Data protection

We, Willis Towers Watson GmbH, process your personal data as a service provider on behalf of Vodafone GmbH within the scope of this portal solution that we provide for Vodafone GmbH. With this application, we inform you about the individual status of your benefits at Vodafone GmbH and provide you with further information on this topic. Furthermore, we inform you about the rights you are entitled to under the applicable data protection law.

Personal data is any information relating to an identified or identifiable natural person, such as personal data, address data, and billing data, that is an expression of a person's identity.

The personal data you enter in our portal solution is processed by us or the respective legal entities of Vodafone GmbH for purposes of determining and administering your Benefits.

Benefits are established in connection with your employment with a Vodafone GmbH company and are processed by employees of WTW, the relevant specialist departments or human resources departments.

The protection of your privacy when processing personal data as well as the security of all business data is an important concern for us, which we take into account in our business processes. We process personal data collected during your visit to our online offers confidentially and only in accordance with legal requirements.

Data protection and information security are part of our corporate policy.

The controller for the processing of your data is the respective legal entity of Vodafone GmbH where you are employed. WTW acts as a processor within the meaning of Art. 28 GDPR for Vodafone GmbH.

You can reach our data protection officer at:
Data Protection Officer of Willis Towers Watson GmbH
Wettinerstr. 3, 65189 Wiesbaden, GERMANY
or
privacy@willistowerswatson.com

To assert your rights and report data protection incidents, please contact one of these addresses.

In connection with your employment with a Vodafone GmbH company, you may have received a benefits commitment (e.g., to a company pension plan or to the accrual of value credits as part of a working time account). Your commitment information is explained in more detail in this application.

The categories of personal data processed include in particular:

• Master data (e.g. name, date of birth, place of residence)
• Duration of employment with the company or group, status (active/not active), position, termination date
• Detailed information on remuneration and pension entitlements/employment benefit credits
• Insurance data
• If applicable, bank data (in case of payment of benefits)
• If applicable, comparable data of dependents entitled to benefits (in the case of payment of surviving dependents' benefits)
• Log data arising from the use of IT systems.

This may also include special categories of personal data such as health data.

Your personal data is predominantly transferred from the respective Vodafone GmbH billing system, on the basis of which your remuneration is determined and paid. Additional data is provided directly by you as part of your benefits within the portal solution or is determined in connection with the administration of your benefits by us.

The portal offers plan participants the opportunity to extract information about their company pension plan or other benefits such as lifetime work accounts. This can include viewing current account balances, simulations, or making elective deferrals.

Willis Towers Watson GmbH and the legal entities of Vodafone GmbH process your personal data in compliance with the provisions of the GDPR, national data protection laws and other applicable national laws. The purpose of the data processing is to identify and manage your benefits resulting from your employment with a legal entity of Vodafone GmbH.

The primary legal basis for this is Section 26 BDSG, if applicable in conjunction with applicable collective law bases such as company agreements, Article 6 (1) b GDPR (performance of a contract). Further legal bases are Art. 6 para. 1 a GDPR ("Consent"): in the context of the establishment of your employment relationship; Art. 6 para. 1 f GDPR ("Weighing of interests"): Legitimate interest of the controller.

Insofar as special categories of personal data within the meaning of Art. 9(1) GDPR (e.g. data relating to health) are processed, this is done on the basis of Art. 9(2) b GDPR.

Within Willis Towers Watson GmbH and within the respective legal entity of Vodafone GmbH by which you are employed, only those persons and entities will have access to your personal data who are entrusted with the processing of your Benefits.

As a matter of principle, we will only transfer your personal data to other responsible parties if and to the extent that this is necessary to process your benefits, we or the third party have a legitimate interest in the transfer, or you have given your consent for this. For details on the legal grounds, please refer to the section "Processing purposes and legal grounds". Third parties may also be other legal entities of Vodafone GmbH. Where data is transferred to third parties on the basis of a legitimate interest, this is explained in this privacy notice. In addition, we may transfer your personal data to other recipients outside Willis Towers Watson GmbH and Vodafone GmbH to the extent necessary to fulfill contractual and legal obligations.

If we use service providers, we have selected them carefully and monitor them regularly, in particular their careful handling of personal data and the security of the data stored with them. All service providers are obligated by us to maintain confidentiality and to comply with legal requirements. Service providers may also be other legal entities of Willis Towers Watson GmbH or Vodafone GmbH.

If we transfer personal data to contractors, service providers or group companies outside the European Economic Area (EEA), the transfer will only take place if the third country has been confirmed by the EU Commission to have an adequate level of data protection or if other appropriate data protection guarantees (e.g. binding internal company data protection regulations or EU standard contractual clauses) are in place.

You can obtain from us an overview of recipients in third countries and a copy of the specific agreed arrangements to ensure the adequate level of data protection. Please use the contact information above for this purpose.

We do not make automated decisions.

We delete your personal data as soon as it is no longer required for the above-mentioned purposes or there is no longer a legitimate interest in storing the data. After termination of the employment relationship, your personal data will be stored as long as we are obliged to do so due to continuing benefits or in accordance with national legislation. In addition, personal data may be retained for the period during which claims may be made against us or against Vodafone GmbH.

We take all necessary technical and organizational measures to ensure an adequate level of protection and to protect your processed data in particular against the risks of accidental or unlawful destruction, manipulation, loss, alteration or unauthorized disclosure or access. Our security measures are constantly being improved in line with technological developments.

Please use the information in the Contact Information section to assert your rights. In doing so, please ensure that we are able to clearly identify you.

You have the right to receive information from Vodafone GmbH about the processing of your data. To this end, you may assert a right of access in relation to the personal information we process about you.

You may request Vodafone GmbH to correct incorrect data and - insofar as the legal requirements are met - to complete or delete your data.

This does not apply to data that is required for billing and accounting purposes or for the determination and administration of your benefits or is subject to statutory retention obligations. However, if access to such data is not required, its processing will be restricted (see below).

You may request Vodafone GmbH - insofar as the legal requirements are met - that we restrict the processing of your data.

In addition, you have the right to object to data processing by Vodafone GmbH at any time. We will then stop processing your data unless we can prove - in accordance with the legal requirements - compelling reasons for further processing that are worthy of protection and which outweigh your rights, in particular your rights to object.

In addition, you have the right to object to data processing by Vodafone GmbH at any time, insofar as this is based on the legal basis of legitimate interest. We will then stop processing your data unless we can prove - in accordance with the legal requirements - compelling reasons for further processing that are worthy of protection and which outweigh your rights, in particular your rights to object.

If you have given us consent to process your data, you can revoke this consent at any time with effect for the future. The lawfulness of the processing of your data until the revocation remains unaffected.

You also have the right to receive data that you have provided to us in a structured, common and machine-readable format or - if technically feasible - to request that the data be transferred to another responsible party.

You have the right to lodge a complaint with a data protection authority. To do so, you can contact the data protection authority responsible for your place of residence or your federal state or the data protection authority responsible for us.

When you visit our websites, we store information in the form of a "cookie" on your computer. Cookies allow us, for example, to adapt a website to your interests or to save your shopping cart so that it can still be made available to you on your next visit. If you do not want us to recognize your computer, please set your browser to delete cookies from your computer hard drive, block all cookies or warn you before a cookie is stored. Please refer to your browser manufacturer's instructions for details on how this works. If you change this setting, this may lead to functional restrictions in the use of our websites.