1. Name and address of the joint controllers pursuant to Art. 26 GDPR
a)    Baker Tilly Rechtsanwaltsgesellschaft mbH, 
Nymphenburger Straße 3b, 80335 Munich
info@bakertilly.de
Website: www.bakertilly.de
b)    the insolvency administrator appointed by the court

2. Name and address of the data protection officer 
Your contact for questions regarding the handling of your personal data by Baker Tilly is our data protection officer (pursuant to Art. 37 GDPR):
Maximilian Pörtner
dsb@bakertilly.de
 or at our postal address with the addition “Data Protection Officer”.

3. Scope of the processing of personal data
We collect and use your personal data only to the extent necessary in order to fulfill our obligations as insolvency administrator under the German Insolvency Code (InsO). This includes the collection of personal data from the court file and from the debtor’s database. We also collect case-related data from creditors, authorities, credit agencies, bailiffs, banks, social security institutions, tax offices, insurance companies, tax consultants, lawyers and other service providers as well as directly from the data subjects. 
In the performance of our engagement, we use order-specific software products (e.g., winsolvenz, GIS) and a document management system to ensure the traceability of any engagement-related communication.

4. Categories of processed data
As part of our engagement, we collect and process address and contact data, account details, receivables data, birth and civil status data, social security data, wage and salary details and, if applicable, other engagement-specific personal data.

5. Legal basis and processing purposes
We process personal data in order to fulfill our legal obligations in connection with the provisions on the processing of insolvency proceedings. The legal basis pursuant to Art. 6 (1) sentence 1 lit. c GDPR is primarily the InsO (Art. 148 ff., 174 ff. InsO).
Debtors are obliged to cooperate with and provide information to the insolvency administrator from the insolvency application proceedings onwards. In this context, the German Insolvency Code (Art. 97 et seq. and Art. 22 (3) sentence 3 InsO) imposes an obligation to provide personal data within the meaning of Art. 13 (2) lit. e GDPR.

6. Data deletion and storage period 
The data subjects’ personal data will be deleted as soon as the statutory retention periods of 10 years according to German Commercial Code (“HGB”) or German General Tax Code (“AO”) have expired. Data may also be stored if this is provided for in regulations, laws or other provisions to which the controller is subject. Furthermore, the data are not deleted if there is a need for further storage of the data for the conclusion or fulfillment of a contract or for the assertion, exercise or defense of legal claims.

7. Data transmission
As part of our reporting obligation to the insolvency court, we transmit personal data to the court. Furthermore, the insolvency table is kept by the insolvency administrator and must be filed at the insolvency court’s registry for inspection by the parties involved. The insolvency court also publishes individual resolutions at insolvenzbekanntmachungen.de as part of the public announcement on a statutory basis.

In insolvency proceedings, we provide the publicly accessible information as well as the information accessible only to creditors in a creditor information system (GIS), which can be accessed via our homepage www.bakertilly.de. Personal data is transferred to an external service provider who operates the creditor information system as processor pursuant to Art. 28 GDPR. The relevant data protection framework conditions are available here.
In addition, we may transfer personal data to other recipients, such as authorities in order to fulfill legal obligations to cooperate.

8. Rights of the data subject pursuant to Art. 15 et seq. GDPR
You have the right to request information about the personal data stored about you. You also have the right to demand the immediate correction of incorrect personal data or the completion of incomplete data. 
If certain conditions are met, you have the right to object to the processing or to request the erasure of your personal data; these conditions are generally not met if the processing purpose is compliance with a legal obligation.

9. Right to lodge a complaint
If you believe that the processing of your personal data violates legal requirements, you have the right to lodge a complaint with a supervisory authority in accordance with Art. 77 GDPR. Generally, the supervisory authority of your usual place of residence or workplace or our company headquarters is available for this purpose. In the latter case, this is
Bayerisches Landesamt für Datenschutzaufsicht
Postfach 1349
91504 Ansbach