1. Who is responsible for processing my data and how can I contact the Data Protection Commissioner?

Responsibility for processing the data lies with the mission of the Federal Republic of Germany in Cyprus (Embassy of the Federal Republic of Germany, 10 Nikitaras Street, 1080 Nicosia; email: info@nikosia.diplo.de ; Tel. +357 22 79 00 00) and the Federal Foreign Office (postal address: Federal Foreign Office, 11013 Berlin, Germany).
The Federal Foreign Office Data Protection Commissioner can be contacted as follows:
Werderscher Markt 1
10117 Berlin Germany
Email: dsb-r@auswaertiges-amt.de
Tel: + 49 30 5000 2711
Fax: + 49 30 5000 51733

2. What data does the mission process when I apply for a visa, and where do the data come from?

The categories of personal data processed cover the data requested on the visa application form. Generally these include in particular your surname, name at birth, forename, date and place (including the country) of birth, gender, nationality/nationalities, civil status, current address, telephone number, email address, occupation, details of your travel document (type of document, serial number, issuing state and authority, date of issue, expiry date), your photograph and fingerprints.
The data in these categories derive from the information you provide in the course of the visa application process.

3. What data does the mission process when I issue a letter of invitation for someone to use to apply for a visa, and where do the data come from?

The categories of personal data processed cover the data requested on the visa application form about the person issuing the invitation. This includes in particular your surname and forename, your address, fax number and email address.
The data in these categories derive from the information you provide in the letter of invitation and the applicant provides in the course of the visa application process.

4. Why are my data collected, and what happens if they are not?

Your data are collected because it is necessary and legally required for the proper conduct of the visa application procedure. If you apply for a visa, you are required under Section 82 of the Residence Act (Aufenthaltsgesetz) to provide the data required for the processing of the application and to make available the necessary evidence. If your data are not provided, it may be that your application is rejected and the fee retained.

5. For what purposes and on what legal basis are my data processed?

Your personal data are processed solely in order to ensure the correct handling of the visa application.
The legal basis is provided by Art. 6 (1) (c) and (e) and (2) of Regulation (EU) 2016/679 (General Data Protection Regulation) in combination with Regulation (EC) No. 767/2008 (VIS Regulation) and Regulation (EC) No. 810/2009 (Visa Code) including its Annexes, and Sections 72a ff. of the Residence Act and Section 69 of the Ordinance on residence, as well as the Central Register of Foreigners implementing regulation (AZRG-DV), the Visa Warning File Act (VWDG) and further special regulations as appropriate or Section 3 of the Federal Data Protection Act (BDSG 2018).

6. How long will my data be kept?

Your data are deleted as soon as they are no longer required for completion of the visa procedure. Generally they are deleted two years after the visa procedure has been completed, but at the latest five years after the final decision on the visa application.

7. Who receives my data?

Your data are transferred to third parties only where necessary for the proper conduct of the visa procedure. As part of this procedure, it may be that your personal data are passed to the competent authorities in Germany, to the responsible visa offices of other Schengen member states or to the responsible authorities in your place of habitual residence. If an external service provider is charged with carrying out individual stages of the visa application procedure, your data will be collected by or transferred to this provider as far as necessary for the completion of the application procedure. Your data are only transferred to recipients outside the European Union to the extent permissible under Chapter V of the General Data Protection Regulation.

8. What data protection rights can I exercise?

You can request information about the personal data stored about you from the abovementioned entities responsible for data processing. In addition, under certain conditions, you can request that your data are corrected, erased or that processing is restricted. Further, under certain conditions you can object to the processing of your data.

9. Where can I file a complaint?

You have the right to file a complaint about the processing of your personal data with a data protection authority, particularly in the member state in which you have your place of residence, your place of employment or the place where the alleged breach of data privacy occurred.