Privacy Policy

1. Data Controller

The data controller responsible for the processing of personal data on this website is:

Investment Funds Ombudsman Service (Ombudsstelle Investmentfonds)
Bockenheimer Anlage 15
60322 Frankfurt am Main
Deutschland
Telephone: +49 711 633 9170
Email: support@ombudsstelle-investmentfonds.org

2. Data Protection Officer

We have appointed a Data Protection Officer in accordance with Article 37 of the General Data Protection Regulation (GDPR). The Data Protection Officer can be reached at the address above or by email at support@ombudsstelle-investmentfonds.org.

3. Scope and Purpose of This Policy

This Privacy Policy explains how we collect, use, store, and protect personal data when you visit this website or contact our office. We are committed to processing personal data in accordance with the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG).

4. Data We Collect

4.1 Website Access Data

When you visit our website, our server automatically records technical access data, including your IP address, date and time of access, the URL requested, the referring URL, browser type and version, and operating system. This data is collected on the basis of Article 6(1)(f) GDPR (legitimate interest in the secure and stable operation of the website). It is not linked to any individual user and is deleted after a maximum of 30 days.

4.2 Contact Form Data

When you submit a message via our contact form, we collect the personal data you provide, including your name, email address, telephone number (if provided), and the content of your message. This data is processed on the basis of Article 6(1)(b) GDPR (processing necessary for the performance of a contract or pre-contractual measures) or Article 6(1)(a) GDPR (your consent), and is used solely for the purpose of responding to your inquiry.

4.3 Complaint Procedure Data

If you formally submit a complaint through our office, we process additional personal data necessary to administer the ombudsman procedure. The legal basis for this processing is Article 6(1)(b) GDPR. Data relating to formal complaint proceedings is retained for a period of ten years in accordance with applicable legal obligations.

5. Cookies

This website uses only technically essential cookies that are necessary for the proper functioning of the site. We do not use tracking cookies, analytics cookies, or advertising cookies. Further details are set out in our Cookie Policy.

6. Recipients of Personal Data

We do not sell, rent, or otherwise transfer your personal data to third parties for commercial purposes. Personal data may be shared with the following categories of recipients where necessary:

• The investment fund company against which a formal complaint has been lodged, to the extent required for the administration of the dispute procedure
• Technical service providers engaged by us under data processing agreements (e.g. website hosting)
• Regulatory authorities, where disclosure is required by law

7. Transfers Outside the EEA

We do not ordinarily transfer personal data outside the European Economic Area (EEA). Where any service provider is located outside the EEA, we ensure that appropriate safeguards are in place in accordance with Chapter V of the GDPR.

8. Your Rights

Under the GDPR, you have the following rights with respect to your personal data:

• Right of access (Article 15 GDPR): You have the right to obtain confirmation of whether we process your personal data and to receive a copy of such data.
• Right to rectification (Article 16 GDPR): You have the right to request correction of inaccurate personal data.
• Right to erasure (Article 17 GDPR): You have the right to request deletion of your personal data, subject to applicable legal retention obligations.
• Right to restriction of processing (Article 18 GDPR): You may request that we restrict the processing of your data in certain circumstances.
• Right to data portability (Article 20 GDPR): Where processing is based on consent or contract and carried out by automated means, you may request a structured, machine-readable copy of your data.
• Right to object (Article 21 GDPR): You may object to processing based on legitimate interests at any time.
• Right to withdraw consent: Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact our Data Protection Officer at the address stated in Section 2. We will respond to your request within one month in accordance with Article 12 GDPR.

9. Right to Lodge a Complaint with a Supervisory Authority

You have the right to lodge a complaint with the competent data protection supervisory authority if you believe that our processing of your personal data infringes the GDPR. The competent supervisory authority for our office is the Hessian Commissioner for Data Protection and Freedom of Information (Hessischer Beauftragter für Datenschutz und Informationsfreiheit), Gustav-Stresemann-Ring 1, 65189 Wiesbaden.

10. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. Our website is served via HTTPS using current TLS encryption standards.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The date of the most recent revision is indicated at the top of this page. We encourage you to review this policy periodically.