Privacy Policy
The responsible handling of your personal data is a special concern to the Bundesamt für Verfassungsschutz (BfV). We want you as visitors to our website to know what data are collected at what point in time during your visit to our site and how long they will be stored and used, i.e. “processed”, by BfV under data protection law.
As an agency of the Federal Republic of Germany without legal capacity, BfV operates a website at www.verfassungsschutz.de where it informs the public of its activities and makes information easily available to the public.
During visits to our website, we process personal data only to the extent necessary. What data are needed and processed for what purposes and on what basis depends on the type of service you choose and for what purpose the data are needed.
BfV processes your personal data in compliance with the European General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG).
We have put technical and organisational safeguards in place to ensure that we and our external service providers comply with data protection law.
1. General information
1.1 Controller and data protection officer
The controller responsible for processing personal data is the
Bundesamt für Verfassungsschutz
Merianstraße 100
50765 Köln
+49(0)228 99 792-0
+49(0)30 18 792-0
Fax: +49(0)228-99/792-2915
E-mail: kontakt@bfv.bund.de
DE-Mail: poststelle@bfv-bund.de-mail.de
If you have specific questions about how your privacy is protected, please contact BfV’s data protection officer:
Datenschutzbeauftragter Bundesamt für Verfassungsschutz
Merianstraße 100
50765 Köln
+49(0)228 99 792-0
+49(0)30 18 792-0
E-mail: datenschutzreferat@bfv.bund.de
You also have the right to submit a complaint to the supervisory authority under data protection law:
Der Bundesbeauftragte für den Datenschutz und die Informationsfreiheit
Graurheindorfer Straße 153
53117 Bonn
+49(0)228/997799-0
E-mail: poststelle@bfdi.bund.de
1.2 Personal data
The term “personal data” means all information related to an identified or identifiable natural person. Natural persons are considered identifiable if they can be identified directly or indirectly, in particular by linking them to an identifier such as a name, identification number, location data or an online reference number.
1.3 Protection of minors
Anyone younger than 16 should not submit data to us without the consent of their parents or guardians.
1.4 Legal basis for processing personal data
BfV processes personal data during visits to its website at www.verfassungsschutz.de.
The legal basis for processing in this case is Article 6 (1) (e) GDPR in conjunction with Section 3 BDSG. If personal data must be processed in the individual case to meet a legal obligation, Article 6 (1) (c) GDPR applies as well in conjunction with the relevant legal provision on which the legal obligation is based.
If we obtain consent from the data subject to process personal data, Article 6 (1) (a) GDPR serves as the legal basis.
2. Data processing related to visiting this website
2.1 Data collection
Every time someone accesses our website and retrieves a file, data are temporarily saved in a log file.
Specifically, the following data are stored:
- date and time of retrieval (time stamp) and the IP address of the device or server requesting access
- details of request and destination (log version, HTTP method, referrer, user agent string)
- name of the file retrieved and amount of data transferred (requested URL and query string, size in bytes)
- whether the request was successful (HTTP status code)
The purpose of data collection is to protect our website against attacks, to ensure the technical provision of the website, to provide other services connected with the use of our website and the Internet, and to statistically analyse the use of our website in order to continuously improve it.
According to Article 6 (1) (e) GDPR in conjunction with Section 5 of the Act on the Federal Office for Information Security (BSI Act), we are also required to store data past the time of your visit in order to protect against attacks on our Internet infrastructure and federal communications technology. These data are analysed and, in case of attacks on the communications technology, needed to initiate legal and criminal proceedings. These data are anonymised after 28 days and deleted 6 months after the month of data collection has expired.
Data logged when BfV’s website is accessed are shared with third parties only if we are legally obligated to do so, or if needed for legal or criminal proceedings in case of attacks on BfV’s website. Otherwise these data are not shared with third parties. BfV does not combine these data with other data sources.
Please note that the service YouTube, which is also incorporated in BfV’s website, does store data of visitors to BfV’s website who actively use this service. YouTube stores these data in line with its privacy policy and uses them for its commercial purposes. For further information about this service provider’s handling of your personal data, please refer to the service provider’s privacy policy.
2.2 Use of cookies
BfV uses cookies on its website. Most browsers accept cookies by default. However, you can disable the storage of cookies or set your browser so that it notifies you when cookies are sent.
Use of necessary cookies
On some parts of our website, cookies are used to facilitate navigation (“session ID”) or to enable load balancing among our web servers. These session cookies do not contain personal data and expire after a session.
Specifically, these cookies are:
| AL_LB | Load balancing of all requests among the available servers | until the end of the current browser session |
| JSESSIONID | Attribution of all requests of this session to the same server in order to make proper navigation and the use of form fields possible | until the end of the current browser session |
| MATOMOTRACKING | Anonymised user behaviour tracking and statistical data collection | until the end of a calendar month |
| GSBBANNER | Showing and hiding of the cookie banner | until the end of a calendar month |
The European Commission offers an English-language information website about cookies and points out that cookies that are technically necessary to provide the website are exempt from restrictions based on data protection provisions.
2.3 Web analysis by means of Matomo
This website uses the web analysis service Matomo to analyse and optimise the use of our website. The software only runs on servers of the Federation on behalf of BfV.
- request (name of the requested file), date and time of request
- browser type/version (for example: Internet Explorer 11)
- title of the page being viewed
- URL of the page being displayed
- URL of the page displayed prior to the current page
- browser language (for example: German)
- operating system used (for example: Windows 7)
- type, model, brand of the device
- screen resolution
- plug-ins used: (for example: Flash, Java)
- referrer URL (the page previously visited directly linked to ITZBund)
- anonymised IP address
- country, region and city the request was made from
- files that were clicked on and downloaded
- clicks
- number of sent forms (depending on the URLs)
Matomo particularly serves the optimisation of our website. The information about your use of this website is collected in anonymised form. It will not be used for analysing personal data or profiling. It will not be passed on to third parties either. The analysis exclusively serves to optimise our website.
3. Processing personal data when you contact us
Personal data are processed differently depending on how you contact us: via e-mail, online form, post or telephone (hotline).
Processing the personal data you provide only serves the purpose of responding to your request. The basis for processing the data is Article 6 (1) (e) GDPR in conjunction with Section 3 BDSG or, if we explicitly ask for your consent, Article 6 (1) (a) GDPR.
3.1 Contacting BfV via e-mail
You can contact BfV via e-mail using the e-mail addresses listed on its website.
If you contact BfV via e-mail, the data you send (such as first and last name, address), but at least your e-mail address and the information contained in your message (including any personal data you provide) are processed for the purpose of contacting you and of responding to your message.
Please note that the document created by your request will be included in records/files for the purpose of responding to your message. These records/files can only be accessed by the units responsible for responding to your message and may only be used for the purpose of processing your request. The data concerned will be deleted as soon as the legal basis for their being processed does no longer exist or when they are no longer needed.
3.2 E-mail addresses of third parties
If e-mail addresses of third parties are provided on BfV’s website in connection with specific topics (please note: such e-mail addresses do not contain “bfv.bund.de” or “verfassungsschutz.de” after the @) and if you use such an address for contact, BfV is not responsible for processing the personal data.
If you have any questions about how these third parties deal with your personal data, please contact them directly.
3.3 Contacting BfV using the online forms
You can contact BfV using the online forms found on our website. You can contact us regarding various matters. You can, for example, send a message to the Internet editorial team, to the alert hotline, the career centre or the press office, order a publication or contact the units responsible for economic security or cyber defence.
The information provided through the BfV contact forms is transmitted via an encrypted https connection.
If you use this form, you will need to provide your title, first and last name and e-mail address, as well as a subject (of your choice) and a message text (maximum 1,000 characters). Without this information, your message cannot be processed.
A postal address is optional and enables us to respond by post, if requested. In addition, the date and time your message was sent will be transmitted to us.
If you send us a message via e-mail or the contact form, we will assume that we are authorised to reply via e-mail. If not, you have to explicitly indicate another means of communication.
Information submitted on this contact form is transmitted only to the organisational units of BfV that are responsible for responding to your message.
By ticking the box to accept the privacy policy and submitting the contact form, you agree in accordance with Article 6 (1) (a) GDPR to have your personal data processed. Your message will be processed only by the staff members responsible for the respective matter, according to the contact form you have chosen. Please note that the document created by your request will be included in records/files for the purpose of responding to your message. These records/files can only be accessed by the BfV units responsible for responding to your message and may only be used for the purpose of processing your request. The data concerned will be deleted as soon as the legal basis for their being processed does no longer exist or when they are no longer needed.
If you do not agree to the processing of your personal data as stated above, you may cancel the contact process at any time. In that case, your message will not be sent.
3.4 Contacting BfV by post
If you write a letter to BfV, the data you send (such as first and last name, address) and the information contained in your letter (including any personal data of third persons you may submit) will be saved for the purpose of contact and responding to your letter.
Please note that the document created by your request will be included in records/files for the purpose of responding to your message. These records/files can only be accessed by the units responsible for responding to your message and may only be used for the purpose of processing your request. The data concerned will be deleted as soon as the legal basis for their being processed does no longer exist or when they are no longer needed.
3.5 Contacting BfV by telephone
If you contact a BfV staff member by telephone, your personal data will be processed as far as necessary to respond to your concern.
If you contact BfV’s enquiry service by telephone using the phone numbers +49(0)228 99 792-0 or +49(0)30 18 792-0 , no personal data will be collected. It will be necessary to collect your personal data if you request a written response or ask to be called back. By providing the data needed for this purpose, you give your consent to the processing of your data on the basis of Article 6 (1) (a) GDPR for the purpose of responding to your concern.
In these cases, the explanation of processing and storage given in number 3.4 applies.
4. Processing personal data in the context of providing information
How personal data are processed depends on the form in which information is provided by BfV: in our e-mail newsletters or printed publications.
4.1 Data for sending newsletters
If you sign up for BfV’s e-mail newsletter, we will store your e-mail address as well as the date and time of your registration. When personalising your subscription, you have the option to voluntarily state a title, an academic degree and your last name. Your data will be processed based on your consent pursuant to Article 6 (1) (a) GDPR.
We use these data only to send the newsletters and for statistical evaluations in order to analyse system performance. We do not share your data with third parties and do not use them for any other purposes.
After you sign up for a newsletter on our website, you will receive an e-mail with a link to click on to finalise your subscription. This double opt-in system ensures that you have consciously chosen to receive the newsletter.
When you register, your data are stored on our server, and an e-mail confirming registration is sent to the e-mail address you provided; this e-mail contains a link to click on to finalise registration. If you do not click on the link to finalise registration, your data will be deleted after 48 hours. Only after you click on the link to finalise registration will your data be stored for the purpose of sending you the desired newsletter as long as your subscription continues.
If you no longer wish your data to be stored for this purpose, and thus no longer wish to subscribe to our newsletter, you may unsubscribe at any time. In that case, the data you provided will be deleted.
4.2. Ordering printed publications
If you order brochures, flyers or other printed publications using the contact form on this website, we must process your personal data in order to process your order.
The legal basis for this is Article 6 (1) (a) GDPR.
The following personal data are needed to process your order:
- title
- first name
- last name
- street address
- postal code and city or town
- e-mail address
These data are only processed to carry out your order. If we are unable to finalise your order, the data you provide will be shared with third parties (shipping company, other government agencies or institutions which send the publications). If you do not provide the necessary data, your order will not be processed. The additional information that you can provide in the contact form, i.e. the name of the company, is not necessary to process your order, although it is helpful.
The data provided by you will be deleted as soon as your order has been completed.
5. Processing personal data when using social networks
BfV is active on the social networks Twitter and Xing. In this context, BfV does not process any data of persons interacting with BfV. Information about what data are processed by Twitter and Xing and for what purpose they may be used can be found in the respective social network’s privacy policy.
This website gives you the possibility to share contents with others via the social networks Facebook, Twitter and Xing. Data are only transferred to these social networks if you actively use the share function.
BfV explicitly points out that personal data will be transferred to the respective social network when the share function is used or when BfV’s social network channels are accessed. These services process personal data according to their business models. Data processing may take place outside the Member States of the European Union. BfV has no influence on data processing by these companies, in particular the use of data, their transfer to third parties and the period of data storage.
6. Rights of data subjects
Concerning the ways of data processing described above, you have the following rights vis-à-vis BfV with regard to personal data concerning you:
- Right to withdraw consent, Article 7 (3) GDPR
If the personal data are processed on the basis of consent, data subjects can withdraw their consent at any time. The lawfulness of processing on the basis of the consent provided remains unaffected until notification has been received that consent has been withdrawn. - Right of access, Article 15 GDPR
Data subjects have the right to obtain access to the personal data concerning them that have been processed as well as to obtain further information, for example about the purpose of processing and the period for which the personal data will be stored. Exceptions to this right are governed by Section 34 BDSG in conjunction with Article 23 GDPR. - Right to rectification, Article 16 GDPR
This right enables data subjects to have inaccurate personal data concerning them corrected and – taking into account the purpose of processing – to have incomplete personal data completed. - Right to erasure, Article 17 GDPR
This right enables data subjects, under certain conditions, to have the controller delete personal data concerning them. Such data will be deleted in particular if they are no longer needed, if they were processed unlawfully or if consent covering their processing has been withdrawn. Exceptions to this right are governed by Section 35 BDSG in conjunction with Article 23 GDPR. - Right to restriction of processing, Article 18 GDPR
This right enables data subjects to temporarily prevent further processing of personal data concerning them. Such a restriction is used above all when data subjects are examining whether to claim other rights. - Right to object, Article 21 GDPR
This right enables data subjects to object, on grounds relating to their particular situation, to a further processing of their personal data which is based on Article 6 (1) (e) or (f). Exceptions to this right are governed by Section 36 BDSG in conjunction with Article 23 GDPR. - Right to data portability, Article 20 GDPR
The right to data portability enables data subjects, under certain conditions, to receive the personal data concerning them, which they have provided to a controller, in a structured, commonly used and machine-readable format from the controller and to transmit them or have them transmitted to another controller. According to Article 20 (3), second sentence of the GDPR, this right does not apply if the data processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
The aforementioned rights can be asserted in writing using the contact details provided in number 1.1. For questions and complaints, you may also contact BfV’s data protection officer. According to Article 77 GDPR, you also have the right to lodge a complaint with the supervisory authority under data protection law, the Federal Commissioner for Data Protection and Freedom of Information (cf. 1.1.).