Trust Centre: data protection, security and AI in the PBM Campaign Platform

The GDPR requires a legal basis for every processing operation, purpose limitation and data minimisation – and that you can demonstrate compliance with these (Art. 5, Art. 6 GDPR). According to Recital 47, direct marketing may be based on a legitimate interest (Art. 6(1)(f)). If a person objects to direct marketing, their data may no longer be processed for that purpose (Art. 21(2) and (3)). The stricter rules of Art. 9 apply to health data and other special categories. Art. 22 governs automated individual decisions with legal or similarly significant effects. PBM processes your data as a processor on the basis of a DPA (Art. 28); the security measures are described in the TOMs (Art. 32).

Under Section 7(2) no. 2 UWG, advertising by electronic mail is generally permitted only with prior express consent. For existing customers, an exception applies under Section 7(3) UWG if all four conditions are met: you obtained the email address in connection with a sale, you are advertising your own similar goods or services, the customer has not objected, and they are clearly informed of their right to object at any time, both when the address is collected and each time it is used. Advertising by letter is not permitted if it is apparent that the recipient does not want it (Section 7(1) UWG).

The EU AI Act (Regulation (EU) 2024/1689) applies in stages. Since 2 February 2025, the prohibitions of certain AI practices and the obligation to promote AI literacy (Art. 4) have applied. Since 2 August 2025, obligations for providers of general-purpose AI models have applied. Since 2 August 2026, the transparency obligations under Art. 50, among others, have applied. Under the amending Regulation (EU) 2026/1744 (“Digital Omnibus on AI”), the obligations for high-risk AI systems under Annex III apply from 2 December 2027, and for high-risk systems in regulated products under Annex I from 2 August 2028. Annex III lists as high-risk, for example, creditworthiness assessment as well as risk assessment and pricing in life and health insurance – these are not functions of the PBM Campaign Platform. As the deployer, you classify your specific use.

Since 17 January 2025, the Digital Operational Resilience Act (Regulation (EU) 2022/2554) has applied to financial entities. Anyone using software as a service such as the PBM Campaign Platform is obtaining an ICT service from an ICT third-party service provider. The financial entity must keep all such contracts in a register of information (Art. 28(3) DORA); BaFin requests the register annually and requires the LEI or EUID to identify the service provider (Implementing Regulation (EU) 2024/2956). Art. 30 DORA prescribes key contractual provisions, such as the description of the service, the locations where the service is provided and data is processed, rules on availability, integrity and security of data, assistance with ICT incidents and termination rights. If the service supports a critical or important function, further obligations apply, including rights of access, inspection and audit as well as exit strategies (Art. 28(8), Art. 30(3)). You assess for yourself whether this is the case for your campaign platform.

Since 28 June 2025, the Barrierefreiheitsstärkungsgesetz (BFSG) has applied to certain products and services for consumers, including banking services and e-commerce services. The PBM Campaign Platform itself is a business-to-business offering. As their provider, you check whether your landing pages or emails form part of a covered consumer service.