Privacy notice and information on the right to object (Applicants)

In accordance with the General Data Protection Regulation (GDPR), the following privacy notice gives an overview of the processing of your data by KfW Capital and your privacy rights

The following party is responsible for the data processing:

KfW Capital GmbH & Co. KG
Represented by KfW Capital Verwaltungs GmbH
(hereinafter referred to as “KfW Capital”, “we” or “us”)
Bockenheimer Landstr. 98 – 100
60323 Frankfurt am Main

Tel: 069 74 31-88 80
Fax: 069 74 31-88 81
E-Mail:

The contact details of KfW Capital’s data protection officer are:

KfW Capital GmbH & Co. KG
Data protection officer
Bockenheimer Landstr. 98 – 100
60323 Frankfurt am Main

E-Mail:

KfW Capital processes the personal data that KfW Capital receives from you as part of your application or from headhunters or other recruitment service providers. These include all documents provided by you and other information on your application (e.g. e-mails, CVs, reference letters, certificates).

Relevant personal data include in particular personal details (e.g. name, contact details (address, e-mail address and telephone number), date and place of birth, information on your career, skills, qualifications and knowledge. Further types of data are included in the documents provided by you (CVs, reference letters, certificates, etc.). Other data that may be collected include information on the reimbursement of travel and application costs (e.g. bank details), and, in case of an online application, usage and log data (e.g. IP address, name of the file accessed, date and time of access, volume of data transferred, notification of successful access, web browser).

The collected data may also include so-called special categories of personal data within the meaning of Art. 9(1) GDPR (such as medical needs, severe disability).

KfW Capital processes your personal data in accordance with the provisions of the General Data Protection Regulation (GDPR), the Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG) and data protection rules specific to the sector and as applicable to employment relationships (also applicable to applicants).

a. Performance of the contract, including steps prior to entering into a contract (Art. 6(1)(b) GDPR, Section 26(1) BDSG)

We process your data for the application process, that is, for making the decision of potentially entering into an employment relationship.

The purpose of the data processing is primarily determined by the requirements for potentially entering into an employment relationship (selection, qualification, relevant role, etc.).

If you provide us with so-called special categories of personal data relevant to the role during the application process (e.g. medical needs, severe disability), the processing is based on Art. 9(2)(b) GDPR, Section 26(3) BDSG.

b. Within the framework of the balancing of interests (Art. 6(1)(f) GDPR)

To the extent necessary, we also process your personal data for the fulfillment of legitimate interests. For example:

• Statistical documentation in an anonymized manner.
• Establishment, enforcement, exercise or defence of legal claims or defence against legal disputes, including assertion in court. This also includes processing your data for investigating and assessing the facts.
• Carrying out a digital application process.
• Involvement of external consultants, experts and other service providers.
• Ensuring IT security and maintaining and further development of IT operations.
• Building and facility security measures (e.g. access controls), measures to ensure house rules.
• Investigation of criminal offences.

c. Based on your consent (Art. 6(1)(a) GDPR)

To the extent you provided consent to the processing of your personal data for specific purposes (e.g. for storing your data for a longer period of time to contact you with future interesting job offers), this consent forms the legal basis for the data processing. You may withdraw your consent at any time. Please note that the withdrawal only takes effect for the future. The withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.

d. Due to legal requirements (Art. 6(1)(c)GDPR)

As a medium sized investment firm with, among other things, a public investment mandate and a subsidiary of a promotional bank, we are subject to various legal obligations or statutory requirements (e.g. under the German Banking Act within the scope of KfW group’s risk management, German Investment Code, Investment Firm Regulation, Investment Firm Directive, German Investment Firm Act (WpIG), German Money Laundering Act, German Securities Trading Act, tax laws) as well as banking and securities regulatory requirements (e.g. of the Federal Financial Supervisory Authority and the German Central Bank).

The purposes of data processing resulting from our legal requirements include, among others, measures for reliability checks, identity and age checks, fraud and money laundering prevention, as well as compliance with control and notification obligations under tax laws.

In this context, we may process your data in individual cases to fulfill notification obligations to offices, authorities and regulators.

Within the company those roles that require the data as part of the application process will receive your data. Data processors engaged by us may also receive data for this purpose.

Data recipients in this context include:

• Public bodies and institutions (e.g. offices/authorities, financial authorities, investigative authorities, courts);
• Consultants providing consulting services to KfW Capital (e.g. attorneys, management consultants, auditors and tax consultants) and service providers who process data on behalf of Kf Capital (e.g. data centers, data destruction, archiving, etc.).

Further data recipients may be those bodies for which you have given us your consent to transfer data.

Where necessary, we process and store your personal data for the duration of the application process.

Your answers and information provided during the application process will be stored with your name for six months after completion of the application process. After that, the results are only stored for statistical analysis in anonymized form, i.e. without any personal data. This statistical data record does not allow any reference to you. Your personal data will be deleted as soon as the data is no longer required to carry out the application process or for compliance with statutory retention periods.

In principle, KfW Capital does not transfer any personal data to a third country. If a transfer may take place in exceptional circumstances, the following applies:

A transfer of data to recipients outside the EU or the EEA (so-called third countries) will only take place if this is necessary for the performance of your orders (e.g. payment and securities orders) or if the transfer is required by law (e.g. notification obligations under tax law) or if you have given your consent for this or where this is subject to a data processing agreement. If service providers are engaged in a third country, they have to comply with the data protection level in Europe by agreeing to the EU Standard Contractual Clauses in addition to written instructions.

Subject to the respective requirements, you have the following data protection rights against KfW Capital:

• Right to access to your personal data processed by us;
• Right to rectification of inaccurate data, to completion of incomplete data and/or to erasure of data;
• Right to restrict the data processing;
• Right to request that we transfer your data to you or to a third party (right to data portability); and
• Right to object to the processing (see the information under section 2).

Where the processing of personal data is based on consent, you have the right to withdraw this consent at any time with effect for the future, without this affecting the lawfulness of the processing up to the time of withdrawal. You also have the right to lodge a complaint with the Data Protection Authority of Hesse (Hessischer Beauftragter für Datenschutz und Informationsfreiheit), Gustav-Stresemann-Ring 1, 65189 Wiesbaden.

As part of your application, you are only required to provide the personal data that is necessary to carry out the application process or that we are legally obliged to collect (e.g. under banking regulatory laws for certain roles). Without this data, we will generally not be able to carry out the application process and will reject your application.

Voluntary information of a severe disability status according to Section 14(1), 25(2) Severely Disabled Persons Act (Schwerbehindertengesetz, SchwbG):

Applicants who wish to take advantage of special rights for severely disabled persons in the application process may voluntarily state their severe disability status in their letter of application. Information on a severe disability status is special categories of personal data pursuant to Art. 9(1) GDPR (health data), which are subject to strict requirements.

It is not required for the application process to provide any further data within the meaning of Art. 9 GDPR (special categories of personal data). Please refrain from providing such data.

If, nevertheless, further data within the meaning of Art. 9 GDPR is included in the letter of application, we will disregard this data for the application process. We will – if possible – delete/redact the data.

We do not make the decision about the establishment of your employment relationship based solely on automated processing within the meaning of Art. 22 GDPR. If KfW Capital uses these processes in individual cases, where required by law you will be informed about this separately.

Your data will not be used for profiling or scoring as part of the application process.