. Furthermore, personal data may be processed for legitimate interests: to ensure IT security and the maintenance and further development of IT operations, prevention and investigation of criminal offenses, measures for security of buildings and systems (e.g. access controls), measures to protection the house right.

e. Based on your consent (Art. 6 Para. 1 a DSGVO)

To the extent you consented to the processing of your personal data for specific purposes (e.g. sending newsletters, invitations to online seminars, photos as part of (online) events), this consent forms the legal basis for the data processing.

Within KfW Capital those roles that require the data to fulfil our contractual and legal obligations will receive your data. Service providers and agents engaged by us (e.g. KfW for regulatory and functional purposes, as well as other consultants and service providers such as lawyers, tax consultants, etc.) may receive data for these purposes. Data is disclosed in particular for the following purposes: support/maintenance of EDP/IT applications, archiving, receipt processing, compliance services, data screening for anti money laundering purposes, data destruction.

Recipients for these purposes may include:

• Public bodies and institutions (e.g. KfW and other entities of the KfW banking group, the German Central Bank, Federal Financial Supervisory Authority, Federal Audit Office (Bundesrechnungshof), audit offices of the German States, the German Bundestag including its committees, European Banking Authority, European Central Bank, European Investment Fund (EIF), European Investment Bank (EIB), European Commission, Federal and State ministries, financial authorities and offices, courts, supervisory and criminal authorities) if there is a legal or official obligation or on the basis of legitimate interests of KfW Capital or third parties.
• Other credit and financial service firms or comparable firms to which KfW Capital discloses personal data in order to perform the business relationship with you (subject to the respective contract: for example financial investment management firms, commercial banks, credit agencies).
• Consultants providing consulting services to KfW Capital (e.g. lawyers, management consultants, auditors and tax consultants) and service providers who process data on behalf of KfW Capital (e.g. data centres, data destruction, archiving, etc.).
• Experts and other appraisers, to the extent necessary for the business process or legitimate interests of KfW Capital or third parties.

KfW Capital does not make the decision about the establishment of our contract based solely on automated processing within the meaning of Art. 22 GDPR. If KfW Capital uses these processes in individual cases, where required by law you will be informed about this separately.

In principle, KfW Capital does not transfer any personal data to a third country. If a transfer may take place in exceptional circumstances, the following applies:

A transfer of data to recipients outside the EU or the EEA (so-called third countries) will only take place if this is necessary for the performance of the contract (e.g. payment and securities orders) or if the transfer is required by law (e.g. notification obligations under tax law) or if you have given your consent for this or where this is subject to a data processing agreement. If service providers are engaged in a third country, they have to comply with the data protection level in Europe by agreeing to the EU Standard Contractual Clauses in addition to written instructions.

Where necessary, KfW Capital processes your personal data for the duration of the business relationship, which also includes entering into and terminating the contract.

If the processing of personal data is no longer necessary, KfW Capital will only store your data if KfW Capital is subject to any retention and documentation obligations, which, among others, result from the German Commercial Code (Handelsgesetzbuch, HGB), the Fiscal Code (Abgabenordnung, AO), the German Banking Act (Kreditwesengesetz, KWG), the Money Laundering Act (Geldwäschegesetz, GwG) and the Securities Trading Act (Wertpapierhandelsgesetz, WpHG). The retention or documentation periods specified therein are between two and ten years.

Further data retention may result from statutory limitation periods, which, for example, can be up to thirty years according to Section 195 of the German Civil Code (Bürgerliches Gesetzbuch, BGB), whereby the regular statutory limitation period is three years.

For the business relationship with KfW Capital, you have to provide the personal data that is required to enter into and perform this business relationship or that KfW Capital is legally obliged to collect. Without this data, KfW Capital will generally have to refuse entering into a contract or perform the order or will no longer be able to perform an existing contract and may have to terminate it.

In particular, we are obliged under the money laundering regulations to carry out an identification process before entering into a business relationship or before setting up the power of representation, for example by using an identification document and to collect and record your name, place of birth, date of birth, nationality, address and identification data. If you do not provide us with the necessary information and documents, we may not enter into or continue the business relationship requested.

Subject to the respective requirements, you have the following data protection rights against KfW Capital:

• Right to access to your personal data processed by us;
• Right to rectification of inaccurate data, to completion of incomplete data and/or to erasure of data;
• Right to restrict the data processing;
• Right to request that we transfer your data to you or to a third party (right to data portability); and
• Right to object to the processing (see the information under section 2).

Where the processing of personal data is based on consent, you have the right to withdraw this consent at any time with effect for the future, without this affecting the lawfulness of the processing up to the time of withdrawal. You also have the right to lodge a complaint with the Data Protection Authority of Hesse (Hessischer Beauftragter für Datenschutz und Informationsfreiheit), Gustav-Stresemann-Ring 1, 65189 Wiesbaden.