KfW Privacy Notice

You can rely on the protection and security of your personal data: we consider it our responsibility to protect your privacy when processing your personal data. The following privacy notices provide an overview of the processing of your data and the rights you have under data protection regulations when using the products and services of KfW Group.

1. Who is responsible for data processing and whom can I contact?

The following party is responsible:

• KfW (hereinafter referred to as ‘we’ or ‘us’)
  Palmengartenstrasse 5-9
  60325 Frankfurt, Germany
• Tel: +49 69 7431-0
  Fax: +49 69 7431 29 44

You can reach our company data protection officer at:

• KfW
  Data protection officer
  Palmengartenstrasse 5-9
  60325 Frankfurt, Germany
  

2. Which sources and data does KfW use?

We process personal data that we receive from our customers, business partners and website visitors in connection with the use of our website, the use of our portals, subscription to newsletters and in connection with our business relationships with these groups.

Personal data processed by us refers in particular to personal details (such as name, address, telecommunications data, date and place of birth, marital status), identification data (such as ID, residence registration data), contractual data, advertising and sales data, documentation data, registration data and similar information.

3. For what purpose does KfW process your data and on what legal basis?

We process personal data in accordance with the provisions of the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (Bundesdatenschutzgesetz; BDSG) and other applicable legal regulations.

For technical reasons, it is necessary to collect and store certain personal data when you visit our website and our portals, such as the IP address, the date and duration of your visit, the websites used, the identification data of the used browser and operating system type and, if applicable, the website from which you arrived at our site. The legal basis for processing your personal data in this context is Article 6(1)(f) GDPR.

In addition, the products and services cited below, which you can find on our website, may require you to provide personal data in order to use them.

3.1 General communications and mailing of newsletters.

• general communications, particularly via the contact form,
• processing other enquiries,
• mailing of newsletters

We store and process your data for inquiries for the purpose of customer information and support. You can object to this type of processing at any time. Any further use and disclosure of your data does not take place. The basis for the processing of your personal data in this context is Article 6(1)(1)(f) GDPR. According to this, the processing of personal data is permitted if this is necessary to purpose legitimate interests, except where such interests are overridden by the interests of the data subject which require protection of personal data. We have a legitimate interest in optimizing prospect/customer support. We protect the data concerned in such a way that we do not see any major disadvantages for you.

If you have given us your consent to process personal data for specific purposes (e.g to send our newsletter), this consent serves as the legal basis for processing the data (Article 6(1)(1)(a) GDPR). Consent which has been granted may be revoked at any time. This also applies to revoking declarations of consent that were issued to us before the GDPR took effect, i.e. before 25 May 2018. If consent is revoked, the legality of data processing carried out before consent was revoked is not affected.

3.2 Portal use

• Use of our portals, including the “Meine KfW” service portal, the KfW grant portal and the online loan portal

The processing of your personal data in the context of using this portal is generally a prerequisite for concluding and fulfilling a contract with you or entering into a preliminary agreement with you in our promotional programmes. For this purpose, we process your personal data on the basis of separate terms of use to be able to provide you, as the person using the portal, with the respective functionalities thereof. You are not legally obligated to share your personal data with us. Without this data, however, we will not be able to execute the relevant contract with you. The legal basis for this processing is Article 6(1)(1)(b) GDPR. This provision permits the processing of personal data if the processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps prior to entering into a contract.

As part of the contractual services provided by KfW, selected KfW portals contain the option for users to design the content of the portal according to personal needs for prolonged use. The processing of personal data required for this is used exclusively for the aforementioned purposes.

In addition, we wish to inform you in particular about the processing of your personal data in connection with the use of our “Meine KfW” service portal:

You can use “Meine KfW” (meine.kfw.de) via our website. “Meine KfW” is a free personal service portal. It enables you to register and create an account for the preparation and/or submission of promotional applications, the submission of evidence, and the management of promotional data in certain KfW promotional programmes.

The following information under this section is intended for you, as the person using the “Meine KfW” portal. We will inform you about the processing of personal data of interested parties, applicants and funding recipients, including to the degree that processing is carried out or initiated, whether in whole or in part, via “Meine KfW”, separately in the “Product-specific data privacy notices and information on the right to object in domestic promotional business”.

a.) Registration and creation of a user account under “Meine KfW”

To use “Meine KfW”, you must register, stating the necessary information (surname, first name, residential address, email address, username, password) and provide confirmations required as part of the registration process. This information is required for the registration and administration of your user account, for the use of “Meine KfW”, and for the purpose of contacting you in this regard (e.g. status emails). In particular, you will receive an activation link to the specified email address during registration. By activating your user account, your registration in “Meine KfW” is complete and the user account has been created. If your account is not activated, your data will promptly be deleted from our systems.

b.) Additional voluntary information and options

In times of particularly high demand for a promotion, KfW reserves the right to set up a virtual waiting room in front of the My KfW service portal to support an orderly application process and to avoid overloads. A service provided by Queue-it ApS, Skelbækgade 4, 1, 1717 Copenhagen V, Denmark is used for the virtual waiting room. Queue-it ApS acts as a processor for KfW and is contractually obliged to process transmitted personal data exclusively for the purposes specified by us and in accordance with our instructions (Art. 28 GDPR).

When using the virtual waiting room, your IP address is recorded and forwarded to the service provider for the purpose of providing the virtual waiting room. Your IP address will be retained by the service provider for a reasonable period of time for reasons of proof and for the purpose of preventing or investigating misuse and then deleted in accordance with data protection regulations.

You have the option of being informed of the current waiting status by e-mail during your waiting time (notification function). This allows you to access the waiting room across all devices and provide us with up to three e-mail addresses for notification purposes. The provision of your e-mail address(es) is voluntary on the basis of Art. 6 para. 1 subpara. 1 lit. a GDPR (revocable consent with effect for the future). The activation of the notification function and the e-mail addresses you provide will be logged to the extent permitted by law for verification purposes.

c.) Technical data

In technical terms, we use an identity and access management system operated on KfW systems for the purpose of access control and user authentication as part of the registration and login for “Meine KfW”. We log the activities of the person using the portal in “Meine KfW” to the extent permitted by law. There is no evaluation of individual usage behaviour. For the storage of technically necessary data as well as for the use of cookies and similar technologies, including in the context of registration and use at “Meine KfW”, please also refer to the provisions under clause 3.6 and to KfW’s cookie notices.

Within the context of providing “Meine KfW”, KfW uses central infrastructure and cloud services to achieve reliable computing and user-optimised data processing with correspondingly short processing times and a high level of multi-layered security methodology. KfW only uses server locations within the European Union and does not intend to transfer your data to third countries. Nevertheless, as part of an international group, the European cloud service provider used by KfW may be obliged to hand over personal data to security authorities via its parent company on the basis of non-European legal systems – in particular the United States (USA). KfW has taken extensive security measures in this regard – both contractual and technical – to exclude corresponding access risks. In addition, the cloud service provider used is obliged to comply with the EU standard contractual clauses and is certified under the EU-US Data Privacy Framework.

The data transmitted to the portal as part of using “Meine KfW”, including your registration and account details as well as the current status and detailed data on individual promotional measures, will be stored in the portal at the longest for the duration of your user account, for the purpose of appropriate and user-optimised provision of the functionalities under “Meine KfW” in accordance with defined deletion deadlines. The deletion concept provides for the deletion of your user account, including your registration and account details, in particular if you have not logged into “Meine KfW” for more than two years after completing registration, and no further promotional measures are administered in your “Meine KfW” user account. Previous promotional measures will be deleted from your “Meine KfW” user account three years after processing is complete. In addition, you can arrange for the deletion of your user account yourself at any time, provided no promotional measure is currently being processed under “Meine KfW”.

The complete recording and storage of data on promotional measures is carried out outside the portal in accordance with the statutory retention periods.

3.3 Analysis of user behaviour and direct marketing – for the purpose of safeguarding legitimate interests:

• testing and optimising demand analysis procedures for the purpose of directly approaching customers,
• advertising or market research and polling, insofar as you have not objected to the use of your data,
• measures in relation to business management and the further development of services and products.

The legal basis for processing your personal data in this context is Article 6(1)(1)(f) GDPR unless we have, in individual cases, obtained your consent. Pursuant to this provision, processing personal data is permissible if this is necessary for the purposes of legitimate interests except where such interests are overridden by the interests or fundamental rights of the data subject which require that the personal data are not processed. We have a justified interest in aligning our offers with customer behaviour and optimising them. We believe that these interests prevail since, as an international financial institution, we must control and optimise our offers in order to fulfil our promotional mandate. The alignment with our customers allows us to offer and optimise services according to the needs and interests of our customers. We protect the relevant data in such a way that we do not see any overriding disadvantages for you.

3.4 Risk management and compliance – for the purpose of safeguarding justified interests:

• assertion of legal claims and defence in legal disputes,
• prevention and investigation of criminal activities,
• guarantee of IT security and IT operations at the bank,
• risk management at KfW Group

The legal basis for processing your personal data in this context is Article 6(1)(1)(f) GDPR. Our justified interest consists of complying with applicable legal provisions, maintaining the security of our IT systems and, in case of non-compliance with legal requirements or violations of security regulations, responding adequately to such circumstances, for instance by asserting legal claims. We believe that these interests prevail since, as a bank, we are subject to a significant number of regulatory requirements and have a responsibility towards our customers to ensure that the corresponding requirements and security regulations are complied with. We protect the relevant data in such a way that we do not see any overriding disadvantages for you.

3.5 Use of social media plugins

We use plugins from various social media (Facebook, X, LinkedIn, Xing) on our website for the purpose of sharing website content. For reasons of data protection compliance in particular, the respective social media plugins are not directly accessible, but are indirectly integrated by means of the so-called ‘Shariff’ solution. This solution prevents a connection to a social network from being established simply because you access a page with a social media plugin without activating it. Information is only transmitted to the social network when you activate the corresponding button of the respective social media provider. Activating the plugin by clicking on the button constitutes consent within the meaning of point (a) of the first subparagraph of Article 6(1) GDPR.

By activating the plugin, the social medium receives the information that you have accessed a corresponding page of the medium on the Internet. If you are already registered with the social medium, it can assign your visit to your account with the social medium. However, even if you have not yet registered with the social medium, it cannot be ruled out that it will collect or store your IP address after you click on the medium. We have no influence on this further processing of your personal data by the social media provider.

3.6 Cookies and other technologies for website analysis

We use cookies and other technologies for the operation of our website, as well as for a pseudonymised recording of its usage. In this way, we can conduct analyses of user behaviour by collecting and analysing the information communicated by your browser. However, none of these analyses are linked to individual persons. Any personal identification characteristics, namely in this case the IP address, are deleted at the moment of processing and replaced by an indicator, which makes it impossible or at least extremely difficult to identify the data subject. This methodology ensures that KfW is routinely unable to establish a concrete link to particular persons.

In our cookie notes you can find detailed information on which cookies and other technologies are used for which concrete purposes and on which legal basis this is done. You can also find opt out-options there.

You can access the cookie notes by clicking on the blue circular icon with the fingerprint at the bottom left of this page.

3.7 Chat: Chatbot and transfer to live chat

You can use the function of the KfW chatbot on this website. Your IP address is collected during use and retained for three days for technical reasons. We have a legitimate interest in the collection and storage of the IP address (Article 6(1)(f) GDPR). This is necessary for the need-based design of our KfW chatbot and for guaranteeing a problem-free service. The technical operation of the KfW chatbot is carried out by a carefully selected service provider. No personal data are transmitted to any country outside the European Union or the European Economic Area.

If you use the KfW chatbot, please do not enter any personal or confidential data such as your name, address or account number. Our chats are stored for 30 days in anonymised form.

If you use the live chat, you will be referred to a KfW specialist. You can enter personal data or confidential data, such as name, address or business partner number (BP number), in the live chat. KfW stores the entire chat history with the data it contains and automatically deletes it after six years if a customer relationship exists or arises. If no contractual relations are established, the data is automatically deleted after six months on the basis of KfW’s legitimate interest. In principle, no personal data is transmitted to any country outside the European Union or the European Economic Area. If, in exceptional cases, your data is transferred to countries outside the EU (for example, if it is necessary to rectify technical errors), this takes place in close consideration of the requirements of Art. 44 et seqq. GDPR, and an appropriate level of data protection is ensured (e.g. appropriateness decision of the EU Commission, EU standard contractual clauses or other suitable guarantees within the meaning of Art. 44 et seqq. GDPR).

3.8 Authentication information

KfW uses its authentication information (e.g. user name and password) to give only you access to your confidential data.

You should therefore

• keep your authentication information secret and do not share it with third parties,
• change them immediately if you suspect a password has been compromised,
• do not use passwords more than once.

4. Who receives my data?

Within the bank, the departments that need your data to fulfil our contractual and legal obligations receive access to your data. Service providers and subcontractors whose services we use may also receive data for these purposes if they observe banking secrecy and data protection. With regard to the transfer of data, we have undertaken to maintain confidentiality concerning all customer-related facts and assessments about which we become aware (banking secrecy).

We may only disclose information about you to third parties if required to do so by law, if you have given your consent or if we are authorised to provide such information for other reasons. Under these conditions, recipients of personal data could include:

• Public bodies and institutions (e.g. the Deutsche Bundesbank, the Federal Financial Supervisory Authority, the Federal Court of Auditors, courts of auditors in the German states, the Federal Parliament including its committees, the European Banking Authority, the European Central Bank (ECB), the European Investment Fund (EIF), the European Investment Bank (EIB), the European Commission, German federal and state ministries, financial authorities and official bodies) in the event of a legal or official obligation.
• Other credit and financial services institutions or similar institutions to which KfW transfers personal data for the purpose of managing its business relationship with you (e.g. commercial banks or credit agencies, depending on the contract)
• Service providers which process data on our behalf (e.g. data centres).
• Specialists and the German Energy Agency (dena), if involved in the promotion.
• Other bodies or service providers, insofar as we refer explicitly to them in these privacy notices or other KfW privacy policies.

Other data recipients may be bodies for which you have given us your consent to transfer data, or for which you have exempted us from banking secrecy by agreement or consent.

If you need further information on individual recipients, please do not hesitate to contact us.

5. Is data transferred to a third country or an international organisation?

Data are not transferred to entities in countries outside of the European Union (known as third countries), with the exception of the cases specified in these privacy notices or other KfW privacy policies.

In the event of a transfer to a third country, this shall be conducted under the application of appropriate guarantees of an adequate level of data protection (Article 44ff GDPR).

6. How long will my data be stored?

How long personal data are stored is based on the respective processing purposes. It is not possible to list the various storage periods in a reasonable format here. The criteria to determine the specific individual storage periods are the following:

• If we only process data for the purpose of executing a contractual relationship, we store the data for the duration of the contractual relationship.
• Where we process data in connection with anticipated legal disputes, we will store the data until the court proceedings have definitively been completed or until the claims at issue have become time-barred in accordance with the applicable civil law provisions. The general limitation period is three years.
• In addition, we are subject to various storage and documentation requirements arising from the German Commercial Code (HGB), the German Fiscal Code (AO), the German Banking Act (KWG), the German Money Laundering Act (GwG) and the German Securities Trading Act (WpHG), among others. The periods for retention and documentation stipulated in these laws range from two to ten years.
• When using the online version of the electronic form archive and the repayment calculator, the entered data are retained in the main memory of our server only for the duration of the use of the applications: the process duration is currently set to one hour from the start of the session. Data are not stored either temporarily or permanently.

In addition, there is a right to lodge a complaint with a data protection supervisory authority (Article 77 of the GDPR).

7. What are my data privacy rights?

If the statutory prerequisites are met, you have the following rights in accordance with Articles 15 to 22 GDPR:

• Right of access in accordance with Article 15 of the GDPR, i.e. the right to obtain confirmation from us as to whether or not personal data concerning you are being processed, and, where that is the case, access to this personal data and other information;
• Right to rectification in accordance with Article 16 of the GDPR if personal data concerning you is not correct;
• Right to erasure in accordance with Article 17 of the GDPR, e.g. when the personal data is no longer necessary in relation to the purposes for which it was processed;
• Right to restriction of processing in accordance with Article 18 of the GDPR; and
• Right to data portability in accordance with Article 20 GDPR, i.e. the right to receive your personal data from us in a structured, commonly used and machine-readable format and the right to transmit that data to another controller. However, in accordance with the second sentence of Article 20(3) GDPR, this right shall not apply to processing necessary for the performance of a task carried out in the public interest.

With respect to the right of access and the right to erasure, the restrictions pursuant to Articles 34 and 35 of the German Federal Data Protection Act apply.

In addition, there is a right to lodge a complaint with a data protection supervisory authority (Article 77 of the GDPR).

8. Note on data processing for undisclosed assignments and the purchase of claims receivable

In the context of undisclosed assignments for the granting of securities in business transactions, KfW is given the name, address and contractual data of the relevant debtors from the grantor of the collateral or from the seller of the receivables for the purpose of the adequate individualisation of the security collateral required by law. Insofar as the assigned receivables are not liquidated by KfW, the data are collected and stored exclusively for administrative purposes (recording of the receivables assigned as collateral) and they are not processed further in any form. In this situation, KfW is not subject to any notification requirement with regard to data owners in accordance with Article 14(5)(b) GDPR.

There is no transfer of the data to third parties or to bodies in a third country during the course of such an undisclosed assignment. The data are deleted after the expiry of the statutory storage obligations. There is no automated individual decision-making, including profiling.

Information about your rights to object

Welcome to this page with information on selected processing activities carried out by KfW Group.

You may be visiting this information page

• because we invited you to find out more about a specific processing activity,
• because we were unable to provide you with all necessary information at the time we received your personal data or
• because you are looking for publicly available information about how we handle personal data that we have not received directly from you. Examples of this include personal data from publicly available sources, where it proves impossible to inform each person individually, or where this would involve a disproportionate amount of effort (Art. 14(5)(b) GDPR).

Note: This site is not an exhaustive source of information for all processing activities we perform. Where possible, we will provide you with the requested information in the form of the specific privacy policies relating to the processing at the time we receive your personal data. For example, if you are looking for information about how we process your personal data on this website, please read our website’s privacy policy.

1. Who is responsible for data processing and whom can I contact?

The following party is responsible:

• KfW (hereinafter “we” or “us”)
  Palmengartenstr. 5–9
  60325 Frankfurt, Germany
  Tel: 069 74 31-0
  Fax: 069 74 31-29 44

You can reach our company data protection officer at:

• KfW
  Data protection officer
  Palmengartenstr. 5–9
  60325 Frankfurt, Germany
  

2. Sources, purpose and legal basis of data processing

We process personal data in accordance with the provisions of the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (Bundesdatenschutzgesetz; BDSG) and other applicable legal regulations.

• Business card processing
  If you give us your business card, we may enter the personal data contained therein in one of our contact management systems. We use the personal data contained therein to contact you, for media/communications work, to establish and maintain contact, to regularly inform media representatives and to invite you to events (e.g. press conferences).
  As a legal basis for the processing of your personal data, we rely on a legitimate interest in the use of your business card for the purpose of maintaining contact (Art. 6(1)(f) GDPR).
  Generally, we only store your personal data for as long as it is necessary to stay in contact with you. At KfW, your contact details will be deactivated after five years at the latest and deleted after a maximum of ten years. For individual processes (such as our event tool, where your data is deleted after six months), the deletion periods may also be shorter. If you would like to know more about the purpose, legal basis or retention period of your personal data, please get in touch with the contact persons in the company with whom you already communicate or our Data Protection Officer.

• Email communication
  When you communicate with us by email, we will use your email address, the information provided in your emails (e.g. name, other contact details from your signature, the content of your emails or all attachments) and also metadata from the email (such as time stamp, IP address of the sender, email programs and servers used during transmission). We use this personal data to facilitate communication with you.
  The legal basis for processing your personal data and the retention period vary depending on the purpose for which we communicate with you.
  Our general retention period for incoming emails is six months, unless your email has been archived, in which case the maximum retention period is ten years. For individual processes, the deletion periods may also be shorter. If you would like to know more about the purpose, legal basis or retention period of your personal data, please get in touch with the contact persons in the company with whom you already communicate or our Data Protection Officer.

• Publicly available data
  We obtain the data of media representatives or stakeholders from sources as Journalisten PR & Medien-Index (a media index for journalists, PR and media), Kürschners Politikkontakte (a source of political contact information) and other publicly available sources, or have received it from you personally.
  We also search the Internet for information for various purposes, which are explained in more detail below. This information may contain personal data. Our Internet research may include the process of identifying and assessing what is being said on the Internet about a company, person, product, brand, or business-related topic relevant to the company. We process personal data that we have collected from publicly accessible areas of the Internet and publicly accessible media by, for example,
  • using keyword searches throughout the Internet (e.g. websites, social media platforms, blogs, established news sources, forums or photo and video websites), including filtering and analysing conversation streams,
  • retrieving visual analytical representations of conversation trends over a specified time period,
  • o keeping track of publicly available opinions, statements or other interactions on the Internet of certain natural or legal persons that are important to us and our business (entities known as opinion leaders).
• We use the insights gained for stakeholder management, as well as for media and communication work with the aim of identifying business opportunities and risks as well as innovations, and better understanding feelings, intentions, moods and trends in the market and society. We also want to develop an even better understanding of our customers’ and stakeholders’ needs, as well as their preferences and opinions, and thus facilitate our engagement in more targeted dialogue with media representatives and stakeholders.
  The legal basis for the processing of personal data in this context is our legitimate interest in the processing, which results from our processing purposes described above (Art. 6(1)(b) GDPR).
  We delete personal data as soon as it is no longer needed for the purposes for which it was originally stored.

• Participant administration for events
  From time to time KfW invites media representatives and selected stakeholder groups to KfW events. Responsibility for the processing of data in the context of events lies with the organising specialist division. (See also points 2A, 2B and 2C).
  We rely on your consent as the legal basis for processing your personal data. This consent is obtained for the purpose of maintaining contact and organising events (Article 6(1)(a) GDPR).
  This includes handling responses confirming or declining the invitation in order to plan event capacities, as well as associated communications as part of the exchange of information about the event. There may also be requests for event-specific data with regard to organising the event (such as clothing sizes, menu choices).
  In the context of participant management, the following persons have access to your data:
  • employees of KfW Group, here limited to the specialist division responsible for organising the event
  • authorised service providers employed by KfW Group
  • Corporate Communications for the professional administration and support of events (see also point 3. Who receives my data?)
• The information collected in the context of an event is stored in KfW’s participant management system and is automatically deleted from the system 180 days after the end of the event.

• Personal data within the meaning of Article 9 GDPR
  Data within the meaning of Article 9 GDPR (including health data) is not routinely collected and/or stored. The organiser relies on data subjects proactively informing it of any information necessary for the proper running of the event, such as personal health data (in this case, allergies and/or intolerances). Information that falls under Article 9 GDPR must only be sent by email to functional mailboxes (e.g. "specialistdivision@kfw.de") and not to personal mailboxes (firstname.surname@kfw.de) of the individuals organising the event. Alternatively, it can be communicated to the organising individuals by phone. Contact details can be found in the event notices for the respective event. They are also indicated in the booking confirmation for the respective event.
  If you would like to know more about the purpose, legal basis or retention period of your personal data, please get in touch with the persons in the company who are the named contact persons for the respective event.

• Photos and video recordings when attending the event
  Photos and/or video recordings may be taken at our events, especially as – depending on the specific situation – we may have a legitimate interest in reporting on our corporate events.
  Based on this justified interest (Art. 6(1)(f) GDPR), we use recordings that show an event as such (e.g. conveying the atmosphere, general recordings in an auditorium), as well as recordings of persons who assume a special, exposed role at an event (e.g. presenter) or who are known to the general public. Whenever possible, we inform the participants before an event that photographs and/or videos will be taken or recorded during the event – for example, in the form of notices at a central location at the event or by means of corresponding data protection notices as part of email communication/invitation to the event. We also make sure that participants are not depicted in any unpleasant, defamatory or similar situation.
  If individual participants are highlighted/depicted in photos and video recordings, we always endeavour to obtain timely consent of the data subjects (Art. 6(1)(a) GDPR).
  If a contractual agreement has been concluded with presenters that regulates photographs and film recordings as a service component, we also base the data processing on the respective agreement (Art. 6(1)(b) GDPR).

3. Who receives my data?

Within the bank, the departments that need your data to fulfil our contractual and legal obligations receive access to your data. Service providers and subcontractors whose services we use may also receive data for these purposes if they observe banking secrecy and data protection. With regard to the transfer of data, we have undertaken to maintain confidentiality concerning all customer-related facts and assessments about which we become aware (banking secrecy).

We may only disclose information about you to third parties if required to do so by law, if you have given your consent or if we are authorised to provide such information for other reasons. Under these conditions, recipients of personal data could include:

• Public bodies and institutions (e.g. the Deutsche Bundesbank, the Federal Financial Supervisory Authority, the Federal Court of Auditors, courts of auditors in the German states, the Federal Parliament including its committees, the European Banking Authority, the European Central Bank (ECB), the European Investment Fund (EIF), the European Investment Bank (EIB), the European Commission, German federal and state ministries, financial authorities and official bodies) in the event of a legal or official obligation.
• Other credit and financial services institutions or similar institutions to which KfW transfers personal data for the purpose of managing its business relationship with you (e.g. commercial banks or credit agencies, depending on the contract)
• Service providers which process data on our behalf (e.g. data centres).
• Specialists and the German Energy Agency (dena), if involved in the promotion.
• Other bodies or service providers, insofar as we refer explicitly to them in these privacy notices or other KfW privacy policies.

Other data recipients may be bodies for which you have given us your consent to transfer data, or for which you have exempted us from banking secrecy by agreement or consent.

If you need further information on individual recipients, please do not hesitate to contact us.

4. Is data transferred to a third country or an international organisation?

Data are not transferred to entities in countries outside of the European Union (known as third countries), with the exception of the cases specified in these privacy notices or other KfW privacy policies.

In the event of a transfer to a third country, this shall be conducted under the application of appropriate guarantees of an adequate level of data protection (Article 44ff GDPR).

5. What are my data privacy rights?

If the statutory prerequisites are met, you have the following rights in accordance with Articles 15 to 22 GDPR:

• Right of access in accordance with Article 15 of the GDPR, i.e. the right to obtain confirmation from us as to whether or not personal data concerning you are being processed, and, where that is the case, access to this personal data and other information;
• Right to rectification in accordance with Article 16 of the GDPR if personal data concerning you is not correct;
• Right to erasure in accordance with Article 17 of the GDPR, e.g. when the personal data is no longer necessary in relation to the purposes for which it was processed;
• Right to restriction of processing in accordance with Article 18 of the GDPR; and
• Right to data portability in accordance with Article 20 GDPR, i.e. the right to receive your personal data from us in a structured, commonly used and machine-readable format and the right to transmit that data to another controller. However, in accordance with the second sentence of Article 20(3) GDPR, this right shall not apply to processing necessary for the performance of a task carried out in the public interest.

With respect to the right of access and the right to erasure, the restrictions pursuant to Articles 34 and 35 of the German Federal Data Protection Act apply.

In addition, there is a right to lodge a complaint with a data protection supervisory authority (Article 77 of the GDPR).

Status: July 2026