DATA PROTECTION

Privacy Notice for the Use of the Website

We are delighted that you are visiting our website and would like to thank you for your interest in Erwin Himmelseher Assekuranz-Vermittlung GmbH & Co. KG and our services.

For us, data protection is not merely a legal obligation, but a key component of our information security policy.

Below, we provide detailed information on what personal data (hereinafter referred to as ‘data’) is collected and processed when you visit our website. We also explain what types of data we collect, process and protect from our customers.

Where specific terms such as ‘controller’ or ‘processing’ etc. are used, we refer to the definitions in the GDPR (e.g. Article 4).

Please address any questions or comments to our external Data Protection Officer:
Oliver Thehos
Tel: +49 (0) 231 427888 18
Email: hisv[at]vithos-dsgvo.de

Data controller/service provider

The data controller within the meaning of the Federal Data Protection Act (BDSG) and, at the same time, the service provider within the meaning of the Digital Services Act (DDG) is Erwin Himmelseher Assekuranz-Vermittlung GmbH & Co. KG; please see our legal notice for further details.

Erwin Himmelseher Assekuranz-Vermittlung GmbH & Co. KG
Theodor-Heuss-Ring 23
D-50668 Cologne
Tel: +49 (0)221 888 25 – 100
Email: hisv[at]himmelseher.com

Updates to our data protection measures

We ask that you check our current privacy policy regularly. We regularly update the privacy policy to comply with legal requirements and reflect our services. The privacy policy set out here always applies when you visit the website again.

This is available on our homepage via this link.

We generally only inform our customers of changes to data processing or legislation if this requires action on their part (e.g. consent) or if there is a direct obligation to provide information.

Web server hosting

The service provided to us by our hosting provider serves to technically provide infrastructure services, database applications, computing and storage capacity as the basis for our website.

On the basis of our legitimate interest (Article 6 of the GDPR), we store the date, time and IP address of the visitor on this web server. This data is anonymised and retained for the purpose of compiling access statistics for our website. The access log files are deleted after 7 days; we retain them for this period to protect against tampering, hacking, etc.

Informational use

If you are using our website purely for information purposes, you are generally not required to provide any personal data.
We, or our hosting partner, temporarily store only the data that your web browser automatically transmits to us:

  • The date and time of your visit to one of our web pages
  • Your IP address

For security reasons, we store the IP address in anonymised form for a period of 7 days; we do not carry out any personal analysis of this data.

SSL encryption

To protect the security of your data during transmission, we use state-of-the-art encryption methods (e.g. SSL) via HTTPS.

Use of cookies

We use cookies on our website. Cookies are small text files that are sent from our web server to your browser during your visit to our website and are stored there.

We only use so-called session cookies (also known as temporary cookies), i.e. those that are stored temporarily solely for the duration of your use of one of our web pages. The purpose of these cookies is to continue to identify your computer whilst you are visiting our website as you move from one of our web pages to another. As we offer different languages, this session cookie is necessary to remember your language selection.

The cookies are deleted as soon as you close your browser session.

Contacting Erwin Himmelseher Assekuranz-Vermittlung GmbH & Co. KG

If you contact us by email or telephone with any enquiries, you are giving us your voluntary consent for the purpose of establishing contact and answering your questions. To do so, you must provide at least a valid email address. This is used to assign your enquiry and subsequently respond to it. Providing further data is optional. The information you provide will be stored for the purpose of processing your enquiry and for any follow-up questions. Once your enquiry has been dealt with, your personal data will be automatically deleted.

Further explanation regarding data protection in relation to brokerage services

Erwin Himmelseher Assekuranz-Vermittlung GmbH & Co. KG processes the data of customers and prospective customers (hereinafter referred to as ‘customers’) in order to provide them with the requested contractual or pre-contractual services (in accordance with Article 6 of the GDPR).

The data processed in this context, as well as the scope, nature and purpose of the processing, depend on the services to be provided and may vary.

As a rule, this includes customers’ so-called master data (or customer records), contact details, contract details and payment details.

In some cases, information relating to the circumstances or characteristics of individuals or their property is processed where this forms part of the estate agency mandate or is necessary for its execution. This may include, amongst other things, details of living circumstances, movable or immovable property.

Where data requiring special protection, such as health data, is processed, the data subject’s explicit consent is obtained (Articles 6, 7 and 9 of the GDPR).

Where necessary for the performance of the contract or due to legal requirements, we transfer data to the providers of the brokered services – usually insurance companies – in connection with cover enquiries and contract processing.

In order to fulfil our obligations to our customers, we transparently exchange data with the following institutions, depending on the nature of the order and subject to the consent of the data subject, legal authorisation or regulatory requirements:

  • Insurers and reinsurers
  • Underwriting agencies and underwriting offices
  • Other insurance brokers
  • Technical service providers
  • Credit institutions
  • Investment companies
  • Social security providers
  • Health insurance funds
  • Tax advisers, auditors & accountancy firms
  • Tax authorities
  • Legal advisers
  • Insurance ombudsmen
  • Federal Financial Services Authority

Furthermore, subcontractors (e.g. sub-agents) may be engaged.

We obtain a declaration of consent from our customers or the data subject where this is required for disclosure or transfer, which may be the case, for example, with regard to special categories of data pursuant to Article 9 of the GDPR. In all cases, notification is provided regarding the disclosure and the associated purpose.

Data is deleted once statutory warranty obligations and comparable obligations or time limits have expired, with the necessity of retaining the data being reviewed every three years; otherwise, the statutory retention obligations and time limits apply.

Furthermore, on the basis of our business interests, we store details of insurers, underwriters, other insurance brokers, suppliers and other business partners, e.g. for the purpose of contacting them at a later date. We generally store this data, the majority of which is company-related, on a permanent basis.

When you contact us (e.g. by email or telephone), your details are processed for the purpose of handling your enquiry and its follow-up. Your details may be stored in a Customer Relationship Management system (‘CRM system’) or similar information systems.

We delete enquiries and information once they are no longer required. We regularly review the necessity of storing and deleting personal data. Furthermore, statutory archiving obligations apply.

Examples of categories of customer data processed

  • Master data (e.g. names, addresses, dates of birth)
  • Contact details (e.g. email address, telephone numbers)
  • Content data (e.g. text entries, emails)
  • Usage data (e.g. access times)
  • Meta/communication data (e.g. IP addresses)
  • Financial data (e.g. bank details)
  • Health data (e.g. expert opinions, medical reports, self-disclosures)
  • Contract data (e.g. subject matter of the contract, term, customer category)

Purpose of processing

We process your data only for the purposes set out in the privacy policy and only if:

  • you have given your explicit consent;
  • the processing is necessary for the performance of a contract with you or for the implementation of pre-contractual measures taken in response to your enquiry;
  • the processing is necessary to safeguard our legitimate interests or those of a third party;
  • the processing is necessary to comply with a legal obligation.

Here are some examples of the processing of personal data:

  • Security measures (e.g. IP address, time of access to web servers, backups)
  • Responding to enquiries and communicating with our customers (e.g. address)
  • Legal requirements (e.g. archiving of business transactions, emails)
  • Provision of our contractual services as part of our core business as insurance brokers (risk identification and assessment, monitoring of insurance contracts, claims management, etc.)

Primary legal bases for processing

Where no specific legal bases are stated, the following applies:

  • Article 6(1) and Article 7 in conjunction with Article 9 of the GDPR (obtaining consent, in particular in relation to health data)
  • Article 6(1) of the GDPR (processing for the performance of a contract or in order to take steps prior to entering into a contract; processing to comply with a legal obligation; processing to safeguard a legitimate interest)

Should processing or disclosure be necessary to protect the life or physical integrity of a data subject, we also refer here to the legal basis set out in Article 6(1) of the GDPR.

Data sharing with third parties and data processors

Should we, in the course of our business, transfer personal data or grant access to it, this is done for the purpose of fulfilling a contract with our customers or carrying out pre-contractual measures at their request, or to safeguard legitimate interests, or on the basis of legal provisions or permissions obtained, in each case to selected partners and data processors.

The exchange of information with partners (e.g. insurance companies) for the purpose of fulfilling our obligations towards our customers (e.g. drafting contracts, settling claims) takes place only with prior consent.

Should we engage data processors, this is done in accordance with Article 28 of the GDPR.

Our selected partners, data processors and service providers are regularly informed about our data protection and information security policy. Furthermore, we assess our partners, data processors and service providers with regard to their data protection standards and information security. Should any non-compliance be identified, the collaboration will be terminated.

Transfer of personal data

Subject to statutory or contractual authorisations, we shall only process personal data in a third country only if the specific conditions set out in Article 44 of the GDPR are met. An exception to the processing or disclosure of personal data in a third country would only apply in the cases set out in Article 49 of the GDPR, in particular where contractual (or pre-contractual) obligations are being fulfilled or where you have given your consent.

The rights of data subjects

You may exercise the following rights at any time by contacting our Data Protection Officer:

  • Access to your data held by us and information about its processing (Article 15 of the GDPR)
  • Rectification of inaccurate personal data or completion of incomplete personal data (Article 16 of the GDPR)
  • Erasure of your data held by us (Article 17 of the GDPR)
  • Restriction of data processing where we are not yet permitted to erase your data due to a legal obligation (Article 17 of the GDPR)
  • Objection to the processing of your data by us
  • Portability of your data (data portability), provided that it has not already been erased due to legal provisions (Article 20 of the GDPR)

You may lodge a complaint with the supervisory authority responsible for you at any time (Article 77 of the GDPR).

The location of the supervisory authority depends on the federal state in which you reside, work or where the alleged infringement of your rights as a data subject has occurred.

A list of international supervisory authorities for the private sector, including their addresses, can be found at:
https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html

The supervisory authority in North Rhine-Westphalia:

State Commissioner for Data Protection and Freedom of Information
North Rhine-Westphalia
PO Box 20 04 44
40102 Düsseldorf

Tel.: 0211/38424-0
Fax: 0211/38424-10
Email: poststelle@ldi.nrw.de

Right to withdraw consent

Any consent you have given us regarding the processing of your data may be withdrawn in whole or in part at any time with future effect (Article 7 of the GDPR).

Right to object

You have the right to object to the future processing of your personal data at any time (Article 21 of the GDPR).

Deletion of data

We adhere to the principles of data avoidance and data minimisation. We store and process your personal data only for as long as is necessary to achieve the stated purposes or as required by the retention periods laid down by law.

Once the statutory retention periods have expired, the purpose of processing no longer applies, or you have withdrawn your consent, personal data will be blocked or erased on a regular basis and in accordance with statutory provisions (Articles 17 & 18 of the GDPR).

Data security

We employ various technical and organisational security measures to protect personal data that is generated or collected, in particular against accidental or deliberate manipulation, loss, destruction or unauthorised access. Our security measures are continuously improved in line with technological developments. Further information can be found in our Information Security Policy.

Data protection during the recruitment process

We process applicants’ data only in accordance with legal requirements. The processing of applicants’ data is carried out to fulfil our (pre-)contractual obligations within the recruitment process within the meaning of Article 6 of the GDPR, provided that the data processing is necessary for us (in Germany, Section 26 of the Federal Data Protection Act (BDSG) also applies).

The application process requires that we receive the applicant’s details. The necessary applicant details are otherwise set out in the job descriptions. These generally include personal details, postal and contact addresses, and the documents forming part of the application, such as a covering letter, CV and certificates. In addition, applicants may voluntarily provide us with further information.

By submitting their application to us, applicants consent to the processing of their data for the purposes of the application process in accordance with the manner and scope set out in this privacy policy.

Where, as part of the recruitment process, categories of personal data requiring special protection are provided on a voluntary basis, their processing is also carried out in accordance with Article 9(2) of the GDPR (e.g. health data, such as severe disability status or ethnic origin).

Where, as part of the recruitment process, applicants are asked to provide special categories of personal data within the meaning of Article 9(1) of the GDPR, the processing of such data is additionally carried out in accordance with Article 9(2) of the GDPR (e.g. health data, where this is necessary for the performance of the job).

Should applications be submitted to us by email, we would like to point out that emails are generally not sent in encrypted form and that applicants must ensure encryption themselves. We therefore recommend sending applications by post.

The data provided by applicants may be further processed by us for the purposes of the employment relationship in the event of a successful application. Otherwise, if the application for a vacancy is unsuccessful, the applicants’ data will be deleted. Applicants’ data will also be deleted if an application is withdrawn, which applicants are entitled to do at any time.

Deletion takes place after a period of six months has elapsed, so that we can answer any follow-up questions regarding the application and fulfil our obligations to provide evidence under the Equal Treatment Act.