Information on data processing at GDV
We would like to inform you below about the collection and processing of your data by
GDV and your rights in this regard.
Controller
The “controller” within the meaning of the General Data Protection Regulation (GDPR) is theGerman Insurance Association (Gesamtverband der Deutschen Versicherungswirtschaft e. V.),
Wilhelmstraße 43 / 43G, 10117 Berlin ("GDV").
Data protection officer
If you have any questions about data protection at GDV, please do not hesitate tocontact our data protection officer:by e-mail: datenschutz@gdv.deby post: at the above address

Purposes of data processing; legal bases
We process your personal data in compliance with the EU General Data Protection Regulation(GDPR), the German Federal Data Protection Act (BDSG) and all other relevant laws. We
process your data for the following purposes:

 Communication in order to fulfil statutory tasks,
Office communication/word processing/office: Processing of contact data (for exampleaddress, e-mail address, phone numbers, including those from publicly available sources)and other data pertaining to communication (such as letters, e-mails and other messages,
which allow the perception of communication participants, time and scope of thecommunication) from contact person in member companies and other communication
partners for transmitting information, stances and comments on legislative projects andexecuting all internal and external correspondence and office communication. creation,
management, archiving of messages, sent information, documents and business processes
in order to document and evaluate the association’s communication, e.g. to determine andexpand the scope of the association’s publications.
Processing of data about member companies and members of legal or statutory
bodies, cooperation with specialists: Processing of personal data to fulfil legal or statutory
tasks of GDV (invitations to general meetings and annual meetings, member information)and to organise cooperation with specialists from the member companies.
Processing of data from suppliers/service providers (e.g. providers, processors):
Administration of personal data from regular service providers such as suppliers, experts,etc. for the purpose of tendering bids, purchasing, contract processing and support.
For these purposes, we use for the processing of contact data and the creation of electronic
messages Microsoft Dynamics365.

 Support for loss prevention and mitigation: Procedures for researching and mitigating
damage (e.g. accident research, procedures for exchange between fire damage specialists)
with the aim of loss prevention or limitation.

 Statistical work of GDV: Calculation of cross-company statistics or risk classificationsin anonymous or – if necessary for the statistical purpose – pseudonymised form. For
motor and property insurance statistics, GDV also receives data records with personal
data such as vehicle registration numbers, vehicle identification numbers and location
data for risk objects such as buildings. No conclusions are drawn about the personsconcerned.

 Distribution of requests for insurance policies of Holocaust victims: Distribution ofrequests for insurance policies of Holocaust victims to the member companies tocompensate Jewish survivors and/or their heirs who were unable to assert theirinsurance claims as a result of persecution by the Nazi regime from 1933 and have notreceived compensation in previous state compensation proceedings.

 Hochwasser-Check - Flood Risk Check: Internet service that informs the public
address accurate about their endangerment by flood, creates risk awareness andpromotes personal provision. It also serves to strengthen the decision-making
competence and personal responsibility of citizens in dealing with the expected effects
of climate change.

 Data processing for organising and executing events: Processing of your masterdata (name, address, phone number, e-mail address, company) as well as yourvoluntarily provided supplementary data for example your position within your company
and data about events you booked (e.g. booked and attended events/conferences,attendance time, appointments), your feedback on events and speakers as well as youraccount and payment information if applicable. GDV also processes your data for quality
control, improvement and refinement of the events it offers. GDV may take photographs
and record films during its event and use them for the purposes of public relations anddocumentation, both in analogue and digital form.

 Conducting web-seminars/online meetings through Teams/Webex: Processing ofdata about title/first and last name, position, company, address, phone number, e-mailaddress, time of submission of chat messages and, if applicable, transmitted content forthe purposes of conducting web-seminars and communicating during online-meetings.

Further information about Microsoft Teams and Microsoft Dynamics365 can be found in
the privacy policy of Microsoft: https://privacy.microsoft.com/de-de/privacystatement
Further information about Webex can be found in the Cisco Online Privacy Statement:
https://www.cisco.com/c/en_uk/about/legal/privacy-full.html

The legal basis for the processing of personal data for pre-contractual and contractual
purposes is Article 6(1)b GDPR. This applies in each case to the processing that takes place
within the scope of a contract between you or your company or your employer and GDV.

We also process your data to protect the legitimate interests of ourselves or third parties(Article 6(1)f GDPR). This may be necessary in particular:

to ensure IT security and operation;
to provide and send association information;
to carry out communication procedures in order to fulfil statutory tasks, officecommunication and exchange information;to represent the interests of the private insurance industry;

to answer requests (e.g. from politicians, businesspeople or consumers);
to organise and execute events and web-seminars/online meetings;
to provide Hochwasser-Check - Flood Risk Check;to carry out statistical work in compliance with Article 89 GDPR.

Data processing for research purposes is carried out on a general societal responsibility toincrease road safety and prevent damages. Legal bases are Articles 5(1)b, 6(1)f and 9(2)j
GDPR in conjunction with § 27 of the German Federal Data Protection Act and Article 89GDPR.
The distribution of requests for insurance policies of Holocaust victims is also based on alegitimate interest pursuant to Article 6(1)f GDPR and within the scope of Article 9(2)f GDPR.
In addition, we process your personal data to fulfil legal obligations such as commercial andtax data retention obligations. In these cases, legal bases for processing are the respective
provisions of law in conjunction with Article 6(1)c GDPR.
Should we ever obtain your consent to process your data, you can withdrawal this consent at
any time. The withdrawal will impinge the permissibility to process your personal data after you
have declared your withdrawal to us.
Source of the data
In case we process data which was not provided to us by the data subject itself, that data either
originates from a register listing certain groups of people (for example members of the Germanparliament) or it was gained through our web research or was transmitted to us by ourcommunication partners (e. g. members of our association).

Recipients or categories of recipients of personal data
Within GDV, only those persons and units (e.g. departments) will receive your personal datathat need the data to fulfil their tasks with regard to the purposes mentioned under Item 3. In
the course of our activities, we will also have to transfer some data to external third parties andmake use of external service providers. In particular, we may transfer your personal data to
the following recipients and categories of recipients:

GDV Dienstleistungs-GmbH and other IT and hosting service providers for tasks of
the individual departments of GDV

telecommunications service providers



participants of events and web-seminars/online-meetingsservice providers to send association informationstate agencies (e.g. to communicate with contact persons in police agencies tocombat crime or the Federal Motor Transport Authority within the framework ofstatistical work)
trustees (in the context of statistical work)

service providers to support the organisation and execution of events and webseminars/ online-meetings

GDV member companies (e.g. to communicate with contact persons within theinsurance industry for certain areas)

Data transfer to a third country
If we transfer personal data to service providers outside the European Economic Area (EEA),
there is a possibility that the level of data protection in one of the countries does not meet
European standards. As far as possible, the data will be transferred on the basis of the EUCommission’s adequacy decisions or standard data protection clauses. When using standard
data protection clauses, we endeavour to implement additional measures to protect your data
if necessary.

Duration of data storage
We delete your personal data as soon as they are no longer required for the above-mentioned
purposes. It may occur that personal data will be stored for the period during which claims canbe asserted against GDV (statutory limitation period of three or up to thirty years). In addition,
we will store your personal data if we are legally obliged to do so. Corresponding
documentation and storage obligations arise, inter alia, from the German Commercial Codeand Tax Code. The storage periods in accordance therewith are up to ten years.
If necessary, we will be pleased to provide you further information on the duration of data
storage with respect to any specific purpose.

Your rights
If we process your data to protect legitimate interests, you may object to suchprocessing for reasons relating to your particular situation. We will then no longer
process your personal data unless we can demonstrate compelling legitimate grounds
for the processing which override your interests, rights and freedoms or for theestablishment, exercise or defence of legal claims.
You can request information about the data stored by us at any time. Please contact the dataprotection officer at GDV by e-mail (datenschutz@gdv.de) or by post to the controller’s above
address.
You may also request that your data be corrected or deleted under certain circumstances. As
soon as you assert a claim for deletion or if the data are no longer necessary to fulfil thepurpose for which they were stored or if the storage thereof is inadmissible for other legal
reasons, we will delete the personal data you have stored. You may also have the right torestrict the processing of your data and to have the data you provide disclosed in a structured,common and machine-readable format.
You have the option to contact the aforementioned data protection officer or a data protection
supervisory authority with a complaint. The data protection supervisory authority responsible
for us is the Berlin Commissioner for Data Protection and Freedom of Information, AltMoabit 59-61, 10555 Berlin.