Data protection

We take good care of your data

The protection of your personal data has always been very important to us. As a public corporation, the provisions of the German Federal Data Protection Act (BDSG) and also the provisions of the German Social Code (SGB) continue to apply to us.

The General Data Protection Regulation (GDPR), which came into force on 25.05.2018, does not result in any fundamental changes. It supplements the existing regulations.

The GDPR is a European Union (EU) regulation that harmonizes the rules for the processing of personal data by private companies and public bodies throughout the EU. The aim is to ensure the overall protection of personal data within the EU on the one hand and to guarantee the free movement of data within the EU on the other.

We consider the protection of our customers' personal data to be an important task in order to guarantee their trust in us. In particular, the new provisions of the GDPR provide for a high degree of transparency in data processing and comprehensive rights for data subjects. In order to do justice to this, we provide you with the necessary information about the processing of your personal data by ZF Betriebskrankenkasse ZF BKK) Krankenkasse and ZF BKK Pflegekasse as well as the rights to which you are entitled from 25.05.2018.

Read information sheet on data protection

Privacy policy

1. general information

We would like to use our website to provide comprehensive and competent information to interested parties, insured persons and employers. That is why we are constantly working on a customer-friendly online service.

2 Introduction

All data collected by us is subject to special protection, the social data protection according to the German Social Security Code (SGB). Data that is collected and stored in order to participate in offers on the website is subject to the data protection regulations of the German Telemedia Act (TMG). We collect and use your personal data exclusively in accordance with these regulations.

Personal data

This refers to information that can be assigned to your person (e.g. first name and surname). With this data protection declaration, we inform you about

• in what way,
• to what extent
• and for what purpose

we collect and use personal data when you visit our website.

We are constantly working to improve our online offering. This may also necessitate changes to this privacy policy. Please visit these pages at regular intervals to keep up to date.

3. personal data

Informational use

You do not have to provide any personal data if you wish to obtain information on a specific topic on our website and do not log in to the website, register or send us any other information. In this so-called "informational use", we only collect the data that your browser transmits to enable you to visit the website. These are

• IP address
• Date and time of the request
• Time zone difference to Greenwich Mean Time (GMT)
• Content of the request (specific page)
• Access status / HTTP status code
• Amount of data transferred in each case
• Website from which the request originates
• browser
• Operating system and its interface
• Language and version of the browser software.

Use of service offers

We require personal data for some of our online services in order to be able to offer them. If you wish to use one of these services, we only collect and store the data that is necessary to provide the service. The stored data will only be used for the stated purpose. Which data we collect, store and use in the respective service offer can be seen from the individual input masks. Mandatory information is marked as such. All other information is voluntary.

Example:
If you would like to use the BKK-KlinikFinder, we need you to enter a zip code or town in order to inform you about clinics in your area.

Participation in competitions

If you take part in a competition, we store the personal data of the participants that is necessary to run the competition. For example, we need an address in order to be able to send the prizes. The data will only be passed on to third parties if the nature of the prize or the handover of the prize makes it necessary, for example if a competition takes place on our website together with a cooperation partner who sends the prizes directly. If the participant has consented to publication, their personal data will be published if they have won the competition. As a rule, this is the winner's first name and surname. The data will be deleted after the competition has been completed.

Deletion of data

We delete personal data

• if the user withdraws their consent to storage.
• if they are no longer required.
• if their storage is inadmissible for other legal reasons.

You can register or deregister yourself at any time for any online offer for which registration is required.

Further information

For further information on data collection and data processing, please refer to the explanations and provisions of the respective service offer.

4. right to information and revocation

You have the right to request information from us at any time about

• what data we have stored about you and for what purpose
• where this data comes from
• and to which recipients or categories of recipients this data may be passed on.

If you have given us your consent to use your personal data, you can revoke this consent at any time. We will then delete your personal data. Please send all requests for information, requests for information or revocations regarding data processing by e-mail to datenschutzbeauftragter@zfbkk.de or to the addresses mentioned under points 11 and 12.

5 Use and deletion of cookies

We use so-called "cookies" on our website. These are small text files that are stored on your computer. They contain certain information about your visit to our website, which is transmitted to us. Cookies are usually set or read automatically each time you visit zfbkk.de.

Important to know

No data is stored in the cookies that allows conclusions to be drawn about the person visiting our website. The information stored in the cookies is stored separately from any other data provided to us. We do not merge this data with other data sources. This website uses session cookies and time-limited cookies. The term "session" refers to an Internet session that ends at the latest when the web browser is closed.

Session cookies

Session cookies are used to store session data. Session cookies store a so-called session ID, with which various requests from your browser can be assigned to a session. This allows your computer to be recognized when you return to the website. The lifespan of a session cookie is limited to the respective session. This means that as soon as you close the browser completely, the cookie becomes invalid and can no longer be used. The same happens if you have not performed any action on our website for more than 30 minutes.

Time-limited cookies

In contrast to session cookies, temporary cookies are stored for a period of up to 6 months. They remain on your computer even after your current visit, unless you deliberately delete them. In addition, time-limited cookies contain a predefined expiry date. After this date, the cookies are automatically deleted. We use time-limited cookies for statistical purposes, for example, in order to be able to recognize which contents of our online offer are particularly in demand. This is important so that we can constantly improve our service offering. A personal reference is not established.

Deletion

You can delete cookies set by us in your browser at any time. Please note, however, that your personal settings for the use of our website are also stored in the cookies. This means that if you delete these cookies, these settings will also be reset and you may not be able to use all the functions of our website.

Cookie consent with Cookiebot

Our website uses Cookiebot's cookie consent technology to obtain your consent to the storage of certain cookies on your end device and to document this in compliance with data protection regulations. The provider of this technology is Cybot A/S, Havnegade 39, 1058 Copenhagen, Denmark (hereinafter "Cookiebot"). When you enter our website, a connection is established to Cookiebot's servers in order to obtain your consent and other declarations regarding the use of cookies. Cookiebot then stores a cookie in your browser in order to be able to assign the consents given or their revocation to you. The data collected in this way is stored until you ask us to delete it, delete the Cookiebot cookie yourself or the purpose for data storage no longer applies. Mandatory statutory retention obligations remain unaffected. Cookiebot is used to obtain the legally required consent for the use of cookies. The legal basis for this is Art. 6 para. 1 sentence 1 lit. c GDPR.

Contract on order processing

We have concluded an order processing contract with Cookiebot. This is a contract required by data protection law, which ensures that Cookiebot processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

6. analysis tools

General information

We evaluate the usage behavior of visitors to our website pseudonymously, i.e. without being able to draw conclusions about the person of the visitor. The knowledge gained in this way helps us to improve our online offering and carry out market analyses. The legal basis for the evaluation is § 15 of the Telemedia Act. As a visitor to our website, you have the right to object to this data collection.

Matomo (formerly Piwik)

This website uses the open source web analysis service Matomo. Matomo uses technologies that enable the cross-page recognition of the user to analyze user behavior (e.g. cookies or device fingerprinting). The information collected by Matomo about the use of this website is stored on our server. The IP address is anonymized before storage. With the help of Matomo, we are able to collect and analyze data about the use of our website by website visitors. This enables us to find out, among other things, when which pages were accessed and from which region. We also record various log files (e.g. IP address, referrer, browser and operating system used) and can measure whether our website visitors perform certain actions (e.g. clicks, purchases, etc.). The use of this analysis tool is based on Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in the anonymized analysis of user behavior in order to optimize both its website and its advertising. If a corresponding consent has been requested (e.g. consent to the storage of cookies), the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR; the consent can be revoked at any time.

You can also stop tracking by Matomo at any time.

Hosting

We host Matomo with the following third-party provider:
Hetzner Online GmbH
Industriestr. 25
91710 Gunzenhausen, Germany

Conclusion of a contract for order processing

We have concluded an order processing contract with these third-party providers, which ensures that the data collected with Matomo is processed exclusively in accordance with our instructions and in compliance with the GDPR.

7 Plugins and tools

YouTube

Our website uses plugins from YouTube, which is operated by Google. The operator of the pages is YouTube, LLC, 901 Cherry Ave, San Bruno, CA 94066, USA. When you visit one of our pages equipped with a YouTube plugin, a connection to the YouTube servers is established. This tells the YouTube server which of our pages you have visited. If you are logged into your YouTube account, you enable YouTube to assign your surfing behavior directly to your personal profile. You can prevent this by logging out of your YouTube account. The use of YouTube is in the interest of an appealing presentation of our online offers. This constitutes a legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR. Further information on the handling of user data can be found in YouTube's privacy policy at: https://www.google.de/intl/de/policies/privacy.

Google Maps

This website uses the map service Google Maps via an API. The provider is Google Inc, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. To use the functions of Google Maps, it is necessary to save your IP address. This information is usually transmitted to a Google server in the USA and stored there. The provider of this site has no influence on this data transfer. The use of Google Maps is in the interest of an appealing presentation of our online offers and to make it easy to find the places we have indicated on the website. This constitutes a legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR. You can find more information on the handling of user data in Google's privacy policy: https://www.google.de/intl/de/policies/privacy/.

Third-party content and computers from inside partner

On some pages, we integrate content and online calculators from our partner inside partner Verlag und Agentur. Cookies may be used here without us being able to point this out to you.

The integration of this content is in the interest of an attractive presentation and the creation of added value for visitors to our online offerings. This constitutes a legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR. You can find more information on the handling of user data in the privacy policy of inside partner: https://www.ip-gkv.de/datenschutzhinweise.php.

8. system security

We maintain up-to-date technical measures to ensure data security. These measures serve in particular to protect your personal data from access by unauthorized third parties. We adapt our protection mechanisms to the current state of the art. If you are asked to enter personal data on our website, data is always transmitted over the Internet using SSL encryption. This encryption is intended to prevent unauthorized persons from gaining access to your data.

9. e-mail communication

In some cases, we answer customer inquiries by conventional post, even if the inquiry has been sent to us by e-mail. This is always the case if our reply contains social data. Unfortunately, there is currently no other option for legal reasons. As soon as a broadly applicable technology is available that guarantees the highest possible level of data security, we will be happy to answer your service requests by e-mail.

10 Newsletter

The data you provide when registering for the newsletter will only be used to personalize our newsletter and will not be passed on to third parties. The information is voluntary. We carry out anonymized link tracking for statistical purposes.

11. responsible body

The controller responsible for data processing on this website is

ZF Betriebskrankenkasse (ZF BKK)
Otto-Lilienthal-Strasse 10
88046 Friedrichshafen
Telephone: 07541 36908-0
E-mail: leistung@zfbkk.de

12. data protection officer

We have appointed a data protection officer for our company:

Otto-Lilienthal-Straße 10
88046 Friedrichshafen
Telephone: 07541 3908-1310
E-mail: datenschutzbeauftragter@zfbkk.de

Privacy policy online branch and service app

This information is currently being revised and will be published here shortly.

Information on data processing in accordance with Art. 13 GDPR

We collect, process, store and use social data to fulfill your legal mandate. Here you will find an overview of the processing purposes and legal bases.

Identity of the controller

ZF company health insurance fund (ZF BKK)
Authorized representative: Ralf Hirmke
Otto-Lilienthal-Straße 10
88046 Friedrichshafen
Telephone: 07541 3908-0
E-mail: leistung@zfbkk.de

The ZF Betriebskrankenkasse (ZF BKK) is a corporation under public law with self-administration.

Contact details of the data protection officer

We have appointed a data protection officer for our company.

Jörg Bukenberger
Data Protection Officer
Otto-Lilienthal-Straße 10
88046 Friedrichshafen
Telephone: 07541 3908-1310
E-mail: datenschutzbeauftragter@zfbkk.de

Processing purposes and legal basis

As a health and long-term care insurance fund, we collect, process, store and use social data to fulfill our legal mandate. To provide you with an overview of the processing purposes and legal bases of both the health and long-term care insurance funds, we have made these available to you in a clearly structured form:

Health insurance

1. Maintaining, restoring and improving the state of health of its insured persons (§ 1 Fifth Book of the Social Code - SGB V)
2. Financing benefits and other expenses by collecting contributions from employers and members (Section 3 SGB V)
3. Determining the insurance relationship and membership, including the data required to initiate an insurance relationship (Section 284 (1) no. 1 SGB V)
4. Issuing the certificate of eligibility and the electronic health card (§ 284 Para. 1 No. 2 SGB V)
5. Determination of the obligation to pay contributions and the contributions, their payment (§ 284 Para. 1 No. 3 SGB V)
6. Examination of the obligation to provide benefits and the provision of benefits to insured persons, including the requirements for benefit restrictions, determination of the co-payment status and implementation of the procedures for reimbursement of costs, repayment of contributions and determination of the limit (§ 284 Para. 1 No. 4 SGB V)
7. Supporting insured persons in the event of treatment errors (§ 284 Para. 1 No. 5 SGB V)
8. Assumption of treatment costs in the cases of § 264 SGB V (§ 284 Para. 1 No. 6 SGB V)
9. Involvement of the Medical Service (§ 284 Para. 1 No. 7 SGB V)
10. Billing with the service providers, including checking the legality and plausibility of the billing (Section 284 (1) no. 8 SGB V)
11. Monitoring the efficiency of service provision (Section 284 (1) No. 9 SGB V)
12. Billing with other service providers (§ 284 Para. 1 No. 10 SGB V)
13. Implementation of reimbursement and compensation claims (Section 284 (1) No. 11 SGB V)
14. Preparation, agreement and implementation of remuneration contracts in accordance with Section 87a SGB V (Section 284 para. 1 no. 12 SGB V)
15. Preparation and implementation of pilot projects, the implementation of care management in accordance with Section 11 (4) SGB V, the implementation of contracts for GP-centered care, special forms of care and the outpatient provision of highly specialized services, including the implementation of performance and quality audits, insofar as contracts were concluded without the participation of the Association of Statutory Health Insurance Physicians. (§ 284 Para. 1 No. 13 SGB V)
16. Implementation of risk structure compensation as well as the preparation and implementation of structured treatment programs, including the recruitment of insured persons to participate in them (§ 284 Para. 1 No. 14 SGB V)
17. Implementation of discharge management in accordance with Section 39 (1a) SGB V)
18. The selection of insured persons for measures in accordance with Section 44 para. 4 sentence 1 SGB V and Section 39b SGB V and their implementation (Section 284 para. 1 no. 16 SGB V)
19. Monitoring compliance with the contractual and statutory obligations of providers of medical aids in accordance with Section 127 (5a) SGB V (Section 284 (1) No. 16a SGB V)
20. Fulfilling the tasks of the health insurance funds as rehabilitation providers in accordance with SGB IX (Section 284 para. 1 no. 17 SGB V)
21. Recruitment of members (Section 284 (4) SGB V)
    
    

Long-term care insurance fund

1. Support for people in need of long-term care who are dependent on assistance due to the severity of their need for long-term care (Section 1 (4) of the Eleventh Book of the Social Code - SGB XI)
2. Financing benefits and other expenses by levying contributions from employers and members (Section 1 (6) SGB XI)
3. Determination of the insurance relationship and membership (§ 94 Para. 1 No. 1 SGB XI)
4. Determination of the obligation to pay contributions and the contributions (§ 94 Para. 1 No. 2 SGB XI)
5. Examination of the obligation to provide benefits and the provision of benefits to insured persons, as well as the implementation of reimbursement and compensation claims (§ 94 Para. 1 No. 3 SGB XI)
6. Involvement of the medical service (§ 94 Para. 1 No. 4 SGB XI)
7. Settlement of accounts with service providers and corresponding reimbursement of costs (§ 94 Para. 1 No. 5 SGB XI)
8. Monitoring the efficiency, billing and reimbursement of care services provided (Section 94 (1) No. 6 SGB XI)
9. Conclusion and implementation of care rate agreements, remuneration agreements and service and quality agreements (Section 94 (1) No. 7 SGB XI)
10. 10. advice on participation and care services and assistance (Section 94 (1) No. 8 SGB XI)
11. Coordination of care assistance, care advice and performing tasks in the care support centers (Section 94 (1) No. 9 SGB XI)
12. Statistical purposes (§ 94 Para. 1 No. 10 SGB XI)
13. Support in the pursuit of claims for damages (Section 94 (1) No. 11 SGB XI)

In addition, we may collect, use, process and store data on the basis of express declarations of consent in accordance with Art. 6 para. 1a of the General Data Protection Regulation (GDPR) in conjunction with Section 67b para. 2 of the Tenth German Social Code (SGB X). We may use your data for other purposes (change of purpose) in deviation from the above-mentioned purposes and legal bases without prior notification if the following conditions are met:

1. It is a measure pursuant to Section 82 (2) SGB X.
2. Another legal basis permits the change of purpose without the obligation to provide information.
3. You have given your express consent.
4. The data is pseudonymized.
   
   

Provision of social data

To enable us to fully perform our statutory duties, please observe the obligations to cooperate pursuant to Sections 60 et seq. of the German Social Code (SGB) First Book (I). According to this, you must provide us with certain personal data that is necessary for the fulfillment of the statutory tasks concerning you. If you do not cooperate, there may be delays or even rejections of benefits you have applied for. Voluntary information such as telephone number or e-mail address is expressly excluded from this data. If you do not provide this data, this does not constitute a breach of your duty to cooperate and you will not suffer any disadvantage as a result. Your social data, which we must collect, process, store and use, is subject to the data protection provisions of SGB X, the Federal Data Protection Act (BDSG) and, from May 25, 2018, also the General Data Protection Regulation (GDPR). We ensure that social confidentiality is maintained in accordance with Section 35 SGB I.

Automated decision in individual cases

We do not make decisions based on automated processing including profiling within the meaning of Art. 22 GDPR.

Categories of recipients

We regularly transfer social data to the following recipients on the basis of statutory provisions of the SGB or other legal provisions

• Pension and accident insurance providers,
• Federal Employment Agency,
• to financial institutions in the context of payment transactions,
• employers and paying agents,
• pension administration,
• service providers,
• military administration,
• tax authorities,
• Transmission in individual cases according to §§ 67d ff. of SGB X,
• external contractors according to § 80 SGB X.

If a transfer is made to a recipient within a category, you will be informed about the recipient unless one of the exceptions according to Section 82 (1) and (2) SGB X or the requirement of Art. 13 (4) GDPR applies.

Duration of storage

There are different retention periods for the processing purposes of social data, which are regulated in § 110a SGB IV, § 304 SGB V, § 107 SGB XI and in the General Administrative Regulation on Accounting in Social Insurance (SRVwV). If the purpose of processing no longer applies, the social data concerned will be deleted.

Rights of the data subject with regard to data processing

You can exercise the following rights using the contact details above if the legal requirements are met:

• Right to information about processed data (Art. 15 GDPR in conjunction with Section 83 SGB X)
• Right to rectification of inaccurate data (Art. 16 GDPR in conjunction with Section 84 SGB X)
• Right to erasure (Art. 17 GDPR in conjunction with Section 84 SGB X)
• Right to restriction of processing (Art. 18 GDPR in conjunction with Section 84 SGB X)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR in conjunction with Section 84 SGB X)
• In the case of data processing based on consent, you have the right to withdraw this consent at any time with effect for the future.

Right to lodge a complaint with the supervisory authorities

As a data subject, you have the right to contact our competent supervisory authorities:

The Federal Commissioner for Data Protection
and Freedom of Information
Graurheindorfer Str. 153
53117 Bonn

Telephone: 0228 997799-0
E-mail: poststelle@bfdi.bund.de

Federal Office for Social Security
Friedrich-Ebert-Allee 38
53113 Bonn

Telephone: 0228 619-0
E-mail: poststelle@bas.bund.de

List of service providers

In compliance with legal requirements, we transfer personal data or social data to service providers (processors) who work for us in accordance with Section 80 SGB X or Section 62 BDSG.

To give you a better overview, we provide you with a corresponding list in which the categories of recipients and the object/purpose of the assignment are named.

List of cookies used

This website uses cookies. ZF BKK uses cookies to provide you with a secure and convenient website visit. Further information can be found in our privacy policy. You can also change your settings there at any time.

Cookies are small text files that are used by websites to make the user experience more efficient.

By law, we can store cookies on your device if they are absolutely necessary for the operation of this site. For all other types of cookies, we need your permission.

This site uses different types of cookies. Some cookies are placed by third parties that appear on our pages.

You can change or withdraw your consent at any time from the cookie statement on our website.

Find out more about who we are, how you can contact us and how we process personal data in our Privacy Policy.

Please provide your consent ID and date when you contact us regarding your consent.

Your consent applies to the following domains: www.zfbkk.de

Data processing for structured treatment programs (DMP)

Patient information on data processing for DMP BKK MedPlus

We are obliged to inform you as follows about data processing in the context of structured treatment programs (DMP). The following personal patient and participation data will be recorded by your doctor as part of your participation in the program and transmitted to us via the data office responsible for the region named on the following page: Details from your insurance card, such as name and date of birth, address and insurance number, as well as additional health data, for which you will receive a printout from your doctor.

Insured person and health data were already comprehensively protected by law, in particular by data protection laws at federal and state level and by special provisions of the German Social Security Code.

You have already been informed about data processing in the context of participation in the DMP MedPlus by the "Information on data protection" before submitting your declaration of participation. Here you will find additional information on your rights under the new GDPR.

Notification of your rights under the General Data Protection Regulation

You have the legal right to information about your data, to deletion and correction of incorrect data, for example, and to blocking. ZF BKK is responsible for processing the data. If you have any questions about data processing or the data office responsible for you in connection with your participation, you can contact us at the following address:

datenschutzbeauftragter@zfbkk.de

You can address complaints about us with regard to data protection to the responsible data protection supervisory authority:

The Federal Commissioner for Data Protection
and Freedom of Information
Husarenstr. 30
53117 Bonn
poststelle@bfdi.bund.de

You can be sure that your data will be particularly well protected against any improper use. All those involved are subject to medical professional confidentiality and/or social confidentiality. Your data will be deleted after you leave the DMP BKK MedPlus in accordance with the applicable legal provisions.

If you agree to the processing of your data, you do not need to do anything further. Your participation in the DMP BKK MedPlus will then begin on the date stated in the enclosed letter.

If you do not agree to the data processing in the DMP BKK MedPlus, you have the option of withdrawing your consent to participation and data processing with effect for the future. All you need to do is send your revocation to us. However, it will then no longer be possible to continue your participation in this DMP.

Below you will find the data center that receives the data from your doctor for your region and forwards it to us:

Electronic patient file (ePA)

Data protection information for the electronic patient file (ePA)

We have compiled all the information on data protection for the electronic patient record and mandatory information in accordance with Section 343 (1) SGB V for you.

Read data protection information on the ePA