Privacy Policy

The following privacy policy applies to the websites of KA Köln.Assekuranz Agentur GmbH and its apps for mobile devices. This website contains links to third-party websites (external links). These websites are the responsibility of their respective operators. If you notice that links on our website lead to websites whose content violates applicable law, please notify us at info@koeln-assekuranz.com. We will then promptly remove these links from our website. KA Köln.Assekuranz Agentur GmbH assumes no liability for the timeliness, accuracy, completeness, or quality of the information provided.

We hereby inform you about the processing of your personal data when you use our websites and apps, as well as the rights to which you are entitled under data protection law.

2.1. Who is responsible for data processing, and who is the data protection officer?
The entity responsible for data processing is
KA Köln.Assekuranz Agentur GmbH
Scheidtweilerstr. 4
50933 Cologne
Email: info@koeln-assekuranz.com
You can contact our Data Protection Officer, Mrs. Raika Welte, using the contact details provided above or viadatenschutz@koeln-assekuranz.com.

2.2. What categories of data do we use, and where do they come from?
In general, you have the option to use our website anonymously. We do not store any personal or personally identifiable data (such as IP addresses) from website users. When you visit our website, data (date, time, pages viewed, navigation, software used) is collected anonymously by us through an external service provider for the purpose of analyzing usage behavior. The data is anonymized before it is stored by the service provider.
Further information about our website can be found in Section 7.

2.3. For what purposes is data processed?
If you provide us with your personal data in certain cases, we will treat it confidentially in accordance with the data protection regulations in effect at the company’s headquarters. If you send us an email or fill out and submit an online form on our website, we will process the personal data you provide there (e.g., your name or email address) exclusively for the purpose of corresponding with you to send you the requested documents or information, or for any other purposes specified on the individual form.
Should we wish to process your personal data for a purpose not specified there, we will inform you of this in advance.

2.4. On what legal basis is your personal data processed?
We process your personal data in accordance with the provisions of the European General Data Protection Regulation (GDPR), the New Federal Data Protection Act (BDSG), and all other applicable laws governing the processing of personal data.
The specific legal basis for data processing depends on the context in which we receive your data and the purpose for which it is used. We will therefore inform you separately regarding this in the respective application, as necessary.
As a rule, the legal basis will be either “legitimate interests of the controller in handling communication” or, in the context of job application processes,
taking steps at the request of the data subject prior to entering into a contract.
; or, particularly in the context of applications with a closed user group (e.g., an applicant portal), the consent of the user or the data subject, as applicable.

2.5. Who Receives Your Data?
Within our organisation, access to personal data is limited to those employees who require it for the relevant business purpose; there is a clear division of responsibilities and authorization framework in place for this purpose. The data may also be transferred to service providers for the purposes mentioned above. The involvement of service providers is necessary, for example, in the context of the administration and maintenance of IT systems. The list of all service providers that process data on our behalf can be viewed or downloaded under Section 5, or sent to you upon request.
In addition, personal data may be transferred to other recipients to the extent necessary to fulfill contractual or legal obligations (e.g., to supervisory authorities).
Furthermore, this data may be forwarded to group companies, for example, in the context of corporate communications or group management.

2.6. Is your data transferred to a third country?
Currently, no such transfers are made to service providers in a third country.
Should personal data be transferred to service providers or group companies outside the European Economic Area (EEA), such transfers will only take place if the European Commission has confirmed that the third country provides an adequate level of data protection or if other appropriate data protection safeguards (e.g., the use of EU Standard Contractual Clauses) are in place. You may also request this information using the contact details provided at the beginning of this document.

2.7. What measures do we take to protect your data?
We implement appropriate technical and organizational security measures in accordance with the current state of the art to protect data against accidental or intentional manipulation, loss, destruction, or access by unauthorized persons. For the contact forms provided on our website, we use SSL (Secure Sockets Layer) encryption to protect your information. This SSL connection protects your data from unauthorized access by third parties during transmission. For your own security, please always use these contact forms. If you send us data in unencrypted form via a standard, unsecured email, there is a risk that your data could be viewed or altered by unauthorized parties during transmission over the Internet.

2.8. What data protection rights can you exercise as a data subject?
You may request information about the data stored about you at the address listed above. In addition, under certain conditions, you may request the correction or deletion of your data. You may also have the right to restrict the processing of your data and the right to receive the data you have provided in a structured, commonly used, and machine-readable format.

2.9. Your Rights, in Particular the Right to Object
If we process your data to protect legitimate interests, you may object to this processing for reasons arising from your particular situation. We will then no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims.
If we process your data based on your consent, you may withdraw that consent at any time with future effect.

You have the following rights:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection (Art. 21 GDPR)
• Withdrawal of consent (Art. 7(3) GDPR)

Please contact datenschutz@koeln-assekuranz.com regarding these matters

2.10. Where can you file a complaint?
You have the option to file a complaint with the Data Protection Officer named above or with a data protection supervisory authority. The data protection supervisory authority responsible for us is:
State Commissioner for Data Protection and Freedom of Information, North Rhine-Westphalia
Kavalleriestraße 2-4
40213 Düsseldorf

2.11. How long will your data be stored?
We delete your personal data as soon as it is no longer necessary for the purposes mentioned above. This is generally determined by legal obligations regarding evidence and record retention, which are governed, among other things, by the German Commercial Code, tax laws, and the German Fiscal Code. Accordingly, the retention periods are generally up to ten years. In addition, personal data may be retained for the period during which claims can be asserted against us (statutory statute of limitations of three or up to thirty years). Additional information, where relevant, can be found in the descriptions of the individual data processing activities. Documents from unsuccessful applicants are generally deleted six months after the internal decision-making process regarding the position has been completed.

2.12. Are you required to provide your data?
You are not required to provide personal data when using the website. However, there are services for which we need personal data from you—for example, to send you information such as newsletters you have requested or to consider you as part of a job application process. Without this data, we cannot provide the requested services. We collect only the data that is actually necessary in each case.

2.13. To what extent do automated individual decision-making processes or profiling measures take place?
Such measures are not currently in use at our company.
If, in individual cases, we use fully automated processing procedures to reach a decision—including profiling—we will provide information about this in the respective application.

2.14. Use of Your Data
Under the GDPR, there will be legal obligations to provide information in the future as soon as and to the extent that personal data is collected from you for processing. Therefore, insurance applications in particular will include relevant information regarding the specific use of your personal data. Below, you can access selected versions of the information on data use: Information Sheet on Data Use
Note: Our company does not participate in the “Notification and Information System of the German Insurance Industry.”

2.15. Changes to This Statement
The ongoing development of our website and changes in technology may lead to updates to our Privacy Policy from time to time. Please be sure to review the current version of our Privacy Policy each time you visit our site.

As of March 1, 2013, ERGO’s German insurance companies have adopted the “Code of Conduct for the Handling of Personal Data by the German Insurance Industry” (Data Protection Code of Conduct). The Data Protection Code of Conduct governs the collection, processing, and use of your personal data. These rules of conduct were agreed upon between the German Insurance Association (GDV) and the data protection supervisory authorities. The Berlin Commissioner for Data Protection has reviewed the Data Protection Code of Conduct and determined that the provisions are consistent with applicable data protection law. The participating companies commit to complying with the requirements agreed upon herein and to implementing any additional provisions that may be necessary in a timely manner. These rules of conduct establish an industry-wide data protection standard for the first time. They clarify the provisions of the Federal Data Protection Act that were previously in effect and address data protection concerns beyond the requirements mandated by law. As a result of these rules of conduct, additional consent is no longer necessary in many cases. However, for particularly sensitive data—such as health information—we still require your consent to the collection and use of health data, as well as a waiver of confidentiality. You can find the code of conduct governing the handling of personal data by the German insurance industry here. We would be happy to provide you with a hard copy of the text. You can also request it by email at info@koeln-assekuranz.com

Since January 1, 2013, ERGO’s German insurance companies have been using new declarations of consent and waivers of confidentiality in their applications, inquiries, and enrollment forms. The content of these forms has been coordinated between the German Insurance Association (GDV) and the data protection supervisory authorities. They provide you with even greater transparency regarding the handling of your personal data.

We maintain a list of all service providers that may perform work for KA Köln.Assekuranz Agentur GmbH under a contract. The obligation to maintain this list arises from the new consent forms and waivers of confidentiality, as well as the new Code of Conduct for Data Protection, which were agreed upon between the German Insurance Association (GDV) and the data protection supervisory authorities. The purpose of this list is to provide transparency regarding the processing of your data. The list includes service providers who, as agreed, collect, process, or use health data and/or other personal data on behalf of the insurance companies of KA Köln.Assekuranz Agentur GmbH. Service providers are specifically named if their primary task is the collection, processing, and use of personal data. Service providers for whom the processing of personal data is not the primary task—such as the waste disposal company for paper waste and electronic data carriers—are listed only by service category. The same applies to service providers who work for KA Köln.Assekuranz Agentur GmbH only occasionally. You may object to the transfer of your data to the service providers listed in the list on a case-by-case basis, stating your reasons.

We will then assess whether, based on your specific personal situation, your legitimate interest in preventing the transfer outweighs other considerations. Please note that the list includes all service providers of KA Köln.Assekuranz Agentur GmbH. However, this does not mean that your data will automatically be shared with all service providers.

You can find the list of service providers for KA Köln.Assekuranz Agentur GmbH here.

Processing of Emails via Microsoft 365
We use Microsoft 365, a cloud service provided by Microsoft Corporation, to manage our email communications. In this process, personal data (e.g., email content, sender, recipient, timestamps) is processed on Microsoft’s servers.
Microsoft acts as a data processor in accordance with Article 28 of the GDPR. Processing is carried out exclusively for the purpose of providing and ensuring the functionality of the email service.
Data Storage Location:
The data is generally processed within the EU. Microsoft has committed to complying with the so-called EU Data Boundary. However, a transfer to third countries (e.g., the U.S.) cannot be completely ruled out. In such cases, the transfer is based on the EU Commission’s adequacy decision or on appropriate safeguards (e.g., EU Standard Contractual Clauses).
As of 09/2025

6.1. Data Transmission and Encryption

When you send a message to KA Köln.Assekuranz Agentur GmbH via the contact form, SSL (Secure Socket Layer) encryption technology with a key length of at least 128 bits is used to transmit this information.

 

6.2. Use of Cookies

During an online session, so-called cookies are stored on your computer. These are small files that control the display and operation of our website. We use cookies to provide you with the best possible experience on our website.

These cookies do not directly identify you as an individual. We use them to analyse website usage and improve the functionality of our website.

This allows us to improve the usability of our website. We conduct statistical analyses of these websites anonymously. We do not link this data to you personally.

The cookies do not contain any personal data.

Note: Cookie settings vary from browser to browser.

 

6.3. Social Networks

Our website and our apps use social plugins (“plugins”) from several social networks: LinkedIn, Xing, and YouTube. The plugins are identified by a logo. When you visit a page on our website or open an app that contains such a plugin, these plugins may establish a direct connection with the social network and, if applicable, transmit data. Communication takes place between the plugin, your browser, and the social network. By embedding the plugins, the social networks receive the information that you have accessed the corresponding page on our website. If you are already logged into the social network, the social network can associate your visit with your account. If you interact with the plugins—for example, by clicking the “Like” button or posting a comment—the corresponding information is transmitted directly to the social network and stored there in accordance with the guidelines of the respective social network. For information on the purpose and scope of data collection, as well as the further processing and use of the data by the social network, and your related rights and privacy settings, please refer to the privacy policy of the respective social network. If you do not want social networks to know about your visit to our websites, you must log out of the social networks before visiting our website or using the app.

Note: You can withdraw your consent at any time. Details about the cookies we use can be found in our Cookie Policy.

KA Köln.Assekuranz Agentur GmbH uses the email address you provide to respond to you via email with the requested information.
We transmit personal or confidential information via encrypted communication channels whenever possible. If secure electronic transmission is not available, we may use postal mail instead.

If the content of your message relates to a contractual relationship, KA Köln.Assekuranz Agentur GmbH will retain the email. The email address is stored solely for the purpose of corresponding with you and will not be shared with third parties. You will not receive any unsolicited emails from us. If you nevertheless receive an unsolicited email purporting to be from us, it is a forgery and should be deleted. Before sending an email to KA Köln.Assekuranz Agentur GmbH via an unencrypted channel, please be aware that its content is not protected against unauthorized access, tampering, etc., on the internet.

If you work with our company in connection with the K.A.R.L.® services we offer, as well as other services provided by our company (in particular in connection with risk management services), the provisions set forth above apply mutatis mutandis.

We process and store your data exclusively within the scope of and for the purpose of fulfilling the existing K.A.R.L.® contractual relationship or other service contractual relationships. This includes the login credentials we have received from you and your email signature, which we use for correspondence with you.

The location coordinates and other location data provided to us as part of a site assessment are used exclusively to fulfill the natural hazard assessment we have contractually committed to. They are not used for any other purposes (e.g., marketing, research on natural persons, or similar activities).

The same applies mutatis mutandis within the scope of any other service contract relationship.
Calculations for K.A.R.L. are performed on servers dedicated to KA in data centers. No calculations are performed in the cloud.