Data Protection Notice

Online Konto Service

Privacy notice regarding the processing of personal data in connection with the Bosch Group’s occupational pension scheme in Germany and the website www.boschvorsorgeplan.de

We are providing you with information regarding the processing of personal data in connection with your company pensions scheme during your active employment, or regarding the company pension entitlement you have accrued during your period of employment with Bosch, as well as during the payment of your company pensions. Furthermore, we are providing you with information regarding the processing of personal data on the website: www.boschvorsorgeplan.de.

1. Bosch respects your privacy

The Bosch Group (hereinafter referred to as “Bosch” or “we” or “us”) is delighted that you have visited our website and are interested in our company and our services. The protection of your personal data is of great importance to us. We process your personal data in connection with the preparation and administration of your company pension entitlement in accordance with the General Data Protection Regulation and other statutory data protection provisions.

Through the Online Konto Service, we provide you with information on the individual status of your company pension scheme within the Bosch Group and offer further information on the subject of company pensions.

In connection with your employment with a legal entity within the Bosch Group, you may have received a commitment to a company pension scheme. Your entitlement to a company pension scheme is explained in more detail in this application, the Online Konto Service.

2. Data controller

Are you currently employed by a legal entity within the Bosch Group in Germany?

The legal entity within the Bosch Group from which you received a commitment to a company pension scheme as part of your employment relationship is responsible for the processing of personal data.

Are you a company pensioner or a former associate?

The legal entity within the Bosch Group from which you received a pension commitment and from which you are now receiving a company pension, or will receive a company pension upon retirement, is responsible for the processing of personal data. This is usually your last employer within the Bosch Group or its legal successor.

Are you a surviving dependant of a deceased beneficiary of the Bosch Group?

The respective legal entity of the Bosch Group, as the former employer of the deceased beneficiary, is responsible for processing your personal data for the purpose of paying out survivors’ pension.

Robert Bosch GmbH and Bosch Pensionsfonds AG handle the administration and payment of your company pension entitlement as in-house service providers.

The contact details of the data controller can be found in your current employment contract, in your last employment contract following your departure from the Bosch Group, or in the last employment contract of the deceased beneficiary.

3. Collection, processing and use of personal data

3.1. Categories of personal data processed

The following categories of personal data are processed:

Master data (e.g. name, date of birth, place of residence, pension number, personnel number, tax identification number)
Contact details (e.g. home address, email address, and where applicable, telephone number)
Data relating to dependants (e.g. in the event that a partner (unmarried) lives in the same household and is to be named as a beneficiary)
Periods of employment within the Bosch Group, status (active/inactive), position, date of leaving
Details regarding the suspension of employment (period, reasons)
Details of remuneration and pension entitlements
Social security details
Tax details
Bank details

3.2. Principles

Personal data is any information relating to an identified or identifiable natural person, such as names, addresses, telephone numbers, email addresses, contract, booking and billing details, which reflect a person’s identity.

We collect, process and use personal data (including IP addresses) only where there is a legal basis for doing so or where you have given us your consent to do so, for example as part of a registration process.

3.3. Purposes of processing and legal bases

Your personal data is processed exclusively for the purposes of determining and administering your company pension entitlements arising from your employment relationship with a legal entity within the Bosch Group.

We process your personal data for the following purposes:

Initiation, administration and termination of benefit payments
Calculation and determination of benefit amounts, benefit adjustments
Applying for the company pension scheme
Taxation of benefits
Registration and payment of social security contributions (health and long-term care insurance)
Company and HR reporting, provisioning
Provision of information and certificates
Advice and support on the above matters
Administration and payment of survivors’ benefits to surviving dependants

The legal basis for the processing of your personal data is Art. 6 (1) (b) GDPR (Contract): performance of the contract underpinning your occupational pension entitlement, namely the agreement relating to the Bosch Vorsorgeplan. In this context, we are required to fulfil obligations under labour, social security and tax law, which necessitates the processing of personal data. This is carried out on the basis of Art. 6 (1) (c) GDPR (legal obligation).

Where necessary, we also process your personal data on the basis of Article 6 (1) (f) GDPR in order to safeguard our legitimate interests. Our legitimate interest generally lies in processing your personal data for the purpose of offering and delivering our services.

Where special categories of personal data are processed in accordance with Article 9 (1) GDPR, this is done to fulfil legal obligations arising from insurance law, employment law (including company pension schemes), social security law and social protection law. This is carried out on the basis of Art. 9 (2) (b) GDPR in conjunction with Section 26 (3) BDSG.

In some cases, we expressly ask for your consent to the processing of your personal data. In such cases, the legal basis for the processing of your personal data is the consent you have given in accordance with Art. 6 (1) (a) GDPR.

3.4. How do we obtain your personal data?

The vast majority of your personal data is transferred from the relevant Bosch payroll system. In order to administer your company pension scheme following the end of your employment, we require not only your master and contact data but also all personal data that we are required to process and, where necessary, disclose to third parties in order to comply with legal obligations. You provide us with this data and inform us of any changes. In addition, data has been generated during your employment with us that also affects your entitlement to a company pension (e.g. periods of employment, salary details). In individual cases, we also receive data on company pensioners from, for example, tax offices, health insurance funds, courts or public authorities.

3.5. Children

This online service is not intended for children under the age of 16.

3.6. Who has access to your personal data?

Your personal data is only made available to authorised staff. Group-wide processes, such as those in the IT department, may stipulate that, in addition to authorised staff at your employer within the Bosch Group, associates at other Group companies may also have authorised access to your data.

Where permitted or required by law, we disclose data to external parties such as the responsible actuary, social security institutions, public authorities, courts, banks, tax authorities, creditors, insolvency administrators and service providers outside the Bosch Group.

3.7. Service providers

We engage external service providers to carry out tasks such as company pension scheme administration, including the service line, the provision of the Online Konto Service, communication and data hosting.

We have carefully selected these service providers and monitor them regularly, paying particular attention to their careful handling and protection of the data stored with them. We require all service providers to maintain confidentiality and to comply with legal requirements. Service providers may also be other companies within the Bosch Group.

3.8. Registration

Provision of the Online Konto Service:

You can access the Online Konto Service in two ways:

1. For Bosch associates, via your Bosch Windows NT user account. In this case, you will be automatically redirected to your personal page for the Online Konto Service via SSO (Single Sign-On). No additional registration is required for this.

2. If you access the Online Konto Service directly via the internet (without your Bosch Windows NT user account), you can also log in using a username and password. A one-off registration is required for this. This is free of charge.

3.9. Log files

Every time you use the internet, your web browser automatically transmits certain information, which we store in so-called log files.

We store these log files for a period of 6 months to investigate faults and for security reasons (e.g. to investigate attempted attacks), after which they are deleted. Log files that need to be retained for further evidence purposes are exempt from deletion until the relevant incident has been fully resolved and may, in individual cases, be passed on to investigating authorities.

The following information is stored in the log files:

IP address (Internet Protocol address) of the device used to access the online service;
Internet address of the website from which the online service was accessed (known as the source or referrer URL);
Name of the service provider through which access to the online service is made;
Name of the files or information accessed;
Date, time and duration of the request;
Amount of data transferred;
Operating system and information about the internet browser used, including any installed add-ons (e.g. for Flash Player);
HTTP status code (e.g. ‘Request successful’ or ‘File not found’).

3.10. Duration of storage, retention periods

We store your personal data for as long as is necessary to fulfil the purposes of processing or for as long as we are legally obliged to do so. Following the termination of your employment, your personal data will be stored for as long as we are obliged to do so on the basis of ongoing company pension entitlements or in accordance with national legislation. Furthermore, personal data may be retained for the period during which claims may be brought against us or any legal entity within the Bosch Group.

4. Use of cookies

General

We use cookies as part of providing our online services. We use only technically necessary cookies.

Cookies are small text files that may be stored on your device when you visit a website.

Technically necessary cookies

By technically necessary cookies, we mean cookies without which the technical provision of the online service cannot be guaranteed. These include, for example, cookies that store data to ensure the smooth playback of video or audio content. These cookies are deleted at the end of your visit.

5. Data processing security

Our staff and the service providers we engage are bound by a duty of confidentiality and are required to comply with the provisions of the applicable data protection laws.

We take all necessary technical and organisational measures to ensure an appropriate level of protection and to safeguard the data we manage, in particular against the risks of accidental or unlawful destruction, manipulation, loss, alteration or unauthorised disclosure or access. Our security measures are continuously improved in line with technological developments.

6. Data subject rights

Please use the information in the “Contact” section to assert your rights. When doing so, please ensure that we can clearly identify you.

Right to information and access

You have the right to receive information from us regarding the processing of your data. To this end, you may exercise your right to access the personal data we process about you.

Right to rectification and erasure

You may request that we rectify any inaccurate data. Provided the legal requirements are met, you may request that your data be completed or erased.

This does not apply to data required for billing and accounting purposes or subject to a statutory retention obligation. However, where access to such data is not required, its processing will be restricted (see below).

Restriction of processing

You may request that we restrict the processing of your data, provided that the legal requirements are met.

Data portability

If the processing of your personal data is based on legitimate interests, you also have the right to object to the processing of your personal data at any time on grounds relating to your particular situation. The reasons must be stated.

We will then stop processing your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your rights, in accordance with the applicable legal requirements.

Objection to data processing where the legal basis is ‘legitimate interest’

You have the right to object at any time to our processing of your data, provided that such processing is based on the legal ground of ‘legitimate interest’. We will then cease processing your data, unless we can demonstrate, in accordance with the statutory requirements, compelling legitimate grounds for continuing the processing which override your rights.

Withdrawal of consent

If you have given us your consent to the processing of your data, you may withdraw this consent at any time with effect for the future. The lawfulness of the processing of your data up to the point of withdrawal remains unaffected.

7. Right to lodge a complaint with the supervisory authority

You have the right to lodge a complaint with a supervisory authority.

8. Changes to the Privacy Notice

We reserve the right to amend our security and data protection measures. In such cases, we will also update our privacy notice accordingly. Please therefore refer to the latest version of our privacy notice.

9. Contact

If you wish to contact us, you can reach us using the contact details provided in the ‘Data Controller’ section.

To exercise your rights, please use the following link: https://request.privacy-bosch.com/entity/RB/lang/en-GB/.

To report data protection incidents, please use the following link: https://www.bkms-system.net/bkwebanon/report/clientInfo?cin=18rbds19&c=-1&language=eng.

For suggestions and complaints regarding the processing of your personal data, we recommend that you contact our Data Protection Officer:

Data Protection Officer
Information Security and Data Protection Department (C/ISP)
Robert Bosch GmbH
PO Box 30 02 20
70442 Stuttgart
GERMANY

Email: DPO@bosch.com

As at 17 October 2025, Version 1.2