Part 1: Data protection information for business partners, tenants, customers and interested parties

We take data protection seriously and hereby inform you about how we process your data and what claims and rights you are entitled to according to the statutory data protection regulations. Valid as of 1 September 2023.

These data protection guidelines do not apply to personal information obtained via our career page.

Where reference is made in this data protection information to “we,” “us” and “our/s,” this refers to the respective controller for data processing. The contact details of the respective controller as well as the contact details of the data protection officer/advisor can be found here.

If you have any questions about data protection, you can contact the respective controller or the designated data protection officer/advisor in confidence at any time.

We process personal data in accordance with the applicable provisions of the GDPR, the FADP, the UK GDPR and other applicable data protection regulations (“Data Protection Legislation”) (details below). Which specific data are processed and the way in which they are used essentially depends on the individual services requested or agreed. Further details or supplements to the purposes of data processing can be found in the relevant contract documents, forms, a declaration of consent and/or other information provided to you (e.g. within the scope of use of our website or in our terms and conditions). In addition, this data protection information may be updated from time to time.

2.1 Purposes of contract fulfilment or pre-contractual measures

The processing of personal data is carried out to implement our contracts with you and execute your orders as well as to implement measures and activities within the scope of pre-contractual relationships information (e.g. with prospective clients. In particular, such processing serves to facilitate the provision of services in accordance with your orders and wishes and real estate services such as the brokering, letting, sale and purchase of real estate in accordance with your orders and wishes and comprises the services, measures and activities necessary for this. These primarily include contract-related communication with you, the corresponding invoicing and associated payment transactions, the traceability of transactions, orders and other agreements as well as quality control by means of corresponding documentation, improvement in sustainability including by optimising consumption data (heat, energy, water and waste) for the building, goodwill procedures, measures for managing and enhancing business processes as well as for meeting general due diligence obligations, management and control by affiliated companies (e.g. parent company); statistical evaluations for corporate management, cost recording and controlling, reporting, internal and external communication, emergency management, settlement and fiscal evaluation of operational benefits, risk management, assertion of legal claims and defence in case of legal disputes; safeguarding of IT security (including system and plausibility tests) and general safety, including building and equipment safety, upholding and exercise of domiciliary rights (e.g. by means of access controls); safeguarding of the integrity,
authenticity and availability of data, prevention and investigation of criminal offences; monitoring by supervisory boards or authorities (e.g. audit). 

2.2 Purposes for the fulfilment of statutory requirements or in the public interest

Like all parties participating in economic affairs, we are also subject to a large number of statutory obligations:

• the fulfilment of requests and requirements of supervisory and law enforcement;
• authorities;
• fulfilment of control and reporting obligations under tax law;
• the fulfilment of legal requirements for the prevention of fraud and money laundering as well as for the prevention and combating of terrorist financing, asset-endangering criminal offences, comparison as obligated parties within the meaning of the Money Laundering Act. This includes, among other things, the identification of business partners and beneficial owners and verification of identity and age if required;
• matching against European and international anti-terror lists;
• archiving of data for the purposes of data protection and data security and review by tax and other authorities;
• local/judicial measures for the purpose of obtaining evidence, prosecuting or enforcing civil claims.

2.3 Purposes in the event of a legitimate interest on our part or that of a third party

We may process your data beyond the actual fulfilment of the contract or preliminary contract if this is necessary for upholding our own legitimate interests or those of third parties, in particular for the purpose:

• of advertising or market and opinion research as long as you have not revoked the use of your data;
• of obtaining information and exchanging data with information bureaux as long as this exceeds our economic risk;
• of reviewing and enhancing needs analysis procedures;       
• of launching and further developing products and services as well as existing systems and processes;
• improving the sustainability of the property by, amongst other things, optimising consumption data (heat, energy, water and waste);
• of disclosing personal data within the scope of due diligence during company sale negotiations;
• of refinancing by another institution;
• of matching against European and international anti-terror lists as long as this exceeds the statutory obligations;
• of enriching our data, for example through the use or research of publicly accessible data;
• of statistical evaluations or market analysis and benchmarking;
• of asserting legal claims and defending ourselves in the event of legal disputes that are not directly attributable to the contractual relationship;
• of limited data storage if deletion is not possible or only possible with a disproportionately high outlay owing to the specific type of storage;
• of developing scoring systems or automated decision-making processes;
• of preventing and investigating criminal offences as long as this is not exclusively for the fulfilment of statutory requirements;
• of building and equipment safety (e.g. by means of access controls and video surveillance) as long as this exceeds the general due diligence obligations;
• of internal and external investigations and security checks;
• of potentially listening into or recording telephone conversations for quality control and training purposes;
• of obtaining and upholding certifications of a private law or regulatory nature;
• of upholding and exercising domiciliary rights through both corresponding measures and video surveillance for the protection of our clients and staff and the securing of evidence in the event of criminal offences and their prevention.

2.4 Purposes within the framework of your consent

The processing of your personal data for specific purposes (e.g. the use of your e-mail address for marketing purposes) may also take place subject to your consent. You can normally revoke this at any time. This also applies to the revocation of declarations of consent that were given to us before the applicable data protection legislation came into force. You will be informed separately in the text of the declaration of consent about the purposes and the consequences of revocation or not granting consent.

As a rule, any revocation of consent only applies to the future. Any processing taking place prior to the revocation is not affected by this and remains lawful.

To the extent that this is necessary for the provision of our services, we process personal data permissibly received from other companies or third parties (e.g. information bureaux, address publishers). We also process personal data that we have  permissibly obtained, received or acquired from publicly accessible sources (such as telephone directories, commercial registers and registers of associations, civil registers, debtor registers, land registers, the press, internet and other media) and are permitted to process. Relevant personal data may in particular include:

• Personal details (name, date of birth, place of birth, nationality, marital status, profession/sector and comparable data);       

• Contact details (address, e-mail address, telephone number and comparable data);

• Address details (registration details and comparable data);

• Payment confirmation/cover note for bank and credit cards;

• Information about your financial situation (creditworthiness data including scoring, i.e. data for assessing the economic risk);

• Client history;

• Data about your use of the telemedia we offer (information (e.g. of retrieval of our websites, apps or newsletter, sites/links clicked on, entries and comparable data);

• Video data 

Any forwarding of your data takes place exclusively in compliance with the applicable data protection legislation and only as long as the legal basis permits this. Within our organisation, only those departments receive your data that require them to fulfil our contractual and statutory duties or for the implementation of our legitimate interests.

Any forwarding of your data to external bodies takes place exclusively 

• in connection with contract conclusion;
• for the purpose of fulfilling statutory requirements according to which we are obliged to disclose, report or forward data or where the forwarding of data is in the public interest;
• to the extent that external service providers processing orders or assuming functions process data on our behalf (e.g. external data centres, support/maintenance of IT applications, archiving, document processing, call centre services, compliance services, controlling, data screening for anti-money laundering purposes, data validation and plausibility check, data destruction, purchasing/procurement, client administration, lettershops, marketing, media technology, research, risk controlling, invoicing, telephone services, website management, audit services, credit institutions, printers or data disposal companies, courier services, logistics);
• on the basis of our legitimate interests or those of third parties for the purposes stated in section no. 2.3 above (e.g. to authorities, information bureaux such as Schufa AG or Intrum AG, debt collection agencies, lawyers, courts, experts, Group companies, committees and supervisory authorities);
• if you have granted us your consent to the transmission of your data to third parties.

We process and store your data for the duration of our business relationship. This also includes the initiation of a contract (pre-contractual legal relationship) and the conclusion of a contract.

We are also subject to various statutory and regulatory retention and documentation obligations resulting, inter alia, from company and commercial law, regulatory provisions and tax law.

The periods specified therein for retention and/or documentation may be up to ten years after the end of the contractual relationship or pre-contractual legal relationship.

Furthermore, special statutory provisions can entail a longer period of retention such as the safeguarding of evidence within the framework of statutory periods of limitation.

Data no longer required for the fulfilment of contractual or statutory obligations and rights are deleted at regular intervals unless their further processing (for a limited period) is necessary in order to fulfil the purposes derived from an overriding legitimate interest listed in section 2.3. Such an overriding legitimate interest also exists, for instance, if deletion is not possible or only possible with a disproportionately high outlay owing to the specific type of storage and any processing for other purposes is ruled out by suitable technical and organisational measures.

Data transmission to entities in countries other than the one in which the controller is based (so-called third country) takes place if this proves necessary for the execution of an order from or contract with you, if it is legally prescribed (e.g. reporting obligations under tax law), it constitutes a legitimate interest of ours or a third party or you have granted us your consent for this.

The recipients of your data may be located in Switzerland, the European Economic Area (EEA), the UK, the USA and any other country in the world.

The processing of your data in a third country can also take place in connection with the commissioning of service providers for the purpose of order processing. If, for the third country in question or for specific sectors in the third country, there is no decision by the EU Commission or the competent data protection authority of the country in which the data transferring entity is located on an appropriate level of data protection in the third country, corresponding agreements (such as EU standard contracts) and additional measures may be used as a basis for the transfer. Information about the suitable and adequate safeguards and the possibility of receiving a copy of these can be obtained on request from the individual controller or from the data protection officer/advisor.

You only need to supply the data that is required for initiating and implementing a business relationship or for a pre-contractual relationship with us or that we are legally obliged to collect. Without these data we will normally be unable to conclude or execute the contract. This can also apply to data required at a later stage within the scope of the business relationship. Should we request any further data from you above and beyond this, we will notify you separately of the voluntary nature of such disclosures.

We do not use purely automated decision-making processes. Should we use such a procedure in individual cases in the future, we will inform you about this separately insofar as this is required by law.

Under certain circumstances we may partially process your data with the aim of assessing specific personal aspects (profiling).         

To enable us to inform and advise you about products in a targeted manner, we may make use of evaluation tools. These facilitate needs-based product design, communication and publicity including market and opinion research.

Such procedures can also be used to assess your solvency and creditworthiness and to combat money laundering and fraud. So-called “score values” can be used to assess your solvency and creditworthiness. Scoring uses mathematical procedures to calculate the probability of a client meeting his or her payment obligations in accordance with the contract. Such score values accordingly support us, for example, in assessing creditworthiness and making decisions regarding the sale of products and are incorporated in our risk management. The calculation is based on mathematically and statistically recognised and proven procedures and carried out on the basis of your data, in particular your income situation, outgoings, existing liabilities, profession, employer, length of employment, experience from existing business relationships, timely contractual repayment of previous loans and information from credit agencies.

Information on nationality and special categories of personal data are not processed here.

Under certain conditions, you can assert your data protection rights towards us.

You are entitled to receive information from us about your data stored with us in accordance with the provisions of (possibly with restrictions under national law).

At your request we will correct the data stored about you if they are inapplicable or erroneous.

If you wish, we will delete your data unless prevented from doing so by other statutory regulations (e.g. statutory retention obligations or any restrictions under national law) or an overriding interest on our part (e.g. for the defence of our rights and claims).

You can ask us to restrict the processing of your data.

You can also register an objection to the processing of your data requiring us to cease processing your data. However, this right of objection only applies if special circumstances pertain with regard to your personal situation and the rights of our Group may obstruct your right of objection.

You also have the right to receive your data in a structured, commonly used and machine-readable format or to transmit it to a third party.

You are furthermore entitled to revoke consent granted to us for the processing of personal data at any time with future effect (see 2.4).

You also have recourse to a right of complaint to a data protection supervisory authority. However, we recommend that you first always address a complaint to the respective controller or to the data protection officer/advisor.

If possible, your requests to exercise your rights should be addressed in writing to the respective controller specified above or to the data protection officer/advisor. 

You have the right to object at any time to the processing of your data on the basis of a  balancing of interests or in the public interest, if there are reasons for doing so arising from your particular situation. This also applies to profiling based on this provision. Should you register an objection, we will no longer process your personal data unless we are able to provide evidence of compelling legitimate grounds for such processing that outweigh your interests, rights and freedoms, or processing serves the assertion, exercise or defence of your legal claims.

We may also process your personal data to conduct direct advertising. If you do not wish to receive any advertising, you are entitled at any time to register an objection to this; this also applies to any profiling connected with such direct advertising. We will observe this objection in the future. We will no longer process your data for the purposes of direct advertising if you object to its processing for these purposes.

The objection can be made informally and should, if possible, be addressed to the respective controller named in section 1.