Personal data protection policy - Authority for Anti-Money Laundering and Countering the Financing of Terrorism

This policy explains how AMLA processes personal data and which rights you can exercise.

Controller

The Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA), MesseTurm, Friedrich-Ebert-Anlage 49, 60308 Frankfurt am Main, Germany, is the controller within the meaning of Regulation (EU) 2018/1725.

Legal basis

Personal data are processed on the basis of Article 5(1)(a) and (b) of Regulation (EU) 2018/1725, in as far as the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in AMLA, and on the basis of the AMLA Regulation (Regulation (EU) 2024/1620).

What data we collect

Depending on your interaction with AMLA, we may process identification and contact data, professional information provided in the context of a selection procedure or a public consultation, and technical data generated when you visit this website.

Why we process your data

to manage recruitment and selection procedures;
to process replies to public consultations and public hearings;
to answer requests submitted through the contact form or by email;
to ensure the security and proper functioning of our website and IT systems.

How long we keep your data

Personal data are stored only for as long as necessary for the purpose for which they were collected, and are then deleted or anonymised in line with AMLA’s retention schedule and the applicable record of processing activities.

Your rights

You have the right to access, rectify and erase your personal data, as well as the right to restriction of processing and the right to object. You may also lodge a complaint with the European Data Protection Supervisor.

Data Protection Officer

Questions concerning the processing of your personal data can be addressed to AMLA’s Data Protection Officer at data-protection@amla.europa.eu.

Records of processing

Where a specific processing operation requires it — for example public consultations — a dedicated privacy statement and record of processing activity are published alongside the relevant activity.