Privacy - APK Vorsorgekasse

IV. Data processing in the administration of contributions

Personal data

The term ‘personal data’ covers any information relating to natural persons directly or indirectly (such as names, addresses or gender). We ascertain, process and store personal data to the extent we need them for operating a corporate staff and self-employment provision fund, and data which are supplied to us by contribution-paying employers or independent contractors. Additionally, we process personal data which we get from you direct (e.g. self-employed pension provision for attorneys-at-law, in the context of disposal of severance pay entitlements, changes of address). These data are processed by us for this purpose:

Contracting partners: Enterprises

Name of company, company register extract, beneficial owner (name, date of birth, gender, nationality, address), authorised representative/s (name, date of birth, gender, copy of photo ID), line of business, contribution account number, contact (name, email, phone number)

Contracting partners: Self-employed

Name, date of birth, gender, social security number, address, type of self-employed activity, copy of photo ID

Administration of severance pay entitlements

Data provided by the Federation of Austrian Social Insurance Institutions, such as name, title, gender, date of birth, social security number, home address, employer, qualifying period for benefits, proof of contribution base, date of retirement, date of death

Customer services

Phone memos, written communication (email, facsimile, letter)

Disposal of accrued benefits

Request for disposal, copy of photo ID, bank certificate, surviving dependants, (name, date of birth, home address, bank details, copy of photo ID), devolvement order, death certificate, family allowance documentation

With a client’s consent (to facilitate the provision of information on disposal):

email address, phone number

Legal basis and purpose of processing

Processing data in compliance with our contractual obligations (Article 6 para 1b GDPR)

Your personal data are processed on the basis of your enrolment contract pursuant to the Corporate Staff and Self-Employment Provision Act (BMSVG).

The purpose of data processing is governed by BMSVG; it comprises the taking on deposit, and investing, of severance pay contributions and self-employed provision contributions, the administration of accrued severance pay entitlements and subsequent disbursement as well as the provision of pertinent information to prospective beneficiaries (Corporate staff and self-employment provision agenda).

Should you not furnish these data, or not to the extent required, we may not be able to justify the contractual relationship in your favour or comply with your request for disposal.

Processing data on the basis of your consent (Article 6, para 1a, GDPR)

Insofar as you have given your consent to the processing of your personal data for specific purposes (e.g. information relating to disbursement via email, telephone contacts, newsletter), processing is lawful, since based on your consent. Such consent may be withdrawn at any time. This also applies to withdrawing any declaration of consent given us prior to GDPR taking effect. Please note that such withdrawal is valid only as of the date it is made and does not impact the lawfulness of any processing based on previously given consent.

In some cases, it may be essential to fulfilling our contractual obligations for you to provide further personal data, or arrange for the provision of data of/by third parties, e.g., relating to the disposal of your severance pay entitlements. Should we not be furnished with these data, or not to the extent required, we cannot act on your request for disposal. Please note that this shall not constitute contractual nonfulfillment on our part.

Processing data in compliance with statutory provisions (Art. 6, para 1 c, GDPR)

Pursuant to the legal provisions of the Corporate Staff and Self-Employment Provision Act, employers and prospective beneficiaries are obliged to furnish the corporate staff and self-employment provision funds immediately and truthfully with information about all crucial issues relating to the contractual agreement, the administration of accrued benefits, and the scrutiny of entitlements to disbursal. Furthermore, as a corporate staff and self-employment provision fund, we are subject to legal constraints such as the Financial Markets Anti-Money Laundering Act. In consequence, we are obliged to demand proof of identity for the prevention of fraud and money laundering.

Processing data to protect legitimate interests (Article 6, para 1f, GDPR)

Additionally, your data may be processed in order to protect legitimate interests on our part, e.g., in matters of conducting our business and evolving processes, safeguarding IT security and IT operations, including tests, in-house risk management as well as in the course of a judicial prosecution.

Data transfer to third parties

Pursuant to Section 1, para 1 Z 21, Banking System Act (BWG), we are subject to banking secrecy pursuant to Section 38, Banking System Act. Hence we are obliged to maintain secrecy with regard to all client-related information and data. Personal data are provided in-house only to those divisions or members of staff who require them for discharging their contractual or statutory duties or for protecting legitimate interests.

Additionally, our subcontracted partners (e.g., IT service providers or postal service providers) are only granted access to your data if they need them for fulfilling specific tasks. Without exception, data will only be transferred to other external recipients if you have given your personal consent (e.g., on your instructions, data are transferred to other corporate staff provision funds), if we are legally obliged or authorised, or in the case of overarching legitimate interests.

Duration of data storage

As a matter of principle, we store your data for the duration of a valid contractual relationship with us. Beyond that, we are subject to numerous restrictions on data storage, in accordance with which we are obliged to store data about you or third parties (e.g., entitled third parties) or your disposals beyond the termination of the contractual relationship, as is the case on account of the limitation period provisions enshrined in company law. Additonally, we also store your data as long as it is possible for you to file legal claims arising from our contractual relationship, which, depending on the case, can be up to 30 years in accordance with the Civil Code.