Information on data processing in accordance with Articles 13 and 14 DS-GVO

Responsible body:

BARMER, Axel-Springer-Str. 44, 10969 Berlin
Telephone: 0800 333 10 10
E-mail: service@barmer.de.

Contact details of the data protection officer:

BARMER, Data Protection Officer, Lichtscheider Straße 89, 42285 Wuppertal
Postal address: BARMER, Data Protection Officer, 42266 Wuppertal
E-mail: datenschutz@barmer.de

Processing purposes

We use your data to fulfil our legal mandate. Below we inform you about the individual processing purposes in health and long-term care insurance:

Health insurance (§ 284 SGB V)

• Determination of the insurance relationship and membership, including the data required for the initiation of an insurance relationship
• Issuing authorisation certificates and the electronic health card
• Determination of the obligation to pay contributions and the contributions, their coverage and payment

Long-term care insurance (§ 94 SGB XI)

• Determination of the insurance relationship and membership
• Determination of the obligation to pay contributions and the contributions, their coverage and payment

In addition, BARMER may process data on the basis of express declarations of consent in accordance with Article 6(1a) GDPR in conjunction with Section 67b(2) of the Tenth German Social Code (SGB X). Consent is voluntary and can be revoked at any time with effect for the future.

We may only process your data for other purposes if

1. the data are necessary for the fulfilment of tasks under other legal provisions of the Social Code than those for which they were collected
2. it is necessary to carry out a specific scientific research or planning project in the area of social benefits and the requirements of Section 75 (1), (2) or (4a) sentence 1 SGB V are met.

Obligation to provide and consequences of non-provision

As part of the fulfilment of our tasks, you must provide the personal data required in individual cases or which we are legally obliged to collect in accordance with Sections 60 et seq. First Book of the German Social Code (SGB I), you must provide the personal data that is required in individual cases or that we are legally obliged to collect. Without this data, we will generally not be able to fulfil our tasks conclusively or comprehensively, which may result in disadvantages for you, e.g. in the context of granting benefits.

Voluntary information such as telephone number or e-mail address is expressly excluded from this data. If you do not provide this data, this does not constitute a breach of your duty to co-operate and you will not suffer any disadvantage as a result. If the evidence submitted contains data that is not required, it can be blacked out.

Your social data processed by BARMER is subject to the data protection provisions of SGB I, X, the Federal Data Protection Act (BDSG) and also the General Data Protection Regulation (GDPR). BARMER ensures that social confidentiality is maintained in accordance with Section 35 SGB I.

Automated individual decision-making including profiling

In certain business processes, we make decisions based exclusively on automated processing. In doing so, we comply with Art. 22 of the General Data Protection Regulation (GDPR).

In the case of simply structured administrative procedures that can be checked and decided by machine according to a certain scheme, we may make decisions (administrative acts) fully automatically (Section 31a of the Tenth Book of the German Social Code - SGB X). We take into account all information that is relevant to the decision, i.e. that may affect the outcome of the decision. If the information provided by the party involved requires this, we will review the decision personally.

After a fully automated review of the legal requirements, we decide on the application. We will state the main reasons that led to the decision. If you do not agree with the decision, you can have it reviewed by BARMER employees. You may present your own point of view to us and you may contest the decision.

In some cases, we also process data automatically with the aim of evaluating certain personal aspects to the extent permitted by law (profiling). We use profiling, for example, to inform and advise you about products in line with your needs. You can object to processing for advertising purposes. We do not use profiling for the purposes of membership, the granting of benefits or the calculation of contributions in accordance with the provisions of the German Social Code.

Categories of recipients

Within BARMER, those departments that require your data to fulfil our contractual and legal obligations will have access to it.

If necessary, BARMER transmits social data to the following recipients on the basis of statutory provisions of the SGB or other legal provisions:

• German Pension Insurance,
• Federal Labour Office,
• statutory accident insurance,
• to financial institutions in the context of payment transactions,
• Federal Insurance Office for the Health Fund,
• Employers and paying agents,
• pension administration,
• Defence administration,
• financial administration,
• service providers,
• Medical service of the health insurance,
• Transmission in individual cases according to §§ 67d ff. of SGB X,
• Contract service providers in accordance with Art. 28 GDPR in conjunction with Section 80 SGB X.

If your data is passed on to BARMER's contract service providers, we have taken technical and organisational measures to ensure that the data protection regulations are observed.

If a transfer is made to a recipient within a category, you will be informed about the recipient unless one of the exceptions under Section 82 (1) and (2) SGB X or the requirement of Art. 13 (4) GDPR applies. This means that the obligation to provide information does not apply if the data subject already has the information, if the storage or disclosure of the personal data is expressly regulated by law or if informing the data subject proves impossible or involves a disproportionate effort.

Data transfer to a third country

BARMER does not transfer any personal data to bodies in third countries (outside the EU or the EEA) or international organisations.

Duration of data storage

The deletion of the data provided by a data subject usually takes place

1. if they are not required for contract fulfilment or other retention obligations and legal reasons
2. when a given consent is revoked
3. if data storage is not permitted for other legal reasons
4. if the deletion is necessary to fulfil a legal obligation, statutory retention obligations or other legal reasons

Depending on the purpose of processing, there are different retention periods for social data, which are regulated in § 110a SGB IV, § 304 SGB V, § 107 SGB XI and in the General Administrative Regulation on Accounting in Social Insurance (SRVwV). If your personal data is no longer required for the above-mentioned purposes and does not need to be retained due to legal provisions, it will be deleted on a regular basis.

We process your personal data exclusively within the framework of the statutory provisions. This includes the following categories of personal data/social data:

Social data of members and insured persons

Personal data:

• Surname, first name
• Address, surname
• Date of birth
• E-mail address
• Bank details
• Gender

Data of the interested parties

• Organisational features
• Surname, first name
• Address details
• Telephone number
• E-mail address

If BARMER processes your personal data, you can exercise the following rights via the contact details provided in the section "Contact details of the controller, the data protection officer and our supervisory authorities" if the legal requirements are met:

• In the case of data processing based on consent, you have the right to withdraw this consent at any time with effect for the future.
• The rights arising from Articles 15, 16, 17, 18, 20 and 21 GDPR (right of access, right to rectification of inaccurate data, right to erasure, right to restriction of processing, right to data portability, right to object).
• The right to contact BARMER's data protection officer to raise your concerns (Art. 38 para. 4 GDPR).
• The right to lodge a complaint with a competent supervisory authority for data protection. To do so, you can contact the competent supervisory authority of BARMER.

The aforementioned rights can only be fulfilled by BARMER if the data to which the asserted claims relate can be clearly assigned to your person.

If you have any technical questions or questions about the use of your personal data by BARMER, please contact us first - either by e-mail at service@barmer.de or by telephone on 0800 333 1010 (calls from German landlines and mobile phones are free of charge for you). You can reach us by post at BARMER, 42266 Wuppertal.

You can also contact our data protection officer by e-mail at datenschutz@barmer.de. You can contact our data protection officer by post at BARMER, Data Protection Officer, 42266 Wuppertal.

The contact details of our supervisory authorities are

• The Federal Commissioner for Data Protection and Freedom of Information Graurheindorfer Str. 153, 53117 Bonn, e-mail: zast@bfdi.bund.de.
• Federal Social Security Office, Friedrich-Ebert-Allee 38, 53113 Bonn, e-mail: poststelle@bas.bund.de.