Status: May 2025
Data protection and data security for our contractual partners and consumers have always been a high priority for our company. That is why the protection of your personal data throughout our business processes is very important to us and a particular concern. Respecting this personal right is a matter of course for us. In general, it is not necessary for you to provide personal data in order to use our website. However, we may need your personal data in order to provide our services. We collect, process and use personal data insofar as this is legally permissible and necessary for processing or you have given your consent.
As the controller, we, SCHUFA Holding AG, Kormoranweg 5, 65201 Wiesbaden, Germany, take all legally required measures to protect your personal data. You can contact our company data protection officer at the above address, Attn: Data Protection Department or by e-mail at
3.1 Accessing our website
When you visit our website, the browser used on your device automatically sends information to the server of our website and stores it temporarily in a log file. We have no influence on this. The following information is also recorded without any action on your part and stored until it is automatically deleted:
- the IP address of the requesting internet-enabled device
- the date and time of access
- the name and URL of the retrieved file
- the website/application from which the access was made (referrer URL)
- the browser you are using and, if applicable, the operating system of your internet-enabled computer and the name of your access provider.
We use the IP address of your end device and the other data listed above for the following purposes:
- Ensuring a smooth connection setup,
- To ensure a comfortable use of our website,
- Evaluation of system security and stability.
The data is stored for a period of 31 days and then automatically deleted. We also use cookies, tracking tools and social media plug-ins for our website. The exact procedures involved and how your data is used for this are explained in more detail in sections 7 and 9.
3.2 Data processing for requests from data subjects
We collect, process and use personal data insofar as this is necessary to process your request, for example insofar as this is necessary to process your application for opening and to carry out an arbitration procedure or for general inquiries about your data. In this context, we also process personal data for internal purposes (e.g. updating our SCHUFA database or further development and optimization of our processes based on the evaluation of inquiries). You can find more information on the SCHUFA procedure at
3.3 Data processing when using the contact forms for interested companies
Registration forms for SCHUFA events, SCHUFA webinars, contact forms as part of marketing campaigns and when registering and using our contractual partner portal SCHUFA4Business
We collect, process and use personal data insofar as this is necessary to process your request (e.g. to enable you to use the SCHUFA contract partner portal) and to transfer it to our CRM system or to the user administration of the SCHUFA4Business contract partner portal. We also use your data as part of the webinar registration to contact you by post, telephone or e-mail about interesting SCHUFA products and services or products of our cooperation partners. We also use your data as part of this process to update our SCHUFA database. You can find more information on the SCHUFA procedure at
3.4 Data processing of media contacts
We collect, process and use personal data insofar as this is necessary to provide the information published by our company or to contact you as requested. We also use your data to inform you about company news by e-mail or telephone, for example to send you press releases. When we contact you, we are guided by the relevance of our message and the thematic focus of your journalistic work.
3.5 Data processing for competitions
In the case of competitions, we use your data for the purpose of notifying winners and advertising our offers. You may find detailed information in our conditions of participation for the respective competition.
3.6 Data processing of applicant data (e.g. when using our application form or at career fairs etc.)
We collect, process and use personal data insofar as this is necessary to process your application and to contact you as requested.
After the retention period has expired, personal data is completely anonymized. The anonymized data is used exclusively for statistical evaluations and to optimize our recruiting processes (e.g. process indicators, quality assurance). It is not possible to draw conclusions about individual persons. The legal basis is the legitimate interest (Art. 6 para. 1 lit. f) GDPR) in the analysis, quality assurance and optimization of our recruiting processes and the creation of statistical evaluations.
3.7 Data processing in the context of the SCHUFA IdentChecker
We need your data to provide the SCHUFA-IdentChecker product. We process the personal data you enter by comparing it with a database for data leaks and showing you the result of the comparison. Immediately after data processing, the personal data is deleted.
3.8 Data processing in the context of the consumer self-service portal
If you have received a data copy in accordance with Art. 15 GDPR or a SCHUFA credit report, you can log in to the Consumer Self-Service Portal after entering your SCHUFA ID (SCHUFA data record number), your date of birth and the document date and send SCHUFA correction requests regarding inquiries from SCHUFA's contractual partners about your person. When using the Consumer Self-Service Portal, you also have the option of entering your e-mail address so that we can inform you of the processing status. In this case, we process your e-mail address exclusively for the purpose of informing you about the processing status and the completion of the processing. Your e-mail address will be stored for the duration of processing. It will be deleted once your request has been fully processed.
If you want to find out about the retention period of a payment disruption in the SCHUFA database on your person, you can view the current retention period of the payment disruption in question by entering the file number of the payment disruption in question, your surname, first name, gender, date of birth and your address and, if applicable, your postal address. The information you enter will only be processed for the purpose of identifying and displaying retention periods, in particular it will not be transferred to the SCHUFA database and will be stored for a period of only 48 hours after the request to check and rectify possible technical errors.
3.9 Data processing for advertising purposes and market and opinion research
3.9.1 Advertising purposes of SCHUFA Holding AG and third parties
If you have concluded a contract with us or we have you as a prospective customer, we process your address data and advertising selection criteria on the basis of Art. 6 (1) (a) or (f) GDPR in order to send you such information and offers from us and other companies. If you do not wish us to do so, you can object to the use of your data for advertising purposes at any time.
3.9.2 Use of data for market and opinion research
We also process your data for market and opinion research. We use this data exclusively in anonymized form for statistical purposes and only for SCHUFA Holding AG. Your answers to surveys are not passed on to third parties or published. We do not store the answers from our surveys together with your e-mail address or other personal data. You can object to the use of data for market and opinion research at any time, either in full or for specific measures, without incurring any costs other than the transmission costs according to the basic rates. A message in text form to the contact details given below (e.g. e-mail, fax, letter) is sufficient for this. Of course, you will also find an unsubscribe link in every survey e-mail.
3.9.3 Right of objection
You can object to the use of your personal data for advertising purposes at any time, either as a whole or for individual measures, without incurring any costs other than the transmission costs according to the basic rates. A notification in text form to SCHUFA Holding AG, Kormoranweg 5, 65201 Wiesbaden or to
If you object, the contact address concerned will be blocked for further advertising data processing. We would like to point out that in exceptional cases, advertising material may still be sent temporarily even after we have received your objection. This is technically due to the necessary lead time for advertisements and does not mean that we will not implement your objection. Thank you for your understanding.
3.9.4 Personalization of advertising emails (marketing profiling)
If you have given us your consent to do so, we use automated processing methods to adapt the content of advertising emails to your interests (profiling). The processing is used exclusively for personalized advertising by e-mail. It is not used for any other purposes. The legal basis is your consent in accordance with Art. 6 para. 1 lit. a) GDPR, which you can revoke at any time with effect for the future.
3.10 Data processing in the event of complaints/information in accordance with the Supply Chain Due Diligence Act (LkSG)
We collect, process and use personal data insofar as this is necessary to process your complaint or your notification in accordance with Section 8 LkSG (e.g. to document your submission, to send a confirmation of receipt or, in the event of queries, to clarify the facts of the case).
3.11 Data processing when using Microsoft Teams
We use Microsoft Teams (hereinafter "Teams") to conduct online meetings, presentations, training courses, seminars or similar formats (hereinafter "meetings") with customers, interested parties, applicants, service providers or other external parties.
Teams is operated by: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18D18 P521, Ireland
It is usually used via the Teams app, but can also be used via the respective browser. Meetings are generally not recorded. In exceptional cases, recordings are only made with the consent of the participants.
A user can read the chat history retrospectively and without participating in a meeting as long as the meeting was invited from a team and they themselves are part of this team. The chat history of meetings can therefore always be read.
When using Teams, documents can be shared in various file formats (Word, PDF, etc.) and made visible to all members of the respective team/meeting.
3.12 Data processing when using the Trust Center
We operate a Trust Center for the transparent provision of information on information security, data protection and our compliance certifications and measures.
We use an external service provider (Vanta Inc., 55 Montgomery Street, Suite 1600, San Francisco, CA 94111, USA) for the provision and operation of the Trust Center.
Personal data is processed to enable access to security-relevant documents (e.g. certifications, guidelines), to process inquiries from interested parties, customers and partners on security and data protection issues, to manage access to protected content (e.g. via access restrictions) and to ensure the IT security and integrity of the Trust Center.
Vanta acts for us within the framework of order processing in accordance with Art. 28 GDPR. A transfer of personal data to the USA cannot be ruled out in certain cases, for example when Vanta provides support or administration services. To protect your data, Vanta uses the standard contractual clauses approved by the EU Commission in accordance with Art. 46 para. 2 lit. c) GDPR as well as additional technical and organizational measures.
Further information on data protection at Vanta can be found at:
SCHUFA processes personal data on the basis of the provisions of the General Data Protection Regulation (also with the help of service providers). Processing is based on consent (Art. 6 (1) (a) GDPR) and on Art. 6 (1) (b) and (f) GDPR, insofar as the processing is necessary for the performance of a contract to which the data subject is a party or for the implementation of pre-contractual measures or insofar as the processing is necessary to safeguard the legitimate interests of the controller or a third party and does not outweigh the interests or fundamental rights and freedoms of the data subject which require the protection of personal data. Processing operations carried out by SCHUFA within the framework of a legal obligation to which it is subject are based on Art. 6 para. 1 letter c) GDPR. We also process your address data and advertising selection criteria on the basis of Article 6(1)(f) GDPR in order to send you such information and offers from us and other companies. If you do not wish this, you can object to the use of your data for advertising purposes at any time. Consent can be withdrawn from SCHUFA at any time. This also applies to consent given before the GDPR came into force. The withdrawal of consent does not affect the lawfulness of the personal data processed until the withdrawal.
5.1 We process the data required for online inquiries from data subjects. This includes the following categories:
Personal data, e.g. surname (including previous names, if applicable, which are provided upon separate request), first name, date of birth, place of birth, address, previous addresses and communication data, ID data.
5.2 In the context of data processing when using the contact forms for interested companies, registration forms for SCHUFA events, for SCHUFA webinars, contact forms in the context of marketing campaigns and when registering and using our contractual partner portal SCHUFA4Business, we process the data required for this purpose. This includes the following categories:
- Personal master data (title, first name, surname, address, position in the company, company master data)
- Communication data
- Usage data
- Processing data
- Marketing data (e.g. consent)
- Login information (e.g. SCHUFA4Business)
When you participate in webinars offered by us, our webinar system generates the following reports:
- Evaluation of the feedback forms (see participant report for questions)
- Questions asked by participants during the event will be saved. (Questions from participants are usually asked in writing. The microphone is muted).
- Registration date/time
- Duration of participation
- Interest/attention (evaluation of whether the participant followed the event in its entirety or whether they worked on the side - percentage value)
- Events could be recorded. (This has rarely or never been used to date).
- Companies that are not yet SCHUFA-VP can also take part in webinars. (special events for interested parties)
5.3 We process the following data as part of data processing for competitions:
- Personal master data
- Communication data
- Consent data
5.4 We process the following data as part of applicant management:
- Personal master data (surname, first name, address)
- Communication data
- Other data from the application documents (e.g. matriculation certificates, certificates, information on marital status, etc.)
5.5 We process the following data as part of the SCHUFA-IdentChecker:
- E-mail address
- Credit card number
- IBAN
- Identity card number
- Passport number
- Driver's license number
- Mobile phone number
5.6 We process the following data as part of the personalization of advertising emails:
- Communication data (e.g. e-mail address)
- Usage and response data in connection with emails (e.g. opening and click behavior),
- if applicable, further information from an existing business relationship or from information provided by you.
5.7 We process the following data in the context of media contacts:
- Personal master data (surname, first name)
- Company data (medium, address)
- Communication data (e-mail address, telephone, department, position)
5.8 We process the following data in the context of complaints/reports in accordance with the LkSG:
- Personal master data (title, surname, first name)
- Address or e-mail address
5.9 We may process the following data when you use Microsoft Teams:
The specific scope of the data also depends on which data details are provided when using Teams.
- User data: e.g. display name, e-mail address. Profile information.
- Meeting data: e.g. date, time, meeting ID, telephone numbers, location
- By using the chat function, users have the option of sharing text messages with other participants. The corresponding personal data is processed insofar as this results from the text messages.
Audio and video data from the meetings are processed by Microsoft under its own responsibility as a telecommunications provider.
5.10 The following data may be processed as part of the provision of the Trust Center:
- Contact data (e.g. name, e-mail address, company)
- Access and usage data (e.g. IP address, time of access, requested content)
- Communication data in the context of inquiries
All information that you provide to us by entering it on these web pages is stored on a server located in a country in the European Union ("EU") and forwarded to the responsible departments within the company to process your inquiries and requests. If your personal data is used to update the SCHUFA database, this data will also be made available to contractual partners as part of the SCHUFA services. Further information on the SCHUFA procedure can be found at
Service providers used by us may also receive data from us in order to fulfill the prescribed purposes. These may be companies in the categories of IT services, printing services, marketing, sales or telecommunications, for example.
When conducting an arbitration procedure, we forward the necessary personal data to the SCHUFA Ombudswoman.
7.1 Cookies - General information
Cookies are small files that your browser automatically creates and that are stored on your end device (laptop, tablet, smartphone, etc.) when you visit our website. Cookies do not cause any damage to your end device and do not contain any viruses, Trojans or other malware. Information is stored in the cookie that results in each case in connection with the specific end device used.
Cookies can be used without consent or with consent. Cookies that do not require consent are those that are necessary to use our online services or that serve IT security (necessary cookies). The legal basis for data processing is Article 6(1)(f) GDPR. Cookies requiring consent, on the other hand, serve to make the use of our website more pleasant for you (preference cookies). For example, we use cookies to recognize that you have already visited individual pages of our website or that you have already logged into your customer account. In addition, we also use temporary cookies for the purpose of user-friendliness, which are stored on your end device for a specified period of time. If you visit our site again to use our services, it is automatically recognized that you have already visited us and which entries and settings you have made so that you do not have to enter them again.
On the other hand, we use cookies to statistically record the use of our website and to evaluate it for the purpose of optimizing our offer for you and to display information specifically tailored to you (marketing and statistics cookies). The legal basis for data processing for cookies requiring consent is Article 6(1)(a) GDPR. This data includes page views, length of stay, origin, country, etc. We analyze this statistical information in order to improve our offer and check the acceptance of individual websites. Invisible GIFs are only used to position elements on the website. No other functions are associated with the invisible GIFs used. These cookies are stored by your browser and are usually deleted when you close the browser. Most browsers accept cookies automatically. However, you can configure your browser so that no cookies are stored on your computer or a message always appears before a new cookie is created. However, completely deactivating cookies may mean that you cannot use all the functions of our website. The storage duration of cookies depends on their purpose and is not the same for everyone.
We recommend that you always log out completely when you have finished using shared computers that are set to accept cookies.
You can see which cookies we are currently using at any time
7.2 Friendly Captcha (bot/spam protection)
Our website uses the "Friendly Captcha" service
7.3 CDN (Content Delivery Network)
For the purpose of delivering and providing our website, its content is provided by a so-called CDN (Content Delivery Network), depending on the user's location. Such a CDN is used for security and load distribution when operating the website. When our website is accessed, the data described in section 3.1 (Accessing our website) (e.g. IP address) may also be processed for the aforementioned purposes. Depending on the user's location, we may also process the data described above in other third countries outside the EEA, including third countries without an adequacy decision.
7.4 etracker
Our website uses the "etracker" service from etracker GmbH, Erste Brunnenstraße 1 20459 Hamburg (https://www.etracker.com) to analyze usage data. This also involves the use of etracker cookies. The data generated with etracker is processed and stored by etracker on our behalf exclusively in Germany
Data processing in the context of the consent-based etracker cookie solution is based on consent in accordance with Art. 6 para. 1 lit. a) GDPR and § 25 para. 1 sentence 1 TTDSG. A more detailed description of consent-based data processing can be found in the description in the cookie management.
Further data processing in the context of the etracker services used is carried out on the basis of legitimate interest in accordance with Art. 6 para. 1 lit. f) GDPR. The purpose of data processing on the basis of legitimate interest is to optimize our online offering and our website. Data that may allow a reference to an individual person, such as the IP address, login or device identifiers, are anonymized or pseudonymized as soon as possible. No other use, combination with other data or forwarding to third parties takes place.
You can object to the data processing described above at any time by clicking on the slider. The objection has no negative consequences. If no slider is displayed, data collection has already been prevented by other blocking measures.
Further information on data protection at etracker can be found here
We use the service of HubSpot Germany GmbH, Am Postbahnhof 17, 10243 Berlin, for the management of contact and customer relationships (CRM), the implementation of double opt-in processes, the management of newsletter and subscription services and, if you have consented to this, for the sending and personalization of advertising emails via the "HubSpot Enterprise Customer Platform".
HubSpot acts for us within the framework of order processing in accordance with Art. 28 GDPR. The processing of personal data for CRM, service and transactional purposes is carried out to fulfill contractual or pre-contractual measures in accordance with Art. 6 para. 1 lit. b GDPR or on the basis of our legitimate interests in accordance with Art. 6 para. 1 lit. f) GDPR.
The use of data processed in HubSpot for the purposes of marketing personalization (profiling) is based exclusively on your consent in accordance with Art. 6 para. 1 lit. a GDPR and is limited to the purposes described in section 3.9.4.
A transfer of personal data to the USA cannot be ruled out in certain cases, for example when HubSpot provides support or administration services. To protect your data, HubSpot uses the standard contractual clauses approved by the EU Commission in accordance with Art. 46 para. 2 lit. c) GDPR as well as additional technical and organizational measures.
Further information on data protection at HubSpot can be found at:
SCHUFA is active on social networks in order to provide information and communicate with interested parties and provide insights into our activities. The platforms currently used include in particular Facebook, Instagram, TikTok, LinkedIn and Bluesky.
When using these platforms, personal data is processed both by us as the operator of the respective accounts and by the respective platform operators.
Below we inform you about the data processing in connection with our social media presences and which data protection declarations of the respective platform operators you can access in addition.
9.1 Facebook
We operate the Facebook page
Joint responsibility pursuant to Art. 26 GDPR: We and Meta are jointly responsible for certain data processing in connection with so-called Page Insights functions. This data includes, for example, the IP address and your interactions with our site (e.g. "Like" information, comments). You can find the joint responsibility agreement at:
Purposes of the processing:
- Provision and optimization of content on our Facebook page,
- Analysis of user behavior using Facebook Insights for market research, advertising purposes and placement of targeted ads
- Processing of inquiries and
- Contact us.
Legal basis: The processing of personal data is based on your consent in accordance with Art. 6 para. 1 lit. a) GDPR, if you have given it. For the use of Facebook Insights, we rely on our legitimate interest pursuant to Art. 6 para. 1 lit. f) GDPR, in particular our interest in optimizing our content and reach. Details on the processing of your data by Meta can be found in Facebook's data policy at
Data transfer: Meta may transfer data to third countries (e.g. USA) and states that it takes appropriate protective measures in accordance with Art. 44 et seq. GDPR.
9.2 Instagram account
We operate the Instagram account
Purposes of the processing:
- Provision and optimization of content on our Instagram page,
- Communication with interested parties
- Statistical evaluations (aggregated usage data from Meta).
Legal basis: The processing of personal data is based on your consent in accordance with Art. 6 para. 1 lit. a) GDPR, if you have given it. For the use of Instagram Analytics, we rely on our legitimate interest pursuant to Art. 6 para. 1 lit. f) GDPR, in particular our interest in optimizing our content and reach. Details on the processing of your data by Meta can be found in Instagram's data policy at https://privacycenter.instagram.com/policy.
Further information can be found here:
9.3 TikTok
We operate the TikTok account
Joint responsibility pursuant to Art. 26 GDPR: Insofar as we receive aggregated statistics ("TikTok Insights") from TikTok about the use of our profile, there is joint responsibility. This data does not allow us to identify individual users.
Purposes of the processing:
- Analysis of user behavior to optimize our offer,
- Communication with interested parties
- Reach measurement and marketing of our content.
Legal basis: For the use of TikTok Insights, we rely on our legitimate interest in accordance with Art. 6 para. 1 lit. f) GDPR, in particular our interest in carrying out data analyses and statistical recording of the use of our TikTok profile, in optimizing our offer for you, in marketing our contributions and videos on our website and in continuously improving and managing our offer and our services.
Data transfer: TikTok may also transfer personal data to third countries (in particular to the USA) and states that it takes appropriate protective measures in accordance with Art. 44 et seq. GDPR.
Further information on data processing can be found in TikTok's privacy policy at:
9.4 YouTube
We operate the YouTube channel
When you visit our YouTube channel, Google processes your personal data as an independent controller. This includes in particular your connection data (e.g. IP address, information about your end device, browser type and settings, operating system, mobile network, app version) as well as your usage behavior on YouTube (e.g. videos viewed, search terms, interactions).
If you are logged in to YouTube during your visit, this data can be assigned to your profile. We would like to point out that we have no complete influence on the data processed by Google and its further use.
Purposes of the processing:
- Provision and optimization of our video content
- Communication with interested parties
- Reach measurement and marketing of our content.
Legal basis: The processing of your data in the context of the use of our YouTube channel is based on our legitimate interest (Art. 6 para. 1 lit. f) GDPR) in effective communication and interaction with users and the optimization of our video content.
Data transfer: Google may transfer your data to countries outside the EU/EEA, in particular the USA. In doing so, Google states that it will take appropriate protective measures in accordance with Art. 44 et seq. GDPR.
Further information on data processing by Google can be found in Google's privacy policy:
9.5 LinkedIn
We maintain a company profile on LinkedIn. The provider is LinkedIn Ireland Unlimited Company ("LinkedIn"), Wilton Plaza, Wilton Place, Dublin 2, Ireland.
When you visit our LinkedIn profile, LinkedIn processes your personal data as an independent controller. This includes, in particular, connection data (e.g. IP address, device information) and information about your usage behavior on LinkedIn. If you are logged in to LinkedIn during your visit, this data can be assigned to your profile.
Joint responsibility pursuant to Art. 26 GDPR: Insofar as we receive aggregated statistics ("page analytics") from LinkedIn about the use of our company profile, there is joint responsibility. This data does not allow us to identify individual users. The joint controllership agreement can be found at: https://legal.linkedin.com/pages-joint-controller-addendum.
Purposes of the processing:
- Provision and optimization of our content
- Communication with interested parties
- Evaluation of aggregated usage statistics
Legal basis: The processing is based on our legitimate interest pursuant to Art. 6 para. 1 lit. f) GDPR in effective communication with users and the optimization of our LinkedIn presence.
Data transfer: LinkedIn may also transfer personal data to third countries (in particular to the USA) and states that it takes appropriate protective measures in accordance with Art. 44 et seq. GDPR.
Further information on data processing by LinkedIn can be found in LinkedIn's privacy policy:
9.6 Bluesky
We operate the Bluesky website
When you visit our Bluesky profile, Bluesky processes your personal data as an independent controller. This includes, in particular, connection data (e.g. IP address, device information) and information about your use of the platform.
Purposes of the processing:
- Provision and optimization of our content on Bluesky
- Communication with interested parties
- Evaluation of aggregated usage statistics
Legal basis: The processing is based on our legitimate interest pursuant to Art. 6 para. 1 lit. f) GDPR in the optimization of our content and communication with users. Insofar as Bluesky uses cookies or similar technologies, the processing is based on your consent in accordance with Art. 6 para. 1 lit. a) GDPR.
Data transfer: Bluesky may also transfer personal data to third countries (in particular to the USA) and states that it takes appropriate protective measures in accordance with Art. 44 et seq. GDPR.
Further information on data processing by Bluesky can be found in Bluesky's privacy policy:
9.7 Exercising your rights as a data subject
Insofar as there is joint responsibility pursuant to Art. 26 GDPR, we recommend that you assert your rights (Art. 15 et seq. GDPR) primarily with the respective platform operator, as they regularly have direct access to the relevant data.
However, you can also contact us at any time. In this case, we will forward your request to the operator concerned.
We generally only store your data for as long as is necessary for the respective purpose of data processing (e.g. processing your request or statutory retention periods).
We store the data collected for the processing of the contract until the expiry of the statutory or possible contractual warranty and guarantee rights. After expiry of this period, we retain the information required under commercial and tax law relating to the contractual relationship for the periods specified by law. For this period (regularly ten years from the conclusion of the contract), the data is processed again solely in the event of a review by the tax authorities.
We initially store the data collected for registration on SCHUFA4Business until the account is deactivated. This can be done by the user himself or automatically after 120 days, provided that the portal has not been actively visited by the user during this period, as well as upon termination of the contractual relationship. The personal data will then be deleted one year to the day after the account is deactivated.
All data in connection with the implementation of a conciliation procedure is generally stored for up to ten years.
The duration of data storage for advertising purposes does not follow any rigid principles and is based on the question of whether the storage is necessary for the advertising approach. We also follow the principle of deleting data for advertising purposes 4 years after the end of the contract or 4 years after the end of marketing efforts. Advertising objections are not deleted.
We store the data that we process as part of the recruitment process for up to 6 months after completion of the application process.
In particularly justified cases, we also store data for longer periods of time, for example if an authority requests this or if the data is required for legal reasons, e.g. for evidence in a court case.
We transfer your data to contractual and business partners based in other third countries (insofar as a corresponding adequacy decision of the European Commission exists or standard contractual clauses have been agreed, which can be viewed at www.schufa.de). SCHUFA is also subject to the statutory powers of intervention of state authorities.
12.1 Overview
In addition to the right to withdraw your consent given to us, you have the following additional rights if the respective legal requirements are met:
- Right to information about your personal data stored by us in accordance with Art. 15 EU GDPR,
- Right to rectification of inaccurate data or completion of correct data in accordance with Art. 16 EU GDPR,
- Right to erasure of your data stored by us in accordance with Art. 17 EU GDPR,
- Right to restrict the processing of your data in accordance with Art. 18 EU GDPR,
- Right to data portability pursuant to Art. 20 EU GDPR.
SCHUFA has set up a Private Customer ServiceCenter for your respective concerns, which can be reached in writing at SCHUFA Holding AG, Privatkunden ServiceCenter, Postfach 10 34 41, 50474 Cologne, by telephone at +49 611 9278-0 and online via a query form
12.2 Right of objection
Under the conditions of Art. 21 para. 1 GDPR, data processing can be objected to for reasons arising from the particular situation of the data subject (e.g. women's shelter, witness protection). The objection can be made informally and addressed, for example, to SCHUFA Holding AG, Privatkunden ServiceCenter, Postfach 10 34 41, 50474 Cologne.
The above general right to object applies to all processing purposes described in this data protection information that are processed on the basis of Article 6(1)(f) GDPR. In contrast to the special right to object to data processing for advertising purposes, we are only obliged under the GDPR to implement such a general objection if you give us reasons of overriding importance (e.g. a possible danger to life or health). In addition, you have the option of contacting the supervisory authority responsible for SCHUFA, the Hessian Commissioner for Data Protection and Freedom of Information.
All data transmitted by you personally is transferred using the generally accepted and secure TLS (Transport Layer Security) standard. TLS is a secure and proven standard that is also used in online banking, for example. You can recognize a secure TLS connection by the s appended to http (i.e. https://...) in the address bar of your browser or by the lock symbol at the bottom of your browser.